Horizon Inc Cloudflare One demo

Demo library

Ten chapters, each one a problem Horizon Inc has and the part of Cloudflare One that solves it. Each stands alone, and the named paths below string them into a demo for a particular room.

Where to start

Twenty-five minutes, a general audience: the whole of Cloudflare One.

Safe AI adoption: the walkthrough, or one of five single-control scripts.

A specific question: pick the chapter that answers it. Every chapter page says what it needs before you start, and which part of it is not built yet.

Paths

The whole of Cloudflare One

The overall demo: identity, retiring the VPN, data protection, AI, and the evidence afterwards - one company, one afternoon.

  1. 1. Identity and per-application access
  2. 2. VPN replacement for an internal app
  3. 6. DLP on uploads and on internal apps
  4. 8. Shadow AI, and the sanctioned path
  5. 10. Evidence: logs, decrypted payloads, prompts

~31 min · needs the lab · all ready

Replace the VPN

For a room that runs a VPN concentrator and is tired of it.

  1. 1. Identity and per-application access
  2. 2. VPN replacement for an internal app
  3. 3. Privileged SSH and database access
  4. 7. Device posture for sensitive applications Planned

~27 min · needs the lab · 1 chapter not built yet

Secure web gateway and data protection

For a room whose question is what leaves the building, and how.

  1. 5. DNS filtering for office networks Planned
  2. 6. DLP on uploads and on internal apps
  3. 4. Clientless isolated access for contractors Planned

~18 min · lab or laptop · 2 chapters not built yet

AI security

For a room whose staff and agents are already using AI, sanctioned or not.

  1. 8. Shadow AI, and the sanctioned path
  2. 9. Securing MCP and agent access
  3. 10. Evidence: logs, decrypted payloads, prompts

~18 min · lab or laptop · all ready

The full tour

Every chapter, in order. For a workshop rather than a meeting.

  1. 1. Identity and per-application access
  2. 2. VPN replacement for an internal app
  3. 3. Privileged SSH and database access
  4. 4. Clientless isolated access for contractors Planned
  5. 5. DNS filtering for office networks Planned
  6. 6. DLP on uploads and on internal apps
  7. 7. Device posture for sensitive applications Planned
  8. 8. Shadow AI, and the sanctioned path
  9. 9. Securing MCP and agent access
  10. 10. Evidence: logs, decrypted payloads, prompts

~63 min · needs the lab · 3 chapters not built yet

Safe AI adoption

Where this lab started, and still the deepest part of it: what happens when a company's AI agent can reach everything its user cannot. One continuous walkthrough, and five scripts that each prove one control.

The walkthrough: one person, one afternoon →

Eleven steps, alternating between the app and the agent. Alice reads a rumour about an acquisition and a restructure, looks for the truth in four applications that each correctly tell her nothing, and asks her assistant the same questions instead. It begins with her pasting a colleague's customer list into a public AI to tidy it up, and ends with "What is Project Ironwood?" being answered in a paragraph.

~20 min · lab or laptop · AI Gateway DLP, three Gateway DLP policies on MCP traffic, Access as a locked door and as an invisible tool list

Five controls, one prompt each

In this order. Between them they cover every control in the AI stack rather than the same policy five times over. Each stands alone.

ScriptCloudflare controlWhat it proves to the customer
Asking the company assistant to help commit a crime unsafe use of company AI AI Gateway Guardrails (violent and non-violent crime, weapons, self-harm) Governs what your staff can make the company's AI do, consistently across every model - instead of relying on each vendor's own refusals. Blocked prompts cost no tokens.
Pasting a colleague's details into a chat accidental exposure AI Gateway DLP (request and response) Covers the everyday incident with no agent in it: someone pasting personal data into a chat. Same profiles as the MCP path, second choke point.
The CEO's home address WorkWeek (HR) · intentional misuse Gateway DLP on MCP traffic (Employee PII) Your apps can be carefully built and still hand an agent a home address. One profile, applied at the network, stops it without touching the app.
The email nobody clicked WorkBox (Inbox/Calendar) · indirect prompt injection AI Gateway Guardrails (prompt injection) + Gateway DLP Anyone who can send your staff an email or a calendar invite can leave instructions for their AI. Two independent layers stop it, neither relying on the model's judgement.
The application she cannot see at all Ledger (Finance) · access control Cloudflare Access policy + MCP portal scoping The cheapest control of all: the app and its tools are not yours to see. An agent cannot call a tool that was never listed for your identity.

Before running any of them: an agent client set up as in setup, signed in as everywhere; a fresh conversation for each script; and each one run twice - protection off, then on - because nothing about the app, the data or the prompt changes between the two halves, only what sits in the path. Chapters 8 and 9 frame the same material as library chapters.

Chapters

7 of 10 can be run today. Planned chapters are listed so the shape of the library is visible; they have no script yet. See coverage for every capability and where it is shown.

#ChapterProvesStatus
1 Who are our people, and what are they allowed to reach?One sign-in, groups that come from the identity provider rather than being typed into Cloudflare, and an application that simply does not exist for someone not entitled to it. Access, FlareID (OIDC + SCIM), App Launcher, Access audit log Ready Lab and laptop · ~4 min
2 Retire the VPN concentrator.An internal ticketing app on a server with no open ports, reached by name through the Cloudflare One client - and with the client off, the address does not answer at all. Cloudflare Tunnel, Private network routes, Split tunnels, Internal DNS, Resolver policies, Access Ready Lab only · ~8 min
3 Admins reach servers without standing credentials.SSH to the apps server with a certificate Cloudflare issues for the session - no key on the laptop, no password on the account - and the database console behind the same group. Access for Infrastructure, SSH certificate authority, SSH command logging, Access for SaaS (OIDC), Gateway network policies Ready Lab only · ~10 min
4 Contractors get access; they do not get a laptop.A contractor signs in with a one-time PIN to a real external address and uses the wiki in a remote browser, with copy, paste, download and print turned off. Clientless Browser Isolation, One-time PIN, Access Planned Lab and laptop · ~5 min
5 Filter the internet for an office with no appliance.DNS locations for Horizon Inc's offices, security and content categories, a business-hours schedule and a branded block page - proven with a query against the location's resolver. Gateway DNS policies, DNS locations, Block page Planned Lab and laptop · ~5 min
6 Stop company data leaving through the browser.A customer list blocked on its way to personal storage, the same profiles catching card numbers and passwords inside an internal app, malware stopped on download, and the matched value decrypted from the log. Gateway HTTP policies, DLP profiles, Application types, Payload logging, Antivirus Ready Lab and laptop · ~8 min
7 Only healthy, managed devices reach production.The database console requires a device that passes posture; break one check and access ends, with the audit log naming the check that failed. Device posture, Device profiles, DEX Planned Lab and laptop · ~5 min
8 Our staff are pasting customer data into ChatGPT.What the company has decided about each AI service, enforced: the sanctioned one inspected, the one under review isolated, the rest redirected to a page naming the two approved paths. Application Library, Gateway HTTP policies, Browser Isolation, AI prompt logging Ready Lab and laptop · ~6 min
9 Our AI agent reaches what the person driving it cannot.An agent with MCP tools across five internal apps, and the controls in the data path that stop it handing back what its user could never see in the web UI. MCP server portal, Access, Gateway DLP on MCP traffic, AI Gateway Ready Lab and laptop · ~7 min
10 Show the auditor what happened.Every decision from the earlier chapters, in the logs that recorded it - including the exact matched value and the full prompt, decrypted with a key Cloudflare does not hold. Access audit log, Gateway activity log, Payload and prompt logs Partial Lab and laptop · ~5 min

Before any of them