Horizon Inc Cloudflare One demo

Demo library › Path

The full tour

Every chapter, in order. For a workshop rather than a meeting.

~63 minutes · needs the lab - at least one chapter reaches the private estate

Not all of this path is built yet

Chapter 4, Clientless isolated access for contractors, Chapter 5, DNS filtering for office networks, Chapter 7, Device posture for sensitive applications are planned. Skip them for now, or describe what they will show without claiming it is live.

  1. Who are our people, and what are they allowed to reach? One sign-in, groups that come from the identity provider rather than being typed into Cloudflare, and an application that simply does not exist for someone not entitled to it. · ~4 min · Lab and laptop
  2. Retire the VPN concentrator. An internal ticketing app on a server with no open ports, reached by name through the Cloudflare One client - and with the client off, the address does not answer at all. · ~8 min · Lab only
  3. Admins reach servers without standing credentials. SSH to the apps server with a certificate Cloudflare issues for the session - no key on the laptop, no password on the account - and the database console behind the same group. · ~10 min · Lab only
  4. Contractors get access; they do not get a laptop. Planned A contractor signs in with a one-time PIN to a real external address and uses the wiki in a remote browser, with copy, paste, download and print turned off. · ~5 min · Lab and laptop
  5. Filter the internet for an office with no appliance. Planned DNS locations for Horizon Inc's offices, security and content categories, a business-hours schedule and a branded block page - proven with a query against the location's resolver. · ~5 min · Lab and laptop
  6. Stop company data leaving through the browser. A customer list blocked on its way to personal storage, the same profiles catching card numbers and passwords inside an internal app, malware stopped on download, and the matched value decrypted from the log. · ~8 min · Lab and laptop
  7. Only healthy, managed devices reach production. Planned The database console requires a device that passes posture; break one check and access ends, with the audit log naming the check that failed. · ~5 min · Lab and laptop
  8. Our staff are pasting customer data into ChatGPT. What the company has decided about each AI service, enforced: the sanctioned one inspected, the one under review isolated, the rest redirected to a page naming the two approved paths. · ~6 min · Lab and laptop
  9. Our AI agent reaches what the person driving it cannot. An agent with MCP tools across five internal apps, and the controls in the data path that stop it handing back what its user could never see in the web UI. · ~7 min · Lab and laptop
  10. Show the auditor what happened. Every decision from the earlier chapters, in the logs that recorded it - including the exact matched value and the full prompt, decrypted with a key Cloudflare does not hold. · ~5 min · Lab and laptop