Horizon Inc Cloudflare One demo

Demo library

15 chapters, each one a problem Horizon Inc has and the part of Cloudflare One that solves it. Each runs on its own, and the walkthroughs below combine them for a particular audience.

Where to start

A general audience: the whole of Cloudflare One.

AI security: the Safe AI Adoption walkthrough.

A specific question: pick the chapter that answers it.

Walkthroughs

The whole of Cloudflare One

The general demo - identity, replacing the VPN, data protection, AI and the evidence.

  1. Identity and per-application access
  2. VPN replacement for an internal app
  3. DLP on uploads and on internal apps
  4. Shadow AI and the sanctioned path
  5. Evidence - logs, decrypted payloads, risk scores

~31 min · needs the lab · all ready

Safe AI Adoption walkthrough

One employee, Alice, and one afternoon. Every AI security control, in the order she runs into them.

  1. Shadow AI and the sanctioned path
  2. Gateway DLP on MCP tool traffic
  3. AI Gateway DLP on prompts
  4. AI Gateway guardrails
  5. Access on MCP tools, then Gateway DLP
  6. Evidence - logs, decrypted payloads, risk scores

~29 min · lab or laptop · all ready

Replace the VPN

For teams running a VPN they want to retire.

  1. Identity and per-application access
  2. VPN replacement for an internal app
  3. Privileged SSH and database access
  4. Device posture for sensitive applications

~27 min · needs the lab · all ready

Secure web gateway and data protection

For teams asking what leaves the company, and how to stop it.

  1. DNS filtering for office networks
  2. DLP on uploads and on internal apps
  3. Clientless isolated access for contractors

~18 min · lab or laptop · all ready

The full tour

Every chapter, in order. For a workshop rather than a meeting.

  1. Identity and per-application access
  2. VPN replacement for an internal app
  3. Privileged SSH and database access
  4. Clientless isolated access for contractors
  5. DNS filtering for office networks
  6. DLP on uploads and on internal apps
  7. Device posture for sensitive applications
  8. Shadow AI and the sanctioned path
  9. Gateway DLP on MCP tool traffic
  10. AI Gateway DLP on prompts
  11. AI Gateway guardrails
  12. Access on MCP tools, then Gateway DLP
  13. Gateway DLP on an HR MCP server
  14. Indirect prompt injection
  15. Evidence - logs, decrypted payloads, risk scores

~82 min · needs the lab · all ready

Chapters

15 of 15 can be run today. See coverage for every capability and where it is shown.

#ChapterShowsStatus
1 Single sign-on and per-application accessSingle sign-on, groups imported from the identity provider, and access to each application decided by Zero Trust policy. Access, FlareID (OIDC + SCIM), App Launcher, Access audit log Ready Lab and laptop · ~4 min
2 Replace the VPN for an internal appAn internal app on a server with no open ports, reached by name through the Cloudflare One client. With the client off, the address does not answer. Cloudflare Tunnel, Private network routes, Split tunnels, Internal DNS, Resolver policies, Access Ready Lab only · ~8 min
3 Admin access to servers without standing credentialsSSH with a short-lived certificate and no key on the laptop, every command recorded, the database console behind the same group, and Postgres closed to everyone else. Access for Infrastructure, SSH certificate authority, SSH command logging, Access for SaaS (OIDC), Gateway network policies Ready Lab only · ~10 min
4 Contractor access without a company laptopA contractor signs in from her own machine, with no client, and uses the wiki in a remote browser with copy, paste, download and print turned off. Clientless Browser Isolation, Access, Gateway isolate policies Ready Lab and laptop · ~5 min
5 Filter the internet for an office, with no applianceA DNS location for the London office, blocking security risks and unwanted categories, social media limited to lunch, and the same policy on every laptop. Gateway DNS policies, DNS locations, Schedules, Block page Ready Lab and laptop · ~5 min
6 Stop company data leaving through the browserA customer list blocked on its way to personal storage, the same checks inside an internal app, malware blocked on download, and the matched data shown from the log. Gateway HTTP policies, DLP profiles, Application types, Payload logging, Antivirus Ready Lab and laptop · ~8 min
7 Only healthy devices reach sensitive appspgAdmin requires a device with its firewall on. Turn it off and access ends. Backlog's response time is measured from every device. Device posture, Access, Digital Experience Monitoring Ready Lab only · ~5 min
8 Customer data pasted into a public AIThe company's AI decisions enforced - ChatGPT inspected, Gemini isolated, the rest redirected - and a customer list blocked on its way into ChatGPT. Application Library, Gateway HTTP policies, Browser Isolation, AI prompt logging Ready Lab and laptop · ~6 min
9 An AI agent reads what the app hidesThe calendar app shows Alice nothing confidential, but its MCP tool returns the company's confidential meetings - until Gateway DLP blocks the response. MCP server portal, Gateway DLP on MCP traffic Ready Lab and laptop · ~6 min
10 Personal data pasted into the company assistantAlice pastes her own HR record into the company assistant. AI Gateway blocks the prompt before it reaches the model. AI Gateway, DLP profiles Ready Lab and laptop · ~4 min
11 Asking the assistant to help commit a crimeAlice asks the company assistant to help her take money from the company. AI Gateway guardrails refuse it before any model is called. AI Gateway guardrails Ready Lab and laptop · ~3 min
12 An AI agent asks for data Alice cannot seeLedger's tools are not offered to Alice's agent at all, and the CRM's over-sharing tool is blocked by Gateway DLP. MCP server portal, Access, Gateway DLP on MCP traffic Ready Lab and laptop · ~5 min
13 An AI agent returns the CEO's home addressThe HR app hides the CEO's home address, but its MCP tool returns it. Gateway DLP blocks the response without changing the app. MCP server portal, Gateway DLP on MCP traffic, AI Gateway DLP Ready Lab and laptop · ~3 min
14 A hidden instruction in an emailAn outside email and a calendar invite tell Alice's agent to fetch the CEO's HR record. AI Gateway guardrails and Gateway DLP stop it. AI Gateway guardrails, MCP server portal, Gateway DLP on MCP traffic Ready Lab and laptop · ~5 min
15 Show the auditor what happenedEvery decision from the other chapters in the logs, the matched data and prompts decrypted with the company's own key, and a user risk score. Access audit log, Gateway activity log, Payload and prompt logs, User risk scoring Ready Lab and laptop · ~5 min

Before any of them