Mind the gap: new tools for continuous enforcement from boot to login

Cloudflare introduces two tools to enforce security continuously from device boot through application access: mandatory authentication and independent MFA. Mandatory authentication prevents unauthenticated devices from accessing the Internet, while Cloudflare MFA adds a second trust authority beyond the identity provider. Together, they reduce visibility gaps and limit the impact of compromised credentials.

Closing the Authentication Gap

• Cloudflare One Client provides policy enforcement and traffic inspection, but historically left devices exposed before a user authenticated or after a session expired.
• In these “unknown device” states, users could potentially bypass controls using local machine connectivity.
• Mandatory authentication, configured through MDM, makes the client enforce access from system boot:
  • Blocks Internet traffic using the system firewall.
  • Permits only the client’s authentication flow through a process-specific exception.
  • Prompts users to authenticate directly.
• The feature will initially support Windows, with other platforms planned.

Independent MFA at the Network Edge

• SSO providers such as Okta, Entra ID, and Google are valuable security anchors but also high-value targets.
• If an attacker hijacks an SSO session, they may gain access to every connected application.
• Cloudflare MFA provides an independent, network-edge “step-up” factor, requiring attackers to overcome a second authority even if the primary IdP is compromised.
• Supported methods include:
  • Biometrics such as Windows Hello, Touch ID, and Face ID.
  • WebAuthn, FIDO2, and PIV security keys.
  • TOTP authenticator applications.

Granular Policy Enforcement

• Administrators can require MFA globally, per application, or within specific access policies.
• Organizations can match authentication strength to resource sensitivity—for example, weaker methods for chat and security keys for source-code repositories.
• Strong MFA can be imposed on contractors using personal identities or social logins.
• Legacy applications can receive modern MFA protection without code changes.
• Cloudflare’s independent MFA is currently in closed beta.

Reducing Attack Impact

• Requiring authentication before Internet access ensures managed devices remain registered and visible.
• Independent MFA reduces the blast radius of stolen passwords or compromised SSO sessions.
• Cloudflare positions these capabilities as part of a broader move toward continuous, automated security posture enforcement.

Organizations using Cloudflare One should consider mandatory authentication for managed endpoints and independent, risk-based MFA for sensitive applications.