Question 1

Can Cloudflare Access from FirstNet replace our VPN?

Accepted Answer

Yes. Cloudflare Access provides zero trust network access: users reach specific private applications through Cloudflare's edge after identity checks such as single sign-on, MFA and device posture, without a traditional VPN concentrator or inbound listeners on your network.

Why this is safer than a VPN:

- Access is granted per application, under per-app policy, not to the whole network
- No inbound listeners are exposed on your side, which reduces your attack surface
- Remote staff and contractors connect through the nearest Cloudflare point of presence, including Johannesburg and Cape Town, without backhauling traffic to head office

How FirstNet migrates you:

- Integrates Cloudflare Access with your identity provider using SAML or OIDC
- Builds the application catalogue with your app owners
- Deploys the WARP client where required
- Moves user groups across in phases, so the VPN can be retired gradually

This also speeds up contractor and partner onboarding, because access is tied to identity rather than network credentials. If your identity provider is not ready for SAML or OIDC at the depth required, FirstNet raises it early and scopes identity remediation first.

Question 2

Can Cloudflare Zero Trust from FirstNet control how our staff use AI tools?

Accepted Answer

Yes. Cloudflare Zero Trust, delivered by FirstNet, shows which AI apps staff use and stops sensitive data being pasted or uploaded into them.

How Cloudflare addresses AI risk:

- Cloudflare Gateway and CASB show which SaaS and AI tools staff are using, including unsanctioned shadow AI
- Policies allow, block or isolate each AI app per user and group
- DLP inspects prompts and uploads and can stop sensitive data, such as POPIA personal information, payment data or credentials, leaving the business
- Reporting shows AI usage trends to security teams and leadership

For AI applications and agents your own teams build, FirstNet also offers Cloudflare AI Gateway and MCP server portals; see Secure AI with Cloudflare.

Policies are tuned after go-live, so controls can be refined as you learn how staff actually use AI, rather than blocking useful tools outright.

If you already run Sophos, FirstNet also offers Sophos Secure AI for shadow AI discovery, prompt monitoring and AI data loss prevention, with AI risk monitored by Sophos MDR.

Question 3

Can FirstNet combine Sophos MDR with backup for ransomware recovery?

Accepted Answer

Yes. FirstNet pairs Sophos MDR with Druva cloud backup, so you have 24/7 detection and response alongside an independent backup copy for recovery. MDR helps detect and contain a ransomware attack, while backup gives you clean data to restore if systems or files are encrypted.

How the two layers work together:

- Sophos MDR analysts detect suspicious activity and alert, and FirstNet's Incident Response team helps contain the attack
- Druva keeps an independent copy of your data, separate from the systems under attack
- Once the threat is contained, clean data is restored from backup
- For Microsoft 365, Druva backs up Exchange, OneDrive, SharePoint and Teams

Detection without backup can leave you unable to recover encrypted data, and backup without detection can let an attacker keep returning. Together they cover both stopping an attack and recovering from one.

The two are separate services, so each is scoped to your environment and contracted separately. Retention settings in Microsoft 365 are not a substitute for backup.

A FirstNet specialist can scope both as one ransomware-resilience plan.

Question 4

Can FirstNet guarantee POPIA compliance for our cybersecurity services?

Accepted Answer

No. No provider can promise POPIA compliance on its own. FirstNet sets up each security service to match your privacy, retention and audit needs. But compliance is shared. It depends on how you set up and run your own systems.

What FirstNet can give you is controls and proof that support compliance:

- Data loss prevention through Cloudflare, to spot and block personal information leaving the business
- FortiAnalyzer as a Service, hosted in South Africa, so log data stays in the country in normal use
- Mimecast, which supports keeping data in South Africa, with archiving for retention and legal hold where agreed
- Reports and audit trails from FortiAnalyzer, Sophos NG-SIEM and the other platforms

Under POPIA, your business is still the responsible party. That means you answer for the personal information you hold. Your duties to the people whose data you keep stay with you, and so does your own governance. FirstNet itself runs ISO 27001 and ISO 9001 management systems.

Do you need a formal questionnaire filled in, or special contract wording, such as where data is kept? FirstNet's product and legal teams check the request before we agree to anything.

Question 5

Can FirstNet help us build secure AI applications on Cloudflare Workers?

Accepted Answer

Yes. FirstNet helps businesses build AI applications on Cloudflare Workers, with WAF, DDoS, bot and API protection in front of every app.

Workers is Cloudflare's serverless platform: code runs on Cloudflare's network with no servers to manage, and the same platform provides storage and AI services.

Building blocks for AI applications:
- Workers AI to run popular open-source models for text generation, image analysis and content moderation.
- Vectorize, a vector database for search, retrieval and recommendation features.
- The Agents SDK to build AI agents that call models and tools, keep state and run workflows, with human approval steps where needed.
- Storage such as R2 object storage and D1 databases.
- AI Gateway and MCP server portals so models and tools are governed and logged.

When prompts and data must stay in South Africa, FirstNet Sovereign AI runs models on FirstNet's own local infrastructure instead. A FirstNet specialist can help you choose the right platform for each workload.

Question 6

Can FirstNet run phishing awareness training and simulations for our staff?

Accepted Answer

Yes. FirstNet can provide or integrate security awareness training and phishing simulations as part of its managed Mimecast email security service, so users learn to spot the attacks that get past technical filters.

What is included depends on the Mimecast tier and what you contract:

- Essentials includes basic awareness nudges alongside spam, malware and phishing filtering
- Resilience, the recommended tier, includes a full awareness training programme
- Complete adds executive human-risk reporting
- Where awareness is contracted, FirstNet runs the campaigns and simulations and provides reporting on a regular stakeholder cadence

Awareness is one layer of FirstNet's email protection. Mimecast also inspects links and attachments in real time and blocks impersonation attempts, and SendMarc stops attackers sending email that uses your exact domain.

Training and simulations are optional, so confirm they are in scope during discovery. A FirstNet email security review can benchmark your current risk and recommend the right tier.

Question 7

Can FirstNet's Microsoft 365 security service help us meet POPIA and audit requirements?

Accepted Answer

Yes, it helps, but no provider can guarantee POPIA compliance on its own. FirstNet configures Microsoft 365 data protection and compliance controls, and sets up reports and dashboards that support audits and regulatory checks, as part of its Microsoft 365 security and compliance service.

Regulatory requirements such as POPIA add pressure for data governance, retention and auditability in Microsoft 365. The controls FirstNet works with include:

- Data protection: data loss prevention, sensitivity labels, encryption and retention
- Compliance: audit trails, eDiscovery and regulatory reporting
- Reporting: dashboards configured for audits and regulatory checks
- SIEM integration: alerts and logs forwarded to your SIEM for centralised visibility

For a professional services client, this approach achieved POPIA-aligned data governance with minimal user friction.

Compliance remains a shared responsibility. Under POPIA your organisation is the responsible party, and the outcome depends on how your tenant is configured and governed over time. FirstNet aligns each service to your privacy, retention and audit requirements, and formal security questionnaires and contract wording are reviewed by its product and legal teams.

A Microsoft 365 security assessment, covering a tenant review, gap analysis and prioritised action plan, is the practical place to start.

Question 8

Can FirstNet's managed firewall service send logs and alerts to our SIEM?

Accepted Answer

Yes. FirstNet can export firewall logs and alerts to your SIEM, or provide reporting dashboards instead. The integration approach, retention period and any forwarding are confirmed during solution design, because they depend on the firewall platform and service you choose.

Options by platform:

- Sophos Firewall as a Service: all firewalls log to Sophos Central; Standard Protection keeps logs on the firewall for seven days, Xstream adds 30-day cloud retention, and logs can be forwarded via syslog to a SIEM you manage or retained in the Sophos MDR data lake
- Fortinet: FortiAnalyzer as a Service gives Fortinet-native log analytics hosted in South Africa, and log forwarding to an existing SIEM such as Splunk or Sentinel can be scoped separately
- Cloudflare: logs can be forwarded into your SIEM or reviewed by FirstNet

FortiAnalyzer is not a SIEM replacement. It sits closer to your FortiGates and provides out-of-the-box compliance reports, while your SIEM correlates events across all your sources.

Raise SIEM forwarding, retention periods and custom dashboards early in discovery, because they can change the service scope and storage sizing.

Question 9

Can we add Sophos MDR to our FirstNet Sophos Firewall as a Service?

Accepted Answer

Yes. Sophos MDR is a separate service that attaches to Sophos Firewall as a Service on the same monthly bill. With Sophos endpoints, Synchronized Security can also isolate compromised devices automatically.

What adding MDR gives you:

- Sophos analysts monitoring, hunting and alerting 24/7
- FirstNet's Incident Response team acting on Sophos alerts with you, under a runbook agreed during onboarding
- Longer log retention through the Sophos MDR data lake, beyond the firewall's own seven-day or 30-day retention
- With Xstream Protection, a connector that feeds firewall telemetry into MDR and XDR

MDR is not part of Firewall as a Service by default, so it is scoped and contracted separately. Incident response on your endpoints is only in scope once Sophos MDR is contracted.

Standard MDR onboarding typically takes two to four weeks and covers discovery, a deployment plan, telemetry validation, MDR onboarding and the incident response runbook.

Everything is managed from Sophos Central, the same console FirstNet uses to run your firewall, which keeps policy and visibility in one place.

Question 10

Can we keep sending and receiving email with Mimecast if Microsoft 365 is down?

Accepted Answer

Yes, if Mimecast email continuity is included in your contracted service. Continuity gives users a failover email experience so they can keep sending and receiving during a Microsoft 365 outage, through Outlook for Windows and Mac, a web interface or mobile apps.

How FirstNet prepares for an outage:

- Continuity requirements are confirmed in the onboarding technical workshop
- FirstNet designs a continuity runbook during onboarding
- During an outage, FirstNet supports activation and communication to users
- The Resilience and Complete tiers include continuity where it is contracted

Continuity is an optional capability, so confirm it is in scope if this matters to your business. FirstNet does not commit to continuity outcomes or outage guarantees beyond the contracted scope.

Continuity keeps mail flowing during a provider outage. It does not replace a backup of your mailbox data, which is a separate service.

If email downtime has hurt your business before, raise it during discovery so FirstNet can design continuity into the service from the start.

Question 11

Can we move our self-hosted FortiAnalyzer to FirstNet's managed FAZaaS?

Accepted Answer

Yes. If you run FortiAnalyzer-VM yourself under a Fortinet licence, you can move to FirstNet's FAZaaS instead of renewing. You stop handling patching, backups, capacity planning and upgrades, move from a US dollar licence renewal to a monthly rand service, and gain South African hosting.

What changes when you migrate:

- Operations: FirstNet runs the dedicated FortiAnalyzer-VM, including patching, upgrades, backups and capacity monitoring
- Commercials: a monthly storage bundle in rands, with no Fortinet licence on your invoice
- Hosting: FirstNet-operated infrastructure in South Africa
- Support: FirstNet's managed-service path instead of you managing the vendor yourself

Timing matters: start planning four to six months before your licence renewal so your log history can be transferred cleanly.

Before onboarding, FirstNet sizes the bundle from your device count, daily log volume and retention. Some reports need minimum FortiGate firmware versions, and FortiGates split across several FortiCloud accounts should be consolidated first, so FirstNet checks both during onboarding.

Question 12

Can we see our firewall configuration and logs with FirstNet's managed firewall service?

Accepted Answer

Yes. You can ask for read-only access. On Sophos this is through Sophos Central. On Fortinet it is a read-only profile in your own FortiManager ADOM. Write access to the live firewall is the exception. It needs clear approval, because it changes how the managed service is run.

What you can see:

- Sophos: FirstNet walks you through Sophos Central at handover, and gives read-only access where agreed
- Fortinet: each client or business unit has its own ADOM in FortiManager, and we can give you a read-only admin profile
- Logs: Sophos Standard Protection keeps seven days of logs with basic reports. Xstream adds 30 days of cloud reports. FortiAnalyzer as a Service gives Fortinet log analysis and compliance reports
- Reports: a summary and change record each month, plus FortiManager reports on policy changes and firmware versions

Read-only access gives your team and your auditors proof, without the risk of changes no one tracked. Changes still go through FirstNet's approved process, so each one is logged and can be undone.

If your team wants to share hands-on admin, raise it when you sign. Then we can agree who does what before go-live.

Question 13

Can we start small with AI security?

Accepted Answer

Yes. Most organisations start with an AI security assessment and shadow AI discovery for one team, then expand.

From there you add prompt and data controls, AI Gateway for your own applications, or MCP server portals for AI agents as the need grows.

The assessment covers which AI tools, agents and data are in play for that team and where the gaps are. Controls start in logging mode and only move to blocking once the rules are proven, so nobody is cut off by surprise. When the first team is settled, the same policies extend to the next team with the approved tools and data rules already agreed with your risk owners.

Question 14

Can we trial Cloudflare Zero Trust with FirstNet before we commit?

Accepted Answer

Yes. FirstNet runs a structured proof of value that tests your main use case with a small user group, against success criteria agreed upfront.

The proof of value confirms fit and shows how Cloudflare improves visibility, control or the user experience in your own environment. FirstNet needs a few things from you:

- A clear use case, such as VPN replacement, web filtering, SaaS and AI control or data protection
- A small test group of users and devices
- Success criteria and timing
- Agreement on who will review the outcome

Example success criteria include replacing VPN access for one team, seeing cloud app and AI activity that was hard to see before, showing that sensitive data is better protected in the test use case, and producing reporting that supports your internal decision.

The proof of value is optional. If you go ahead, rollout follows FirstNet's normal sequence: identity integration, a pilot with a smaller user group, production rollout, then handover and ongoing tuning.

Question 15

Can we use Cloudflare from FirstNet alongside Zscaler or our existing WAF?

Accepted Answer

Yes. Many customers run Zscaler for outbound users and Cloudflare for inbound apps. Where you have an existing WAF, FirstNet plans a phased migration rather than a rip-and-replace.

How coexistence usually works:

- Zscaler, or another secure service edge, continues to secure staff browsing and SaaS access
- Cloudflare protects your public-facing websites, applications and APIs with WAF, DDoS, bot protection and API Shield
- An existing WAF stays in place while Cloudflare is onboarded in detection mode and tuned against real traffic
- Applications move across in phases, with a documented rollback path until enforcement

FirstNet maps your current tools and identifies which contracts Cloudflare could retire over time, since it can consolidate separate WAF, DDoS, CDN, web gateway and VPN services. Consolidation is a choice, not a requirement, and Cloudflare is positioned to fit alongside what already works.

A WAF, CDN or VPN renewal is often a good moment to review the approach. Share renewal dates during discovery so the migration plan can line up with them.

Question 16

Do FortiAnalyzer logs stay in South Africa with FirstNet, and who is responsible under POPIA?

Accepted Answer

Yes. With FirstNet's FortiAnalyzer as a Service (FAZaaS), logs are held on FirstNet-run systems in South Africa and, in normal service, stay there. FirstNet carries the job of running the platform, but under POPIA you remain the responsible party.

How the roles split:
- FirstNet: runs the hosted platform, including patching, backups, upgrades and capacity monitoring.
- You: your duties to data subjects and your internal governance stay the same.
- Exceptions: backup locations, support workflows and any other exception paths follow the governing service terms and service description.

This applies to FAZaaS only. If you buy FortiAnalyzer Cloud directly from Fortinet, it is typically hosted in US or EU regions. Your compliance review must then take cross-border data into account. If you host FortiAnalyzer yourself, the hosting and the running of it stay with you.

For regulated organisations in financial services, the public sector, education and healthcare, three things are often decisive. These are South African hosting, rand billing and a FirstNet-run model. FirstNet reviews formal compliance wording or questionnaires before making any commitment.

Question 17

Do we have to replace all our security tools at once to move to Cloudflare Zero Trust?

Accepted Answer

No. Most organisations start with one urgent use case, prove it, then add the next control on the same Cloudflare platform.

Typical first use cases are replacing a VPN, replacing a web proxy, controlling SaaS and AI tool use, or protecting sensitive data.

Typical expansion paths:

- VPN replacement with Cloudflare Access, then web filtering with Cloudflare Gateway
- Web gateway refresh, then CASB, Browser Isolation and DLP
- Shadow IT or AI governance, then DLP on prompts and uploads
- Users first, then whole sites through a Peplink router and Cloudflare WAN

Rollouts usually begin with a pilot for a smaller group of users before production, so policies can be tested without disrupting the business. The renewal date of an existing product is often a good moment to decide what moves next.

FirstNet plans the move in phases rather than as a rip-and-replace, and can supply, deploy, co-manage or run the platform at each stage.

Question 18

Do we need to install software on devices to secure AI use?

Accepted Answer

Some controls need it and others do not. Inspecting AI app traffic from laptops uses the Cloudflare WARP client on managed devices.

AI Gateway, MCP server portals and data protection built into your own applications need nothing installed on the device. FirstNet recommends the right mix for managed, unmanaged and contractor devices.

On managed laptops, Cloudflare Gateway inspects traffic through WARP and blocks or logs sensitive data sent to AI apps. For devices you do not manage, protection sits in the application or tool instead: sensitive data such as ID numbers and contact details is detected and redacted before a response leaves. During the design step FirstNet agrees which devices get the client and which rely on application controls.

Question 19

Does Cloudflare AI security work with Microsoft 365 and Entra ID?

Accepted Answer

Yes. Policies use your Microsoft Entra ID users and groups, and people sign in with the work accounts they already have.

Okta and Google identity are supported too. FirstNet connects your identity provider during deployment, so AI access rules follow the same identities as the rest of your security.

Because access follows Entra ID groups, you can give one team access to an approved AI tool and keep another team on a stricter policy, without separate accounts. The same identities are used for MCP server portals, so AI agents sign in through your identity provider before they reach internal or third-party tools, and every request and policy decision is logged for audit.

Question 20

Does Cloudflare Zero Trust guarantee compliance with POPIA or other regulations?

Accepted Answer

No solution guarantees compliance alone. Cloudflare Zero Trust strengthens control, visibility and evidence, which supports compliance goals.

How Cloudflare supports compliance work:

- Controls who can reach which applications, based on identity and device posture
- Shows and manages how cloud apps, including AI tools, are used
- Protects sensitive data, such as POPIA personal information, with DLP across web, SaaS and AI channels
- Reduces browsing risk with Cloudflare Gateway and Browser Isolation
- Keeps logs of access and policy decisions, which can be sent to your SIEM for audit

Security and compliance remain a shared responsibility between FirstNet and your organisation. FirstNet and Cloudflare help improve control, visibility and evidence, but your policies, data classification and governance decide the outcome.

If you need formal compliance wording, a control mapping or a completed security questionnaire, FirstNet escalates the request for formal review rather than giving informal assurances.

Question 21

Does Cloudflare inspect our website and app traffic in South Africa?

Accepted Answer

Yes, for South African users. Cloudflare operates points of presence in Johannesburg and Cape Town, so South African traffic is cached and inspected locally. Specific data residency or POPIA commitments are reviewed against Cloudflare's published data localisation options.

What local points of presence mean:

- Traffic enters the nearest Cloudflare point of presence, which for South African users is Johannesburg or Cape Town
- The same machines filter DDoS, enforce WAF policy, serve cached content and broker Zero Trust access, with no redirect to a separate scrubbing centre
- Local cache hits and local security inspection keep latency low for both applications and Zero Trust access

Visitors outside South Africa are served by the Cloudflare point of presence nearest to them, as part of its global edge.

If your organisation needs contractual residency wording or a specific POPIA inspection scope, FirstNet escalates the request to its product and legal teams and aligns it with Cloudflare's published data localisation options, rather than making informal commitments.

Compliance remains a shared responsibility that depends on your configuration and governance.

Question 22

Does DMARC protect our business against look-alike and typo-squat domains?

Accepted Answer

No. DMARC protects only your real domain, stopping attackers from sending email that uses your exact address. It does not stop criminals registering look-alike or typo-squat domains that resemble yours, because those domains have their own DNS records that you do not control.

Look-alike domains need different controls:

- FirstNet offers an optional brand-impersonation takedown add-on to SendMarc that detects look-alike domains and phishing infrastructure and runs a takedown workflow
- Inbound protection such as Mimecast helps detect look-alike domains in email reaching your staff, with impersonation protection in the Resilience tier and above
- Mimecast's Complete tier adds Brand Exploit Protect for advanced brand protection

DMARC at p=reject is still essential, because it removes your real domain from the attacker's toolkit. The strongest approach combines enforced DMARC for your own domain, takedown for impersonating domains, and inbound filtering for whatever still arrives.

The takedown add-on suits organisations that have been targeted recently or run a recognisable consumer brand.

Question 23

Does DMARC work with Microsoft 365 and Google Workspace email, and can FirstNet set it up?

Accepted Answer

Yes. DMARC applies to any domain sending email, including mail sent from Microsoft 365 and Google Workspace. For DMARC to be enforced safely, every legitimate sender must pass SPF or DKIM alignment, including Microsoft 365 itself, marketing platforms and finance or ERP systems that send as your domain.

FirstNet's managed SendMarc service handles this alignment work before moving your policy to enforcement:

- Publishes a monitoring-only DMARC record and collects reports from receiving mail providers
- Identifies every sending source, often 15 to 40, including marketing tools, ERP, transactional and bespoke applications
- Specifies SPF and DKIM settings for Microsoft 365, Google Workspace and each other platform, which your administrators apply under FirstNet's guidance
- Moves the policy from p=none to p=quarantine to p=reject, with go or no-go reviews and rollback guardrails

DMARC complements, rather than replaces, inbound email security. FirstNet runs Mimecast in front of Microsoft 365 or Google Workspace to filter phishing reaching your users, while SendMarc stops attackers spoofing your domain to others.

Once DMARC is enforced, BIMI can display your logo in Gmail, Apple Mail and Yahoo.

Question 24

Does FirstNet help with security compliance reports and audit evidence?

Accepted Answer

Yes. FirstNet sets up reports and dashboards that support audits and checks by regulators. Compliance reporting is part of the managed service FirstNet wraps around its Sophos deployments.

Reports you can get across FirstNet's security services:
- Sophos NG-SIEM: telemetry intake, compliance reports and log retention. The Enhanced and Premium support tiers add more reports and executive reports.
- FortiAnalyzer as a Service: built-in compliance reports for Fortinet estates. You can check them against FortiManager policy changes.
- FortiManager: monthly reports on policy changes, firmware drift and licence use.
- Mimecast: monthly reports on incident trends, policy changes and DMARC progress, depending on scope.
- SendMarc: your published DMARC policy, enforcement status and a monthly report as evidence.
- Cloudflare Zero Trust: access, gateway and DLP logs and dashboards, which can also be sent to your SIEM.

These reports give auditors and boards evidence that controls are in place and working. They support your compliance goals but do not guarantee them. Compliance is shared, and it depends on your own settings and governance.

FirstNet's product and legal teams review formal security questionnaires and audit evidence packs. They review contract wording too. None of these are signed informally.

Question 25

Does FirstNet operate its own security operations centre (SOC)?

Accepted Answer

No. FirstNet does not run its own SOC (security operations centre). Sophos MDR delivers the 24/7 SOC layer, including threat hunting and analyst-led detection, and FirstNet's Incident Response team acts on its alerts with you.

The model has two arms. It works like this:
- Sophos MDR analysts watch your environment, hunt for threats and send an alert when they spot suspicious activity.
- FirstNet's support desk receives the alert.
- FirstNet's Incident Response team then works with you to contain the threat, fix the cause and recover.
- An incident response runbook, agreed at onboarding, sets out how alerts arrive, who steps in and which remediation playbook applies.

Around this, FirstNet handles onboarding, setup, customer success, compliance reporting and escalation for every Sophos deployment. Higher support tiers add expanded incident response. The Premium tier includes on-site remediation support where it applies.

FirstNet is a Sophos MSP and Titanium Partner. Titanium is the top tier of the Sophos Partner Program, and it gives FirstNet direct escalation paths into Sophos.

Question 26

Does FirstNet resell security licences, or does it run the security service for you?

Accepted Answer

FirstNet runs the service. It deploys each security platform, sets and tunes policies, monitors it and handles changes through its Rapid Response support desk. Where a customer specifically needs hardware or licences only, FirstNet can supply them, but that is quoted separately from its managed services.

What running the service means in practice:

- One contract, one support desk and one team accountable for outcomes
- Policy tuning is ongoing, not a one-off setup task
- FirstNet escalates directly into Sophos, Mimecast, Fortinet, Cloudflare and Peplink, so you do not manage vendor support queues
- You keep ownership of your data and configurations

Some services offer a choice of operating model. With Cloudflare Zero Trust, for example, you can buy licensing only, have FirstNet deploy and hand over, co-manage the platform with FirstNet, or have FirstNet run it as a full managed service, with the split of responsibilities agreed upfront. FortiGate hardware and Fortinet licences can also be bought separately, but that is not FirstNet's Firewall as a Service.

If you are unsure which model suits your team, a FirstNet specialist can compare the options with you.

Question 27

Does FirstNet's FortiAnalyzer as a Service replace our SIEM?

Accepted Answer

No. FortiAnalyzer is the Fortinet-native analytics and reporting layer, sitting closer to your FortiGates and providing out-of-the-box compliance reports. If you already use Splunk or Sentinel, keep it; FirstNet can scope log forwarding to your SIEM separately.

How the work divides:

- FortiAnalyzer as a Service: centralised log analytics, threat correlation, incident investigation and compliance reporting across your Fortinet devices
- Your SIEM: correlation across all your security and IT sources, not only Fortinet
- FortiManager, if FirstNet runs it too: policy revisions are cross-referenced in FortiAnalyzer reports, giving a change-and-evidence trail for audits

Neither FortiAnalyzer nor FortiManager is a SOC. For 24/7 analyst-led detection, FirstNet offers Sophos MDR with its own Incident Response team, and Sophos NG-SIEM is an option if you want to replace a legacy SIEM as part of a planned transformation.

If you do not have a SIEM, FortiAnalyzer as a Service may cover your Fortinet logging and reporting needs on its own, provided the storage bundle is sized for your log volume and retention period.

Question 28

Does FirstNet's managed cybersecurity cover cloud and hybrid environments?

Accepted Answer

Yes. FirstNet's managed cybersecurity protects on-premises, cloud and hybrid environments with consistent visibility and control, so cloud workloads and SaaS users are not treated as a separate security problem.

How cloud is covered depends on the services in your contract:

- Sophos XDR and MDR connect to Microsoft 365, Azure, AWS and Google Workspace for identity and cloud telemetry
- A cloud access security broker (CASB) from Cloudflare finds risky sharing, misconfigurations and unsanctioned SaaS and AI apps
- Fortinet Hosted VDOM firewalls can act as the firewall layer for FirstNet Private Cloud workloads and connected sites
- Cloudflare protects public-facing apps and APIs with WAF, DDoS and bot protection at the edge
- Mimecast sits in front of Microsoft 365 or Google Workspace email

Cloud security is scoped like every other layer: FirstNet confirms which platforms, tenants and workloads are in scope during discovery. Compliance remains a shared responsibility that depends on your configuration and governance.

A FirstNet security architect can map your cloud estate to the right controls.

Question 29

Does FirstNet's managed cybersecurity protect remote and hybrid workers?

Accepted Answer

Yes. FirstNet's managed security controls follow users wherever they work, so staff at home, in branches or on the road get the same protection as those at head office, without relying on a traditional network perimeter.

Several services cover the hybrid workforce:

- Endpoint protection: Sophos protects laptops, servers and mobile devices with malware protection, endpoint detection and response, and rapid containment of compromised devices
- Secure web and SaaS access: Cloudflare Gateway inspects internet and cloud app traffic for office, remote and contract users
- Private app access: Cloudflare Access gives app-level zero trust access instead of a legacy VPN
- Email: Mimecast filters phishing and impersonation before mail reaches any device

Cloudflare's edge, which includes Johannesburg, Cape Town and Durban, lets remote staff and contractors reach applications without backhauling traffic to head office. Sophos MDR monitors around the clock, and FirstNet's Incident Response team acts on its alerts.

Most organisations start with the gap that hurts most, such as an overloaded VPN, and add layers over time on the same FirstNet contract.

Question 30

Does FirstNet's managed security help meet cyber-insurance requirements?

Accepted Answer

Yes, it helps. Sophos MDR, XDR, NG-SIEM and Secure AI map to the controls most cyber insurers ask for, and FirstNet provides audit-grade reporting to evidence them. Compliance and insurance outcomes remain a shared responsibility.

Controls that insurers commonly ask about, and the FirstNet services that address them:

- 24/7 monitoring and response: Sophos MDR with FirstNet Incident Response
- Log retention and reporting: Sophos NG-SIEM or FortiAnalyzer as a Service
- Email authentication: SendMarc takes DMARC to p=reject, which insurers increasingly ask about
- Recovery: Druva backup paired with MDR for ransomware recovery
- Application protection: Cloudflare WAF, DDoS protection and DLP controls for public-facing apps and data

FirstNet can align the services to your insurer's control list, but it cannot promise a policy outcome. Insurer questionnaires that need formal answers or signed wording are reviewed by FirstNet's product and legal teams.

Bring your latest insurer questionnaire to discovery so FirstNet can show which controls you already have and where the gaps are.

Question 31

How are email archives protected in FirstNet's managed Mimecast service?

Accepted Answer

Email archives in FirstNet's managed Mimecast service are encrypted, and access is controlled by roles and audit trails, so only authorised people can search or export archived mail and their activity is recorded.

Archiving is an optional capability, added where you contract it:

- Retention periods of 30 days, 1 year, 7 years or 99 years
- Every inbound and outbound message captured under enforced retention, indexed for eDiscovery and legal hold
- FirstNet helps configure retention, guides legal hold and search or export workflows, and supports day-to-day use
- The Complete tier includes a 99-year archive option for regulated or high-risk organisations

Your organisation remains the owner of the archived data and makes the final decisions on retention and governance, while FirstNet operates the Mimecast layer and advises. Mimecast supports South African data residency preferences, and specific contractual residency wording is reviewed by FirstNet's product and legal teams.

An archive is not a backup. It preserves messages for compliance and investigations, while a backup restores lost mailboxes, so many regulated organisations need both.

Large legacy archive migrations are scoped as a separate project after a technical workshop.

Question 32

How can FirstNet show us every system that is sending email using our domain?

Accepted Answer

A baseline DMARC report shows every system sending email as your domain. FirstNet publishes a monitoring-only DMARC record (or uses your existing one) and collects the reports that receiving mail providers send back, usually over two reporting cycles.

How the discovery works:

- Aggregate (RUA) reports from receiving mail providers list pass and fail results for each sending source
- Forensic (RUF) reports, where providers send them, give samples of failed messages and reveal specific impersonation attempts
- The SendMarc platform turns these reports into one inventory of sending IP addresses, platforms and alignment status
- Each source is classified as legitimate, a forwarder or unauthorised, and shared with your business owners

Most organisations discover far more senders than expected, often 15 to 40 sources including marketing platforms, ERP and finance systems, and some they do not recognise. Legacy domains and domains from acquisitions often still send mail too.

A monitoring-only record does not block or change any mail, so discovery carries no delivery risk. The inventory then becomes the plan for authenticating legitimate senders before FirstNet moves your policy towards enforcement.

Question 33

How can FirstNet stop sensitive data leaving through Microsoft 365, email and AI tools?

Accepted Answer

Data loss prevention (DLP) controls detect and block sensitive information, such as personal information covered by POPIA, payment data or credentials, as it moves through web, SaaS, email, endpoints and AI interactions. Cloudflare DLP, delivered by FirstNet, applies these controls from one policy engine across web, SaaS and AI tools, including prompts.

How a DLP rollout typically runs:

- Discovery: which data matters most, where it lives and which channels it leaves through
- Policy design for the first use case, such as SaaS uploads or AI prompts
- A pilot with a smaller group of users before production
- Tuning after go-live to balance protection with usability
- Reporting on DLP alerts, either reviewed by FirstNet or sent to your SIEM

Within Microsoft 365, FirstNet can also apply sensitivity labels, encryption and retention as part of its Microsoft 365 security work.

DLP supports your compliance goals but does not guarantee compliance on its own; outcomes depend on your setup, governance and operation.

Many organisations start with one high-risk channel and extend DLP to more apps and channels once the first policies are proven.

Question 34

How can we see risky sharing and unsanctioned apps in Microsoft 365 with FirstNet?

Accepted Answer

A cloud access security broker (CASB) gives visibility into how your Microsoft 365 or Google Workspace estate is being used. It can scan for misconfigurations, public file shares, risky OAuth grants and third-party app sprawl, and show which SaaS and AI tools staff are using. FirstNet delivers CASB through Cloudflare.

What FirstNet does with the findings:

- Reviews them with you on a regular cadence
- Helps you work through remediation, such as closing public shares or removing risky app permissions
- Adds data loss prevention where needed to control egress of POPIA personal information
- Reports through dashboards suited to administrators and leadership

Cloudflare's CASB sits on the same platform as Cloudflare Gateway, Access and DLP, so findings and policies share one dashboard.

FirstNet's Microsoft 365 security work also covers identity controls such as MFA and conditional access, sensitivity labels, retention and audit trails.

A Microsoft 365 security assessment is a practical starting point: a tenant review, gap analysis and prioritised action plan.

Question 35

How can we stop staff pasting sensitive data into ChatGPT and other AI tools?

Accepted Answer

Use prompt inspection and DLP. FirstNet sets up Cloudflare to check prompts and uploads in real time and stop sensitive data reaching AI.

Blocking every AI tool rarely works: people find a way around it. The better approach is to let staff use approved tools and stop the data that must not leave.

What the controls do:
- Inspect prompts as they are sent and block or log sensitive content such as ID numbers, financial data, customer information and source code.
- Apply DLP to file uploads as well as typed prompts.
- Detect risky behaviour, such as attempts to jailbreak a model.
- Allow, block, isolate or redirect each AI app per user and group, steering people to the approved tool.

These controls apply to managed devices running the Cloudflare WARP client. For your own AI applications and agents, redaction can also be built into the application itself, so it works on any device. A FirstNet specialist can design the rules with your risk owners.

Question 36

How do FirstNet's managed cybersecurity services reduce business risk?

Accepted Answer

Managed cybersecurity cuts business risk in three ways. Controls block attacks. Monitoring never stops. And a team responds fast. Together they make ransomware, phishing, data leaks and break-ins less likely, and less harmful if they do happen. FirstNet runs this as layers of services that work together.

Blocking comes from controls such as managed firewalls, Mimecast email filters and DMARC through SendMarc. DMARC stops attackers faking your domain in email. Zero trust access helps too, by giving users only the apps they need. Spotting threats is the job of Sophos MDR (managed detection and response). Its analysts watch, hunt for threats and raise alerts day and night. Responding is the job of FirstNet's Incident Response team. They work with you to stop the threat, fix the problem and recover. They follow a runbook, a step-by-step plan agreed when you join.

Recovery matters too. FirstNet pairs Sophos MDR with Druva backup. So you have a separate copy of your data to restore if files are locked by ransomware.

The business case is about avoiding what an attack costs. That means long downtime, getting data back and rebuilding systems. It means legal, regulatory and contract risk. It also means lasting harm to your name. Managed services turn security into a steady cost aimed at cutting risk.

A FirstNet security risk assessment can show where your biggest risk is today.

Question 37

How do FirstNet's security services fit together into a layered defence?

Accepted Answer

FirstNet's security services each cover a different part of the attack surface, so most organisations combine several. Every layer runs as a managed service under one FirstNet contract, with one support desk.

The layers are:

- Network edge: Firewall as a Service on Fortinet or Sophos, on your site or hosted by FirstNet, with FortiManager and FortiAnalyzer for Fortinet estates
- Inbound email: Mimecast filters phishing, malware and impersonation before delivery
- Outbound email: SendMarc enforces DMARC so nobody can spoof your domain
- Endpoint and SOC: Sophos endpoint protection with Sophos MDR detects threats around the clock
- Incident response: FirstNet's team remediates when Sophos MDR raises an alert
- Secure access: Cloudflare Zero Trust secures web, SaaS and private app access and replaces legacy VPN
- Public apps: Cloudflare WAF, DDoS and bot protection at the edge

The layers reinforce each other. A Sophos firewall and Sophos endpoints share health status through Synchronized Security, and FortiManager with FortiAnalyzer gives a change-and-evidence trail for audits.

Most customers start with the layer that matches their most urgent risk, then add the others over time.

Question 38

How do FortiManager and FortiAnalyzer work together in FirstNet's Fortinet service?

Accepted Answer

In FirstNet's Fortinet service, FortiManager sets up your devices and FortiAnalyzer analyses what they see. With FirstNet running both, devices register once, logs flow automatically, and you can match FortiAnalyzer reports to FortiManager policy changes.

The two products are built as a pair. Here is how the three Fortinet layers fit:
- FortiGate and the wider fabric (FortiSwitch, FortiAP, FortiExtender, FortiSandbox): enforce policy and inspect traffic.
- FortiManager: plans and pushes changes, with install previews, revisions and one-click rollback.
- FortiAnalyzer, delivered as a service (FAZaaS): captures logs and evidence for analytics and compliance reports.

This closes the loop between planned changes and proof of what happened. That helps in audits: you can show when a policy changed and how traffic behaved after it.

Neither product replaces the other, and neither is a SIEM or a SOC. For 24/7 detection, FirstNet offers Sophos MDR with its Incident Response team.

By default, FirstNet runs both on its South African platform, under one managed-service contract.

Question 39

How do we move from Netskope to Cloudflare Zero Trust with FirstNet?

Accepted Answer

FirstNet moves you in phases: map your Netskope policies, rebuild them in Cloudflare, pilot a team, then switch over before your renewal date.

How the move runs:

- Inventory: FirstNet lists your current web, CASB, DLP and private access policies, identity groups and steering set-up
- Mapping: each control is matched to its Cloudflare equivalent: Cloudflare Gateway for web filtering, Cloudflare Access with Cloudflare Tunnel for private apps, CASB and DLP for SaaS, AI tools and data
- Pilot: one team moves to the Cloudflare One Client while everyone else stays on Netskope
- Cutover: the remaining users move in waves, then the old client is removed

Plan the switch around your Netskope renewal date, so you do not pay for both platforms longer than needed. Identity stays the same: Cloudflare uses your existing Microsoft Entra ID, Okta or Google groups.

FirstNet still supports existing Netskope customers until they move.

Question 40

How does Cloudflare Tunnel publish private apps without a VPN?

Accepted Answer

A small connector inside your network opens an outbound-only link to Cloudflare, so private apps are reachable without a VPN or open ports.

How it works:

- The connector runs on a server, virtual machine or container next to the app, in your office, data centre or cloud
- It dials out to Cloudflare, so no inbound firewall rules or public IP addresses are needed for the app
- Cloudflare Access checks each request against identity, device posture and policy before it reaches the app
- Users connect through the Cloudflare One Client, or through a browser for web apps, including contractors on unmanaged devices

Because each app is published on its own, users reach only the apps they are allowed to use, not the whole network, which limits what a stolen password can reach.

FirstNet installs and monitors the connectors, usually two per site for resilience, and rolls apps across one at a time, starting with a pilot group. See whether Cloudflare can replace your VPN for the wider picture.

Question 41

How does Cloudflare compare with Zscaler for secure access and data protection?

Accepted Answer

Both are strong cloud security platforms. Cloudflare suits teams that want one network for zero trust, web security and app protection.

Points to compare against your own requirements:

- Platform model: Cloudflare runs zero trust access, web filtering, CASB and DLP on the same network that protects public websites and APIs, so one provider can cover both users and apps
- Network: Cloudflare runs every service in every location, including Johannesburg, Cape Town and Durban; Zscaler emphasises the scale of its own security cloud
- VPN replacement: both offer zero trust private access; Cloudflare publishes apps through an outbound-only tunnel
- Sites: Cloudflare WAN can connect whole sites to the same platform, which FirstNet pairs with Peplink routers

The right choice depends on your main use case, users and existing tools, so FirstNet recommends comparing them against your own requirements rather than on general claims. A proof of value lets you test your main use case in your own environment.

FirstNet sells, deploys and optionally manages Cloudflare.

Question 42

How does Cloudflare, managed by FirstNet, stop bad bots and protect APIs?

Accepted Answer

Cloudflare Bot Management uses machine-learning bot scoring, JavaScript challenges and mobile signals to stop automated abuse such as credential stuffing, scraping, inventory hoarding and fake sign-ups. API Shield protects APIs with schema validation, mutual TLS, JWT validation, sequence analytics and abuse detection, covering risks a traditional web application firewall can miss.

What each control does:

- Bot scoring rates how likely each request is to be automated, so policies can challenge or block suspect traffic while letting real users through
- Challenges test suspicious clients before they reach your application
- Schema validation rejects API calls that do not match the expected structure
- Mutual TLS and JWT validation confirm that API clients are who they claim to be
- Sequence analytics spots abnormal patterns of API calls that point to abuse

Both run on the same platform as Cloudflare's WAF and DDoS protection, with one dashboard, and FirstNet tunes the policies as part of the managed service.

Bot Management suits retail and e-commerce sites facing credential stuffing or inventory hoarding, while API Shield suits organisations whose application surface has shifted towards APIs that the WAF no longer fully covers.

Question 43

How does FirstNet handle changes to our managed firewall?

Accepted Answer

Firewall changes follow approved workflows with testing and rollback plans to keep your network stable. Only your authorised technical contacts can request and approve changes, and FirstNet implements them through its Rapid Response service process.

How changes are controlled:

- Standard moves, adds and changes within the agreed policy framework are handled as part of the managed service
- Emergency, after-hours and major design changes, such as new VPNs, SD-WAN topology changes or large policy refactors, need explicit approval and may be scoped separately
- On Fortinet estates run through FortiManager, every policy install needs an install preview, peer review and a documented rollback step, with one-click rollback to a known-good configuration
- Rollouts can be staged and scheduled across sites
- On Sophos, all changes are logged and audit-traceable through Sophos Central audit logs

FirstNet also keeps change records and monthly summaries, and FortiManager reports policy revisions and firmware drift so the estate stays aligned.

Large redesigns, migrations and security audits are scoped as projects outside the standard managed service, so confirm your expected change volume when you contract.

Question 44

How does FirstNet help secure staff use of AI tools like Copilot and ChatGPT?

Accepted Answer

FirstNet uses Sophos Secure AI to give you visibility of shadow AI use, policy and role-based controls with prompt monitoring, and protection through input sanitisation, output interception and AI data loss prevention, with AI risk monitored by Sophos MDR.

Sophos Secure AI is built on three pillars:

- Visibility: shadow AI discovery, an AI usage dashboard and multi-layer detection
- Control: granular access, global policy, role-based controls and prompt monitoring
- Protection: input sanitisation, output interception, AI data loss prevention and 24/7 MDR-managed AI risk

A Secure AI rollout typically takes two to six weeks, depending on how many AI tools and users are in scope.

FirstNet also offers AI controls through Cloudflare, whose gateway and CASB identify AI app usage and whose DLP can stop sensitive data, such as POPIA personal information, being exposed in prompts. Which platform fits depends on whether you already run Sophos or are building a secure access stack.

These controls let you set rules for AI use rather than relying on an outright ban. A sensible first step is mapping which AI tools your staff already use.

Question 45

How does FirstNet size a firewall correctly?

Accepted Answer

A firewall should be sized on your real peak inspected traffic, not on your internet line speed. FirstNet gathers sizing inputs during discovery before recommending a model or hosted option, because enabled security features and SSL inspection change the answer most.

What FirstNet looks at:

- Users: total, peak concurrent and remote VPN users
- Devices: endpoints, BYOD, IoT and servers, since devices drive sessions and traffic
- Peak throughput: internet, inter-site and encrypted traffic that will be inspected
- Security features: IPS, application control, antivirus, web and DNS filtering, sandboxing
- SSL/TLS inspection: often the biggest sizing factor, treated separately from basic firewall throughput
- VPN tunnels, concurrent sessions, new sessions per second, interfaces, HA, the firewall's role and growth over the next 12 to 36 months

These inputs are then matched against datasheet metrics such as threat protection throughput, SSL inspection throughput and IPsec VPN throughput. FirstNet documents whether the recommendation assumes basic firewalling, NGFW services or full threat protection with SSL inspection, which prevents under-sizing once advanced inspection is switched on.

Question 46

How does FirstNet use MFA and conditional access to stop Microsoft 365 account takeovers?

Accepted Answer

FirstNet hardens Microsoft 365 sign-in with multi-factor authentication (MFA), conditional access and privileged identity management as part of its Microsoft 365 security and compliance service. For a finance-sector client, conditional access and MFA adoption reduced account takeovers.

Weak identity controls are a root cause of many breaches. In general terms, each control does a different job:

- MFA asks for a second proof of identity, so a stolen password alone is not enough to sign in
- Conditional access checks conditions such as the user, device, location or sign-in risk before granting access
- Privileged identity management limits standing administrator rights, reducing what a compromised admin account can do

How the rollout is handled matters as much as the policies. FirstNet sets policy baselines, rolls changes out in stages under change control and communicates each phase clearly, prioritising controls that add protection with minimal friction for users. Dashboards then track incidents, drift and user risk signals, and admin and end-user training helps the changes stick.

Conditional access and privileged identity management depend on your Microsoft Entra ID licence level. FirstNet is a Microsoft Cloud Solution Provider and can supply Entra security add-ons if your current licences fall short.

Question 47

How does FortiManager reduce the risk of firewall changes in FirstNet's managed service?

Accepted Answer

FortiManager lets changes be validated before they reach your firewalls. FirstNet uses install previews, policy package validation, ADOM and device revisions, and one-click rollback to a known-good configuration, and its change process requires an install preview, peer review and a documented rollback step for every policy install.

The controls in practice:

- Policy packages: firewall, NAT and security policies built once, validated, then installed to one or many devices
- Shared object database: change an address or service once, rather than editing each firewall by hand
- Workspace mode and approval workflows: changes are isolated and approved before installation, which suits regulated estates
- Staged, scheduled rollouts across sites
- Firmware drift reports, with a quarterly firmware programme to keep the estate aligned

Each customer or business unit has its own ADOM, so a change in one estate cannot spill into another.

When FortiAnalyzer as a Service is also in place, reports can be cross-referenced against policy revisions, giving auditors evidence of what changed and what happened afterwards.

Question 48

How does a FirstNet Secure AI with Cloudflare project work?

Accepted Answer

A FirstNet Secure AI project has four steps: discover, design, deploy and manage. Most start with an AI security assessment for one team.

The four steps:
- Discover: AI usage discovery and a risk assessment, covering which AI tools, agents and data are in play and where the gaps are.
- Design: policy and guardrail design, including approved tools, data rules and access per team, agreed with your risk owners.
- Deploy: integration with your identity provider, network, SIEM and applications. Controls start in logging mode and move to blocking once the rules are proven, so nobody is cut off by surprise.
- Manage: ongoing monitoring and a managed service, with policy changes, reporting and escalation into Cloudflare.

From there you can add prompt and data controls, AI Gateway for your own applications or MCP server portals for AI agents as the need grows. A FirstNet specialist can scope the assessment with you.

Question 49

How does securing AI with Cloudflare help with POPIA?

Accepted Answer

It helps you apply POPIA's security safeguards to AI use: see where personal information goes, stop leaks and keep the logs.

You can see which AI tools handle personal information, stop it being pasted into unapproved tools, control what is sent to AI providers outside South Africa, and keep logs that show what happened. These controls support compliance; they do not replace your own POPIA programme, and the outcome depends on how your policies are set and run.

Question 50

How long are Sophos firewall logs kept in FirstNet's managed firewall service?

Accepted Answer

With Standard Protection, logs are kept on the firewall for seven days with basic reporting in Sophos Central. Xstream Protection adds Central Firewall Reporting Advanced, with 30-day cloud log retention and multi-firewall reporting.

If you need logs for longer:

- Sophos MDR: logs can be retained in the Sophos MDR data lake, alongside 24/7 detection and response
- Your SIEM: logs can be forwarded via syslog to a SIEM you manage
- Sophos NG-SIEM: available for compliance reporting and longer log retention at enterprise scale

All firewalls, on site or hosted by FirstNet, log to Sophos Central, and all changes are audit-traceable through Sophos Central audit logs.

Retention requirements often come from auditors, regulators or cyber insurers, so check what period you need to evidence before choosing a bundle or retention option. The retention approach and any integration are confirmed during the design phase, so they can be built into the service from day one rather than added after an audit finding.

Security questions & answers

Hosted Firewall & Network Security 26

Email Security & Threat Protection 19

Secure AI with Cloudflare 15

Managed Cybersecurity Services 13

Secure Access & SSE 12

Security 12

Web Application & DDoS Protection 10

Microsoft 365 Security & Compliance 7