Short answer
Yes. Cloudflare Access provides zero trust network access: users reach specific private applications through Cloudflare's edge after identity checks such as single sign-on, MFA and device posture, without a traditional VPN concentrator or inbound listeners on your network.
In detail
Why this is safer than a VPN:
- Access is granted per application, under per-app policy, not to the whole network
- No inbound listeners are exposed on your side, which reduces your attack surface
- Remote staff and contractors connect through the nearest Cloudflare point of presence, including Johannesburg and Cape Town, without backhauling traffic to head office
How FirstNet migrates you:
- Integrates Cloudflare Access with your identity provider using SAML or OIDC
- Builds the application catalogue with your app owners
- Deploys the WARP client where required
- Moves user groups across in phases, so the VPN can be retired gradually
This also speeds up contractor and partner onboarding, because access is tied to identity rather than network credentials. If your identity provider is not ready for SAML or OIDC at the depth required, FirstNet raises it early and scopes identity remediation first.
Source: FirstNet Web Application & DDoS Protection service page →
Didn’t answer your question?