Knowledge Hub · Security

Replacing security tools in stages

Do we have to replace all our security tools at once to move to Cloudflare Zero Trust?

Secure Access & SSE · Answered by FirstNet Technology Services

Short answer

No. Most organisations start with one urgent use case, prove it, then add the next control on the same Cloudflare platform.

In detail: Replacing security tools in stages

Typical first use cases are replacing a VPN, replacing a web proxy, controlling SaaS and AI tool use, or protecting sensitive data.

Typical expansion paths:

  • VPN replacement with Cloudflare Access, then web filtering with Cloudflare Gateway
  • Web gateway refresh, then CASB, Browser Isolation and DLP
  • Shadow IT or AI governance, then DLP on prompts and uploads
  • Users first, then whole sites through a Peplink router and Cloudflare WAN

Rollouts usually begin with a pilot for a smaller group of users before production, so policies can be tested without disrupting the business. The renewal date of an existing product is often a good moment to decide what moves next.

FirstNet plans the move in phases rather than as a rip-and-replace, and can supply, deploy, co-manage or run the platform at each stage.

Source: FirstNet Secure Access & SSE service page →

Call