Ask FirstNet about Security
Protect Every App. At the Edge
Cloudflare's global edge, including Johannesburg and Cape Town, protects your public apps and users. FirstNet designs, hardens and tunes it for you.
The platform
One global edge, one control plane
Cloudflare runs every service on every point of presence across 300+ cities, including Johannesburg and Cape Town. The same edge filters DDoS, enforces WAF policy, serves cached content and brokers Zero Trust access, so there are no appliances to deploy and no separate scrubbing-centre redirect.
- Local cache and local security inspection for South African users
- One dashboard across security and performance
- Can consolidate separate WAF, DDoS, CDN, web gateway and VPN contracts
- WAF, DDoS and bot protection integrated in one product
Quick answers
Isn't Cloudflare just a CDN?
It started as a CDN. Today it covers application security, Zero Trust access, network services and edge compute on one platform, and often replaces three or four separate security and delivery contracts.
Will turning on the WAF break our applications?
The WAF is staged in detection mode first and tuned against your real traffic before enforcement. FirstNet documents a rollback path with your application team, and cutover stays reversible until enforcement.
Does Cloudflare inspect our traffic in South Africa?
Cloudflare operates points of presence in Johannesburg and Cape Town, so South African traffic is cached and inspected locally. Specific data residency or POPIA commitments are reviewed against Cloudflare's published data localisation options.
Can we use Cloudflare alongside Zscaler or our existing WAF?
Yes. Many customers run Zscaler for outbound users and Cloudflare for inbound apps. Where you have an existing WAF, we plan a phased migration rather than a rip-and-replace.
Application services
Protect public apps and APIs
Web Application Firewall
Managed rulesets, custom rules, OWASP Top 10 coverage, virtual patching and exposed-credential checks for public-facing apps.
DDoS Protection
Always-on network and application-layer (L3/L4 and L7) mitigation across the global edge, with no scrubbing-centre redirect.
Bot Management
Machine-learning bot scoring and challenges against credential stuffing, scraping, inventory hoarding and fake sign-ups.
API Shield
Schema validation, mTLS, JWT validation, sequence analytics and abuse detection for growing API estates.
CDN and Argo Smart Routing
Global caching with local cache hits in Johannesburg and Cape Town, plus real-time path optimisation for dynamic content.
Magic Transit
Always-on L3 DDoS protection for your whole IP range via BGP, ideal for customers running their own ASN on FirstNet IP Transit.
Zero Trust
Retire the VPN, secure the workforce
Cloudflare Zero Trust secures remote staff and contractors without backhauling traffic to head office. FirstNet integrates your identity provider, builds the app catalogue and migrates users in phases.
Cloudflare Access (ZTNA)
Identity-aware access to private apps with SSO, MFA, device posture and per-app policy, with no inbound listeners on your network.
Cloudflare Gateway (SWG)
DNS, network and HTTP filtering for internet egress, with inline DLP for a distributed workforce.
Browser Isolation
Renders risky sites remotely and sends only pixels to the device, hardening executives and high-risk users.
CASB and DLP
Finds Microsoft 365 and Google Workspace misconfigurations, public shares and risky OAuth grants, and controls egress of POPIA personal information.
How we deliver
The FirstNet managed wrap
Cloudflare provides the platform; FirstNet provides the design, deployment and ongoing operation. Onboarding is staged: the WAF runs in detection mode first and cutover stays reversible until enforcement.
- Discovery and phased design aligned with Cloudflare's technical account team
- Account set-up with SSO, MFA, audit logging and role-based access
- Onboard domains, identity provider, or BGP and tunnel topology
- WAF tuning, DDoS hardening and Gateway policy before enforcement
- Logs forwarded to your SIEM or FirstNet monitoring
- Ongoing false-positive triage, attack-event reviews and service reviews
- Single Rapid Response entry point, with escalation into Cloudflare
Is Cloudflare a SOC or MDR service?
No. Cloudflare is a security platform, not a 24/7 security operations centre. For managed detection and response, FirstNet offers Sophos MDR with FirstNet Incident Response.
Why buy Cloudflare through FirstNet rather than directly?
You get local engineering in South African business hours, policy hardening, ongoing tuning, SIEM integration and partner-tier escalation into Cloudflare, joined up with FirstNet SD-WAN, DIA, Colocation, Private Cloud and IP Transit on one contract.
What is Cloudflare Magic Transit?
Magic Transit provides always-on DDoS protection for an entire IP range. Cloudflare advertises your IP prefixes from its global network using BGP, filters malicious traffic at the edge and sends clean traffic back to you. It suits organisations with their own ASN or IP space that need DDoS protection beyond what their upstream carrier provides, including customers on FirstNet IP Transit. FirstNet designs the BGP topology and validates failover with your network team.
Can Cloudflare replace our VPN?
Yes. Cloudflare Access provides zero trust network access: users reach specific private applications through Cloudflare's edge after identity checks such as single sign-on, MFA and device posture, without a traditional VPN concentrator or inbound listeners on your network. FirstNet integrates Cloudflare Access with your identity provider, builds the application catalogue and moves user groups across in phases, which also speeds up contractor and partner onboarding.
How does Cloudflare stop bots and protect APIs?
Cloudflare Bot Management uses machine-learning bot scoring, JavaScript challenges and mobile signals to stop automated abuse such as credential stuffing, scraping, inventory hoarding and fake sign-ups. API Shield protects APIs with schema validation, mutual TLS, JWT validation, sequence analytics and abuse detection, covering risks a traditional web application firewall can miss. Both run on the same platform as Cloudflare's WAF and DDoS protection, and FirstNet tunes the policies as part of the managed service.
What happens to our website if Cloudflare has a problem?
Cloudflare publishes its operational status, and FirstNet designs your deployment around your risk tolerance. Depending on the service, that can include documented DNS fallback procedures, BGP failover for Magic Transit, and alternate paths for business-critical applications. Failover is validated with your network team during onboarding. FirstNet does not quote uptime figures outside your contracted terms, so resilience requirements are agreed during design.
What do we need to provide to onboard Cloudflare?
You need control of DNS for the domains being protected, plus proof of domain ownership. For Zero Trust, FirstNet needs your identity provider details (SAML or OIDC endpoint, attribute mapping and MFA set-up) and a catalogue of the applications in scope with their owners. For Magic Transit, FirstNet needs your public IP ranges and ASN. You also name a technical contact for service requests and agree change windows and acceptance criteria before cutover.
From the Knowledge Hub
In-depth answers about Web Application & DDoS Protection
- Why buy Cloudflare through FirstNet rather than directly from Cloudflare?
- What do we need to provide to onboard Cloudflare with FirstNet?
- What happens to our website if Cloudflare has a problem?
- How does Cloudflare, managed by FirstNet, stop bad bots and protect APIs?
- Can Cloudflare Access from FirstNet replace our VPN?
- What is Cloudflare Magic Transit, and who needs it?
Your place in the stack
Security is layer 3 of 5.
Enriched by Sovereign AI Keep AI POPIA-aligned: prompts, documents and data are processed on South African infrastructure instead of foreign APIs. Explore the AI Factory →
Bring us a problem.
We’ll show you the stack that solves it.
Ask FirstNet for an instant answer, or leave your details in the chat and the right specialist will contact you.