Agenda
What is Cloudflare?
One of the world's largest connectivity cloud networks — connecting, protecting, and building everything on the Internet.
Cloudflare at a Glance
Founded 2010 · NYSE: NET · $1.6B ARR · 4,800 employees globally · 3M+ developers on platform
One Platform. Four Pillars.
A unified connectivity cloud — security, networking, performance, and developer tools on a single global network. Trusted by ASD's ACSC as an official co-author of Australian Government cyber guidance.
The Problem Organisations Face Today
Legacy network complexity is holding back digital projects — and cyber risk is accelerating.
VPNs and perimeter firewalls were not built for a cloud-first, remote-work world. Attackers exploit lateral movement freely once inside.
IT teams manage 10–20 point products that don't integrate. Siloed visibility, duplicate costs, and alert fatigue.
Legacy security stacks add latency. Routing traffic through centralised appliances slows users — especially remote workers.
State-sponsored attacks, ransomware, DDoS, phishing, and supply chain attacks are increasing in frequency and sophistication.
MPLS, hardware refresh cycles, egress fees, and managing multiple vendors drains IT budgets with little strategic value.
70% of large-scale tech programs fail to deliver on time, budget & scope. Compliance requirements add further complexity.
Why Organisations Choose Cloudflare
Replace 5–10 point products with a single platform — one dashboard, one API, one vendor. Dramatically reduces complexity and cost.
Every service runs on every server in every data centre. Security and performance are delivered simultaneously at the nearest edge node — no hairpinning.
Processing 20% of global web traffic gives real-time visibility into emerging threats — automatically feeding WAF, DDoS, Bot, and Zero Trust products.
Verify every user, every device, every request — regardless of location. Eliminates the "trust everything inside the network" assumption attackers exploit.
No hardware. Minimal agents. Deploy in front of existing infrastructure in hours — not months. New apps can be protected in under 5 minutes.
Consolidating vendors, eliminating MPLS, removing cloud egress fees (R2 vs AWS/Azure) drives measurable, auditable cost reduction.
Competitive Positioning
The Australian Cyber Threat Reality
Source: ASD's ACSC Annual Cyber Threat Report 2024–25 · cyber.gov.au · Published October 2025
- 37% — Compromised asset / network / infrastructure
- 16% — DoS / DDoS attacks — second highest threat type
- 15% — Malware infection
- State-sponsored actors (PRC, Russia) actively targeting Australian government networks for espionage and pre-positioning
- 55% — Compromised asset / network / infrastructure
- 23% — DoS / DDoS — a top-3 threat for CI sectors
- 19% — Compromised accounts / credentials
- ASD warns CI entities face increasing risk of disruptive attacks designed to degrade essential services
The WA Government Context
WA state government departments face a unique and demanding set of challenges — all validated by the ACSC's 2024–25 Annual Cyber Threat Report:
- DDoS against Australian organisations up 280% — ACSC responded to 200+ incidents
- State-sponsored actors (PRC, Russia) targeting government networks
- Ransomware, credential theft, and data breaches increasing year-on-year
- WA government data must remain in Australia
- SOCI Act 2018 — cloud classified as critical infrastructure
- Privacy Act 1988 — APP 11 security obligations
- ACSC Essential Eight mandatory for Commonwealth; adopted at state level
- ACSC published/updated 26 PROTECT publications in FY24–25 including Essential Eight updates
- Maturity Level 2+ now expected for sensitive workloads
- ACSC recommends "replace legacy IT" as a key strategic move for all organisations
- Ageing VPNs are a primary attack vector — Zero Trust is the modern replacement
- MPLS and on-premise firewalls not fit for cloud-first, hybrid work environments
- Average cybercrime cost to large organisations up 219% — cost of inaction is rising
- Vendor consolidation is a strategic priority to maximise taxpayer value
- Prevention is measurably cheaper than breach response
- IRAP assessment is the mandatory government procurement credential
- BuyICT / Cloud Marketplace panel arrangements shorten sales cycle
- Cloudflare's co-authorship with ACSC demonstrates highest-level trust
Cloudflare's Australian Government Credentials
IRAP Assessed
- Active IRAP assessment at OFFICIAL and PROTECTED classification levels
- Assessed against the Australian Government Information Security Manual (ISM)
- The mandatory credential for Australian government procurement
- Agencies can issue Authority to Operate (ATO) using Cloudflare's IRAP report
Data Sovereignty
- PoPs in Perth · Sydney · Melbourne · Brisbane · Adelaide
- Data Localisation Suite — pin inspection, logs & keys to Australian nodes
- Logpush to Australian storage (S3 Sydney, Azure Australia East)
- Supports 12–72 hour SOCI Act incident reporting to ASD/ACSC
Other Certifications
SOCI Act Compliance
- Cloudflare classified as Critical Infrastructure under SOCI Act 2018
- Mandatory incident reporting within 12–72 hours to ASD/ACSC
- Transparent supply chain — no dependency on adversarial nation infrastructure
- Detailed log retention via Logpush supports all audit requirements
Essential Eight — Cloudflare Mapping
Cloudflare helps WA government agencies achieve Essential Eight maturity across all eight strategies:
| Essential Eight Strategy | Cloudflare Solution | Maturity Support |
|---|---|---|
| Application Control | Zero Trust Gateway — enforce app access policies | ML 1–3 |
| Patch Applications | WAF virtual patching — block exploits before patching occurs | ML 1–3 |
| Configure MS Office Macros | Area 1 Email Security + Remote Browser Isolation | ML 1–3 |
| User Application Hardening | Remote Browser Isolation (RBI) — removes browser attack surface | ML 2–3 |
| Restrict Admin Privileges | Cloudflare Access — least privilege, per-resource, time-limited | ML 2–3 |
| Patch Operating Systems | Zero Trust device posture checks — block non-compliant OS versions | ML 2–3 |
| Multi-Factor Authentication | Cloudflare Access enforces MFA at the identity layer (all IdPs) | ML 2–3 |
| Regular Backups | R2 Object Storage — durable, zero egress, Australian region | ML 1–3 |
Zero Trust — Replacing Legacy VPN
Legacy VPN is one of the biggest pain points for WA government departments — and Cloudflare's #1 use case in the public sector.
❌ Legacy VPN Problems
- Slow — all traffic routed through central gateway, adding latency for remote workers
- Expensive — hardware, licensing, ongoing maintenance
- Insecure — once inside the VPN, users have broad lateral movement access
- Primary attack vector — VPN credential stuffing is a top initial access technique
- Poor user experience — high IT ticket volumes, productivity loss
✅ Cloudflare Zero Trust
- Identity-verified access to specific applications only — no lateral movement
- Works on any device, any location — no VPN client required
- Device posture checks — only compliant devices access sensitive systems
- MFA enforced at every access request
- No hardware — deploys via DNS change or lightweight connector
Phased Roadmap for WA Government
A pragmatic, low-risk approach — each phase delivers standalone value and builds toward a full Cloudflare platform.
Immediate protection of existing web presence. Establishes IRAP-compliant security baseline. Fast deployment — no hardware.
Stop phishing before it reaches the inbox. Prevent scraping, credential stuffing, and automated abuse on citizen-facing portals.
Eliminate VPN. Enforce MFA and device posture. Protect high-risk browsing. Secure remote and hybrid government workforces.
Replace MPLS between agency locations. Cloud-native firewall-as-a-service. Network-layer DDoS for IP infrastructure. Cut network costs by up to 50%.
Discussion & Next Steps
Questions for Datacom
- How is Datacom currently positioning security solutions to WA government customers?
- Which agencies are you most active with? (DPC, DBCA, Water Corp, Main Roads, Health WA?)
- What pain points are you hearing most from government CIOs/CISOs?
- Existing vendor relationships we should be aware of? (Zscaler, Palo Alto, Akamai?)
- Interest in a co-sell or referral arrangement for WA government opportunities?