Cloudflare Gateway

Name: Cloudflare Gateway
Brand: Cloudflare
Rating: 4.6 (195 reviews)

Leader

At Cloudflare, we have our eyes set on an ambitious goal — to help build a better Internet.

Est 2009|Valuation $115.5B|Raised $3B

LinkedIn 1.2M|Website|Web traffic 91.2M|FTEs 5,483|HQ San Francisco, CA

MarketsFirewalls Security Service Edge (SSE)

Published Oct 15, 2026

01Common complaints

- High-assurance anti-bypass requirements (e.g., schools/exam environments/kiosks) without strong endpoint controls: DNS filtering can be circumvented if clients can set their own DoH/DoT or alternate resolvers. - Organizations needing fully mature, admin-friendly reporting workflows (scheduled reports, granular admin notifications) where community feedback suggests limitations. - Enterprises that require extensive third-party validation and a long SWG-only operational track record: alternatives such as Zscaler or Netskope may be preferred in conservative procurement contexts. - Complex TLS inspection environments with many legacy applications and limited IT support capacity: any SWG deployment can be operationally demanding during early rollout phases.

Deal disqualifiers (poor fit)

Environments where endpoints cannot be controlled and strict anti-bypass controls are required
Teams requiring highly mature out-of-the-box reporting workflows and minimal tolerance for UI inconsistencies
Use cases requiring a specific SWG app catalog with extensive third-party validation (subject to buyer benchmarks)

Documented/acknowledged limitations (from documentation)

TLS decryption can break some applications and requires exceptions/allowlists and certificate management.
Resolver policy management may not automatically update with changes to virtual network route associations; manual intervention can be required.

Roadmap / change monitoring

Cloudflare maintains a Gateway changelog in its documentation. Organizations should monitor the changelog for updates affecting:

authentication approaches
policy engine behavior
inspection capabilities

Operational limitations surfaced in community

Documentation gaps on specific edge cases (for example, protocol-specific behavior such as HTTP/3)
Confusion around Gateway versus WARP client modes and how specific settings affect enforcement behavior

02Why they buy

Key differentiators supported by evidence (neutral phrasing)

Global network-based inspection: Cloudflare documents an architecture that performs inspection at the edge of its global network rather than routing all traffic through central backhaul points.
Integrated stack: Gateway is designed to operate alongside other Cloudflare Zero Trust services (Access, DLP, Browser Isolation), which some customers deploy together.

Differentiation to validate

Vendor performance claims regarding speed advantages versus alternatives should be validated through vendor-provided methodology details and independent testing in target environments.

Competitive advantages held by others

Zscaler: strong market presence and enterprise referenceability in SWG deployments.
Netskope: positioning around CASB/DLP and SaaS control depth.

03Field reports

Review platforms (TrustRadius examples)

TrustRadius contains multiple reviews of Cloudflare Zero Trust Services that reference Gateway/SWG functionality. Positive examples (TrustRadius): - A reviewer described the product as an efficient and easy-to-use secure web gateway with a top rating, noting filtering of end-user web requests and suitability for organizations with limited control over remote users; the reviewer also mentioned browser isolation (recent review). - Another reviewer described a "turn key solution that 'just works'" with comments about scale and an inconsistent GUI in an earlier review. This represents a quoted opinion from a reviewer and should be weighed alongside other reviews. Criticism examples (TrustRadius): - One reviewer listed cons including limitations around scheduled reports, email notifications for required rules, and filters saving for admins (recent review). Interpretation: Review content available on TrustRadius skews positive in accessible snippets; buyers should examine a range of reviews (including lower-scoring items) and consider reviewer context (environment, incentives) when evaluating claims.

Community/social (Reddit examples)

Community threads highlight operational issues and edge cases. These are anecdotal and should be validated in pilot deployments or with vendor support. Policy / bypass concerns (DNS): - A user reported a potential bypass vector involving Cloudflare Gateway DNS endpoints and unexpected subdomain behavior used for DoH/DoT, suggesting administrators validate how Cloudflare’s DNS endpoints and policy enforcement interact with client-controlled DoH/DoT configurations and whether additional network controls are required. Client/network edge cases: - A Home Assistant–related thread referenced an HTTP/3-related edge case and suggested documentation could highlight this behavior more clearly. WARP/Gateway state confusion: - Users have reported scenarios where the WARP client’s reported state related to Gateway attachment appears inconsistent, which can affect policy enforcement that depends on client connection state. These community items surface operational realities (client behavior, documentation gaps), but they are anecdotal and should be tested against an organization’s own environment and Cloudflare support guidance.

Gartner Peer Insights / G2

Gartner Peer Insights and G2 contain vendor review content relevant to Cloudflare and to various Cloudflare products. Access to some platform content may be gated. Use these sources to cross-check support experience, product maturity, and enterprise deployment pain points, while noting potential sampling biases.

Vendor materials and product overview documents

Cloudflare publishes product overview and datasheet materials for Gateway that describe architecture, DNS/HTTP filtering, and integrations such as DLP and Browser Isolation. Critical evaluation: - Performance claims such as vendor statements of a substantial speed advantage should be treated as vendor-provided claims unless accompanied by transparent methodology and reproducible test data. Cloudflare has published performance-oriented materials comparing itself to alternatives in specific scenarios; buyers should run pilots across target geographies, SaaS applications, and TLS inspection policies to validate performance and compatibility.

Third-party case studies

In this research pass, readily accessible third-party case studies with quantified ROI specific to Gateway SWG were limited. To obtain validated outcomes, request:

customer references in the same industry or with a similar technical footprint
proof-of-concept success criteria and measured results (latency, block efficacy, false positive rate)

04Best fit

Company sizes

Small to mid-market organizations: companies with relatively small IT/security teams that want a rapid rollout and baseline protections.
Large enterprises: organizations intending to run structured pilots and evaluate integration with broader SSE/SASE strategies.

Industries

Tech/SaaS, professional services, education, and distributed workforces (common SWG drivers)
Regulated industries can be a fit but should validate compliance scope, data residency, and logging requirements.

Roles/personas

Security: Security Engineering, Network Security, SOC
IT: Endpoint/MDM administrators, network administrators
Procurement / Vendor risk: compliance, legal

Pain points addressed

Phishing and malware risk reduction for roaming users
Shadow IT visibility
Consistent web access controls across remote and office locations

Qualification criteria (good fit)

Willingness and ability to deploy/manage an endpoint client or to enforce DNS routing
Desire to consolidate ZTNA, SWG, and DNS filtering under one vendor
Capacity to use policy-as-code / Terraform for scalable management (if relevant)

05The pitch

What the product does (core value proposition)

Cloudflare Gateway is Cloudflare’s cloud-native Secure Web Gateway (SWG) within the broader Cloudflare Zero Trust / Cloudflare One platform. It is designed to inspect and control outbound Internet access (DNS and HTTP/S) for users and devices to reduce threats (phishing/malware/C2), enforce acceptable-use policies, and improve visibility—without traditional backhaul-to-a-data-center architectures. Cloudflare states that inspection occurs on its global network with the intent of minimizing added latency. Cloudflare’s product page describes Gateway as an SWG that inspects browser traffic on Cloudflare’s global network (vs. backhauling), and includes a vendor claim of being significantly faster than SWG alternatives. These are vendor claims; independent benchmarking is limited and should be validated in evaluation environments.

Target market and positioning

SMB to enterprise organizations needing SWG/SSE controls for:
- Remote/hybrid workforces
- Branch/office egress filtering
- BYOD/contractors (policy-based, identity-aware controls)
Often positioned as part of SSE/SASE consolidation when combined with Cloudflare Access (ZTNA), WARP client, DLP, Browser Isolation, and (in broader Cloudflare One) network services.

Get a comprehensive analysis of Cloudflare Gateway including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Oct 15, 2026

01Common complaints

High-assurance anti-bypass requirements (e.g., schools/exam environments/kiosks) without strong endpoint controls: DNS filtering can be circumvented if clients can set their own DoH/DoT or alternate resolvers.
Organizations needing fully mature, admin-friendly reporting workflows (scheduled reports, granular admin notifications) where community feedback suggests limitations.
Enterprises that require extensive third-party validation and a long SWG-only operational track record: alternatives such as Zscaler or Netskope may be preferred in conservative procurement contexts.
Complex TLS inspection environments with many legacy applications and limited IT support capacity: any SWG deployment can be operationally demanding during early rollout phases.

Deal disqualifiers (poor fit)

Environments where endpoints cannot be controlled and strict anti-bypass controls are required
Teams requiring highly mature out-of-the-box reporting workflows and minimal tolerance for UI inconsistencies
Use cases requiring a specific SWG app catalog with extensive third-party validation (subject to buyer benchmarks)

Documented/acknowledged limitations (from documentation)

TLS decryption can break some applications and requires exceptions/allowlists and certificate management.
Resolver policy management may not automatically update with changes to virtual network route associations; manual intervention can be required.

Roadmap / change monitoring

Cloudflare maintains a Gateway changelog in its documentation. Organizations should monitor the changelog for updates affecting:

authentication approaches
policy engine behavior
inspection capabilities

Operational limitations surfaced in community

Documentation gaps on specific edge cases (for example, protocol-specific behavior such as HTTP/3)
Confusion around Gateway versus WARP client modes and how specific settings affect enforcement behavior

02Why they buy

Key differentiators supported by evidence (neutral phrasing)

Global network-based inspection: Cloudflare documents an architecture that performs inspection at the edge of its global network rather than routing all traffic through central backhaul points.
Integrated stack: Gateway is designed to operate alongside other Cloudflare Zero Trust services (Access, DLP, Browser Isolation), which some customers deploy together.

Differentiation to validate

Vendor performance claims regarding speed advantages versus alternatives should be validated through vendor-provided methodology details and independent testing in target environments.

Competitive advantages held by others

Zscaler: strong market presence and enterprise referenceability in SWG deployments.
Netskope: positioning around CASB/DLP and SaaS control depth.

03Field reports

Review platforms (TrustRadius examples)

TrustRadius contains multiple reviews of Cloudflare Zero Trust Services that reference Gateway/SWG functionality.

Positive examples (TrustRadius):

A reviewer described the product as an efficient and easy-to-use secure web gateway with a top rating, noting filtering of end-user web requests and suitability for organizations with limited control over remote users; the reviewer also mentioned browser isolation (recent review).
Another reviewer described a "turn key solution that 'just works'" with comments about scale and an inconsistent GUI in an earlier review. This represents a quoted opinion from a reviewer and should be weighed alongside other reviews.

Criticism examples (TrustRadius):

One reviewer listed cons including limitations around scheduled reports, email notifications for required rules, and filters saving for admins (recent review).

Interpretation: Review content available on TrustRadius skews positive in accessible snippets; buyers should examine a range of reviews (including lower-scoring items) and consider reviewer context (environment, incentives) when evaluating claims.

Community/social (Reddit examples)

Community threads highlight operational issues and edge cases. These are anecdotal and should be validated in pilot deployments or with vendor support.

Policy / bypass concerns (DNS):

A user reported a potential bypass vector involving Cloudflare Gateway DNS endpoints and unexpected subdomain behavior used for DoH/DoT, suggesting administrators validate how Cloudflare’s DNS endpoints and policy enforcement interact with client-controlled DoH/DoT configurations and whether additional network controls are required.

Client/network edge cases:

A Home Assistant–related thread referenced an HTTP/3-related edge case and suggested documentation could highlight this behavior more clearly.

WARP/Gateway state confusion:

Users have reported scenarios where the WARP client’s reported state related to Gateway attachment appears inconsistent, which can affect policy enforcement that depends on client connection state.

These community items surface operational realities (client behavior, documentation gaps), but they are anecdotal and should be tested against an organization’s own environment and Cloudflare support guidance.

Gartner Peer Insights / G2

Gartner Peer Insights and G2 contain vendor review content relevant to Cloudflare and to various Cloudflare products. Access to some platform content may be gated. Use these sources to cross-check support experience, product maturity, and enterprise deployment pain points, while noting potential sampling biases.

Vendor materials and product overview documents

Cloudflare publishes product overview and datasheet materials for Gateway that describe architecture, DNS/HTTP filtering, and integrations such as DLP and Browser Isolation.

Critical evaluation:

Performance claims such as vendor statements of a substantial speed advantage should be treated as vendor-provided claims unless accompanied by transparent methodology and reproducible test data. Cloudflare has published performance-oriented materials comparing itself to alternatives in specific scenarios; buyers should run pilots across target geographies, SaaS applications, and TLS inspection policies to validate performance and compatibility.

Third-party case studies

In this research pass, readily accessible third-party case studies with quantified ROI specific to Gateway SWG were limited. To obtain validated outcomes, request:

customer references in the same industry or with a similar technical footprint
proof-of-concept success criteria and measured results (latency, block efficacy, false positive rate)

04Best fit

Company sizes

Small to mid-market organizations: companies with relatively small IT/security teams that want a rapid rollout and baseline protections.
Large enterprises: organizations intending to run structured pilots and evaluate integration with broader SSE/SASE strategies.

Industries

Tech/SaaS, professional services, education, and distributed workforces (common SWG drivers)
Regulated industries can be a fit but should validate compliance scope, data residency, and logging requirements.

Roles/personas

Security: Security Engineering, Network Security, SOC
IT: Endpoint/MDM administrators, network administrators
Procurement / Vendor risk: compliance, legal

Pain points addressed

Phishing and malware risk reduction for roaming users
Shadow IT visibility
Consistent web access controls across remote and office locations

Qualification criteria (good fit)

Willingness and ability to deploy/manage an endpoint client or to enforce DNS routing
Desire to consolidate ZTNA, SWG, and DNS filtering under one vendor
Capacity to use policy-as-code / Terraform for scalable management (if relevant)

05The pitch

What the product does (core value proposition)

Cloudflare’s product page describes Gateway as an SWG that inspects browser traffic on Cloudflare’s global network (vs. backhauling), and includes a vendor claim of being significantly faster than SWG alternatives. These are vendor claims; independent benchmarking is limited and should be validated in evaluation environments.

Target market and positioning

SMB to enterprise organizations needing SWG/SSE controls for:
- Remote/hybrid workforces
- Branch/office egress filtering
- BYOD/contractors (policy-based, identity-aware controls)
Often positioned as part of SSE/SASE consolidation when combined with Cloudflare Access (ZTNA), WARP client, DLP, Browser Isolation, and (in broader Cloudflare One) network services.

Get a comprehensive analysis of Cloudflare Gateway including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →