Zero Trust Demo Lab

Demoing Zero Trust to customers requires showing the full stack live — device enrollment, traffic filtering, identity-gated application access, DLP enforcement, and SaaS audit findings. A corporate laptop can't do this. The WARP client is already enrolled via MDM, Gateway policies are owned by corporate IT, and you can't connect CASB to your own SaaS accounts on a managed device.

The result: most Zero Trust demos are slides and screenshots. Customers hear about the product but never see it work. That gap between pitch and proof is where deals stall.

A personal Mac running the full Cloudflare Zero Trust stack — every layer configured, every policy enforced, every finding real. The protected application is SE Intel, an internal AI tool containing customer intelligence and competitive data — exactly the kind of application enterprises need to protect.

Tunnel hides the origin. SE Intel runs locally on the Mac, exposed at internal.macksportreport.com via an outbound-only encrypted tunnel. Zero inbound ports. The origin IP is invisible.

Access gates the application. Every request to SE Intel requires Google authentication and a passing device posture check — disk encryption enabled, OS version current, firewall active. No VPN. No client certificate prompt. Three-second login.

WARP enrolls the endpoint. The Mac is a managed device. All DNS queries and HTTP/HTTPS traffic route through Cloudflare Gateway. Device posture checks run every five minutes.

Gateway filters outbound traffic. DNS policies block malware, phishing, command-and-control, and newly registered domains. HTTP policies block file uploads to personal cloud storage and enforce DLP on the request body.

DLP scans in transit. Predefined profiles detect credit card numbers, Social Security numbers, and API keys in outbound HTTP requests. Attempts to upload PII to personal email are blocked at the edge.

CASB scans at rest. OAuth integrations with Google Drive and GitHub surface real findings — publicly shared files, stale access tokens, admin accounts without MFA, OAuth apps with overly broad permissions. Same DLP profiles, different enforcement channel.

Browser Isolation sandboxes risky sites. Newly registered domains open in a headless Chromium browser in Cloudflare's cloud. The user sees a normal page. Malicious code executes in the sandbox. User actions — copy, paste, download, print — are logged and controllable per policy.

A dummy "internal dashboard" would work for the demo flow, but it wouldn't resonate with security buyers. SE Intel is a real application with real sensitive data — customer intelligence, competitive positioning, deal strategy. It has role-based access, it processes queries against a knowledge base, and it stores conversation history. That's exactly the kind of internal tool that CISOs worry about: built by an engineering team, deployed on someone's infrastructure, accessed by the sales team, containing data that would cause real damage if exposed.

Protecting SE Intel with Zero Trust creates a two-portfolio-signal moment: the AI application demonstrates engineering depth, and the security architecture around it demonstrates Zero Trust deployment expertise. Both matter for technical pre-sales roles.

The CASB findings are not fabricated. When I connected my personal Google Drive and GitHub accounts, Cloudflare surfaced real misconfigurations and real content risks:

• • Google Drive — files shared with "anyone with the link" that should have been private, OAuth apps with broad access scopes from integrations I'd forgotten about, and files matching DLP patterns for credentials.
• • GitHub — personal access tokens without expiry dates, repositories with no branch protection on the default branch, and stale SSH keys.

That's the CASB pitch to a security buyer: "How many Google Drive files in your org are publicly shared right now? You don't know. We can tell you in five minutes."

The demo runs as a single 20-minute narrative across seven products — no context switching between vendor dashboards:

• • Enrollment — The Mac appears in Devices with hostname, OS, posture checks all passing. No MDM, no IT ticket.
• • Network — The Tunnel connector is live. The origin is invisible. A port scan finds nothing.
• • Access — Open the protected app in an incognito window. Access intercepts, Google authenticates, posture check validates, SE Intel loads. Three seconds.
• • Gateway — DNS blocks a gambling domain. The Gateway log shows the block with the user's email attached. HTTP policy blocks a file upload. DLP matches PII in the request body.
• • CASB — Real posture and content findings on real SaaS accounts. Publicly shared Drive files. Stale GitHub tokens. No fabricated data.
• • Isolation — A newly registered domain opens in a remote browser. User actions are logged. Clipboard and download controls are enforced.
• • Logs — Every event from every layer in one log pipeline. One dashboard. One identity.

WARP Client — Enrolls the Mac into the Zero Trust organization via WireGuard. All DNS and HTTP traffic tunneled through Cloudflare's edge. Device posture checks run on a 5-minute interval.

Cloudflare Tunnel — Outbound-only encrypted connection from the Mac to Cloudflare. SE Intel is exposed at internal.macksportreport.com without opening any inbound ports. Four connections to two PoPs for high availability.

Cloudflare Access — Identity-aware reverse proxy. Google OAuth for authentication, device posture for compliance, JWT-based session management. Per-app policy, per-app audit trail.

Gateway (DNS) — Category-based DNS filtering. Malware, phishing, C2, and newly registered domains blocked at resolution — no connection ever established.

Gateway (HTTP) — TLS-inspected HTTP filtering with identity-aware policies. Blocks file uploads to personal cloud storage. References DLP profiles for sensitive data detection.

Data Loss Prevention — Predefined detection profiles for credit cards, SSNs, API keys. Enforced inline via Gateway HTTP (in transit) and scanned via CASB (at rest). Same profiles, two channels.

CASB — API-based SaaS scanning via OAuth. Connected to Google Drive and GitHub. Surfaces posture misconfigurations and content findings without any agent or traffic redirect.

Browser Isolation — Remote browser rendering via Network Vector Rendering. Risky sites execute in Cloudflare's cloud. User actions (copy, paste, download, print) are logged and controllable per policy.

Deep Dive