Cloudflare adds programmable logic to Gateway and DLP for Zero Trust users

Cloudflare announced today that it has integrated its edge computing platform with Cloudflare Gateway and Data Loss Prevention. This update introduces true programmability to the secure web gateway, allowing customers to run their own code inline during policy evaluation. The company stated that these new features are available to all Zero Trust plans immediately.

The release includes a new Gateway action called Forward and custom validation functions. According to Cloudflare, these tools allow users to use a Cloudflare Worker to transform and manipulate traffic or bring their own data into the policy evaluation process. This moves beyond standard allow, block, isolate, or log actions.

Context and Background

Cloudflare argues that traditional secure web gateways rely on a model that has existed for nearly thirty years. In that model, traffic matches a condition and a terminal action fires. The company says this handles common cases well but has a ceiling for customers with complex environments. Many vendors claim programmability by offering public APIs, Terraform providers, or webhooks.

Cloudflare distinguishes its approach by defining true programmability as running arbitrary logic written for a specific environment. This code runs at the moment a security decision is made. The company notes that it is the only provider running both distributed customer compute and a full-featured secure web gateway on the same globally distributed network.

Who Is Affected

Enterprise customers often face a binary choice between maintaining custom security engines or accepting vendor constraints. Cloudflare cites examples of teams struggling with this trade-off over the past six years. One team needed to inject HTTP headers based on JWT claims but had to stand up NGINX proxies to do so.

Another team wanted real-time Slack notifications for new SaaS sign-ups. Because the policy engine could only allow or block, they built a delayed Logpush-to-SIEM-to-Slack pipeline. Other enterprises requested dynamic warning pages that prompt users for justification before accessing sensitive destinations. The new programmable features aim to solve these specific infrastructure burdens.

What should you do?

Security professionals should review their current Zero Trust policies to identify areas where static rules cause operational friction. Teams using external proxies for header injection or complex routing may find the new Forward action useful. Organizations should evaluate whether custom validation functions can replace legacy monitoring pipelines.

Background: Edge computing

Edge computing processes data near its source instead of sending it to a distant data center. This approach lowers delay, saves bandwidth, and keeps sensitive information local. It shifts security responsibilities from the core network to individual devices.

Read the full guide: Edge Computing Explained: Why Processing Data Locally Changes Everything

What to do and how to stay safe: Cloudflare

• Audit existing secure web gateway policies to identify use cases that require dynamic logic or external data checks.
• Review current infrastructure for standalone proxies or middleware used solely for traffic transformation or header injection.
• Monitor Cloudflare documentation for guidance on implementing custom validation functions within Zero Trust plans.
• Assess data loss prevention workflows to determine if inline code execution can improve detection accuracy.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What new actions are available in Cloudflare Gateway?

Cloudflare released a new Forward action and custom validation functions that allow users to run Cloudflare Workers code inline.

Is this feature available to all customers?

Yes, the new programmable capabilities are available to all Zero Trust plans according to the company announcement.

How does this differ from standard API-based programmability?

Standard programmability often relies on webhooks or APIs for post-event actions. This integration allows running custom code at the moment of policy evaluation.