Inside Cloudflare: Preventing Account Takeovers

This post details how Cloudflare's Security Team uses Cloudflare products (Gateway, Access, WAF) and internal engineering to prevent account takeovers on their own applications. It highlights the use of FIDO2 hardware security tokens, managed corporate devices, and machine learning models for detecting anomalous authentication behavior. It also discusses the importance of blocking malicious domains via Gateway and enforcing granular access policies via Access to mitigate various account takeover techniques like credential stuffing, phishing, and SIM-swapping.