[{"data":1,"prerenderedAt":583},["ShallowReactive",2],{"insight-cloudflare-zero-trust-and-integrity":3,"insights-cards":473},{"id":4,"title":5,"body":6,"category":455,"date":456,"description":457,"extension":458,"meta":459,"navigation":374,"path":460,"readingTime":461,"relatedArticles":462,"relatedAssessment":466,"relatedServices":467,"seo":470,"stem":471,"__hash__":472},"insights\u002Finsights\u002Fcloudflare-zero-trust-and-integrity.md","Who Got In Versus What Is Running: Two Integrity Problems One Control Cannot Solve",{"type":7,"value":8,"toc":438},"minimark",[9,13,18,21,24,27,68,71,76,93,97,100,103,106,109,113,116,119,145,148,152,155,178,181,184,188,287,290,294,297,300,332,335,339,342,356,359,363,431,435],[10,11,12],"p",{},"Access control and client-side script monitoring both get filed under \"integrity\", and they answer unrelated questions. One asks whether the party making a request should be allowed to make it. The other asks whether the code running in your visitor's browser is still the code you intended. A team can be excellent at the first and completely blind to the second, and attackers who skim payment and login forms count on exactly that.",[14,15,17],"h2",{"id":16},"problem-one-is-this-requester-who-they-claim-to-be","Problem one: is this requester who they claim to be?",[10,19,20],{},"The older model of access trusted location. If a request came from inside the network, by office cable or VPN, it was allowed to reach whatever the network could reach. The flaw is well understood by now: one stolen laptop or one phished VPN credential gives an intruder the same broad reach as an employee.",[10,22,23],{},"Zero Trust replaces location with a per-request decision. Each application sits behind a policy check. To get through, the requester has to prove identity, and often more than identity.",[10,25,26],{},"In Cloudflare's stack the main pieces are:",[28,29,30,38,44,50,56,62],"ul",{},[31,32,33,37],"li",{},[34,35,36],"strong",{},"An access proxy in front of each application."," It sends the user to your identity provider, receives the result, and evaluates a policy before any request reaches the application. The application itself can be an internal tool with no login of its own.",[31,39,40,43],{},[34,41,42],{},"Policies written per application."," Typical conditions: membership of a group in the identity provider, a specific authentication method (a hardware key for the finance system, say), country, and device posture.",[31,45,46,49],{},[34,47,48],{},"Device posture."," An agent on the device reports facts such as disk encryption, operating system version and the presence of endpoint protection. A valid password from an unmanaged laptop can then be refused.",[31,51,52,55],{},[34,53,54],{},"Outbound-only tunnels."," A small connector inside your network dials out to the edge. The application needs no inbound firewall opening and no public address, which removes it from internet scans altogether.",[31,57,58,61],{},[34,59,60],{},"Non-human identities."," Service tokens and mutual TLS let machines authenticate under the same policy engine, so CI jobs and partner systems are not a side door.",[31,63,64,67],{},[34,65,66],{},"Short sessions and a log of every decision."," Access is re-evaluated regularly, and each allow or deny is recorded with the identity attached.",[10,69,70],{},"What you gain is narrow, attributable access. A contractor sees the one tool they need and cannot even resolve the others. Removing someone from a group in the identity provider removes their access everywhere at once.",[72,73,75],"h3",{"id":74},"where-zero-trust-is-commonly-left-half-done","Where Zero Trust is commonly left half done",[28,77,78,81,84,87,90],{},[31,79,80],{},"The policy says \"anyone with a company email\", which is identity without authorization.",[31,82,83],{},"The origin is still reachable directly by IP, so the proxy can be bypassed.",[31,85,86],{},"Service tokens never expire and are shared between systems.",[31,88,89],{},"The break-glass account is exempt from every control and nobody reviews its use.",[31,91,92],{},"Decision logs are collected and never read.",[14,94,96],{"id":95},"problem-two-is-this-page-still-what-we-shipped","Problem two: is this page still what we shipped?",[10,98,99],{},"Now consider a different scene. A customer opens your checkout page. They are a real person on their own phone. Every access control you have is satisfied, because the page is public and they are welcome.",[10,101,102],{},"The page loads your own JavaScript, plus an analytics tag, a chat widget, an A\u002FB testing snippet, a consent banner, a fraud tool and a tag manager that loads four more. Each one runs with full access to the page. Any of them can read what is typed into the card number field and send it anywhere.",[10,104,105],{},"One of those vendors gets compromised, or a domain it once used lapses and is bought by someone else, or a dependency deep in its build changes. The script served to your visitors now contains a few extra lines. Your servers never see it. Your WAF never sees it, because the malicious code is delivered from a third party directly to the browser and the stolen data leaves from the browser directly to the attacker. Your deployment pipeline shows no change, because you did not deploy anything.",[10,107,108],{},"This is the client-side supply chain problem, widely known through payment skimming attacks on online stores. Its defining property is that the page changed without your release process being involved.",[72,110,112],{"id":111},"what-script-monitoring-adds","What script monitoring adds",[10,114,115],{},"Cloudflare's client-side monitoring product, long known as Page Shield, addresses this from the edge. Described generally, it works by having visitors' browsers report what they loaded. The edge adds a reporting-only content security policy header to your pages, browsers send back reports of scripts and connections, and the service builds an inventory from them. No change to your application is needed to start.",[10,117,118],{},"From that inventory you get:",[28,120,121,127,133,139],{},[31,122,123,126],{},[34,124,125],{},"A list of every script actually running",", including the ones loaded by other scripts, which is almost always longer than the list anyone has written down.",[31,128,129,132],{},[34,130,131],{},"The pages each script appears on",", so you can ask why a marketing tag is on the payment page.",[31,134,135,138],{},[34,136,137],{},"Alerts on change",": a new script, a new domain, and on higher tiers a change in a known script's content or a match against threat intelligence.",[31,140,141,144],{},[34,142,143],{},"Outbound connections",", which is where a skimmer reveals itself by sending data to an unfamiliar host.",[10,146,147],{},"Be clear about what this is. In its basic form it is detection, not prevention. It does not stop a vendor from changing their script. It shortens the time between the change and your knowing about it, from \"a researcher emailed us months later\" to \"we were alerted that day and pulled the tag\". On higher tiers, the same product can enforce an allowlist by generating a blocking policy, which moves it toward prevention.",[72,149,151],{"id":150},"the-browser-native-controls-it-complements","The browser-native controls it complements",[10,153,154],{},"Monitoring is strongest alongside two standards you can adopt on any platform:",[28,156,157,172],{},[31,158,159,162,163,167,168,171],{},[34,160,161],{},"Content Security Policy"," in enforcing mode restricts which sources may run scripts and where the page may send data. A strict ",[164,165,166],"code",{},"connect-src"," and ",[164,169,170],{},"script-src"," on payment and login pages is the most direct defense against exfiltration. It takes work to build without breaking features, which is why starting from a monitored inventory helps.",[31,173,174,177],{},[34,175,176],{},"Subresource Integrity"," pins a third-party file to a hash. If the file changes, the browser refuses it. It suits versioned libraries and does not suit vendor tags that update constantly by design.",[10,179,180],{},"And one non-technical control beats all three: fewer scripts. Every tag on a sensitive page is a party you have chosen to trust with that page. Payment fields hosted in the processor's own iframe keep card data out of reach of your page's scripts altogether.",[10,182,183],{},"If you take card payments, this is also a compliance matter. PCI DSS version 4 added requirements to keep an inventory of scripts on payment pages with a justification for each, to ensure their integrity, and to detect unauthorized changes to those pages.",[14,185,187],{"id":186},"side-by-side","Side by side",[189,190,191,206],"table",{},[192,193,194],"thead",{},[195,196,197,200,203],"tr",{},[198,199],"th",{},[198,201,202],{},"Zero Trust access",[198,204,205],{},"Client-side script monitoring",[207,208,209,221,232,243,254,265,276],"tbody",{},[195,210,211,215,218],{},[212,213,214],"td",{},"Question answered",[212,216,217],{},"May this requester reach this system?",[212,219,220],{},"Is the code in the browser what we intended?",[195,222,223,226,229],{},[212,224,225],{},"What is verified",[212,227,228],{},"User, device, service",[212,230,231],{},"Scripts, their sources, their connections",[195,233,234,237,240],{},[212,235,236],{},"Where it acts",[212,238,239],{},"Before the request reaches the application",[212,241,242],{},"In and around the visitor's browser",[195,244,245,248,251],{},[212,246,247],{},"Typical asset",[212,249,250],{},"Internal tools, admin panels, APIs",[212,252,253],{},"Public pages, especially login and payment",[195,255,256,259,262],{},[212,257,258],{},"Classic failure it stops",[212,260,261],{},"Stolen credential, over-broad VPN reach",[212,263,264],{},"Tampered third-party script, skimming",[195,266,267,270,273],{},[212,268,269],{},"What it cannot see",[212,271,272],{},"Anything the page does after loading",[212,274,275],{},"Who the visitor is or whether they should have access",[195,277,278,281,284],{},[212,279,280],{},"Usual owner",[212,282,283],{},"IT or platform security",[212,285,286],{},"Often nobody, split between marketing and front end",[10,288,289],{},"A simple way to hold it in mind is a grid of two questions. Was the requester legitimate? Was the code legitimate? Bad requester and good code is the case access control exists for. Good requester and bad code is the case it can never catch, because from the access point of view nothing went wrong. That second cell is where script-based breaches live.",[14,291,293],{"id":292},"the-third-meaning-of-integrity-correct-and-available","The third meaning of integrity: correct and available",[10,295,296],{},"There is a quieter sense of the word that matters just as much: the system gives correct answers, consistently, and can be put back when it does not. The classic security triad lists integrity next to availability for a reason. A system that is secure and down, or secure and serving corrupted data, has failed its users.",[10,298,299],{},"At the edge this is built from a few unglamorous parts:",[28,301,302,308,314,320,326],{},[31,303,304,307],{},[34,305,306],{},"Health checks"," that probe each origin with a request that exercises something real (a path that touches the database, not a static file) and that expect a specific response.",[31,309,310,313],{},[34,311,312],{},"Load balancing with failover",", so traffic moves away from a failing origin or region without waiting for a human.",[31,315,316,319],{},[34,317,318],{},"Sensible timeouts and retries",", so a slow origin fails over instead of stalling everyone.",[31,321,322,325],{},[34,323,324],{},"Backups with a tested restore."," A backup that has never been restored is a hope. The test that counts is restoring to a clean environment and timing it.",[31,327,328,331],{},[34,329,330],{},"Rollback for configuration",", since an edge rule change can take a site down as surely as a bad deploy.",[10,333,334],{},"The trap here is the control that has never been exercised. Until a probe has reported a real failure and a failover has actually fired, neither one has been verified. Schedule the drill: on a quiet weekday, take one origin out on purpose and watch what happens. You will learn whether the check detects it, how long traffic takes to move, whether the second origin can carry the load, and whether sessions survive. Finding that out on your own schedule is the entire point.",[14,336,338],{"id":337},"three-owners-and-the-gaps-between-them","Three owners, and the gaps between them",[10,340,341],{},"In most companies these three concerns belong to different people. IT owns identity and access. Marketing owns the tag manager, and with it most of the third-party scripts. Infrastructure owns failover and backups. Each group can pass its own review while the seams stay open:",[28,343,344,347,350,353],{},[31,345,346],{},"A new marketing tag goes onto the checkout page through the tag manager, with no engineering review, because tag changes are not deployments.",[31,348,349],{},"An admin panel is protected by a strong access policy, and it loads a third-party script that can read everything on the screen once the administrator is in.",[31,351,352],{},"The failover origin was built a year ago and is missing the access rules that protect the primary.",[31,354,355],{},"A restore procedure brings back data and not the access policies around it.",[10,357,358],{},"Treating integrity as one practice means asking all three questions about each important system at the same time: who can reach it, what code runs in it, and how it recovers. The same habit applies during modernization work. When a legacy system is being replaced piece by piece, each piece that moves needs its access policy, its script inventory and its failover to move with it, or the migration quietly lowers the bar.",[14,360,362],{"id":361},"a-starting-checklist","A starting checklist",[28,364,367,377,383,389,395,401,407,413,419,425],{"className":365},[366],"contains-task-list",[31,368,371,376],{"className":369},[370],"task-list-item",[372,373],"input",{"disabled":374,"type":375},true,"checkbox"," Every internal application is behind a per-application policy, and none is reachable by direct IP.",[31,378,380,382],{"className":379},[370],[372,381],{"disabled":374,"type":375}," Policies require group membership and strong authentication, not only a company email domain.",[31,384,386,388],{"className":385},[370],[372,387],{"disabled":374,"type":375}," Service tokens have owners and expiry dates.",[31,390,392,394],{"className":391},[370],[372,393],{"disabled":374,"type":375}," Break-glass access exists, is logged and is reviewed after each use.",[31,396,398,400],{"className":397},[370],[372,399],{"disabled":374,"type":375}," A current inventory of scripts exists for login and payment pages, with a named owner and reason per script.",[31,402,404,406],{"className":403},[370],[372,405],{"disabled":374,"type":375}," Alerts fire on new scripts and new outbound domains on those pages, and reach a person.",[31,408,410,412],{"className":409},[370],[372,411],{"disabled":374,"type":375}," Tag manager changes on sensitive pages require review.",[31,414,416,418],{"className":415},[370],[372,417],{"disabled":374,"type":375}," An enforcing content security policy is in place, or scheduled, for sensitive pages.",[31,420,422,424],{"className":421},[370],[372,423],{"disabled":374,"type":375}," Health checks test a meaningful path, and failover has been triggered on purpose in the last six months.",[31,426,428,430],{"className":427},[370],[372,429],{"disabled":374,"type":375}," A restore has been performed and timed in the last six months.",[14,432,434],{"id":433},"could-you-list-today-every-script-that-runs-on-your-login-and-payment-pages","Could you list, today, every script that runs on your login and payment pages?",[10,436,437],{},"Most teams cannot, and the real list is usually longer than the guess. Trivo implements Zero Trust access, client-side monitoring and failover as one piece of work, starting with an inventory of what is actually running before anything changes. Bring your access policies and your list of third-party scripts, and you will get back a map showing which parts are checked today and which have gone unreviewed for too long.",{"title":439,"searchDepth":440,"depth":440,"links":441},"",2,[442,446,450,451,452,453,454],{"id":16,"depth":440,"text":17,"children":443},[444],{"id":74,"depth":445,"text":75},3,{"id":95,"depth":440,"text":96,"children":447},[448,449],{"id":111,"depth":445,"text":112},{"id":150,"depth":445,"text":151},{"id":186,"depth":440,"text":187},{"id":292,"depth":440,"text":293},{"id":337,"depth":440,"text":338},{"id":361,"depth":440,"text":362},{"id":433,"depth":440,"text":434},"Cloudflare","2026-10-12","Zero Trust verifies who reaches a system. Client-side script monitoring verifies what runs in the browser. They fail differently and need separate owners.","md",{},"\u002Finsights\u002Fcloudflare-zero-trust-and-integrity",9,[463,464,465],"cloudflare-waf-and-ddos","hipaa-technical-safeguards-checklist","cloudflare-observability","legacy-risk",[468,469],"cloudflare","modernization",{"title":5,"description":457},"insights\u002Fcloudflare-zero-trust-and-integrity","ctcUozBDcZmQKHLMw9MKK3MrVvYuMEJTVJfdEEOoOlA",[474,481,486,491,496,498,506,511,516,521,527,534,539,545,551,557,563,568,573,578],{"path":475,"title":476,"description":477,"category":478,"readingTime":461,"relatedServices":479,"date":456},"\u002Finsights\u002Fbuild-vs-buy","The License Fee Is the Small Number: A Working Guide to Build or Buy","Buying software is usually right, until the product sits on top of how you make money. How to sort capabilities, price the hidden costs and decide.","Strategy",[480,469],"custom-software",{"path":482,"title":483,"description":484,"category":455,"readingTime":461,"relatedServices":485,"date":456},"\u002Finsights\u002Fcloudflare-observability","The Cloudflare Signals You Need Wired Up Before Something Breaks","Cloudflare records plenty by default. Whether a person hears about a problem in time depends on choices made in a quiet week, not mid-outage.",[468,469],{"path":487,"title":488,"description":489,"category":455,"readingTime":461,"relatedServices":490,"date":456},"\u002Finsights\u002Fcloudflare-performance-tuning","After the Static Assets: Where Cloudflare Performance Is Actually Won","Default caching handles images, CSS and JavaScript. The larger gains sit in HTML, API responses, cache keys and origin trips that nobody tuned.",[468,480],{"path":492,"title":493,"description":494,"category":455,"readingTime":461,"relatedServices":495,"date":456},"\u002Finsights\u002Fcloudflare-waf-and-ddos","Managed Rules Know the Internet. Custom Rules Have to Know Your Application.","Cloudflare's managed WAF and DDoS rules stop generic attacks. Logins, APIs, bots and false positives still need rules written from your own traffic.",[468,480],{"path":460,"title":5,"description":457,"category":455,"readingTime":461,"relatedServices":497,"date":456},[468,469],{"path":499,"title":500,"description":501,"category":502,"readingTime":503,"relatedServices":504,"date":456},"\u002Finsights\u002Fcrm-adoption-and-training","Your CRM Passed Every Test and Nobody Uses It: A Diagnostic for Stalled Adoption","Low CRM adoption is rarely a training gap. How to tell whether the cause is screen friction, missing payback or management habits, and what to fix first.","CRM",8,[505],"crm",{"path":507,"title":508,"description":509,"category":502,"readingTime":503,"relatedServices":510,"date":456},"\u002Finsights\u002Fcrm-implementation-timeline","The Honest Calendar of a CRM Implementation: Five Phases and Where the Weeks Go","Provisioning a CRM takes a day. Making it the place your team sells from takes months. A phase-by-phase calendar, with the parts quotes tend to leave out.",[505,480],{"path":512,"title":513,"description":514,"category":502,"readingTime":461,"relatedServices":515,"date":456},"\u002Finsights\u002Fcrm-migration-checklist","CRM Migration Checklist: The Records Arrive, the Selling Process Gets Left Behind","A CRM migration is a process migration with a data load attached. What a plain export loses, how to choose a cutover, and a checklist for each stage.",[505,469],{"path":517,"title":518,"description":519,"category":502,"readingTime":503,"relatedServices":520,"date":456},"\u002Finsights\u002Fcustom-crm-vs-off-the-shelf","Should You Build Your Own CRM? Run the Build-or-Buy Test on Your Sales Process","Most of a CRM is a commodity you should buy. The question is whether the way you sell fits the platform's model, and what it costs when it does not.",[505,480],{"path":522,"title":523,"description":524,"category":478,"readingTime":525,"relatedServices":526,"date":456},"\u002Finsights\u002Fcustom-software-cost-framework","Estimate Before the Estimate: Sizing a Custom Software Budget on Your Own","You can't know the price before a quote, but you can know what drives it. Six cost drivers, a self-check worksheet and how to read a proposal.",10,[480],{"path":528,"title":529,"description":530,"category":531,"readingTime":461,"relatedServices":532,"date":456},"\u002Finsights\u002Fetl-vs-elt","Transform before or after loading? A practical ETL versus ELT decision for mid-sized teams","ETL or ELT is a question of where transformation runs and who pays for it. A practical way for a mid-sized team to choose, with the costs most plans miss.","Data",[480,533],"ai-automation",{"path":535,"title":536,"description":537,"category":478,"readingTime":525,"relatedServices":538,"date":456},"\u002Finsights\u002Fevaluating-engineering-depth","Ask About the Outage: How to Vet a Software Vendor's Real Engineering Ability","Portfolios and logos look the same from every vendor. The interview questions, artifacts and deal-breakers that show who has really run software in production.",[480,469],{"path":540,"title":541,"description":542,"category":543,"readingTime":525,"relatedServices":544,"date":456},"\u002Finsights\u002Fhipaa-business-associate-agreement","A BAA Is a Contract, Not a Badge: What Your Software Vendor Is Really Signing Up For","What a HIPAA Business Associate Agreement commits a software vendor to, what it leaves unproven, and what to ask and build before PHI reaches the system.","Compliance",[480,533],{"path":546,"title":547,"description":548,"category":543,"readingTime":549,"relatedServices":550,"date":456},"\u002Finsights\u002Fhipaa-technical-safeguards-checklist","Reading 45 CFR 164.312 Like a Design Document: HIPAA Technical Safeguards for Engineers","The five HIPAA technical safeguard standards mapped to concrete engineering decisions: identity, logging, integrity, authentication and encryption.",11,[480,469,468],{"path":552,"title":553,"description":554,"category":555,"readingTime":461,"relatedServices":556,"date":456},"\u002Finsights\u002Flegacy-erp-anticorruption-layer","The ERP stays as it is: building on a decades-old system through an anti-corruption layer","How to build new software on an old ERP without modifying it, using an anti-corruption layer: what goes inside, how to handle writes, when to skip it.","Modernization",[469,480],{"path":558,"title":559,"description":560,"category":561,"readingTime":525,"relatedServices":562,"date":456},"\u002Finsights\u002Fllm-in-production-confidence-thresholds","An LLM that proposes and a system that decides: thresholds, review and audit for production AI","Running an LLM in production without giving it autonomy: measured confidence, thresholds set by business cost, human review that works, an audit trail.","AI",[533,480],{"path":564,"title":565,"description":566,"category":478,"readingTime":461,"relatedServices":567,"date":456},"\u002Finsights\u002Fnearshore-offshore-onshore-cost","Cheap Hours, Expensive Projects: Pricing US, Nearshore and Offshore Teams Honestly","The hourly rate tells you little about what a project will cost. How overlap, rework, turnover and compliance change the math for each delivery model.",[480],{"path":569,"title":570,"description":571,"category":561,"readingTime":461,"relatedServices":572,"date":456},"\u002Finsights\u002Frpa-vs-api-integration","Bots on the screen or calls to the API: where RPA earns its place and where it becomes debt","RPA and API integration solve the same problem at different layers. How to choose, what screen automation really costs, and how to run it safely if you must.",[533,480],{"path":574,"title":575,"description":576,"category":555,"readingTime":461,"relatedServices":577,"date":456},"\u002Finsights\u002Fstrangler-fig-modernization","Replace the legacy system in slices: a working guide to the strangler fig pattern","How to retire a legacy system piece by piece while the business keeps running: the facade, the first slice, parallel runs, and when the pattern fails.",[469,480],{"path":579,"title":580,"description":581,"category":478,"readingTime":525,"relatedServices":582,"date":456},"\u002Finsights\u002Ftwo-week-discovery-deliverables","Paying for a Plan, Not a Pitch: What Two Weeks of Discovery Owes You","A paid discovery should leave you with documents another team could build from. The five deliverables, the work behind them and the limits to expect.",[480,469],1792618973202]