# Who uses Cloudflare WAF? 13 companies use Cloudflare WAF on usedby: 5 confirmed, 2 declared by the company, 6 observed and 0 signals. Customers include Caliente, CrazyGames and Hack The Box. Latest check 2026-11-12: 13 of 13 companies checked, from 8 public sources. - Category: [Threat detection & SOC](https://www.usedby.ai/tools/category/ai-cyber-defense.md) - Website: [developers.cloudflare.com](https://developers.cloudflare.com/waf/) ## Customers Every line is a customer, at one of three proof levels: confirmed (a case study, a named quote, a press release, or the company's own public account of using the tool (its own site, or a post by one of its executives, VP or above)), observed (the vendor shows the company on its own pages) or signal (a job post shows the company's employees use the tool, the weakest proof). A line the company declared to usedby itself, or that it lists as a sub-processor on its own legal page, is marked declared. The first public proof is a relationship-level date, not an adoption date. Relationship labels describe the source's scope. They do not establish current contract, spend or company-wide deployment. The claim permalink identifies the usedby record; the primary source supports the relationship. These two links provide attribution for a summary. Evidence is selected, not exhaustive; missing evidence or a public archive does not establish that none exists. Relationship-level dates are not verified publication dates of the selected source. | Company | Industry | Proof | First public proof | Source | Relationship | Claim | |---|---|---|---|---|---|---| | [Caliente](https://www.usedby.ai/companies/caliente.md) | — | Confirmed · checked 2026-11 | — | [cloudflare.com](https://www.cloudflare.com/case-studies/caliente/), captured 2026-11-12 | Usage described by a public source | [Caliente · Cloudflare WAF claim](https://www.usedby.ai/claims/cmwdwsyr700yuwt4efpwtyj5w) | | [CrazyGames](https://www.usedby.ai/companies/crazygames.md) | — | Confirmed · checked 2026-11 | — | [cloudflare.com](https://www.cloudflare.com/case-studies/crazygames/), captured 2026-11-12 | Usage described by a public source | [CrazyGames · Cloudflare WAF claim](https://www.usedby.ai/claims/cmwdwt81800zhwt4ewhldw0uv) | | [Hack The Box](https://www.usedby.ai/companies/hack-the-box.md) | — | Confirmed · checked 2026-11 | — | [cloudflare.com](https://www.cloudflare.com/case-studies/hack-the-box/), captured 2026-11-12 | Usage described by a public source | [Hack The Box · Cloudflare WAF claim](https://www.usedby.ai/claims/cmwdwt9sa00zlwt4e14g04u50) | | [Olive Young](https://www.usedby.ai/companies/olive-young.md) | Retail | Confirmed · checked 2026-11 | — | [cloudflare.com](https://www.cloudflare.com/case-studies/olive-young/), captured 2026-11-12 | Usage described by a public source | [Olive Young · Cloudflare WAF claim](https://www.usedby.ai/claims/cmwdwtbgw00zpwt4ek962eoyi) | | [VFS Global](https://www.usedby.ai/companies/vfs-global.md) | — | Confirmed · checked 2026-11 | — | [cloudflare.com](https://www.cloudflare.com/case-studies/vfs-global/), captured 2026-11-12 | Usage described by a public source | [VFS Global · Cloudflare WAF claim](https://www.usedby.ai/claims/cmwdwt2f000z2wt4ehqnjpt3v) | | [Capacity](https://www.usedby.ai/companies/capacity.md) | Artificial Intelligence | Declared by the company · checked 2026-11 | On or before November 2026 | Listed as a sub-processor by the company: [trust.capacity.com](https://trust.capacity.com/subprocessors), captured 2026-11-12 | Listed as a sub-processor by the company | [Capacity · Cloudflare WAF claim](https://www.usedby.ai/claims/sp_usage_capacity_cloudflare-waf_20261112_mwdb8xy4) | | [Halcyon](https://www.usedby.ai/companies/halcyon.md) | Artificial Intelligence | Declared by the company · checked 2026-11 | On or before November 2026 | Listed as a sub-processor by the company: [halcyon.ai](https://www.halcyon.ai/policies/data-processing-addendum), captured 2026-11-12 | Listed as a sub-processor by the company | [Halcyon · Cloudflare WAF claim](https://www.usedby.ai/claims/sp_usage_halcyon_cloudflare-waf_20261112_mwdb8ukr) | | [Gusto](https://www.usedby.ai/companies/gusto.md) | HR & Recruiting | Observed · checked 2026-11 | — | [cloudflare.com](https://www.cloudflare.com/case-studies/), captured 2026-11-12 | Listed as a customer by the vendor | [Gusto · Cloudflare WAF claim](https://www.usedby.ai/claims/cmwdwt4ze00z9wt4ewu8x8xpi) | | [BAFTA](https://www.usedby.ai/companies/bafta.md) | — | Observed · checked 2026-11 | — | [cloudflare.com](https://www.cloudflare.com/case-studies/), captured 2026-11-12 | Listed as a customer by the vendor | [BAFTA · Cloudflare WAF claim](https://www.usedby.ai/claims/cmwdwtdpl00ztwt4euf5q76bg) | | [ComfortDelGro](https://www.usedby.ai/companies/comfortdelgro.md) | — | Observed · checked 2026-11 | — | [cloudflare.com](https://www.cloudflare.com/case-studies/), captured 2026-11-12 | Listed as a customer by the vendor | [ComfortDelGro · Cloudflare WAF claim](https://www.usedby.ai/claims/cmwdwt43500z6wt4e2ftb2fqr) | | [Fujitec](https://www.usedby.ai/companies/fujitec.md) | Manufacturing | Observed · checked 2026-11 | — | [cloudflare.com](https://www.cloudflare.com/case-studies/), captured 2026-11-12 | Listed as a customer by the vendor | [Fujitec · Cloudflare WAF claim](https://www.usedby.ai/claims/cmwdwt6go00zdwt4ei7owushx) | | [Poki](https://www.usedby.ai/companies/poki.md) | — | Observed · checked 2026-11 | — | [cloudflare.com](https://www.cloudflare.com/case-studies/), captured 2026-11-12 | Listed as a customer by the vendor | [Poki · Cloudflare WAF claim](https://www.usedby.ai/claims/cmwdwswld00yqwt4e1iiei81k) | | [TAP Air Portugal](https://www.usedby.ai/companies/tap-air-portugal.md) | Airlines & Aviation Services | Observed · checked 2026-11 | — | [cloudflare.com](https://www.cloudflare.com/case-studies/), captured 2026-11-12 | Listed as a customer by the vendor | [TAP Air Portugal · Cloudflare WAF claim](https://www.usedby.ai/claims/cmwdwt0nt00yywt4ee6ojbxtz) | ## Published results Reviewed stories only. A figure is the vendor’s or the customer’s claim, quoted with its label; usedby did not measure it. - [Olive Young](https://www.usedby.ai/case-studies/olive-young-cloudflare-waf.md): **25%** Improvement in bot detection precision (Vendor case study, captured by usedby 2026-11-12) - [Hack The Box](https://www.usedby.ai/case-studies/hack-the-box-cloudflare-waf.md): **13.37 million** threats stopped targeting the platform during a 30-day period in 2026 (Vendor case study, captured by usedby 2026-11-12) - [CrazyGames](https://www.usedby.ai/case-studies/crazygames-cloudflare-waf.md): **25 million** threats mitigated per month (Vendor case study, captured by usedby 2026-11-12) - [VFS Global](https://www.usedby.ai/case-studies/vfs-global-cloudflare-waf.md): **581 million** protective firewall events generated by the WAF in a single month (Vendor case study, captured by usedby 2026-11-12) - [Caliente](https://www.usedby.ai/case-studies/caliente-mx-cloudflare-waf.md): **56%** Reduction in latency (Vendor case study, captured by usedby 2026-11-12) ## Before you buy usedby has not verified Cloudflare WAF’s pricing, security or data terms yet. ## Alternatives Tools of the same or a competing category, from another vendor, ranked by public customers (every proof level, job posts included). - [Abnormal AI](https://www.usedby.ai/tools/abnormal-ai.md): 43 public customers, 0 shared with Cloudflare WAF. - [SentinelOne](https://www.usedby.ai/tools/sentinelone.md): 42 public customers, 0 shared with Cloudflare WAF. - [Vectra AI](https://www.usedby.ai/tools/vectra-ai.md): 39 public customers, 0 shared with Cloudflare WAF. - [Torq](https://www.usedby.ai/tools/torq.md): 28 public customers, 0 shared with Cloudflare WAF. - [Darktrace](https://www.usedby.ai/tools/darktrace.md): 19 public customers, 0 shared with Cloudflare WAF. More: https://www.usedby.ai/alternatives/cloudflare-waf.md ## Frequently asked questions about Cloudflare WAF ### Who uses Cloudflare WAF? 13 companies use Cloudflare WAF (5 confirmed, 2 declared, 6 observed), including Caliente, CrazyGames, and Hack The Box. ### What results do companies report with Cloudflare WAF? Companies that use Cloudflare WAF report these results in public case studies. Olive Young: Mitigation time dramatically reduced by over 80% (source: [cloudflare.com](), checked November 12, 2026). Cloudflare mitigates 25 million threats targeting CrazyGames every month (source: [cloudflare.com](), checked November 12, 2026). VFS Global: In a single month, the WAF generated 581 million protective firewall events (source: [cloudflare.com](), checked November 12, 2026). ### What are the alternatives to Cloudflare WAF? Ranked by public customers (every proof level counts, job posts included), the top Cloudflare WAF alternatives are Abnormal AI (43 customers, 0 shared), SentinelOne (42 customers, 0 shared), Vectra AI (39 customers, 0 shared), and Torq (28 customers, 0 shared). [See all Cloudflare WAF alternatives](https://www.usedby.ai/alternatives/cloudflare-waf.md). ### How does usedby know who uses Cloudflare WAF, and how current is it? Each company here links to a public page that names it as a Cloudflare WAF customer, and each line shows its proof level. A company that declared Cloudflare WAF itself is marked Declared. The latest check ran on November 12, 2026. [How usedby collects and checks its data](https://www.usedby.ai/methodology.md). --- Source: https://www.usedby.ai/tools/cloudflare-waf · How we check: https://www.usedby.ai/methodology