Mind the gap: new tools for continuous enforcement from boot to login

**Executive summary:** Cloudflare introduces mandatory authentication in the Cloudflare One client (blocking internet access until the device/user authenticates) and an independent network-edge MFA to provide a secondary root of trust beyond SSO providers; the post describes supported MFA options, policy controls, deployment notes (Windows-first mandatory auth, MFA in closed beta), and frames these features as reducing the blast radius of compromised credentials and improving continuous device posture enforcement.