How is this more effective than having Cloudflare WAF (or your WAF of choice that can inspect and transform potentially malicious inbound traffic) front all public endpoints and mitigating attacks there with rules? All non public access can be put behind a VPN requiring certificate based auth, which is unlikely to be broken with AI. You can then patch as time permits through exposure management and attack surface reduction.
How is this more effective than having Cloudflare WAF (or your WAF of choice that can inspect and transform potentially malicious inbound traffic) front all public endpoints and mitigating attacks there with rules? All non public access can be put behind a VPN requiring certificate based auth, which is unlikely to be broken with AI. You can then patch as time permits through exposure management and attack surface reduction.