Understand what CF Guard Desk is, how the audit workflow is structured, and how the free trial and subscription licensing fit together.
- Capability matrix and buyer fit
- Trial and license flow
- Cross-signal findings model
- Exports, drift tracking, and local-first posture
Product overview
What CF Guard Desk is
CF Guard Desk is a desktop-first security posture console for Cloudflare.
It is built for operators who need to prove posture, not just monitor it.
The product connects accounts, validates tokens, discovers zones, runs structured audits, reviews cross-signal findings, tracks posture drift, and exports evidence-backed reports from one local desktop workspace.
Capability matrix
| Surface | What the product does |
|---|---|
| Secure access | Workspaces, vault gating, keychain-backed credentials, token validation, capability inspection |
| Structured scans | Quick Scan, Full Audit, Focused Rescan |
| Findings | WAF coverage, DNS exposure, origin bypass risk, bot pressure, cache risk, TLS and header posture, visibility gaps, cross-signal risk |
| Operator workflow | Lifecycle state, notes, suppressions, severity context |
| Evidence | Markdown and JSON exports, scan snapshots, drift comparison, score trends |
Trial and license flow
Every installer starts with 7 days of full Pro access.
The intended sequence is:
- Install the app.
- Accept the EULA on first launch.
- Create and unlock the local vault.
- Use the full product during the 7-day trial.
- Subscribe through Lemon Squeezy if you want to continue.
The desktop runtime verifies license state locally and keeps a 7-day offline grace window.
Who the product is for
CF Guard Desk is built for:
- freelance consultants and agencies
- internal infrastructure or security operators
- hosting, platform, and SMB teams managing many Cloudflare zones
It is not positioned as collaborative enterprise SaaS with shared dashboards, RBAC, or SSO-first workflow.
Why cross-signal findings matter
The lead differentiator is compound risk detection.
The product correlates signals across DNS, WAF, traffic, and configuration state so buyers can defend findings such as:
- origin bypass risk plus weak WAF coverage
- auth-path pressure without throttling
- partial visibility that meaningfully limits confidence
That is the layer the native dashboard does not package into one exportable audit narrative.