Horizon Inc, on Cloudflare One
A complete, fictional company - thirty people, five internal applications, an internal service desk on a private server, and an AI agent - deployed so that every problem Cloudflare One solves can be shown on something that looks real.
The demo library is the place to start. Each chapter is one problem Horizon Inc has - retiring a VPN, getting admins onto servers without standing credentials, staff pasting customer data into a chatbot - and the part of Cloudflare One that solves it. 7 of 10 can be run today; coverage says exactly which capabilities are shown, which are planned, and which are out of scope here.
The whole of Cloudflare One - identity, the VPN, data protection, AI and the evidence afterwards, in about twenty-five minutes.
Safe AI adoption: the walkthrough - one person, one afternoon, and an AI assistant that can reach everything she cannot. Or one of five scripts that each prove a single control.
What is in the environment
| What it is | Reached as | |
|---|---|---|
| WorkWeek | HR - people, pay, reviews, HR case files | Public hostname, behind Access |
| Pipeline | Sales CRM - accounts, contacts, deals | Public hostname, behind Access |
| WorkBox | Mail and calendar | Public hostname, behind Access |
| Nexus | Wiki - public and restricted spaces | Public hostname, behind Access |
| Ledger | Finance - Executives only | Public hostname, behind Access |
| Backlog | The internal service desk, on a private server | https://backlog.corp.internal - lab only, through the Cloudflare One client |
| pgAdmin | The database console, IT Admins only | https://pgadmin.corp.internal - lab only |
| The apps server | SSH, for IT Admins | 192.168.10.10 - lab only |
| FlareID | The identity provider behind all of it | Public hostname |
| MCP portal | Every app's MCP server, for the company's AI agent | |
| Driftbox | A fictional consumer file sharing service - the outside world | Public, deliberately not behind Access |
The people
Alice Watson
Content Strategist, Marketing. No special access anywhere - the person most chapters are run as.
Nikita Chapman
Chief Executive Officer. In the Executives group, so Ledger exists for her.
Rickie Deckow
VP of Engineering, and one of the two IT Admins - the people who may reach the apps server and the database console.
Ramona Flatley
Sales manager, engaged as a contractor - one of four. Signs in successfully, and is not an employee.
Every account's password is Savetheinternet!1 unless the deployment set another.
Two storylines run through the data
Project Ironwood
A confidential acquisition, mid-diligence: an Executive wiki page, a CRM deal, calendar entries, an exec mail thread, and a data-room request in the service desk.
The Q1 restructure
A planned reduction in Marketing, with a named list. HR case notes, planning meetings, a restricted wiki page - and a service desk ticket asking IT to prepare account suspensions. Alice is on the list.
How it fits together
Before you run anything
- Setup - the Cloudflare One client, and the agent client for the AI chapters.
- The data - what each app holds, and what its API and MCP server hand out that its web UI never will.
- Controls - what the protection layer deploys, and why each rule is shaped the way it is.
Every person, customer, figure and message here is synthetic. The incidents behind the AI controls are real, and are cited here.