[TRANSCRIPT - Acme Financial Services - Discovery Call - April 14, 2026] [Duration: 47 minutes] SE (Divya): Thanks everyone for joining. I'm Divya from Cloudflare's Solutions Engineering team, and I have Mark from our account team. Could everyone on your side introduce themselves? Customer (Sarah Chen, CISO): Sure — I'm Sarah Chen, CISO at Acme Financial. With me is Tom Rodriguez, Head of Infrastructure, and Lisa Park, VP of Application Security. SE: Tom, you mentioned on our intro call that you had significant incidents last quarter — can you walk me through what happened? Tom (Head of Infrastructure): Three major DDoS incidents in Q4. Our current Zscaler setup is struggling with volume and attack sophistication. We're also running Palo Alto for network firewall and managing three separate vendors is becoming operationally painful. 15,000 employees, VPN infrastructure creaking under hybrid load. Sarah (CISO): The bigger concern is API exposure. We launched a mobile banking platform 8 months ago — 47 public-facing APIs. Two months ago we had a credential stuffing attack — 50,000 accounts compromised. Board wants a solution before September. We need this by Q3. SE: Is the timeline driven by the board presentation or is there a contract renewal? Tom: Both. Zscaler contract up for renewal in August. Been unhappy for 18 months — support poor, performance unacceptable during peak trading hours. SE: And budget — existing approved budget or new business case? Sarah: Budget approved. Board approved $2.8M for security infrastructure as a direct response to the incident. We need to make the right decision, not the fast one. Lisa (VP Application Security): How does Cloudflare handle client-side JavaScript security? We had a Magecart-style attack attempt last month — skimmer injection on our payment page. We got lucky catching it manually. And we're 3 months from launching an AI-powered financial advisor — need LLM protection from prompt injection before go-live. SE: Both exactly what we built for. Page Integrity Manager handles client-side protection — monitors every JavaScript resource on payment pages in real time. AI Gateway is our LLM security layer — sits between your application and the model, handles prompt injection detection, rate limiting, content filtering. Having both requirements is actually a strong case for Cloudflare's unified platform versus point solutions. Tom: What does migration from Zscaler look like in practice? SE: More manageable than teams expect. Parallel deployment — users stay on Zscaler while we onboard a pilot group to Cloudflare Access. Typically 30 days pilot, 60 days to full cutover for your size. I can have our Zero Trust architect prepare a specific migration analysis. Mark (AE): I'll send over our POC framework document by end of this week. Sarah: What do you need from us to get started? SE: Technical deep-dive with Tom's infrastructure team to understand network topology and identity stack. And if Lisa can share the AI architecture, we can scope AI Gateway in parallel. Can we get on the calendar in the next two weeks? Tom: Yes. Our ideal decision date is June 1st so we have time to implement before August renewal. SE: We'll work backwards from June 1st. Mark, can you coordinate? Mark: On it — something out today. Sarah: One more — what does Cloudflare look like versus Zscaler on pricing at our scale? SE: I'll have our team put together a TCO comparison — apples to apples on what you're paying Zscaler versus a Cloudflare deployment at same scope. At 15,000 seats we're competitive, and when you factor in consolidating the Palo Alto workload, the combined TCO story is usually compelling. [Call ended]