Cloudflare Zero Trust & SIEM for SaaS

Client:

International e-commerce SaaS company

Industry:

E-commerce / SaaS

Focus:

Implementation of secure access and centralized event monitoring

Main challenge:

Lack of centralized access control and SIEM created a high risk of developer and partner account compromise.

Market:

International

Services provided:

Cloudflare Zero Trust and Wazuh SIEM implementation

Key Takeaways

MTTD reduced to 1–2 hours

False positives reduced by 50–65%

55 SIEM use cases implemented

SIEM detected 9 incidents during the pilot period

Managed compliance with PCI DSS, ISO 27001, and SOC 2

1,5

months for the project

SIEM-use cases

50–65%

reduction in false positives

Upd: 04.08.2026 4 min

The e-commerce SaaS company lacked centralized access control for remote developers and partners, creating a high risk of account compromise. Datami implemented VPN-free secure access and Wazuh SIEM to improve incident detection and support compliance with security standards.

An international e-commerce SaaS platform on AWS manages online sales, marketplace integrations, and payment gateways, generating 1,800–2,200 events per second with peaks of 4,000 EPS.

Because it processes personal and payment data while providing internal access to partners and remote developers, cybersecurity compliance is critical.

Project tasks and challenges

The lack of centralized SIEM and access control created serious security risks. The company could not quickly detect compromised developer and partner accounts, correlate security events, or support audits with evidence. MTTD was not measured, and monitoring remained fragmented.

Cloudflare Zero Trust was implemented to provide secure access to internal services and integrated with Wazuh SIEM for centralized logging, event correlation, and access monitoring across AWS, Kubernetes, and CI/CD, improving visibility and security operations.

Deploy Cloudflare Zero Trust to provide secure VPN-free access to internal services.
Integrate log sources (Cloudflare, AWS, Kubernetes, CI/CD) with Wazuh SIEM for event correlation.
Configure detection rules, fine-tune SIEM, and ensure PCI DSS, ISO 27001, and SOC 2 compliance.

Secure Access

Deploy Cloudflare Zero Trust with MFA and device posture checks for VPN-free remote access.

Centralized SIEM

Integrate AWS, Kubernetes, Cloudflare, CI/CD, and endpoint logs into Wazuh for event correlation.

Compliance

Close PCI DSS, ISO 27001, SOC 2, and GDPR gaps through logging and incident response.

Our approach

Datami conducted a comprehensive audit of the access architecture, AWS IAM policies, Kubernetes logging, and the CI/CD environment. The core solution combined Cloudflare Zero Trust with Wazuh SIEM.

A hybrid approach combined risk-based analysis, MITRE ATT&CK mapping, and PCI DSS, ISO 27001, and SOC 2 compliance requirements to maximize threat coverage.

Hybrid-approach

Combined access risk analysis, threat scenario modeling, and logging and security control configuration aligned with security standards.

Key project phases and solutions

The project lasted 1.5 months with weekly status meetings and progress reports.

Critical IAM and Cloudflare policy changes were deployed within 48 hours of identifying security gaps.

Detection rules were validated through session cookie theft and account compromise simulations.

Audit and planning

Assessment of Cloudflare Zero Trust policies, AWS IAM, Kubernetes/CI/CD logging, and SIEM readiness
Implementation, testing, and tuning

Assessment of Cloudflare Zero Trust policies, AWS IAM, Kubernetes/CI/CD logging, and SIEM readiness
Documentation

Prepare incident response procedures, access policies, and a hardening recommendations report with security metrics

Results and recommendations

Before the project, security risks were elevated due to the lack of centralized monitoring and access control. The Datami team identified critical gaps in AWS IAM permissions, Cloudflare Zero Trust policies, and logging visibility.

During the Wazuh SIEM pilot, 9 security incidents were detected. After implementation, the risk of account compromise was significantly reduced, MTTD decreased to 1–2 hours, MTTR to 6–10 hours, and false positives by 50–65%. Key PCI DSS, ISO 27001, and SOC 2 compliance gaps were addressed.

The client gained:

Secure VPN-free access through Cloudflare Zero Trust.
Centralized visibility of all security events in Wazuh SIEM.
Formalized incident response processes and regular rule tuning.
Recommendations for periodic IAM and CI/CD reviews and staff security training.

Key project results

The project was completed on schedule. The company gained VPN-free secure access through Cloudflare Zero Trust, a fully operational SIEM, and measurable security metrics, closing key compliance gaps and strengthening resilience against real-world threats.

This case shows that SaaS platforms with remote teams need a modern Zero Trust model and centralized SIEM monitoring. Continuous monitoring and rapid response help protect payment data and business reputation.

Metric

Before the project

After the project

MTTD

Not measured

1–2 hours

MTTR

Several days

6–10 hours

False positives

High

Reduced by 50–65%

SIEM use cases implemented

Detected incidents

No centralized detection

9 incidents during the pilot

Compliance

Partial (gaps)

Managed (PCI DSS, ISO 27001, SOC 2)

More success stories with Datami

Browse other project case studies

WordPress Website Recovery After a Hack

Backdoor infections and web shells were completely removed.
9 unauthorized admin accounts were removed.

Services:

WordPress Security Audit (White-box)

Aug 4, 2026

SIEM Wazuh Implementation for a Financial Company

PCI DSS & ISO 27001 audit-ready
Reduced false positives by 60–70%

Services:

SIEM Implementation (Wazuh)

Jul 1, 2026

Blockchain Project Security Audit

Audited 9,000+ lines of Rust code
Project certified by Datami

Services:

Blockchain security audit

Jun 30, 2026

Back to home page

Datami articles

When AI Meets Smart Contracts: How Prompt Injection Creates a New Web3 Attack Surface

Oleksandr Filipov

When AI Meets Smart Contracts: How Prompt Injection Creates a New Web3 Attack Surface

A smart contract can pass the most rigorous audit and the product around it can still be exposed. All it takes is an AI reading on-chain text as a command. A new class of Web3 risk, from a real Datami finding.

3 min Aug 3, 2026

Cybersecurity Risk Self-Assessment: 6 Gaps Fintech Companies Notice Last

Oleksandr Filipov

Cybersecurity Risk Self-Assessment: 6 Gaps Fintech Companies Notice Last

Most companies learn about their weak spots not from their own team, but from a due diligence partner or an attacker. We explain which gaps in fintech remain unnoticed the longest and why.

4 min Jul 27, 2026

Cyber Risk Self-Assessment: 20 Questions for Fintech Companies

Oleksandr Filipov

Cyber Risk Self-Assessment: 20 Questions for Fintech Companies

We offer a free cybersecurity self-assessment questionnaire, developed from Datami’s 9 years of experience in pentesting for financial sector organizations.

5 min Jul 15, 2026

Show all articles

On this page you will learn what cookies are and how and when we use them. Definition of the term Cookies Cookies are pieces of data that a web server generates and that a website stores on your user device (computer, smartphone, tablet, etc.). Each website or third-party service sends cookies to the browser installed on your device only if your browser allows it. This is possible if you have not set any restrictions in your browser settings to save cookies. Browsers are a very well thought out technology. They protect personal data and allow websites to access only cookies that were previously sent to them. Cookies are divided into: session cookies. They are stored in the memory of the browser only during your session, after leaving the site immediately removed. permanent. They are stored in the memory of the browser for a long time. Definition of the term “browser” A browser is an application for browsing websites. The most popular browsers are Chrome, Internet Explorer, Firefox and Safari. All listed browsers are safe. In the settings of these browsers, cookies can be easily disabled, as well as change the settings of their work. You can: accept all cookies; ask the browser to notify when cookies are used; do not accept cookies. Cookies on datami.ee and how we use them We use cookies to: our site is more functional; to understand how you navigate on the site, what content you consume better, to develop the content strategy of the site; understand how many visits to the site were per day, month, year. Analyze the geographical identity of users of the site, the number of repeated visits and other data. Cookies that we use on our site. Third-party cookies. The buttons of social networks, videos and some other services of our site are the property of other companies. These companies may also use cookies on your device if you have used them on our site or have been previously registered with them. The privacy policy of the use of personal data by these services can be found on the websites of these services. Blocking cookies All browsers allow simple actions to disable cookies. To disable them, you must go to your browser settings and find cookies in them. But we must remember that blocking cookies can have a negative impact on the performance of many websites. How to delete files You can also always delete cookies that are stored on your computer. To do this, follow the instructions of your browser Again, deleting cookies can have a negative effect on the performance of many websites.