VFS Global

Cloudflare helps VFS Global protect sensitive data by bolstering security with a single solution

VFS Global is a global leader in trusted technology services, empowering secure mobility for governments and citizens. The company manages non-judgmental and administrative tasks related to applications for visa, passport, and consular services for its client governments, increasing productivity and enabling them to focus entirely on the critical task of assessment. With a responsible approach to technology development, adoption and integration, the company serves as the trusted partner to 71 client governments, operating over 4,000 Application Centres in 167 countries.

Challenge: Meeting compliance requirements while keeping their services online

Information security has been a business-critical function at VFS Global well before the General Data Protection Regulation (GDPR) of 2018 came into effect. Operating in a highly-regulated and information-sensitive ecosystem, “VFS Global is the custodian that holds data on behalf of its client governments,” explains Brajesh Jha, VFS Head IT - Projects & Products, and the person responsible for the company’s applications portfolio. “Our entire business and reputation depend on how we secure private data.”

As a result, VFS Global has very specific security and compliance requirements for their multiple website deployments. Blocking bot attacks tops the list of challenges followed by DDoS attacks. Jha explains VFS Global’s unique situation, “Because we are, at times, equated with governments we serve, attackers either try to disrupt our services so applicants can’t get appointments or look for ways to leak their data, which is even worse.”

Further, improving site performance across the globe is our constant endeavor. After witnessing record traffic in 2019, the company took advantage of the travel shutdown during the pandemic to move key systems to the cloud and enhance functionality.

“We prepared our visa application systems for heavy traffic when world travel restarted, but early warnings on reopening travel routes showed surges that exceeded the 5X peaks of 2019 as people began accessing our sites to find out when they could begin to travel again,” says Jha. “That's when we decided we needed something more robust, secure and easier to manage.”

VFS Global replaces multi-vendor solutions with integrated Cloudflare tools

In anticipation of these traffic peaks, VFS Global approached Cloudflare. The initial goal was to consolidate its multi-vendor content delivery, security, and performance infrastructure under one umbrella.

“What we had in place was efficient, but we wanted it integrated and more proactive,” says Jha.

VFS Global saw immediate performance results with the Cloudflare cache, rapidly off-loading 97% of its static traffic to edge servers.

Additionally, the integrated Cloudflare Web Application Firewall (WAF), Bot Management, and Rate Limiting solutions were an ideal match for VFS Global requirements.

“After our proof of concept (POC) testing, we adopted Cloudflare for all of our critical routes,” says Jha. “Five months in, we were happy with what we had achieved by bringing it all together.” Using Cloudflare tools, the VFS Global team can quickly correlate key information from within the dashboard. “Cloudflare’s visibility lets us see events as they happen and implement changes in real time with ease,” says Jha.

Cloudflare security solutions reduce server loads and eliminate bad bots

By implementing Cloudflare Rate Limiting rules across its seven primary domains, VFS Global bolsters its in-application security while protecting its servers by blocking traffic before it becomes harmful. For example, Jha cites limiting the number of hourly calendar checks or registration attempts to levels they consider fair use.

“Earlier, if an individual or scripts attempted a high number of logins or tried to break a password, we blocked it at the application level, but that traffic would still get to our server and cause peaks or even the addition of more servers using auto-scale,” says Jha. “Now we have taken those blocks and challenges out to the perimeter on Cloudflare where we can tighten things up when we see excess traffic coming in and relax them when things revert to normal, managing it with no more than 20 rules per domain.”

When it comes to bot incursions, Cloudflare Bot Management gives VFS Global similar peace of mind and a level of automated detection which its previous solutions couldn’t match. In a single month, Cloudflare Bot Management identified 10 million automated bot requests by JA3 fingerprint, and detected and mitigated 194 million app layer threats.

“The bot behavior we see is unique to us, and we have dedicated a significant effort to identifying and blocking each type of attack,” says Jha. “During the POC we were clear we were clear - we required a solution that went beyond generic detection to address the purpose-specific bots targeting our site. Cloudflare delivered this by identifying patterns, thresholds, and JA3 fingerprints. This has allowed us to accelerate our response, by saving us days of manual effort and eliminating exposure to disruptions. Currently, Cloudflare identifies and blocks as much as 15 percent of our total traffic.”

In addition, the Cloudflare WAF further secures VFS Global by shielding the system from threats in the Open Web Application Security Project (OWASP), protecting API endpoints, and preventing sensitive data detection. In a single month, the WAF generated 581 million protective firewall events using a combination of managed rules, custom rulesets, and other native Cloudflare features.

Accelerating Investigations with Cloudflare Log Explorer

VFS Global managed 27 active data centers and a staggering 20 to 30 million hits per week in the Asia Pacific region alone, leveraging native IIS and database logs accessed on an as-needed basis. While we maintained a SIEM for long-term strategy, the adoption of Cloudflare Log Explorer has allowed us to centralize our processes. By moving toward this integrated, native solution, we have transitioned from a localized process to a unified, real-time posture that provides complete visibility across our entire high-traffic infrastructure.

Sudesh Shinde, Regional IT Lead – Operations & Solutions, at VFS Global, likens that era to digital archaeology He explains how the company has moved from reactive reconstruction to real-time observation. “We simply look at the dashboard and see the story of our traffic unfolding as it happens. It’s the difference between reading a cold case file and watching a live feed, Shinde added"

Because logs were scattered across various servers, investigating security incidents was a time-consuming task. Additionally, traditional backend logs offered limited context regarding application-layer attacks or bot activity, making it nearly impossible to distinguish between legitimate traffic spikes and abusive behavior.

The implementation of Log Explorer helped transform this workflow. It serves as a vital "middle layer" providing near real-time visibility into traffic headers and request-level metadata before they ever reach restricted backend servers. This allows VFS Global to gain a level of context, including WAF actions and bot signals that enable instant correlation between security events and backend impact, allowing the team to triage incidents in minutes—a more than 97% improvement.

"Cloudflare acts as that key middle layer that fiddles with the traffic to stop the abusers and violators," says Shinde. " We are now aware that the traffic coming through is 'good' traffic. This allows our servers to focus strictly on processing transactions rather than being overloaded by the noise of the internet." This shift ensures that even during high-demand periods, the back-end systems remain shielded and efficient.

Beyond security, this visibility has redefined the user experience for VFS Global. By leveraging Cloudflare’s insights and tools like the Waiting Room, it maintains 100% uptime. Even if a back-end process is under heavy load, the front-end remains accessible, providing users with vital documentation and transparency,, ensuring applicants don’t feel abandoned.

Ultimately, Log Explorer delivered immediate value without the cost and complexity of external logging solutions. For Shinde, the most significant gain is the human element. "The true ROI of this transition isn't just the 97% reduction in triage time; it's what our engineers are doing with those recovered hours. We have started optimizing the experience at the edge." By moving to this proactive, data-driven approach, VFS Global has further fortified its digital infrastructure.

“Cloudflare has elevated our overall security. We now have edge-level visibility, faster incident response, and stronger protection against API abuse and bot-driven traffic, all while maintaining high availability”, Sudesh shares.

Cloudflare improves efficiency and encourages proactive collaboration

Since moving to Cloudflare, VFS Global has significantly reduced its dependence on multiple vendors and combined/restructured the existing teams to provide business value in other areas.

They are also seeing a positive response from external support teams. “With the Cloudflare dashboard as their source of information, our managed service provider team contacts me when they spot any issue and proactively open a ticket.”

Cloudflare has had a similar effect as VFS Global employees outside of Jha’s immediate team gravitate towards the console and consult the system unprompted.

“Our teams are now proactively identifying and resolving issues even before a ticked is raised. They come to me with solutions rather than problems”, Jha relates. “It’s a beautiful product with a great onboarding experience.”

Continuous improvement with Cloudflare enhanced customer and technical support

Following a successful onboarding, with controls established and baselines in place, the Cloudflare support teams continue to work with VFS Global to identify gaps and ensure the company achieves optimum performance.

“Cloudflare provided insights that took our performance further,” says Jha. “They have also been an essential partner during urgent, unscheduled rollouts, helping us troubleshoot and maximize our results instantly.”

Due to Cloudflare’s rapid support response, VFS Global has never had to roll back a change.