Cloudflare for Gainsight — Vendor Consolidation Executive Brief

Eight consolidation plays

Each maps to a real product, domain, disclosed incident, or a live conversation already underway with Gainsight's own security team.

One DNS + edge for every acquired brand

↳ replaces fragmented DNS (GoDaddy, UltraDNS, Route53)

gainsight.com sits on GoDaddy + UltraDNS, Skilljar/Northpass/inSided sit on AWS Route53, and Aptrinsic sits on GoDaddy — each with its own partial or nonexistent edge protection. Staircase AI is already fully delegated to Cloudflare; use it as the template.

staircase.ai NS: aitana/burt.ns.cloudflare.com — the working model
gainsight.com: partial CNAME proxy only (NS still GoDaddy/UltraDNS)
One authoritative DNS + WAF policy across every brand

One WAF across Azure + AWS — a live, stated ask

↳ replaces Azure WAF + ModSecurity (AWS) run in parallel

Gainsight's own Senior Information Security Analyst confirmed a product line runs Azure WAF and ModSecurity (AWS Env) side by side and is explicitly looking to "maintain a single WAF for both the clouds." The Gainsight CS core app (app.gainsight.com / auth.gainsightcloud.com) separately resolves straight to an AWS load balancer with no edge WAF at all.

*Per account-team (Gainsight InfoSec, Feb 2026): "single WAF for both clouds" is a named requirement
Identified: app.gainsight.com → prod-apigateway-lb-*.us-east-1.elb.amazonaws.com; no cf-ray
One rule set instead of maintaining Azure WAF + ModSecurity configs separately
Bot Management on the auth endpoint (credential-stuffing target)

Cloudflare Stream — Skilljar + Gainsight CE

↳ consolidates two overlapping LMS video pipelines

Skilljar (dashboard.skilljar.com) and Gainsight CE/Northpass (app.northpass.com) are both video-heavy customer-education platforms today running on AWS — and are the two most obviously overlapping products post-acquisition.

Identified: dashboard.skilljar.com via CloudFront (x-amz-cf-id)
One encoding/adaptive-bitrate pipeline instead of two
Natural moment to standardize before further LMS consolidation

R2 — egress-free storage

↳ offloads AWS + Heroku-hosted assets

Course assets, community media, and static marketing files (static.gainsight.com) are split across AWS S3/CloudFront and Heroku today. R2 charges $0 egress and pairs directly with Stream and Images as one origin.

Identified: static.gainsight.com → herokudns.com CNAME
S3-compatible API — low-friction migration
One storage bill instead of three

Cloudflare for SaaS — automate the cert flow they described

↳ replaces a manual Let's Encrypt + cert-manager pipeline

Gainsight's own security team described their current per-tenant custom-domain flow directly: customers set a CNAME, then "Let's Encrypt take[s] care for the HTTP Challenge" via cert-manager — manual, per-domain, ops-owned. Communities (ex-inSided) is the clearest fit, white-labeled for Zoom, Zendesk, Greenhouse, and Kaseya per Gainsight's own May 2026 release.

*Per account-team (Gainsight InfoSec, Feb 2026): exact architecture described as a requirement
Identified: communities.gainsight.com → insided.com → CloudFront
Automatic SSL issuance/renewal per tenant custom domain — no cert-manager babysitting
Same edge already used for gainsight.com's own WAF

Turnstile + Bot Management — community moderation

↳ filters spam before it reaches their new AI moderation agent

Gainsight's own Oct 2025 release announced a "Moderation AI Agent" for Customer Communities. Stopping bot/spam signups and posts at the edge cuts the volume — and cost — of what that AI layer has to review.

Privacy-first CAPTCHA replacement on registration/posting forms
Bot Management blocks scripted account creation & scraping
WAF for public UGC injection/XSS risk

Zero Trust Access + Email Security

↳ directly responds to their disclosed Salesloft Drift breach

Gainsight's own security page discloses a Sept 2025 incident: an OAuth-token theft campaign against Salesloft Drift compromised business contact data and support-case content connected to their Salesforce environment. Their mail is also routed through Mimecast.

Identified: MX → us-smtp-inbound-1/2.mimecast.com; incident disclosed at gainsight.com/security
Access/CASB-style controls on third-party OAuth-connected SaaS apps
Cloudflare Email Security evaluated alongside Mimecast for phishing-resistant coverage

AI Gateway + Enterprise MCP — govern the agentic stack Gainsight already sells

Cost control · compliance · safe agent access

Gainsight markets Atlas AI Agents and a public MCP Library, and Staircase AI (Cloudflare's one fully-adopted asset here) just earned ISO 42001 — the AI-management-systems standard. AI Gateway puts a governed, logged front door on every LLM call across these products; Enterprise MCP lets Gainsight expose internal systems to agents safely, behind Zero Trust, instead of open data paths.

One pane of glass + logs across any model provider, across every acquired product
Cache & rate-limit to cut token spend as Atlas usage scales
MCP servers fronted by Access — no open data paths for external AI tools
Directly reinforces the AI-governance story Gainsight is already telling the market

Consolidation roadmap

Land the quick wins on the core app first, then expand into the acquired brands, then unify the whole portfolio under one control plane.

First 6 months

Land & quick wins

Full Cloudflare DNS delegation for gainsight.com + skilljar.com (today: partial/CNAME only)
WAF + Bot Management in front of app.gainsight.com / auth.gainsightcloud.com
Page Shield across customer-facing app domains — Gainsight PX's own JS SDK runs on thousands of customer sites
Stream pilot on one Skilljar or Gainsight CE course library

By 12 months

Expand & secure

R2 migration for LMS/media storage; retire the Heroku-hosted static assets
Cloudflare for SaaS custom hostnames for Customer Communities' white-label tenants
Zero Trust Access unifying the 5 separate product login systems
AI Gateway in front of Atlas AI Agents + Staircase AI model calls

Within 2 years

Consolidate & govern

Bring Gainsight PX (Google Cloud) and Gainsight CE (AWS) onto the same edge as Staircase AI
Enterprise MCP governance across the public MCP Library
Evaluate Cloudflare Email Security alongside Mimecast
One commercial relationship & a repeatable playbook for the next acquisition

Consolidation snapshot

Current-state platforms are evidence-based; nothing here is assumed.

Function	Today	How it was identified	On Cloudflare
Corporate site edge	WP Engine + partial Cloudflare identified	x-powered-by: WP Engine; server: cloudflare; NS: GoDaddy/UltraDNS	Full Cloudflare (DNS+WAF+CDN)
Gainsight CS (core app)	AWS ELB, us-east-1, no CDN	app.gainsight.com → prod-apigateway-lb-*.us-east-1.elb.amazonaws.com; no cf-ray	WAF + Bot Management
Gainsight PX (ex-Aptrinsic)	Google Cloud	app.aptrinsic.com — "via: 1.1 google"; GCP IP range	CDN/Workers for embedded SDK
Gainsight CE (ex-Northpass)	AWS, no CDN	app.northpass.com resolves in AWS ranges; no cf-ray	Stream + R2
Customer Communities (ex-inSided)	AWS CloudFront	communities.gainsight.com → insided.com → *.cloudfront.net	Cloudflare for SaaS + Bot Mgmt
Skilljar (app)	AWS CloudFront	dashboard.skilljar.com — x-amz-cf-id / via CloudFront	Stream + R2
Static / marketing assets	Heroku	static.gainsight.com → herokudns.com	R2 / Workers
Staircase AI	Cloudflare (full)	NS: aitana.ns.cloudflare.com, burt.ns.cloudflare.com	Expand: AI Gateway + MCP
Email security	Mimecast	MX: us-smtp-inbound-1/2.mimecast.com	Cloudflare Email Security (evaluate)
WAF (secondary product line)	Azure WAF + AWS ModSecurity confirmed	*Per Gainsight InfoSec (Feb 2026 email): "Azure WAF and ModSecurity (AWS Env). Application on both clouds."	One Cloudflare WAF policy, both clouds
Custom-domain TLS	Manual Let's Encrypt + cert-manager confirmed	*Per account-team: CNAME + HTTP-01 challenge, ops-managed per tenant	Cloudflare for SaaS (automated)
VPN / ZTNA	AWS native + Palo Alto Prisma confirmed	*Per account-team (Gainsight Tech Ops, Nov 2025 call)	Cloudflare Access

One network for every brand Gainsight has acquired.

From four clouds to one network

Why now