Enforza exists to give cloud teams the egress, ingress and east-west control they actually need — the capability of the cloud-native firewall and more — at a fraction of the cost, deployed their own way. No per-GB data-processing tax. No six-figure platform you will half-fill. The control you need, in the gap between the two.
Securing a cloud network had become a choice between two bad deals: pay the cloud firewall a tax that scales with your traffic forever, or buy an enterprise platform you will never fully use. We built the third option.
Cloud service moved at light speed; cloud networking caught up; cloud network security didn't. The hyperscalers' own firewalls do the job, but they meter you per gigabyte — the cost rises every time you move more data, not every time you write more policy. The enterprise vendors do far more, at a price and complexity where most of what you buy is never switched on.
Enforza is the firewall in between: a lightweight Linux VM inside your own cloud network — run a single instance, or scale out to a fleet of ten, exactly as your availability and throughput requirements demand — governing egress, ingress and east-west traffic, billed at one flat per-firewall rate with no per-GB charge. The capability of the cloud-native firewall and more, on a line you can forecast — and the flexibility to size your own deployment, rather than pay for the one the provider sizes for you.
Most cloud teams feel squeezed from both sides. Enforza is built precisely for the space in the middle.
To secure egress on a hyperscaler you stack a NAT gateway and a managed firewall — each metered per gigabyte, on top of a per-hour and often per-availability-zone fee. The bill scales with the traffic you push, not the policy you write. Protecting more, or moving more data, costs more every month — indefinitely.
The alternative is a mega-NGFW platform — hundreds of features, a six-figure invoice, and a licence metered by vCPU and instance size. Most teams switch on a fraction of it and pay for all of it. Half used, fully paid for. It is more firewall than a cloud network needs, at a price a cloud team cannot justify.
More than the cloud-native firewall. Far less — and far cheaper — than an enterprise NGFW platform. We are clear about our scope on both axes; that fairness is the point.
We are not a Palo Alto, Fortinet or Check Point mega-NGFW, and we do not claim to be. We are the way to replace your cloud-native firewall without going full-blown enterprise security vendor — the real control most organisations need, between the cloud tax and the six-figure platform.
We have been at this since 2023, and we have evolved toward what cloud teams actually want — adding the control that matters, removing what does not, and building our own engine for speed.
Enforza starts while exploring a secure replacement for cloud NAT gateways, founded by Neil Briscoe — who previously co-founded Cloud Gateway, the UK's first SASE platform.
The NAT-gateway concept grows into a full firewall with FQDN-based filtering — across every cloud and on-premise, not one provider.
A fully automated platform ships, with a deliberately simplified pricing model. Features are added — and removed — based on real usage: lean by design, never half-used and fully paid for.
A lifecycle refresh adds the Cloud Controller console for GUI-driven teams and white-label capability for partners — and Enforza reaches its 100th customer.
Work begins on our own single-pass packet classification and verdict engine — built to classify each flow once, in microseconds rather than milliseconds, for high performance and low overhead on the same standard Linux network primitives everyone uses.
Development of the GitOps workflow: firewall policy as code, reviewed in a pull request and gated by the same compliance checks before it ships — for platform-engineering teams who keep policy where the rest of their infrastructure lives.
A ground-up rework of the Cloud Controller console — the same fleet, policy and live-log experience on a faster, more scalable foundation.
The new engine, Cloud Controller and pipeline integration go into beta testing together — proven against real fleets before general release.
The new architecture ships. On the same standard Linux network primitives, the single-pass engine classifies each flow once in microseconds — a measured p99 of around 49.5 µs first-packet — then enforces in-kernel at line rate, 98.5% fast-path, with zero dropped packets across our throughput runs. High performance, low overhead, built for cloud.
“Paying by the gigabyte never sat right with me — not when you're already billed by the hour for the same firewall. So we filled the gap: one flat price, and a tool that fits both worlds — a console for network and security teams, policy-as-code for cloud and platform teams.”
Neil Briscoe Founder, Enforza
Neil founded Enforza in 2023, after co-founding Cloud Gateway — the UK's first SASE platform. The thread is the same: take control that used to demand heavy, expensive kit and deliver it as a cloud service a small team can run. Enforza applies that to the cloud firewall — the capability of the cloud-native one and more, at a fraction of the cost, deployed your team's way.
The positioning is the why. These are the two places the engineering is genuinely better — the engine, and the attack surface — not just managed for you.
Like every firewall, Enforza sits on the same proven, standard Linux network primitives — that common ground is the honest opener. What is different is what we built on top. Our single-pass packet classification and verdict engine classifies each flow once, in microseconds — a measured p99 of around 49.5 µs first-packet on a standard VM — then enforces it in-kernel at line rate, with 98.5% of packets never leaving the kernel and zero dropped across our throughput runs. It is a cloud NVA engineered for the cloud, not an on-prem box bolted onto it.
We are also ahead of the self-managed world on attack surface. A box you run yourself — open-source firewall or NGFW VM — needs a reachable management interface to administer it; that interface is itself something to expose, harden and stand a VPN in front of. Enforza's firewall instance has no inbound management port and no admin UI at all: its control plane is outbound-only to the Enforza cloud, so it manages up, never in. There is nothing on the security device to find.
Trust is the conversion lever, so these are commitments we can stand behind — not slogans.
Enforza covers the egress, ingress and east-west control most organisations actually need — FQDN/SNI-based L7, secure NAT, threat hardening, compliance — and deliberately stops there. The vast majority of core use cases you actually use, none of the bloat you do not. We are aware of our scope and proud of it.
One flat per-firewall line. No per-GB tax, no per-rule tiers, no charge by CPU, instance size, protected IP or protected device. Your firewall should not bill you for how much it protects, or how hard it works.
Log export streams to your own SIEM and never passes through Enforza's cloud. The firewall instance runs inside your network, on a VM you own. We manage the policy and the fleet; we do not sit in the path of your traffic or your logs.
The firewall instance has no inbound management port and no admin UI to expose. Its control plane is outbound-only to the Enforza cloud — it manages up, never in. There is nothing reachable on the security device to find, harden or stand a VPN in front of.
Run it as policy-as-code through a GitHub pipeline, or drive the Cloud Controller console by hand. Same firewall NVA underneath, same billing. We do not make you adopt a workflow to adopt a firewall.
Our performance numbers are measured on standard VM sizes and quoted as conservative floors, not marketing ceilings. Our cost comparisons are directional and dated against published vendor rates. If a proof point does not exist yet, we do not invent one.
The capability of the cloud-native firewall and more, at a flat per-firewall price, on any cloud — GitOps or console, logs to your own SIEM. Start free, no card.
