For insurers and IT reviewers
What Walltunnel covers on an insurance application.
Cyber-insurance applications ask the same questions. Here is where Walltunnel answers them, where it helps, and where a firm needs something else. Print this page to attach it.
| The application asks | Walltunnel | What it does |
|---|---|---|
| Web and DNS filtering | Covered | Every device's lookups and web traffic are checked against Cloudflare's threat intelligence; phishing, malware, scam and newly registered domains are blocked. |
| Malware scanning of downloads | Covered | Downloads and uploads are scanned before they reach the disk. Installers and scripts from untrusted sites are blocked. |
| Encryption of remote and public Wi‑Fi traffic | Covered | All traffic leaves through an encrypted, post-quantum tunnel (ML-KEM-768 with P-256). |
| Controls can't be disabled by users | Covered | Firm devices are locked on and reconnect by themselves; leaving the firm's protection needs an administrator. |
| Disk encryption on laptops | Monitored | Each Mac reports every five minutes whether FileVault is on. Walltunnel shows it; it doesn't turn it on. |
| Operating systems kept up to date | Monitored | Each Mac reports its macOS version; out-of-date Macs are visible to the firm. Updating them is the firm's job. |
| Logging of security events | Partly | Every block is logged with the device and time. Logs are kept for a day by default, longer on request. |
| Email filtering | Partly | Walltunnel stops the link or attachment when it's opened. It doesn't filter the mailbox; the firm's email provider does that. |
| Multi-factor authentication | Not covered | Set up in the firm's email and case-management accounts. |
| Endpoint detection and response | Not covered | Walltunnel works at the network. Pair it with endpoint protection for files that arrive another way. |
| Offline or immutable backups | Not covered | A backup service is still needed. |
Technical summary
- Engine: Cloudflare One client, signed by Cloudflare and notarised by Apple, unmodified.
- Tunnel: MASQUE over HTTP/3, post-quantum key agreement, no classical fallback.
- Policy: one Cloudflare Zero Trust account per firm; rules apply to every enrolled device at once.
- Default: fails closed. If a device can't reach the checks, traffic doesn't go around them.
More detail is on the security page. Questions from an underwriter: support@aai.dev.
Last updated 14 October 2026.