Data: 3,263 configured users / 3,400 cap = 95.8%. Growing ~25 users/month. Will hit cap by ~June 2026. 2,800 employees total. BISO seats (3,400) should increase in tandem.
"You're at 95.8% seat utilization and growing. Let's get ahead of this before it impacts onboarding new employees. A move to 3,800–4,000 seats gives you 18 months of headroom."
Capacity planning conversation, not upsell
Data: Feb 2026 = 2.31B queries vs 2B cap (115.4%). DNS records growing 270/month. DNS-only zones: 177 → 185 in 6 months. Proxied records also growing.
"You're already in overage on DNS queries. Rather than incurring overage charges, let's right-size the cap for your growth. A 3B cap gives you 18 months of runway."
Bundle with $150K open pipeline deal
Data: 11/11 prefixes at 100%. All onboarded prefixes now advertised. 0 leased prefixes.
"All your allocated prefixes are advertised. If your network team needs to onboard additional prefixes for new infrastructure, we'll need a cap increase."
Raise during network review
Data: 3,400 BISO seats purchased, ~0 active usage. WARP deployed to 3,100+ users. Technical prerequisites are met. The hard part (endpoint deployment) is done.
Not revenue expansion — but activating BISO strengthens stickiness, creates a richer security posture, and protects against the seat being cut at 2028 renewal.
CSM: Propose BISO enablement session. Start with high-risk use case: isolate risky web categories or unmanaged device access.
Data: Negligible DLP activity (100–1,000 log events/mo). Insurance technology company processing sensitive policyholder data. WARP + Gateway infrastructure now deployed.
"You've built the foundation with WARP and Gateway. The next step is protecting sensitive data in transit. Given your industry's regulatory requirements, DLP can help detect and prevent data exfiltration."
Requires understanding their data classification posture
Data: 8,295 configured devices, 3,247 active = 39% device utilization. 0 mobile devices. 100% desktop deployment. 5,000+ gap between configured and active.
Ask about mobile device management strategy and field staff access needs
Data: 3x closed-lost attempts ($78K Sep 2024, $0 Aug 2025, $70K undated). Active $150K "Applied_Dev_NW" deal in Discovery may include network services.
Risk: This has been tried and rejected multiple times. Don't re-pitch the same way. Understand why it was rejected — pricing? Technical fit? Timing? Competitive?
Investigate closed-lost reasons before re-approaching
Data: No Workers/KV/D1/DO usage. workersEntitled: false across all zones. But 86% API traffic + workers.dev subdomain configured. CF1 and App Service Mix propensity active. Active Fly-Fishing trials: Bot Management + Images (since Jun 2025).
Requires understanding their development stack and API-first architecture
Data: 2,800 employees, no email security product. Insurance industry = high phishing target.
Only raise if natural conversation about phishing/BEC arises
Outstanding Balance: $364K
Total balance is $364K for a customer paying $118K/month. The >90-day balance is a credit (-$9.4K), so no aged receivable issue. But the total suggests recent invoices are unpaid — could be billing dispute, AP processing delays, or contract extension billing catching up. Action: Check with Finance.
Long-Open WARP Ticket (94+ Days)
Dec 12, 2025: "Reconnect setting is not being honored on macOS client" (CUSTESC-59863). Routed to engineering. For a customer that just deployed WARP to 3,100+ users, an unresolved macOS bug is a bad look for Premium Success. Action: CSE Sergio Bentim should be tracking this. Escalate if needed.
Oct 2025 WAF Incident Cluster — Were These Properly Addressed?
Three urgent tickets in Oct 2025 related to Cloudflare-side WAF rule changes breaking their traffic: managed rule update false positives, beta rule blocking despite disabled, ASN misclassification. These were Cloudflare's fault. If not properly post-mortem'd, they erode trust. Action: Verify addressed in QBR or dedicated follow-up.
Multiple Closed Lost Deals + Termination Attempt
Magic WAN (3x lost), Load Balancing (2x lost), ZT expansion (lost), CASB (lost). Plus a termination attempt in Nov 2024 (-$187K) followed by a $161K termination amendment that closed in Dec 2024. Something caused them to want to reduce spend. Understanding what was terminated and why is critical context for future expansion conversations.
Browser Isolation Is Shelfware
3,400 BISO seats purchased, ~0 active usage. If they don't start using BISO before the 2028 renewal, this is the first line item to get cut. This is both a value realization risk and a revenue risk. Action: Enablement session to activate BISO now that WARP is deployed.
Low Access SSO Activity
Only ~50 SSO logins per 30-day period across 3,263 configured users. Access is not a primary authentication gateway. Most users access apps directly or through other SSO flows. If perceived value is lower than cost, it becomes a renewal risk.
Fly-Fishing Trials Not Converting
Active trials since Jun 2025: Bot Management on ivansinsurance.ca (they already own BotMgmt — may be testing new zone) and Images (no visible usage). If stale, these represent disengagement with new products. Action: Check trial status and engagement.
Applied Systems Account Dashboard · Generated from Cloudflare Lighthouse Insights API · March 16, 2026
Salesforce ID: 001o000000M6KOyAAN · 5 Sub-Accounts · 361 Active Zones