Cloudflare’s 2025 outage exposed risky dependence on edge WAFs. Emergency origin bypasses stripped defenses, turning downtime into a live pen test. Resilience now demands multi-vendor architecture, origin controls, and pre-approved, ZTA incident governance that assumes outages, and resilience.