How First Wave and Cloudflare strengthened ComfortDelGro’s digital resilience across 13 countries

ComfortDelGro operates public and private mobility services across 13 countries. Working with Cloudflare and First Wave Technology, the Singapore-headquartered transport group turned a fragmented response to automated traffic into a globally managed model for application security, delivery and observability.

First Wave is a Cloudflare Powered+ Partner (Resell). That partnership brings together Cloudflare’s global edge platform and First Wave’s local implementation, managed operations and observability expertise to help CDG protect and run high-volume digital mobility services.

At a glance

A global mobility network needs a reliable digital front door

ComfortDelGro is one of the world’s largest multi-modal transport operators. Its businesses span taxi and point-to-point transport, buses, rail and travel disruption management, with operations across markets including Singapore, Australia, the United Kingdom, China, Sweden and New Zealand.

That scale brings a practical technology challenge: the group needs a consistent security baseline, while each market still faces its own operating conditions and threat patterns. As ComfortDelGro expanded and consolidated its technology operations, the business needed its public-facing services to remain available, fair and responsive for genuine users.

Before Cloudflare, ComfortDelGro did not have the bot-management and API-protection capabilities needed for two high-impact use cases.

At its driving school, automated bots could take newly released lesson slots within seconds, leaving genuine learners unable to complete a booking. On the taxi platform, some drivers used bots to secure advance bookings, making it harder for other drivers to compete fairly for work. The resulting automated traffic consumed application bandwidth and back-end processing capacity, contributing to slow or failed transactions and negative feedback on social media.

The issue was more than a security problem. For a mobility provider, availability and fairness directly shape the experience of learners, drivers and passengers.

What First Wave and Cloudflare deliver to ComfortDelGro

As a Cloudflare Powered+ Partner (Resell), First Wave helps CDG turn Cloudflare capabilities into a solution that can be implemented, operated and optimised across markets:

• CDN to accelerate public-facing applications and improve the consistency of digital experiences.
• WAF and DDoS Protection to defend the application layer and network edge against malicious traffic.
• Bot Management and Advanced Rate Limiting to distinguish abusive automation from legitimate learners, drivers and passengers, while protecting application capacity.
• API Shield to provide visibility into API traffic and support customised, dynamic mitigation rules.
• DNS through a consolidated management plane for in-scope Group domains.
• First Wave managed services and observability support to connect deployment, monitoring, optimisation and day-to-day operations.

Together, these capabilities create a managed digital front door: Cloudflare filters and accelerates traffic at the edge, while First Wave helps CDG design the controls, integrate them with its environment and keep the service running.

Turning Cloudflare into an operating model

Our role at First Wave was to help ComfortDelGro move from a point solution to a repeatable, managed way of protecting and operating its digital estate.

Starting at the front gate

After a proof-of-concept evaluation, Cloudflare was selected for its stability, mitigation effectiveness and performance. The initial deployment combined Cloudflare CDN with rate limiting to protect the applications most affected by automated traffic.

From there, the footprint expanded globally. Cloudflare became the external-facing layer in a broader security architecture, working alongside existing firewalls, intrusion detection and prevention systems, and endpoint detection and response.

This layered approach gave ComfortDelGro a consistent way to filter and manage internet traffic before it reached the applications and services behind it.

Turning an incident into better API visibility

The next stage began with a security incident involving a subsidiary’s API environment. ComfortDelGro needed to understand how the threat actor was behaving and determine how to block similar activity more effectively.

Working with our team, ComfortDelGro deployed Cloudflare API Shield as a proof of concept. The exercise provided deeper visibility into traffic patterns and helped the team create customised mitigation rules that could adapt dynamically as the observed behaviour changed.

The value was not only in blocking one incident. API Shield helped ComfortDelGro build a more responsive control model, with less dependence on continuous manual tuning. At the time of the Cloudflare case study, the company reported that the same or similar attack patterns had not been observed for 18 months after the tailored controls were implemented.

Making global operations simpler to run

As the Cloudflare deployment matured, ComfortDelGro consolidated DNS management for in-scope Group domains into a single portal. This reduced the operational overhead of managing different DNS platforms and gave teams a common management plane across markets.

First Wave now provides a fully managed Cloudflare service for ComfortDelGro. We also support the customer’s CDN and observability operations, helping its teams keep high-volume mobility services fast, secure and reliable as the business grows.

“First Wave has greatly improved the efficiency of our observability and CDN solutions. We are assured we can depend on the professional services of the First Wave team to deliver projects reliably with minimum risk.” — Head of DevSecOps & Production Support, ComfortDelGro— Head of DevSecOps & Production Support, ComfortDelGro

Results that improve both user experience and operational confidence

The combined Cloudflare and First Wave approach has delivered measurable improvements across security, availability and operational efficiency:

• Approximately 90% less bot-driven disruption on affected booking services in the initial months after deployment.
• More than 99.9% availability for in-scope external-facing applications.
• Stronger API protection, with dynamic, customised rules used to mitigate a targeted attack pattern against a subsidiary.
• One global DNS management plane, replacing a more fragmented operating model.
• Faster market integration, with one UK subsidiary’s migration to Cloudflare completed in less than a week, compared with roughly four and a half months for its previous solution.

For the people using the services, the outcome is straightforward: a better chance of completing a booking when they need to. For the technology teams responsible for those services, it means more visibility, more consistent controls and less operational friction across markets.

The First Wave perspective: technology needs to be run, not just deployed

Cloudflare provides the edge platform. The difference comes from how that platform is designed into the customer’s environment, introduced in phases, connected to existing controls and operated day after day.

At First Wave, we help enterprises build that operating model around their business priorities. For ComfortDelGro, that meant starting with the services under the most pressure, proving the value of the controls, extending protection across the group, and giving local and central teams a simpler way to manage a global footprint.

The result is a more resilient digital front door for a transport business where uptime, speed and fairness are all part of the customer experience.

Looking ahead: preparing for the next security challenge

ComfortDelGro’s next priority is broader than transport applications: how to provide oversight as employees adopt generative AI tools, while protecting the data used with those tools.

The company is developing its AI governance framework and policies before deciding which technologies should enforce and provide visibility into them. That direction reflects the same principle that shaped the Cloudflare programme: establish the operating model first, then choose and implement the controls that support it.

Build a more resilient cloud and application environment

If your organisation is managing high-volume digital services across markets, First Wave can help you assess the right combination of Cloudflare security, CDN, observability and managed operations.

Talk to First Wave about your cloud, security and observability requirements.