---
title: Voidhawk Deployment | CDN Traffic Copies & Native Enforcement | ZioSec
description: Copy requests and responses from your CDN to Voidhawk out of band. Start in observe mode, then enforce through Cloudflare, Fastly, or AWS controls when you choose.
url: https://ziosec.com/voidhawk/deployment
---

# Copy at the edge. Decide in the cloud.

Enforce through your platform’s API.

A worker on your CDN copies requests and responses to Voidhawk asynchronously. Users keep the same request path. Voidhawk analyzes the copies in its cloud and, when you enable enforcement, writes scoped rules into your existing edge controls.

- No new proxy, appliance, application agent, or app code changes.
- Responses never wait for a Voidhawk verdict.
- Rules remain visible and editable in your platform.

## Operating modes

Observe mode copies both requests and responses. It provides actor, intent, and outcome visibility without enforcement. Enable actions per site and per action when you are ready.

### Observe

See actors, intent, and outcomes without changing how traffic is handled. Visibility remains useful even if you never enable enforcement.

### Enforce via API

Write scoped rules and list entries through your platform’s management API. Your existing edge controls enforce them.

### Enforce in the worker

Optionally apply Voidhawk’s current decisions in the worker for actions the platform’s native rules cannot express.

## Integrations

| Platform | Where the worker runs | Where blocks land |
| --- | --- | --- |
| Cloudflare | Worker on selected routes, zones, or hostnames | WAF custom and rate limiting rules; IP and custom lists |
| Fastly | Compute service in front of your origin | Next-Gen WAF rules and lists, or edge ACLs |
| AWS CloudFront | Edge functions on selected distributions | AWS WAF IP sets and rule groups |

Available controls depend on your plan with each provider. Request and response copies are processed in Voidhawk cloud; discuss traffic scope and data handling during deployment planning.

## Control over every rule

Rules match the actor’s fingerprint, address set, path, or credential. Each rule is tagged to its actor and incident, carries an expiry, and can be reviewed before it ships. Choose automatic pushes or analyst approval per site and action.

## Rollout

1. **Scope access.** Grant worker deployment and rule or list edit permissions only for the sites you choose.
2. **Deploy the worker.** Select routes to observe. Your application and origin need no code changes.
3. **Observe.** Review actors, intent, outcomes, and evidence from your own traffic without enforcement.
4. **Enable enforcement.** Turn on rule pushes per site and action once your team is ready.

[Discuss your environment](/contact?intent=voidhawk) | [Back to Voidhawk](/voidhawk)