The trust boundary between the CDN edge and the origin is the single most common weak point we see in infrastructure engagements. It is not because origin protection is difficult in principle — it is because the assumptions that anchor the boundary rarely survive the lifecycle of the deployment.
Certificate transparency logs remember every hostname → IP relationship the origin ever presented. Historical DNS records, expired sub-domains, staging environments left listening, and CI runners hosted on production-adjacent IPs all provide a direct path around the edge.
We model reachability the way an attacker does: enumerate every publicly known association with the origin, connect to the results with a Host header matching production, and assert the trust boundary from the outside — not from the WAF dashboard.