The redesign is the obvious part — a cleaner UI, a right-click context menu for common actions on macOS, DNS search-suffix support. The interesting part is the new Windows option to block every packet from the moment the machine boots until a user signs in, which closes the pre-login gap that Zero Trust setups have always had to hand-wave around. Both builds are beta, so treat it as a preview rather than a rollout. Cloudflare also taught its Radar post-quantum TLS checker to name specific handshake failures the same day — Split ClientHello, HRR failure, unknown keyshare. Small thing, but it saves real time when a PQ handshake won't complete and you can't see why.