I used to main a firewall similar to CloudFlare's and we never charged for filtered traffic, as you say, it makes no sense. My guess is that the traffic that is

I used to main a firewall similar to CloudFlare's and we never charged for filtered traffic, as you say, it makes no sense. My guess is that the traffic that is being charged is not really being filtered out by the firewall in itself but by some other part of the infrastructure, part that is — for some reason — generating some cost. However, being sure that this is just a misunderstanding, I wonder why the CTO didn't know that this was already happening.