Cloudflare Details Evidence-Grounded AI Agents for Managed Defense
Summary
Cloudflare says its Managed Defense beta uses deterministic data collection and specialized AI agents to correlate alerts and produce evidence-cited recommendations, while keeping analysts responsible for decisions and mitigations.
Key points
- Cloudflare says deterministic, versioned reconnaissance gathers customer identity, detection history, traffic baselines, enforcement outcomes, and network observations before AI analysis.
- A coordinator sends alerts for deeper review to four specialist agents covering traffic, customer context, global telemetry, and threat intelligence.
- The synthesis agent combines typed findings but cannot fetch new evidence or select classifications outside an approved vocabulary.
- Application code validates that evidence citations exist, belong to the investigation, and support attached claims; unsupported findings are corrected or recorded as limitations.
- The system records missing or unavailable evidence separately from a checked lookup with no match, and makes no classification or disposition recommendation when evidence is insufficient.
- Cloudflare says its global telemetry specialist uses aggregates rather than other customers’ individual records or identities.
- Managed Defense Analysts remain responsible for decisions and mitigations; the early beta is available for eligible application-security alerts and cases.
Article Details
- Event Type
- Early beta announcement of an AI-agent security operations harness in Cloudflare Managed Defense.
- Impact
- The harness gathers and correlates alert evidence, helps prioritize alerts, and produces auditable recommendations for analysts. Cloudflare says the beta is available to eligible application-security alerts and cases. Managed Defense Analysts retain responsibility for decisions and mitigations; no quantified impact is reported.
Vendors
AnthropicTo further analyze context, we make use of the OpenAI Daybreak Defense Network and our partnership with Anthropic. Cloudflare uses approved OpenAI Daybreak and Anthropic models, including GPT-5.6 Cyber and Mythos, forCloudflareparadox. Now, our built-in, multi-AI-agent security operations harness can handle more of this work at Cloudflare scale.OpenAIfor missing sources while new alerts continue to arrive. To further analyze context, we make use of the OpenAI Daybreak Defense Network and our partnership with Anthropic. Cloudflare uses approved OpenAI Daybreak and
Products
ClefGPT-5.6 Cyber and Mythos, for deeper model-backed analysis. Initial analysis and scoring is done with Clef, Cloudflare’s open-source decision model.Cloudflare Managed DefenseOur Cloudflare Managed Defense AI agent harness speeds up the process of gathering data, connecting and aggregating detections, and accounting for missing sources while new alerts continue to arrive. To further analyzeGPT-5.6 Cyberpartnership with Anthropic. Cloudflare uses approved OpenAI Daybreak and Anthropic models, including GPT-5.6 Cyber and Mythos, for deeper model-backed analysis. Initial analysis and scoring is done with Clef,MythosAnthropic. Cloudflare uses approved OpenAI Daybreak and Anthropic models, including GPT-5.6 Cyber and Mythos, for deeper model-backed analysis. Initial analysis and scoring is done with Clef, Cloudflare’sWorkers AIClef, running on Workers AI, was the perfect fit for this type of fast agentic reasoning.