Security Report · github.com/jacobdjwilson

Cloudflare’s 2026 Security Signals Report Highlights Six Enterprise Risk Fault Lines

Oct 21, 2026 · Original Report (PDF) ↗

Summary

Cloudflare’s 2026 Security Signals Report identifies risks in AI governance, autonomous systems, supply chains, threat intelligence, legacy architecture, and cloud dependencies, urging continuous controls and failure containment.

Key points

The report identifies six interconnected risk areas and advocates systems that detect stress, adapt, and contain failures without waiting for manual intervention.
Citing IBM’s 2025 breach report, it says 97% of organizations reporting an AI-related security incident lacked proper AI access controls; it recommends AI inventories, data-flow visibility, and continuous logging.
Cloudflare reports bots account for 92% of login attempts it observes, often involving credential stuffing. It recommends verifiable machine identities, short-lived credentials, and enforceable authorization boundaries for AI agents.
Citing Verizon’s 2025 DBIR, the report says third parties were involved in 30% of breaches, twice the prior year’s share. It recommends continuous dependency visibility and operational use of SBOMs and VEX.
The report cites a finding that only 37% of organizations have formalized and documented threat modeling, and recommends integrating business-relevant threat intelligence into that process.
Citing VulnCheck, it reports 884 vulnerabilities were observed being actively exploited in 2025, with 29% showing exploitation on publication day, underscoring the limitations of lengthy patch cycles.
Cloudflare’s DDoS figures rose from 13.9 million attacks in 2023 to 47.1 million in 2025. The report warns that shared identity, control-plane, and deployment dependencies can undermine multicloud redundancy and recommends testing failure containment.

Article Details

Publisher: Cloudflare
Scope: Global enterprise resilience, covering AI governance, autonomous systems, supply-chain dependencies, threat intelligence, legacy architecture, and cloud failure containment.
Key Statistics: Citing IBM's 2025 report, 97% of organizations that reported an AI-related security incident in 2025 lacked proper AI access controls.
Citing Verizon's 2025 DBIR, 30% of breaches involved third parties, twice the proportion in the prior year.
Citing VulnCheck, 884 vulnerabilities were observed being actively exploited in 2025; 29% showed evidence of exploitation on the day they were published.
Cloudflare Radar recorded 47.1 million DDoS attacks in 2025: 34.4 million network-layer attacks and 12.7 million HTTP attacks, compared with 13.9 million total attacks in 2023.
Citing IBM's Cost of a Data Breach Report 2025, organizations extensively using AI and automation shortened breach lifecycles by 80 days and reduced average breach costs by $1.9 million compared with organizations not using those capabilities.
Recommendations: Maintain a shared inventory of AI use, map data flows and ownership, and continuously log activity and collect evidence to detect unsanctioned usage.
Give AI agents verifiable cryptographic identities and short-lived, context-aware, revocable credentials; enforce policy-as-code and separate decision-making from authorization.
Continuously map supply-chain dependencies using operational signals, SBOMs, and VEX; verify machine-to-machine access and reassess vendor risk based on observed behavior.
Integrate business-relevant threat intelligence into documented threat modeling, controls validation, and threat hunting.
Centralize modernization authority, consolidate fragmented platforms, and separate critical identity, policy, execution, and control-plane dependencies; test failure scenarios to verify containment.