Introducing Cloudflare Application Confidence Score For AI Applications

Why AI apps need a confidence score

The same SaaS and Gen AI tools that boost team productivity also create serious exposure for security, IT, GRC and legal teams. Employees often turn to unapproved applications and paste sensitive data into them for quick wins, creating “Shadow IT” and “Shadow AI” problems across the organization.

The risks are concrete. Gen AI apps may train their models on user inputs, leading to proprietary data leaks to third parties, competitors, or through attack vectors like prompt injection. Providers may retain data for long periods, share it with partners, maintain lax security practices, suffer a breach, or even go bankrupt — leaving confidential data exposed. Model outputs can also be biased, unsafe, or incorrect, triggering compliance violations or poor business decisions.

Yet blanket bans on Gen AI don't work. They stifle innovation and simply push usage underground. What organizations actually need is a smarter, scalable way to triage the rapidly growing number of third-party AI applications without manually auditing each one.

Cloudflare aims to solve this with a new Application Confidence Score for AI applications, part of its AI Security Posture Management (AI-SPM) suite in the Cloudflare One SASE platform. IT and security administrators will be able to check the confidence level of any third-party SaaS or AI application, then write policies informed by those scores. The feature is starting with AI applications.

Built on a transparent rubric

The Cloudflare Application Confidence Score is designed to be transparent, understandable, and accountable, with a focus on app safety, security, and data protection. It is deliberately not based on subjective judgments or black-box “learning algorithms.” Instead, each score is computed against an objective rubric derived from publicly available data: privacy policies, security documentation, compliance certifications, model cards and incident reports.

This rubric will be publicly maintained and kept up to date in the Cloudflare developer docs. If a vendor disagrees with its score, it can submit supporting material to [email protected], and Cloudflare will adjust the score if warranted.

Key principles of the design:

• Public data only. Each rubric component requires a simple yes/no answer based on what the provider publicly discloses. If something isn't documented, the application gets zero points for that component — no assumptions, no guesswork.
• Automated but verified. Scores are computed via crawlers that gather public documentation, process it with AI for extraction and scoring, then route results to human analysts for final review.
• Periodic updates. Scores are revisited on a regular schedule.
• Positive evidence focus. Rather than a risk score, using a confidence score lets Cloudflare reward clear, documented evidence of good security, compliance and safety practices — even if an organization ultimately decides a low score is acceptable for its use case.

One product, two score types

AI applications combine traditional Shadow IT risks — data retention, lax security, financial instability, third-party data sharing — with Gen AI-specific risks such as training on user prompts or producing biased and unsafe outputs. To address these separately, Cloudflare issues two distinct scores:

• Application Confidence Score (out of 5) — covers general SaaS maturity.
• Gen-AI Confidence Score (out of 5) — focused on risks unique to generative AI.

Two separate scales keep the metric extensible to non-AI SaaS apps and make the output easier to reason about. Each score also applies to each account tier of a given provider, since the risk profile can differ dramatically. For example:

• ChatGPT Free scores App Confidence 3.3, GenAI Confidence 1, because by default input data is used for model training.
• ChatGPT Plus scores 3.3 / 3, as users can opt out of training on their inputs.
• ChatGPT Team scores 4.3 / 3, adding collaboration safeguards and configurable data retention windows.
• ChatGPT Enterprise scores 4.3 / 4, with training on input data disabled by default while retaining the Team tier's enhanced controls.

Deployment plans

Cloudflare plans to make the scores available for free across all customer tiers in the future. Non-customers will also be able to browse the scores by creating a free Cloudflare account and navigating to the Application Library in the dashboard.

Inside the Scoring Rubric

The total Application Confidence Score is a five-point scale, with each half covering a distinct set of risks: the overall maturity of the application as an enterprise SaaS product, and the specific risks introduced by its generative AI features.

Application Maturity (5.0 Points)

This portion of the rubric assesses the vendor's operational maturity using established enterprise benchmarks.

Regulatory compliance: Credit is awarded for holding widely recognized certifications that demonstrate a commitment to security and data protection best practices:

• SOC 2: 0.4 points
• GDPR: 0.4 points
• ISO 27001: 0.4 points

Data management practices: These criteria address data retention and third-party sharing, which are direct contributors to the risk of data leaks or misuse.

• Documented data retention window: Shorter retention is rewarded with more points.
  • 0 day retention: 0.5 points
  • 30 day retention: 0.4 points
  • 60 day retention: 0.3 points
  • 90 day retention: 0.1 point
  • No documented retention window: 0 points
• Third-party sharing: Less external sharing of enterprise data is scored more favorably. Sharing for advertising or user targeting is considered the highest risk.
  • No third-party sharing: 0.5 points
  • Sharing only for troubleshooting or support: 0.25 points
  • Sharing for advertising or end-user targeting: 0 points

Security controls: This section rewards the presence of foundational defenses against unauthorized access, with 0.2 points for each of the following:

• MFA support
• Role-based access
• Session monitoring
• TLS 1.3
• SSO support

Security reports and incident history: This criterion incentivizes transparency and penalizes a history of security incidents. To receive the full point credit, a company must have both of the following:

• A publicly accessible security or trust page with documentation covering encryption in transit and at rest, authentication and authorization mechanisms, and network or infrastructure security design.
• Transparent incident response, demonstrated by a published vulnerability disclosure or bug bounty policy, or a documented incident response process and security advisory archive.

Companies missing either component, such as a security page without comprehensive documentation, receive no credit for this criterion. Furthermore, any company that has experienced a material breach resulting in unauthorized disclosure of customer data externally — publicly acknowledged via trust center, press release, or regulatory filing — within the last two years receives a full deduction to zero points.

Financial stability: The vendor's financial health is a proxy for its ability to maintain security and support, reducing the risk of abrupt disruption or sale of data. Points are allocated as follows:

• Public company, or private with >$300M raised: 0.8 points
• Private with >$100M raised: 0.5 points
• Private with <$100M raised: 0.2 points
• Recent bankruptcy or financial distress: 0 points

Generative AI Confidence (5.0 Points)

This half of the score focuses on AI-specific risks, particularly regarding data usage in training and input vulnerabilities.

ISO 42001 compliance: As an emerging management system standard for AI, ISO 42001 is a single indicator of mature, forward-thinking AI governance. A compliant vendor earns 1 point; all others receive 0.

Deployment security model: Strong access controls are essential for enabling monitoring and logging, which aid in misuse detection and incident investigation. An authenticated web portal or key-protected API with rate limiting receives 1 point; unprotected public access receives 0.

Model card: This criterion rewards transparency into the AI model's design, training data, limitations, and biases. A provider that issues its own model card earns 1 point; using a foundation model with a published card earns 0.5 points; and the lack of any model card yields 0 points.

Training on user prompts: This is the most heavily weighted factor, as users may inadvertently share sensitive corporate information in prompts that could be used for model training. The scoring is designed to push for user control over this data usage.

• Explicit opt-in is required for training on user prompts: 2 points
• Opt-out of training is explicitly available: 1 point
• No way to opt out: 0 points

A common pattern emerges when these scores are applied to popular AI providers: enterprise tiers tend to score higher than their consumer counterparts.

Rubric Rollout and Roadmap

The rubric is being published now to solicit community feedback and will be iteratively refined with input from experts in AI research, law, and security operations. The methodology is designed to be transparent, accountable, and extensible.

Soon, these Cloudflare Application Confidence Scores will appear within the Application Library in Cloudflare's SASE platform, where customers can click or hover over a score to see the detailed breakdown of its underlying components. Beyond that, the intent is to enable integration into Cloudflare Gateway and Access, allowing administrators to create policies that block, redirect, or apply controls like data loss prevention or remote browser isolation based directly on an application's score.