Cloudy Arrives: Cloudflare’s AI Agent Tackles WAF and Gateway Config Drift

Cloudflare is embedding an AI agent, Cloudy, directly into its dashboard to combat a common enterprise headache: configuration sprawl. The first release targets security teams managing complex Web Application Firewall (WAF) Custom Rules and Cloudflare One Gateway policies. The goal is straightforward—automating the drudgery of manually reviewing large, evolving rule sets so administrators can understand what is configured, spot gaps, and receive actionable fixes.

AI-Driven Rule Auditing for WAF

For WAF users managing custom rules, the new Cloudy functionality provides an automated summary of what is configured across their account. Rather than auditing dozens of rules by hand, Cloudy analyzes the relationships and interactions between them. This helps surface several common conflict types, including:

  • Redundant rules: Flagging multiple rules performing the same function or using similar fields.
  • Execution order issues: Identifying where a terminating rule (e.g., block or challenge) prevents subsequent rules from running.
  • Conflicting logic: Detecting when one rule blocks traffic that another is designed to allow.
  • Disabled protections: Highlighting security-critical rules that are turned off.

Cloudy goes beyond mere description; it provides recommendations based on an analysis of rule relationships, saving teams time on manual audits and offering a clearer view of their security coverage.

Streamlining Cloudflare One Gateway Policies

The same AI assistance is live in Cloudflare Gateway, the Secure Web Gateway component of the Cloudflare One SASE platform. Gateway configurations often degrade over time with forgotten policies and complex nested logic involving numerous selectors and operators. Administrators can inadvertently block hundreds of URLs in one step or carve out specific user groups in ways that are hard to track.

For this reason, Cloudy now provides a quick, concise summary of any Gateway policy. This feature gives admins a clear understanding at a glance—without needing to parse raw configuration data—helping them identify misconfigurations or redundant controls quickly.

The Workers AI Backend

Cloudy is built on Cloudflare Workers AI, the same platform made publicly available to developers. It uses publicly-available LLM models combined with a purpose-built prompt that is enriched with context. The process involves several key data points to ensure accuracy:

  • Policy & rule data: The current configuration that Cloudy must summarize and suggest improvements for.
  • Product documentation: Details on permissible configurations so the model only suggests valid recommendations.
  • Enriched datasets: Translating IDs in lists (e.g., country codes, category lists) into plain text so the model can interpret them.
  • Output instructions: Structuring output in JSON for easy handling.
  • Clarification prompts: Explicit instructions emphasizing that the model must prioritize certainty in its output to mitigate hallucinations.

This automation aims to reduce human error and the burden of manual review, providing transparent insights that help teams streamline configurations and maintain a robust security posture.

Roadmap and Feedback

Beta previews of Cloudy for WAF Custom Rules and Gateway are available to all customers today. Cloudflare’s roadmap for 2025 includes extending these agent capabilities to other areas of the product suite, focusing on recommendations for performance optimization and operations, beyond just security.

Users are encouraged to send feedback to [email protected] or tag posts with #SecurityWeek to shape the future AI roadmap.