WAF Attack Score Lite and Security Analytics arrive for Business customers

Cloudflare has extended its machine-learning-based attack detection to Business plan customers. WAF Attack Score Lite and the Security Analytics dashboard, previously Enterprise-only offerings, are now rolling out to Business plans automatically.

Why signature rules aren't enough

Signature-based WAF rules are fast and generate few false positives for known attack patterns. But the CVE program alone tracks more than 197,000 disclosed vulnerabilities, and new exploits appear constantly. When a zero-day is disclosed, there is an inevitable gap while security teams analyze the threat and update managed rules. During that window, signature-based detection has a blind spot.

Cloudflare's answer is a complementary machine learning layer trained to recognize attack patterns it has never seen. The supervised model was trained on hundreds of millions of requests, blending clean and malicious samples with fuzzy techniques to catch similar patterns. It is currently optimized for three high-impact categories: SQL Injection (SQLi), Cross Site Scripting (XSS), and Remote Code Execution (RCE) attacks including shell injection, PHP injection, Apache Struts compromises, and log4j-style exploits. These classes accounted for more than 24% of mitigated layer 7 attacks in the company's Application Security Report, making them the most common exploitation vectors.

What Business plan customers get

WAF Attack Score Lite provides three functions for Business users:

  • Attack detection: Every incoming HTTP request is inspected and bucketed into one of four classes: attack, likely_attack, likely_clean, and clean.
  • Attack mitigation: A new cf.waf.score.class field is exposed for use in WAF Custom Rules and Rate Limiting Rules expressions, enabling actions like challenge or block based on the classification.
  • Traffic visibility: The Security Analytics dashboard (currently in beta) shows all HTTP traffic, including requests that don't match any rule. This helps investigate false negatives and harden security configurations. Security Analytics is available under Security > Analytics, separate from Security Events under Security > Events.

The Enterprise WAF Attack Score version remains more granular, offering per-category scores with per-domain configuration freedom. The Lite version consolidates those categories into a single classification per request.

Deployment

No action is required to enable the new capabilities. HTTP machine learning inspection began rolling out immediately, and the Security Analytics tab will appear for all Business plan customers as the rollout completes over the coming weeks.

Detection and visibility are passive. Traffic is not blocked or challenged unless customers explicitly create rules using the cf.waf.score.class field. The feature provides insight; mitigation remains a customer decision.

Example: blocking automated attacks

A common workflow combines bot score with Attack Score to catch automated attack traffic:

  1. In the Security Analytics dashboard, use the Attack Analysis panel to filter for "Attack" class. Use the quick filters under Insights to apply multiple filters at once, such as adding the Bot "Automated" filter.
  2. Scroll through the logs to validate the filtered requests.
  3. Select Create WAF Custom Rules from the filtered results. This opens Security Events with the filters pre-applied, where the rule can be deployed — for instance, challenging all matched requests.

Once deployed, the rule challenges traffic matching the selected automated attack variations. Customers needing the full WAF Attack Score with per-category granularity can contact Cloudflare's sales team.