Defensive AI: Cloudflare’s approach to AI-powered security
Generative AI has given attackers powerful new tools for crafting credible phishing lures, automating social engineering, and building targeted malware for specific sites. Defending against these evolving threats requires security solutions that can learn and adapt at machine speed. Cloudflare’s Defensive AI framework is built on this premise: using intelligence gathered from its network to improve security products across application, email, and Zero Trust domains.
The foundation of Defensive AI is the data Cloudflare collects from its network—both broadly across all traffic and specifically for individual customers. This allows for two distinct approaches: training models on global attack patterns to identify unknown threats, and building per-customer models that learn what normal traffic looks like for a specific application or user.
Anomaly detection for API security
APIs now account for 57% of dynamic traffic on Cloudflare’s network, making them a prime target for attackers seeking to exfiltrate data or take over accounts. Yet securing APIs is hard: each one has unique business logic that differs from traditional web applications, making rule-based protection inefficient.
Cloudflare is developing an ML-powered feature called API Anomaly Detection for its API Gateway product. The system learns an application’s intended business logic by analyzing sequences of client API requests. Once it models what a “normal” sequence looks like, it can detect deviations that indicate an attack. This pairs with the Gateway’s existing Sequence Mitigation capability, which can enforce the learned model to block suspicious behavior.
API Anomaly Detection is still in development, but customers can sign up for the beta here. In the meantime, API Gateway customers can use Sequence Analytics and Sequence Mitigation, with docs available here. Enterprise customers without API Gateway can start a trial from the Cloudflare dashboard.
Making the WAF smarter than its rules
Cloudflare’s Web Application Firewall (WAF) processes 55 million HTTP requests per second on average, giving it broad visibility into attack traffic worldwide. But a signature-based WAF has two persistent problems: new vulnerabilities take time to translate into rules, and attackers constantly mutate known payloads to evade detection.
To address this, Cloudflare uses machine learning models trained on attack traffic from its network. These models can identify variations and bypasses of known attacks, as well as entirely new vulnerabilities, without waiting for manual rule creation. This is the mechanism behind WAF Attack Score, which is now available to all Enterprise and Business customers.
Attack Score classifies each HTTP request by the likelihood it’s malicious. It doesn’t replace human analysts—rather, it works alongside them. When Attack Score identifies a novel attack payload, analysts can use that intelligence to write better rules; those rules, in turn, improve the training data for the models. This feedback loop shortens the response time for new threats.
Cloudflare plans to extend this model to account for customer-specific traffic patterns, improving its ability to detect deviations from benign traffic for particular applications.
Fighting AI-generated phishing at the inbox
Email remains the most common attack vector: 90% of cyber attacks start with phishing, and Cloudflare’s own data shows 2.6% of emails secured in 2023 were malicious. AI-generated phishing is harder to spot from language alone, as attackers no longer rely on obvious spelling errors.
Cloudflare Email Security uses AI models trained on both global and per-customer data to analyze phishing attacks. In 2023, the service processed approximately 13 billion emails and blocked 3.4 billion of them, providing substantial training data. Privacy is handled by excluding personally identifiable information from training sets.
Two notable detection techniques in the product are:
- Honeycomb: a patented sender-domain reputation model that builds a graph of message senders and assigns risk. It is trained per customer, so each client’s model reflects their own legitimate traffic.
- Labyrinth: a per-customer ML model that targets spoofing. It maintains a list of a client’s known-good partner domains; a message from an unverified domain that references a verified one is flagged as spoofed.
Zero Trust with behavior-based risk scoring
Enforcing strict Zero Trust access controls often creates friction—frequent verification prompts slow down users, and IT teams struggle to mine log data for signs of compromised accounts.
Cloudflare’s approach is to delegate that analysis to AI. The Zero Trust platform performs user and entity behavior analytics, scoring users as Low, Medium, or High risk based on real-time behavioral signals. This enables teams to detect account compromise, policy violations, and other risks without holding security incidents up to manual log review.
The first contextual behavior available is “impossible travel”—flagging when a user’s credentials are used in two locations too far apart for plausible physical travel. Future extensions include patterns in time-of-day usage and access to sensitive resources like internal repositories, which can be observed because traffic proxies through the Secure Web Gateway.
A broad push across the security stack
Defensive AI is not a single feature but a framework applied across Cloudflare’s products. In application security, it means anomaly detection and attack scoring. In email, it’s the domain reputation and spoofing models. In Zero Trust, it’s continuous user risk scoring.
The common thread is this: AI is already central to digital defense—it differentiates vendors able to stop new, never-before-seen attacks from those relying on static signatures to catch yesterday’s threats.
