How Cloudy translates complex security into human action

Why Security Alerts Need an Explanation Layer

Modern security telemetry is vast and complex. A single email scan might draw on sender reputation, authentication checks, link behavior, infrastructure metadata, and more. CASB engines simultaneously track SaaS environments for misconfigurations, risky access, and exposed data. Detection engines are sophisticated, but the explanations attached to their findings often lag behind, leaving security teams with results they can’t quickly interpret and end users without the context they need for real-time decisions.

Cloudy is an LLM-powered explanation layer built into Cloudflare One. It takes raw signal output and turns it into clear, human-readable guidance. For Cloudflare Email Security, that means helping users understand why a message was flagged before they hit “report.” For Cloudflare CASB, it helps administrators assess SaaS findings and remediation paths without decoding low-level signals. This post covers how Cloudy is being extended across Phishnet and API CASB to improve decision-making and reduce security team noise.

Explaining Detections Inside Phishnet

Cloudflare Email Security doesn’t rely on a single model. Multiple ML models evaluate different parts of a message — sender reputation, content, links, structure, behavior — and the model set grows as new detections are trained. Outcomes are labeled Malicious, Suspicious, Spam, Bulk, or Spoof. Customers have consistently said the labels are correct but the reasoning is opaque. To address this, Cloudy was first introduced to provide LLM-powered summaries of detections, initially for SOC teams in the dashboard. Feedback confirmed those summaries meaningfully improve understanding.

The next problem surfaced around Phishnet, the tool that lets users submit messages to the SOC. Security teams report that queues are often flooded with submissions that turn out clean, creating backlog and slowing response to genuine threats. Traditional security training doesn’t fix this — periodic sessions don’t help users evaluate a real email in the moment. Cloudy is now being embedded directly into Phishnet to close that gap, giving users immediate, contextual guidance. The goal is to reduce escalations that don’t need investigation while helping cautious users recognize risk, rather than forcing SOC teams to choose between noise and missed threats.

Over the next month, the Phishnet reporting button for Microsoft will get the Cloudy treatment. When a user clicks report, a Workers-based workflow aggregates structured outputs from multiple detection models — sender reputation, domain and infrastructure characteristics, authentication results, link and content analysis, and behavioral indicators. That aggregated data is passed to Workers AI, where purpose-built prompts generate a natural language explanation. The process focuses on explanation and doesn’t alter the original disposition. Because it runs on Cloudflare’s Workers platform, summaries are generated at low latency and global scale, providing immediate feedback at the point of interaction.

Plain Language, Not Technical Jargon

The user-facing summaries are intentionally redesigned compared to admin views. During testing, Cloudflare found that admin summaries relied on concepts like ASNs, IP reputation, and authentication failures — terms that don’t work for non-technical users. The Phishnet experience therefore strips that jargon and uses plain language while preserving the meaning of the detection. Users get a summary they can actually act on: whether an email appears risky and why, or why it looks safe.

The summaries are generated in real time, only when a user interacts with a message in Phishnet. They are currently in beta with Microsoft customers, with validation to prevent hallucination and ensure no incorrect guidance that could introduce security risk. Cloudy summaries are not trained on customer data. After the beta period, access will expand to all Microsoft users, and Google Workspace will see similar Phishnet sidebar upgrades later in 2026.

Cloudy moves from inbox to SaaS misconfigurations

Cloudy's role isn't limited to the inbox. Cloudflare is now applying the same assistant to the administrative side of security operations, translating complex CASB findings into structured explanations. The goal is to help security and IT teams understand risk, prioritize remediation, and act confidently across SaaS environments without diving into documentation for each connected app.

From black box to structured breakdown

Cloudflare One's API-based CASB connects to SaaS tools over API to provide a consolidated view of misconfigurations, overshared files, and risky access patterns across Microsoft 365, Google Workspace, Slack, Salesforce, Box, GitHub, Jira, and Confluence. It continuously scans for new issues as users share and collaborate, with findings that are organized, searchable, and exportable.

Previously, understanding why a specific finding was triggered required piecing together context from the detection and the app involved. Cloudy summaries replace that effort with a short description of the detection rationale, listing the specific details of the match.

Rather than a plain text summary, Cloudy for CASB produces a structured breakdown designed for immediate remediation. During beta testing across providers from Microsoft 365 to Dropbox, the model consistently parsed findings into two distinct sections:

• Risk: States exactly why the finding matters—for instance, clarifying that a "Suspended User" may indicate a compromised account or a user who should no longer have access to company data.
• Guidance: Suggests concrete next steps, such as verifying whether a suspension was intentional or reviewing an application's legitimacy before revoking access.

This structure lets analysts grasp the severity of a finding without requiring deep expertise in the specific SaaS application involved, removing unnecessary delay between identifying an issue and fixing it.

Privacy-first generation

Cloudy summaries in CASB are generated with Cloudflare Workers AI, keeping data within Cloudflare's infrastructure during analysis. The models are not trained on your SaaS data, and summaries are generated ephemerally to aid triage—so teams get the speed of AI without sending sensitive internal documents to public models.

What’s next for Cloudy

For Email Security, Cloudflare will keep expanding Cloudy's support for administrators and end users through clearer explanations, better in-context guidance, and deeper integration into daily workflows.

For CASB, the roadmap includes natural-language querying of findings, allowing administrators to ask questions about their cloud and SaaS apps directly. That builds on richer explanations for additional detection types, tighter feedback loops between user actions and detections, and improved collaboration between users and SOC teams through Phishnet. The broader aim is to make Cloudy a core part of how organizations understand, trust, and act on email and SaaS security decisions.

Organizations that aren't yet Cloudflare customers can try the free Retro Scan tool, which uses Cloudflare's predictive AI models to scan existing Microsoft 365 inbox messages. It detects and highlights threats so organizations can remediate them directly in their email accounts and then implement controls—either via Cloudflare Email Security or another solution—to prevent similar threats from arriving in the future.