Cloudflare Consolidates Predictive Security Posture Management in One Place
Modern companies operate across a sprawling mix of SaaS, public cloud, and on-premises infrastructure. While that diversity offers flexibility, it also widens the attack surface. The shift security teams need is from reactive defense to a predictive posture—one that continuously identifies risk before it becomes a breach. Cloudflare’s latest updates aim to bring this into a single view, covering both SaaS and web applications.
Healthy security posture management relies on three pillars: real-time discovery of assets and documents, continuous threat detection driven by asset awareness, and prioritized remediation guidance. Cloudflare is now building these out across the full stack, starting with the centralized Security Center dashboard and extending down into posture-specific views for SaaS fleets and individual web domains.
Role-Based Security Insights Center
Cloudflare’s Security Center is the hub for posture data across all connected applications. The platform scans for misconfigurations and risks on a regular cadence, surfacing results as insights grouped by severity, risk type, and the relevant Cloudflare solution. For many issue types—such as setting a minimum TLS version of 1.2, a standard recommended by PCI DSS—remediation can be applied with a single click without leaving the dashboard.
To help larger teams act faster, Cloudflare has added role-based access control (RBAC) to Security Insights. Individual practitioners now see a filtered view of the issues relevant to their function, while users with administrator roles—such as a CSO—retain full visibility across every insight in the account.
Posture Findings for SaaS Fleets
Without centralized management, SaaS applications can feel like the “security wild west.” Sensitive data—files, invoices, databases, integrations—lives behind settings controlled by third-party vendors, while your own users constantly create and update content, risking configuration drift and public exposure.
Posture findings stemming from account-wide Security Insights can now reveal these issues. From there, the Cloud Access Security Broker (CASB) digs deeper into misconfigurations, highlighting findings like:
- Publicly available or externally shared files
- Third-party apps with read or edit access
- Unknown or anonymous user access
- Databases with exposed credentials
- Users without two-factor authentication
- Inactive user accounts
You can also browse the dedicated Posture Findings page for a searchable view across documents stored in your SaaS apps. Beyond visibility, Cloudflare lets you build prevention-based policies to keep configurations compliant and reduce alert fatigue for Security Operations. These policies can also block the movement or exfiltration of sensitive data, providing the audit trail and control needed to lock down regulated data classes.
Real-Time SaaS Discovery
A major weakness in the previous SaaS discovery process was reliance on crawlers pulling data from vendor APIs. Rate limits on larger datasets forced batched scanning, producing stale findings and a confusing cadence of remediation—when a file was un-shared, the dashboard might continue to flag it for some time.
Cloudflare has replaced this with a real-time collection pipeline, now live for Microsoft 365, covering Admin Center, OneDrive, Outlook, and SharePoint. The flow runs through a set of Cloudflare components:
- Webhook listener: A Worker receives asset change notifications from the SaaS vendor.
- Data storage and queuing: The raw payload is archived to Cloudflare R2 and published to a Cloudflare Queue.
- Transformation Worker: A second Worker consumes the raw messages, maps vendor-specific data to a generic CASB format, then stores the result in R2 and forwards it to a second queue.
- Polling consumer and crawler: A CASB consumer polls processed messages, routes them to the correct crawler, and fetches current asset details via the vendor API for storage in the CASB database.
The improved pipeline handles anywhere from 10 to 20 Microsoft updates per second—between 864,000 and 1.72 million updates daily—making findings effectively instantaneous. Additional SaaS vendors are set to join the platform in the coming months.
Web Application Security Overview
Web applications pose their own challenge: no one-size-fits-all security approach. Every Cloudflare customer now has access to the Security Overview page, a customization-first landing page for each onboarded domain. It aggregates and prioritizes a clear list for protecting your specific setup:
- If any attacks are ongoing, they can be surfaced immediately.
- Traffic disposition (mitigated, served by Cloudflare, served by origin) across the past seven days is shown.
- Active security modules that are detecting threats are summarized.
- A step-by-step guide suggests improvements to your security posture.
- Your most active and most recently modified rules are listed for quick review.
Web Asset Discovery and Labeling
Cloudflare’s threat detection now operates with knowledge of the assets behind your web domains. Rather than treat all traffic equally, the system discovers endpoints—whether a login form or a marketing page—by examining hosts and paths. Each endpoint can then carry a label noting its business purpose, which powers more specific, useful detections. For example, a POST to /portal/login likely indicates a user authentication API, which is a very different threat profile from a GET request serving the login webpage itself.
By labeling multiple ends of the same business function with a common label—like pointing both employee /api/admin/login and customer /portal/login to the cf-log-in label—security teams can classify potentially similar behavior. This lets you build one rule that protects all endpoints sharing a label, even if the paths differ.
API Shield customers can already leverage endpoint labeling. In early Q2 2025, Cloudflare is introducing label discovery and suggestions for the cf-log-in, cf-sign-up, and cf-rss-feed labels. Other customers can manually add labels to their own saved endpoints.
Threat Detection Riding on Labels
One use case this unlocks is fighting AI-driven account fraud. The traditional CAPTCHA approach is increasingly insufficient, especially given that AI can now solve most image-based puzzles. The actual issues—like disposable email signups from humans—are best addressed at the root.
To combat such fraud, Cloudflare is developing a rule that could block all signups using disposable email addresses as user identifiers. One deployment of this rule would cover all labeled cf-log-in and cf-sign-up endpoints, offering consolidated protection across your entire account.
These use-case-driven detections run by default once traffic lands on Cloudflare’s network. Future expansions are planned for securing LLM-powered services (with separate rules for inspecting prompts and gating rate limits based on token usage), as well as an account fraud detection framework to tackle multiple attack vectors in 2025.
API Posture Scans
APIs bring their own distinct security challenges. Cloudflare now offers seven new risk scans under the API Posture Management umbrella in API Shield. The goal is to pinpoint vulnerabilities before an API is attacked, distinguishing which specific backend service needs attention from development teams.
The scans include detection for—among other things—authentication posture, sensitive data exposure, underprotected APIs, and Broken Object Level Authorization (BOLA) attacks. They also incorporate anomaly scanning across API metrics like error rates, latency, and response sizes.
Authentication Posture is the flagship scan, addressing situations where sensitive data is exposed because API authentication checks are broken or entirely bypassed. An API Shield daily scan tracks requests against your endpoints and logs their authentication status, flagging any endpoints with missing or mixed authentication for further review. Customers with session IDs configured can locate these per-endpoint risk labels directly in API Shield for easy handoff to the development team.
What’s Next
The ability to assess threats consistently in a multi-environment setup is the first step toward maintaining security posture rather than reacting to it. Cloudflare intends to sharpen these insights further by layering in its own global threat-level data—such as identifying attackers’ current targets or the dominant threats facing a specific industry.
That context will arrive in future updates later this year, adding greater relevance to the suggestions surfaced across Security Center, SaaS posture findings, and the web application Security Overview. For now, the suite of new capabilities provides a consolidated line of sight into your SaaS documents, web traffic, and API vulnerabilities directly from the Cloudflare dashboard.
