Cloudflare Details Agentic Security Operations Harness
Cloudflare has detailed a new multi-AI-agent security operations harness designed to tackle the alert paradox for security analysts at global scale.
Radwan AbdulhadiEditor and technology writer
Tackling the Alert Paradox with Multi-Agent Systems
Security alerts rarely arrive one at a time, often causing spikes across an environment that overwhelm human analysts. To address this alert paradox, Cloudflare has introduced a built-in, multi-AI-agent security operations harness for Cloudflare Managed Defense. The system speeds up data gathering, connects and aggregates detections, and accounts for missing sources while new alerts continue to arrive.
According to the Cloudflare Blog, early prototypes revealed the limitations of relying on a single general-purpose agent. Flattening telemetry, detector descriptions, policies, and threat intelligence into one prompt caused distinct roles to merge, resulting in hallucinations where context became authority, scope drifted, and evidence retrieval failures disappeared.
Deterministic Reconnaissance and Scope Enforcement
To solve the challenges of single-shot AI agents, Cloudflare moved evidence collection and scope enforcement into application code before any model analysis begins. Before calling inference, deterministic code runs a fixed set of reconnaissance workflows with versioned API calls to gather identity, detection history, traffic baselines, enforcement outcomes, and network observations.
This fixed reconnaissance snapshot makes evaluation reproducible. By ensuring that identical snapshots can be replayed, differences between specialist AI agent findings stem from interpretation rather than retrieval discrepancies.
Lightweight Triage and Open-Source Decision Models
Because many alerts are repetitive background noise rather than active incidents, paging analysts every time increases the risk of missing real threats. Cloudflare utilizes Clef, an open-source decision model running on Workers AI, to quickly compare alerts with reconnaissance data.
Known high-volume noise is deterministically classified as passive upon arrival, remaining available as context while skipping active queues. Alerts with a high likelihood of being false positives bypass the specialist AI agents entirely.
Specialist AI Agents and Advanced Model Integration
For alerts requiring deeper investigation, a coordinator AI agent runs four specialist agents in parallel: traffic analysis, customer context, global telemetry, and threat intelligence. A synthesis AI agent then combines their typed findings into a single advisory without being able to fetch new evidence or choose classifications outside approved vocabularies.
For deeper model-backed analysis, Cloudflare incorporates approved models from the OpenAI Daybreak Defense Network and a partnership with Anthropic, utilizing models such as GPT-5.6 Cyber and Mythos.
Leveraging Global Network Telemetry
Cloudflare compares incoming alerts with patterns observed across its massive global network to determine whether an IP is targeting a single site, scanning thousands, or appearing for the first time. To preserve customer privacy, the global telemetry specialist relies strictly on aggregates without receiving individual records or identities from other customers.
This holistic security overview combines intelligence features derived from multiple Cloudflare pillars, ensuring that global reputation is weighed alongside customer-specific historical dispositions to assist Managed Defense Analysts effectively.
Sources
- Cloudflare BlogBuilding an evidence-grounded agentic security operations harness on Cloudflare
Continue chronologically
Related entity coverage
Related stories
Cloudflare Releases AI Gateway Auto Router in Public Beta
Cloudflare launches its AI Gateway Auto Router in public beta, helping organizations cut AI token spending by up to 30 percent while maintaining performance.
Cloudflare Unveils Adaptive Application Security Framework for AI Era
Cloudflare has introduced an adaptive security framework to combat AI-driven cyber attacks, connecting risk discovery, agent governance, runtime protection, and intelligence.
Cloudflare Says Non-Human Web Traffic Exceeds 50% Amid AI Boom
Cloudflare reports that non-human web traffic has surpassed 50% for the first time, driven by a surge in AI agents and automated software requests.
Cloudflare Rebuilds Containers to Scale Agent Sandboxes
Cloudflare has rearchitected its Containers platform with 6x faster startup times, runtime image selection, and filesystem snapshots in public beta.
