Organisations Gain Grounded Security Advice via Cloudflare’s AI Agent-Driven Managed Defense

Cloudflare has introduced a new agentic security operations harness within its Managed Defense service, designed to assist human analysts in processing security alerts more effectively. According to first-hand research published by Cloudflare, this system leverages a team of specialised AI agents running on the company’s Workers platform. The primary goal is to deliver grounded recommendations by combining global network telemetry with artificial intelligence, thereby enhancing the efficiency and accuracy of security operations for organisations relying on the service.

How does the new agentic system function?

The core of this new approach lies in the separation of duties between data collection and analysis. Cloudflare states that the system distinguishes deterministic evidence collection from model inference. By keeping these processes distinct, the platform ensures that the AI agents work with verified data rather than generating speculative information. The agents utilise global network telemetry to gather context around security alerts, providing a comprehensive view of potential threats before any analytical models are applied.

This architecture allows the AI to focus on interpreting the evidence rather than hunting for it. According to the published research, this method results in "grounded" recommendations. These insights are then presented to Managed Defense Analysts, who use them to make informed decisions about security incidents. The integration of Workers enables these agents to operate at scale, processing telemetry data globally without the latency issues often associated with traditional cloud-based analysis tools.

Why is evidence grounding critical for security teams?

In security operations, the reliability of information is paramount. False positives or ungrounded AI hallucinations can lead to wasted resources and alert fatigue for security teams. By emphasising evidence-grounded analysis, Cloudflare aims to mitigate these risks. The system ensures that every recommendation provided to analysts is backed by concrete data collected from the network.

This focus on grounding means that the AI agents do not simply guess the nature of a threat. Instead, they analyse specific telemetry data to determine the likelihood and impact of an alert. For CISOs and IT managers, this translates to a more trustworthy security operation where human expertise is augmented by reliable machine-driven insights, rather than replaced by them. The result is a more efficient workflow where analysts can prioritise genuine threats with greater confidence.

What does this mean for organisational risk and operations?

For organisations using Cloudflare Managed Defense, this update represents a shift towards more automated and intelligent threat response. The integration of AI agents into the security operations lifecycle allows for faster processing of alerts, which can be crucial in mitigating the impact of sophisticated cyber attacks. By offloading the initial analysis to specialised agents, human analysts can focus on complex decision-making and strategic response actions.

This development also highlights the growing role of AI in cybersecurity operations. Rather than viewing AI as a standalone solution, Cloudflare is embedding it into existing workflows to enhance human capabilities. For business leaders, this suggests a future where security operations are not only faster but also more accurate, reducing the operational burden on internal security teams while maintaining a high standard of defence.

What are the next steps for implementation?

Cloudflare has deployed this agentic security harness as part of its Managed Defense service. Organisations already using the service will benefit from these enhancements as the system processes alerts. There is no separate product launch or additional configuration required for existing customers; the improvements are integrated into the ongoing operation of the Managed Defense platform.

As the technology matures, it is likely that Cloudflare will continue to refine the capabilities of these AI agents. The company’s focus on separating evidence collection from inference suggests a commitment to maintaining high standards of accuracy and reliability. Security leaders should monitor updates to the service for any new features or improvements in the agents’ analytical capabilities.

Background: Alert fatigue

Alert fatigue is the reduced sensitivity to alerts caused by excessive notifications. It occurs when security teams receive more data than they can process, leading to missed threats. You combat it by tuning detection rules, automating low-risk responses, and focusing on meaningful signal rather than raw volume.

Read the full guide: What Is Alert Fatigue: How to Stop Security Noise from Blinding Your Team

What to do and how to stay safe: Cloudflare

• Static roles accumulate privileges over time, creating hidden attack paths that standard audits often miss.
• Just-in-time access mechanisms reduce the window of opportunity for attackers who compromise service accounts.
• Automated policy enforcement is the only reliable way to maintain least privilege at scale in dynamic environments.

Least privilege is a continuous process of defining, granting, and revoking access based on immediate need, not a one-time configuration task. Start by auditing your most critical service accounts and implementing automated permission reviews.

Step-by-step guide: Cloud Least Privilege: Answers to 8 Critical Implementation Questions

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does Cloudflare Managed Defense use AI agents?

Yes, Cloudflare Managed Defense uses a team of specialised AI agents built on Workers to analyze security alerts.

How does the system ensure recommendations are accurate?

The system separates deterministic evidence collection from model inference, delivering grounded recommendations based on global network telemetry.

Who benefits from this new agentic security harness?

Managed Defense Analysts benefit from the grounded recommendations, which assist them in analyzing security alerts more effectively.