Cloudflare adds AI-driven vulnerability prioritization to Managed Defense

Cloudflare has launched an early-access service designed to help security teams prioritize and remediate vulnerabilities by linking code analysis with real-world traffic patterns and existing security controls. The new offering, part of Cloudflare Managed Defense, targets a persistent challenge: determining which of thousands of flagged vulnerabilities pose the greatest immediate risk to production systems.

How the service works

The Vulnerability Discovery and Remediation (VDR) tool combines static code analysis with live traffic data from Cloudflare’s global network. When customers authorize access to specific codebases, the system maps vulnerabilities to active routes, assesses traffic volume, and checks for recent attack activity or existing Web Application Firewall (WAF) protections. This context allows the service to assign risk ratings that reflect actual exposure rather than generic severity scores.

VDR uses OpenAI’s GPT-5.6 Cyber model through the OpenAI Daybreak Defense Network to perform reconnaissance, hunting, and validation. The model runs on OpenAI’s infrastructure, with prompts routed via Cloudflare’s AI Gateway. No inference occurs at Cloudflare’s edge, and all proposed fixes—whether code patches or WAF rules—require explicit customer approval before deployment. The system also includes safeguards such as redaction controls and automated checks to prevent unauthorized changes or overbroad rule suggestions.

Key features and limitations

The service focuses on Cloudflare Workers and proxied applications. For Workers, VDR retrieves the latest source code and matches it to configured routes, then cross-references this with traffic data from Workers Observability and security events from the WAF. This allows the system to flag vulnerabilities in "hot paths"—routes handling high volumes of requests or exhibiting suspicious activity—as higher priority.

VDR proposes two types of remediation: code patches and WAF custom rules. The latter are scoped conservatively to avoid blocking legitimate traffic. For example, if a route pattern contains only wildcards or variables, the system will not suggest a WAF rule, prioritizing precision over coverage. All proposed fixes undergo validation by Cloudflare’s team before being presented to the customer, including synthetic testing for WAF rules.

Access is currently limited to selected customers by invitation, with each engagement starting with a single authorized application. The process remains semi-automated, requiring manual review of all findings and proposed changes before deployment.

Practical implications

The integration of production context into vulnerability management could reduce the time security teams spend triaging findings. By correlating code vulnerabilities with live traffic and attack patterns, VDR aims to surface the subset of issues most likely to be exploited in the wild. However, the service’s effectiveness depends on the accuracy of the underlying models and the quality of the traffic data, which may vary across environments.

What to watch

The early-access phase will likely shape the tool’s roadmap, particularly around scalability and integration with other Cloudflare services. Future updates may expand support beyond Workers and proxied applications or refine the risk-scoring model as more production data becomes available. Observers will also monitor how the service handles edge cases, such as applications with highly dynamic route patterns or those subject to frequent, targeted attacks.