Cloudflare replaces most third-party security tools with AI agents

Cloudflare has transitioned most of its security operations to internally developed AI-driven systems, replacing third-party tools with over 200 autonomous agents. The shift was detailed by company executives during a media event in Sydney, where they outlined both the efficiencies gained and the challenges of replicating such a model elsewhere in the industry.

How Cloudflare automated security workflows

The company now uses Anthropic’s Claude Sonnet model to process incoming bug bounty reports at a cost of $58 per month. This replaces a previously manual triage process, with the AI assessing submissions for duplicates and severity before flagging them for human review. Cloudflare’s chief security officer (CSO) Grant Bourzikas noted that an alternative security-specific model would have cost approximately $200,000 monthly for the same workload, illustrating the importance of model selection in AI deployment.

Beyond bug bounties, Cloudflare has extended AI automation across its security stack, developing custom applications—some with AI-assisted coding—to handle tasks traditionally managed by external vendors. Bourzikas emphasized that this approach is not universally applicable, citing Cloudflare’s unique infrastructure and in-house expertise as key enablers. He explicitly discouraged other organizations from attempting similar transitions without comparable resources, framing the move as a product of the company’s specific operational context rather than a broader industry trend.

AI’s impact on Cloudflare’s workforce and business model

The automation of security processes coincides with broader changes in Cloudflare’s workforce. Chief Strategy Officer Stephanie Cohen linked recent layoffs of 1,100 employees to AI-driven shifts in job roles, particularly in areas where automation has reduced the need for manual intervention. She suggested that the company’s headcount may eventually return to pre-layoff levels but acknowledged that AI is altering the skill sets required for certain positions. Bourzikas added that even early-career developers now need proficiency in prompt engineering to effectively collaborate with AI tools, as traditional coding skills alone may no longer suffice for some roles.

Cohen also outlined a vision for AI’s future business model, arguing that the current advertising-driven web economy is ill-suited to sustain AI companies. She proposed that Cloudflare could act as an intermediary between publishers and AI firms, facilitating micropayments for content access—a role the company is already positioned to play due to its existing infrastructure. However, she acknowledged skepticism about this model, given historical examples of tech platforms exploiting their intermediary positions to the detriment of content creators.

Industry implications and cautionary notes

While Cloudflare’s AI adoption has yielded operational efficiencies, executives stressed that its approach is not a template for other organizations. Bourzikas reiterated that most companies lack the expertise to build and maintain their own security software, and Cohen warned against assuming that AI will universally replace packaged software. Instead, she predicted a shift toward vendors embedding engineers within client organizations to develop bespoke solutions, a departure from traditional software-as-a-service (SaaS) models.

The executives also addressed broader industry concerns about AI’s economic sustainability. Cohen criticized the lack of compensation for content creators whose work trains AI models, framing Cloudflare’s proposed intermediary role as a potential solution. However, she conceded that trust in such a model would depend on Cloudflare’s ability to avoid the exploitative practices of past tech intermediaries.