Cloudflare Deploys AI Agent Team to Augment Managed Defense Security Operations

Cloudflare has published details on a new agentic security operations harness designed to support its Managed Defense service. The system employs a team of specialized AI agents to analyze security alerts, aiming to provide more precise and evidence-based recommendations to human security analysts.

The architecture relies on Cloudflare Workers to host the AI agents, which process data derived from global network telemetry. By integrating these agents into the security operations workflow, Cloudflare seeks to enhance the efficiency and accuracy of threat detection and response within its Managed Defense offering. The core innovation lies in how the system handles data before it reaches the generative models.

Separating Evidence from Inference

According to Cloudflare’s first-hand research, the system distinguishes between deterministic evidence collection and model inference. This separation is critical for ensuring that the recommendations provided to analysts are grounded in verifiable data rather than speculative model outputs. The agents first gather concrete evidence from the network telemetry, creating a factual basis for subsequent analysis.

Once the evidence is collected, the model inference component processes this information to generate actionable insights. This two-step process reduces the risk of hallucination or inaccurate assessments that can occur when AI models attempt to both gather and interpret data simultaneously. The result is a stream of recommendations that are directly tied to observable network events, allowing Managed Defense Analysts to make faster and more confident decisions.

Who Is Affected

This development primarily impacts organizations that subscribe to Cloudflare Managed Defense. These customers benefit from an enhanced security operations capability that leverages AI to prioritize and contextualize alerts. For security professionals monitoring these environments, the introduction of agentic workflows signals a shift toward more automated, yet human-supervised, threat analysis.

The use of global network telemetry means that the system can draw on a broad spectrum of data points, potentially identifying patterns that might be missed by localized monitoring tools. However, the final analysis and action remain under the control of human analysts, ensuring that the AI serves as a tool for augmentation rather than replacement.

What should you do?

Security teams using Cloudflare Managed Defense should review the updated capabilities of their service to understand how AI agents are influencing alert prioritization and analysis. While no specific patch or fix is required for this feature introduction, users should monitor the performance and accuracy of the AI-generated recommendations as part of their standard operational procedures.

Organizations not currently using Managed Defense may want to evaluate whether the agentic approach aligns with their security operations center (SOC) workflows. The emphasis on evidence-grounded inference suggests a move toward more reliable AI integration in security tools, which could influence future procurement decisions.

What to do and how to stay safe: Cloudflare

• Isolate the affected resource before attempting remediation to prevent lateral movement.
• Preserve forensic evidence by capturing logs and state before modifying the environment.
• Rebuild compromised infrastructure from trusted images instead of attempting to clean it.

Rebuild compromised infrastructure from trusted images rather than attempting to clean it, as hidden persistence mechanisms often remain. Implement automated policy checks in your deployment pipeline to catch misconfigurations before they reach production.

Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does Cloudflare ensure the AI agents provide accurate security recommendations?

The system separates deterministic evidence collection from model inference, ensuring recommendations are grounded in verified network telemetry data.

What technology powers these AI agents?

The specialized AI agents are built on Cloudflare Workers and utilize global network telemetry for analysis.

Does this replace human security analysts?

No, the system delivers grounded recommendations to Managed Defense Analysts, who remain involved in the analysis and decision-making process.