All about Internet Measurement, Resilience, and Transparency
In this episode, host João Tomé talks with Marwan Fayed, Principal Scientist and Research Lead at Cloudflare, about the science behind understanding and improving the Internet.
Security | Threat Detection | Cyberattacks | DevSecOps | Compliance
The Latest Cybersecurity News & Insights From Around The World
Cloud Application Security: Securing SaaS and Custom Cloud Apps
What is cloud application security? In this guide, we’ll explore what cloud app security means, the challenges, the evolving threat landscape, and how businesses can stay one step ahead.
Rising Cloud Outages : New Wave of Cyber Resilience Crisis
October 2025 brought disruptions across cloud infrastructure and retail sectors, exposing vulnerabilities in enterprise IT systems.
Beyond IP lists: a registry format for bots and agents
As bots and agents start cryptographically signing their requests, there is a growing need for website operators to learn public keys as they are setting up their service. I might be able to find the public key material for well-known fetchers and crawlers, but what about the next 1,000 or next 1,000,000? And how do I find their public key material in order to verify that they are who they say they are? This problem is called discovery.
Anonymous credentials: rate-limiting bots and agents without compromising privacy
The way we interact with the Internet is changing. Not long ago, ordering a pizza meant visiting a website, clicking through menus, and entering your payment details. Soon, you might just ask your phone to order a pizza that matches your preferences. A program on your device or on a remote server, which we call an AI agent, would visit the website and orchestrate the necessary steps on your behalf.
Policy, privacy and post-quantum: anonymous credentials for everyone
The Internet is in the midst of one of the most complex transitions in its history: the migration to post-quantum (PQ) cryptography. Making a system safe against quantum attackers isn't just a matter of replacing elliptic curves and RSA with PQ alternatives, such as ML-KEM and ML-DSA. These algorithms have higher costs than their classical counterparts, making them unsuitable as drop-in replacements in many situations.
A Guide to Cloudflare Load Balancing Setup (Step-by-Step Walkthrough)
Setting up Cloudflare Load Balancing (LB) made easy! In this in-depth tutorial, we walk you through the essential pre-activation steps for Cloudflare Load Balancing. From understanding the core concepts to configuring your initial pools and health checks, this video covers everything you need to know to get started. If you're looking to improve your website's uptime, latency, and availability, this is the place to start.
Step-by-Step Guide to CNAPP Implementation: Securing Cloud-Native Applications
Key Takeaways Achieving scalability and agility is one of the top goals for every organization. Cloud-native applications have become the lifesavers of these organizations across various industries to achieve this. But implementing these applications also comes with a few disadvantages. The main reasons are these applications are dynamic and prone to attacks. Traditional or legacy security tools won’t be enough to secure their dynamic, short-lived workloads.
Defending QUIC from acknowledgement-based DDoS attacks
On April 10th, 2025 12:10 UTC, a security researcher notified Cloudflare of two vulnerabilities (CVE-2025-4820 and CVE-2025-4821) related to QUIC packet acknowledgement (ACK) handling, through our Public Bug Bounty program. These were DDoS vulnerabilities in the quiche library, and Cloudflare services that use it. quiche is Cloudflare's open-source implementation of QUIC protocol, which is the transport protocol behind HTTP/3.
Is Your Security Quantum-Ready?
Post-quantum cryptography is coming, and the impact on our defenses will be significant. That’s why NIST and the Australian Signals Directorate recommend being quantum ready by 2030. Threat actors could collect sensitive data today and decrypt it later, so preparation is critical.
Unlock Deeper Insights: Mastering Cloudflare Log Explorer for Better Security & Performance
Cloudflare Log Explorer is the native observability and forensics tool designed to give security teams and developers unparalleled, granular access to Cloudflare traffic logs directly within the dashboard. Key benefits include: Understanding your traffic patterns is fundamental to optimizing for peak performance and maintaining a robust security posture.
Keeping the Internet fast and secure: introducing Merkle Tree Certificates
The world is in a race to build its first quantum computer capable of solving practical problems not feasible on even the largest conventional supercomputers. While the quantum computing paradigm promises many benefits, it also threatens the security of the Internet by breaking much of the cryptography we have come to rely on. To mitigate this threat, Cloudflare is helping to migrate the Internet to Post-Quantum (PQ) cryptography.
Resilient by Design: Cato's Visibility and Backbone Performance Through the AWS Outage
On October 20, 2025, Amazon Web Services (AWS) experienced an outage affecting its US-East-1 region. The event caused temporary service degradation across a wide range of global applications and digital services, including business collaboration tools, financial platforms, airline operations, and consumer-facing websites used by millions of people worldwide, as reported in the news. We extend our appreciation to our partners at AWS for their swift and professional handling of the incident.
Securing agentic commerce: helping AI Agents transact with Visa and Mastercard
The era of agentic commerce is coming, and it brings with it significant new challenges for security. That’s why Cloudflare is partnering with Visa and Mastercard to help secure automated commerce as AI agents search, compare, and purchase on behalf of consumers. Through our collaboration, Visa developed the Trusted Agent Protocol and Mastercard developed Agent Pay to help merchants distinguish legitimate, approved agents from malicious bots.
How Cloudflare's client-side security made the npm supply chain attack a non-event
In early September 2025, attackers used a phishing email to compromise one or more trusted maintainer accounts on npm. They used this to publish malicious releases of 18 widely used npm packages (for example chalk, debug, ansi-styles) that account for more than 2 billion downloads per week. Websites and applications that used these compromised packages were vulnerable to hackers stealing crypto assets (“crypto stealing” or “wallet draining”) from end users.
Cloudflare Connect 2025 Highlights: Common, James Allworth, David Tuber & Kenton Varda
We cover Cloudflare’s partnership with Mastercard & Visa on AI agent commerce, highlights from rapper Common, and conversations with: Full interviews with each guest will be published in the coming weeks. Plus: next week’s Cloudflare blog series on Internet Measurement, Resilience, and Transparency — the foundations of a faster, safer, and more reliable web.
Agentless Network Monitoring: The New Standard for Cloud Security Visibility
Agentless network monitoring represents a fundamental shift in cloud security strategy. Rather than installing software agents across every cloud resource, this approach leverages existing infrastructure to gather comprehensive security intelligence remotely.
Beyond the AWS Outage: How CloudCasa and Any2Cloud Enable True Multi-Cloud Resilience for Kubernetes
When AWS’s US-East-1 region went down again this month, it reminded the industry of an uncomfortable truth: even the most trusted cloud platforms can fail. From streaming services to SaaS providers, many businesses were caught off guard, not because they lacked backups, but because they lacked redundancy. In a Kubernetes world, redundancy isn’t just about having data snapshots.
Jingle Thief Gift Card Fraud: How Cloud Account Misuse Became a Pandemic for Retailers
Jingle Thief gift card fraud is a reminder that attackers don’t always need zero-day bugs or exotic malware to make millions — they need credentials and patience. In 2024–2025, security teams observed a financially motivated cluster (tracked by defenders as “Jingle Thief” / CL‑CRI‑1032) that focused on phishing and identity misuse to quietly harvest access to cloud platforms, then abuse gift-card issuance workflows at scale.
After the AWS Outage: How to Build Systems That Survive
When AWS goes down, the ripple effects are global, from authentication failures to service disruptions that bring businesses to a standstill. But while every outage makes headlines, the real question is: Why are so many organizations still unprepared? In this live fireside chat, Wallarm’s Field CTO, and STO of Security Edge, Tim Ebbers, unpacks the architectural lessons behind the latest AWS outage — and what engineering, DevOps, and security leaders can do today to prevent history from repeating itself.
Building Trust Through Cyber Resilience
This Cybersecurity Awareness Month, we are reminded why building cyber resilience is key to earning and keeping customer trust especially against evolving threats like DDoS attacks.
Navigating the Fog: A Guide to Application Security in the Cloud
The speed of cloud development and the ubiquity of open-source code have created an unprecedented risk surface. For many engineering and security teams, the result is a dense fog of fragmented tools, reactive workflows, and rising software supply chain threats. To move forward, your strategy for application security in the cloud must be proactive, unified, and developer-friendly.
Ask SME Anything: What is Unified Data Security?
Tired of the data security "alphabet soup"? DSPM. DLP. Protecting data in the AI era shouldn't require a glossary. In this episode of Ask SME Anything, Netskope expert Ankur Chadda cuts through the jargon and breaks down the fundamentals of unified data security, revealing four crucial questions every security professional must be able to answer to effectively protect your data from emerging threats.
Alert: Watch Out For Phishing Attacks in the Wake of the AWS Outage
Cybernews warns that threat actors will likely take advantage of the recent AWS outage to launch phishing attacks against affected users. Attackers frequently exploit high-profile events to carry out social engineering attacks while people are confused or stressed, as these users are more likely to act without careful consideration.
The Future of Cloud Security: From CNAPP to CADR - Why ARMO Leads the Next Wave
The recently published 2025 Latio Cloud Security Market Report, authored by industry analyst James Berthoty, captures a major transformation: cloud security is leaving behind static visibility tools and moving toward runtime-driven risk reduction. The report traces five years of evolution – from dashboards full of misconfigurations to platforms that can detect, prioritize, and mitigate threats in real time. Six key insights define this new era.
AWS Outage: Lessons Learned
What can we learn from the recent AWS outage, and how can we apply those lessons to our own infrastructure?
Cloud Security Tips for Companies
Cloud computing is now central to company operations, but it can also be an opportunity for hackers. As of late last year, 80% of organizations experienced more frequent cloud attacks. Strengthening security is essential. Clear, actionable cloud security tips help protect digital assets with minimal complexity. As companies migrate more services and data to cloud environments, risks grow and become harder to detect.
Featured Post
Mitigating Cloud Security Threats with Strategic Cyber Recovery
Cloud computing has reshaped the business landscape, delivering the scalability, flexibility and efficiency needed to stay competitive in a fast-moving world. However, this digital transformation brings with it security risks. From data breaches to cyberattacks and unexpected outages, today's cloud environments face constant threats. As stated in the IBM data breach report, 80% of organisations have experienced a rise in cloud security incidents, with 45% of breaches being cloud-based, and the average cost of a data breach is $4.35 million.
Zero Trust Engine
The Zero Trust Engine is a foundational component of the Netskope One platform. It plays a pivotal role in gathering comprehensive risk telemetry and delivering unmatched contextual awareness to enable adaptive, least-privileged access to users, devices, applications, and data. This live demo showcases examples of how the Netskope Zero Trust engine provides full visibility and control.
The Deep Dive | Elevating Security: Device Trust with Chrome Enterprise and JumpCloud 10.17.2025
Resources: Guided Sims Or reach out to us: Karthick - karthick.srivatsan@jumpcloud.com Akhil - akhil.nair@jumpcloud.com.
AI: What's the future smell like? | AI Avenue Ep 6
In the season finale, Craig and Yorick take a big whiff of the future. What is our world going to look like? Which future do you want? The sit down with thought leaders from Cloudflare, @IBM, Science Fiction author, and a 9 year-old vibe coder/comedian named Fay. The future is bright if you want it to be.
Improving the trustworthiness of Javascript on the Web
The web is the most powerful application platform in existence. As long as you have the right API, you can safely run anything you want in a browser. Well… anything but cryptography. It is as true today as it was in 2011 that Javascript cryptography is Considered Harmful. The main problem is code distribution. Consider an end-to-end-encrypted messaging web application.
Securing AI Applications in the Cloud: Shadow AI, RAG & Real Risks | Mend.io
What does it take to secure AI-based applications in the cloud? In this episode, host Ashish Rajan sits down with Bar-el Tayouri, Head of Mend AI at Mend.io, to dive deep into the evolving world of AI security. From uncovering the hidden dangers of shadow AI to understanding the layers of an AI Bill of Materials (AIBOM), Bar-el breaks down the complexities of securing AI-driven systems. Learn about the risks of malicious models, the importance of red teaming, and how to balance innovation with security in a dynamic AI landscape. What is an AIBOM and why it matters The stages of AI adoption.
Azure Identity & Access Fundamentals | Sedara Cyber Bytes 2025
Learn how to strengthen your Microsoft cloud security in this recorded session of Sedara’s Cyber Bytes 2025 - Azure Identity & Access Fundamentals. In this workshop, Jason Taylor breaks down how identity and access management works in Microsoft Entra ID and Azure, explains the key differences between Entra and Azure roles, and shares best practices for securing your organization’s cloud identities.
Cloudflare Channel Business Accelerates with New Program Advancements
Introduces platform solution bundles for partners as customers consolidate services.
Sweet Security Named Cloud Security Leader and CADR Leader in Latio Cloud Security Report
Sweet Security, a leader in Runtime Cloud and AI security solutions, today announced that it has been recognized as both a Cloud Security Leader and a Cloud Application Detection & Response (CADR) Leader in the 2025 Cloud Security Report by James Berthoty of 'Latio Tech.'
Corelight reconnects visibility across the entire AWS cloud environment
Today, we are pleased to announce the launch of Corelight’s new AWS Flow Monitoring Sensor, a new addition to Corelight’s flow monitoring capabilities. This new sensor was purpose-built to address the longstanding visibility challenges that have frustrated security teams running their most critical workloads in AWS. AWS provides one of the world’s most popular cloud platforms, hosting applications and sensitive data for some of the largest organizations.
VM Backup Gets Cloud-Native: How Spectro Cloud and CloudCasa Make It Actually Work
For years, backing up virtual machines has been a necessary evil — a dull, repetitive chore hidden deep inside IT maintenance schedules. It’s the sort of thing that keeps enterprise workloads safe but rarely excites anyone. You’d spin up VMs, configure snapshots, cross your fingers before a restore, and hope that your “incremental forever” backup didn’t quietly break somewhere along the way. But lately, something has started to shift.
How Do Cloud Migration Consulting Services Help Businesses?
Organizations are modernizing their IT infrastructure. On-premises environments are no longer the preferred choice for them, as they are expensive and hard to manage. Because of this, organizations are moving to cloud-based environments for smoother business operations. But moving data, applications, and workloads from traditional platforms to the cloud is anything but easy. It requires careful assessment, technical precision, and risk management.
Security Visionaries | I Do Love To Be BSides the CSIDES (Interview with Samantha Swift)
Get an insider's look at community-driven cybersecurity events like BSides and CSIDES. In this episode of Security Visionaries, host Emily Wearmouth sits down with cybersecurity veteran and community organizer Samantha Swift (BSides organizer, DefCon volunteer) to unpack the power of community-driven security events. We dive deep into: If you are "cyber curious" or an industry veteran looking to connect, this episode is a must-listen!
Trust Starts with Security | Protect Your Digital Reputation
This Cybersecurity Awareness Month, see why cybersecurity is more than IT. It is a matter of trust and brand.
Give First: Shifting to an Abundance Mindset in IT with Venture Capital Legend Brad Feld
In this installment of Make Work Happen, we're joined by Brad Feld, partner at Foundry Group, to dive into the powerful "Give First" philosophy that has shaped the Boulder startup community for decades. Brad discusses his career, from starting his first company 40 years ago to co-founding Foundry Group and Techstars. We explore how core values, or cultural norms, like non-transactional, positive-sum, multi-turn relationships, can define the success of a business or a community.
Introducing REACT: Why We Built an Elite Incident Response Team
Cloudforce One’s mission is to help defend the Internet. In Q2’25 alone, Cloudflare stopped an average of 190 billion cyber threats every single day. But real-world customer experiences showed us that stopping attacks at the edge isn’t always enough. We saw ransomware disrupt financial operations, data breaches cripple real estate firms, and misconfigurations cause major data losses. In each case, the real damage occurred inside networks.
What is MCP. Demo with Dina Kozlov (Paypal, Stripe, and more)
Clip from a episode from late May 2025 about MCP (Model Context Protocol) servers. Cloudflare Product Manager Dina Kozlov goes into live MCP demos, practical use cases, and a look at how companies like Stripe, PayPal, and Anthropic are getting involved.
How to Choose the Right Cloud DDoS Solution for Enterprise Security
Enterprise DDoS attacks reached critical levels in 2025, with authoritative reports documenting unprecedented attack volumes and sophistication. Global cybercrime costs are projected to reach $10.5 trillion annually by 2025, representing the greatest transfer of economic wealth in history. Selecting the wrong cloud DDoS protection creates operational disruption, compliance violations, and irreversible business damage.
Beyond the Buzzwords | Our Vision for a Secure Digital Future
This Cybersecurity Awareness Month, learn why always on security is key in a world of AI-powered threats.
AI Learning: It's copying everything we do!!! | AI Avenue: Ep 4
Don’t you hate it when your robot hand co-host tries to hijack your show? Yorick makes his OWN version of AI Avenue, prompting a conversation about ethics and learning in AI. Craig reaches out to experts like Amanda Haskell from @anthropic-ai to discuss how we can all use AI more responsibly. AMECA from @EngineeredArtsLtd makes a cameo to get Yorick in line. And Nick from @heygen_official swings by to make a new Craig Avatar, ethically.
Vanta signs a strategic collaboration agreement with AWS to deepen integration
We’re thrilled to announce that Vanta has signed a strategic collaboration agreement (SCA) with Amazon Web Services (AWS) to make it even easier for businesses to scale securely in the cloud. We’re expanding the reach of our compliance automation and trust management platform, enabling organizations to build stronger security programs, accelerate audit readiness, and demonstrate compliance more efficiently—all while scaling on AWS.
Securing The Future: Cloudflare's Implementation of Post-Quantum Cryptography - Michiel Appelman
Explore how Cloudflare’s Post-Quantum Cryptography (PQC) capabilities are future-proofing enterprise security. Learn how we’re integrating PQC across our network to safeguard data against quantum threats, ensuring businesses stay protected in an evolving cryptographic landscape—without compromising performance or scalability.
CTEM Solutions Explained How to Build a Stack
Vulnerability numbers are spiraling. Compliance checklists and point scans cannot keep pace. Continuous Threat Exposure Management (CTEM) provides security leaders with a practical approach to identify and mitigate real attack paths in real-time. This article explains what CTEM is, the solutions that enable it, and how to build a stack that actually shrinks exposure instead of counting it. CTEM solves the eternal problem of vulnerability management (too many vulnerabilities to ever fix) with a continuous program to find, validate, and reduce exposures before adversaries can use them.
Security and Networking Reimagined
We reimagined security and networking so organizations can reject trade-offs between risk and performance. Experience modern security and networking without trade-offs.