Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customers

We're proud to introduce Programmable Flow Protection: a system designed to let Magic Transit customers implement their own custom DDoS mitigation logic and deploy it across Cloudflare’s global network. This enables precise, stateful mitigation for custom and proprietary protocols built on UDP. It is engineered to provide the highest possible level of customization and flexibility to mitigate DDoS attacks of any scale.

Kimi Found 40+ Security Issues in Our Code. Open Source AI Is Here | Michelle Chen

In this episode of This Week in NET, host João Tomé is joined by Michelle Chen from Cloudflare’s AI product team to discuss the rise of open models, the launch of Kimi 2.5 on Workers AI, and why enterprises are rethinking the cost of proprietary AI.

Behavioral Analysis in Cloud Workload Protection: Why Runtime Detection Is Now Mandatory

Cloud environments don’t follow the same rules traditional data centers did. Workloads spin up in seconds, containers live and die within a single request cycle, serverless functions execute without a persistent footprint, and infrastructure scales faster than any manual security process can track. The security problem this creates isn’t just about scale. It’s about visibility.

AI Workload Security on Azure: Evaluating Defender for Cloud Against Specialized Runtime Tools

Your SOC gets a Defender for Cloud alert: “Suspicious API call from AI workload pod.” You click through and find a LIST secrets call against the Kubernetes API server from a pod running your invoice-processing agent on AKS. The pod’s Workload Identity has Contributor access to your key vault. By the time your analyst opens the AKS Security Dashboard, the pod has been rescheduled.

AI Agent Security Framework on AWS EKS: Implementation Guide

You’ve enabled GuardDuty EKS Runtime Monitoring across your clusters. You’ve configured IRSA for your Bedrock-calling agents. CloudTrail is logging every bedrock:InvokeModel event. And last Tuesday, one of your AI agents exfiltrated 12,000 customer records through a sequence of API calls that every one of those tools recorded as completely normal—because at the control plane level, they were.

Cloudflare Client-Side Security: smarter detection, now open to everyone

Client-side skimming attacks have a boring superpower: they can steal data without breaking anything. The page still loads. Checkout still completes. All it needs is just one malicious script tag. If that sounds abstract, here are two recent examples of such skimming attacks: To further our goal of building a better Internet, Cloudflare established a core tenet during our Birthday Week 2025: powerful security features should be accessible without requiring a sales engagement.

The Deep Dive | Seamlessly Manage your Organization's Credentials with JumpCloud Vault 03.27.2026

Empower your team with secure password management and modern privileged access Management. Learn how JumpCloud Vault strengthen's your security posture and manages the entire lifecycle of your organisation's credentials.

AI Agents Now Rank With the Top 3 Hacking Teams: Chema Alonso

In this episode of This Week in NET, host João Tomé is joined by Chema Alonso, Vice President and Head of International Development at Cloudflare. Chema shares how a 1998 paper on SQL injection launched his career in hacking, his path from running a startup in Madrid to becoming a Microsoft MVP for 14 years, and how he ended up leading cybersecurity at Telefónica for more than a decade — after telling them “you don’t have enough money to make me work for you.” He also explains why he left Telefónica in 2025 to join Cloudflare, and what surprised him about the company’s technical depth.

The Hidden Costs Of Not Using Cloud Technology

Business owners often stick to familiar routines - even when those habits drain the company bank account. Holding onto physical servers feels safe until the hidden bills for maintenance and repairs start piling up. These expenses act like a slow leak in your budget - slowly draining resources that could go toward growth. Many leaders overlook the subtle drains on their budget when they avoid modern systems. Shifting away from physical setups reveals expenses that were hiding in plain sight for years. Taking the step toward better systems is the only way to protect your long-term profits.

Advanced Certificate Manager: Essential TLS Control for Regulated Industries

Get full, granular TLS control with Cloudflare Advanced Certificate Manager (ACM). While every Cloudflare account includes free basic TLS, complex and highly-regulated businesses, like technology, financial services, or healthcare, need more granular control, and ACM eliminates the manual overhead of managing certificates. Key Features Include: Helpful Links & Resources.

Agentic Context Security Platform Protecto is Now Available on Google Cloud Marketplace

Enterprise Agentic AI adoption faces a critical barrier: sensitive data exposure. AI agents perform tasks only as well as the context provided to them. However, context is precisely where enterprise data enters the workflow, introducing significant risk. Organizations need to deploy AI applications while maintaining strict data security, regulatory compliance, and privacy. This challenge stalls production deployments across enterprises, especially in healthcare and financial services.

BlueVoyant TPRM Is Now Available on Google Cloud Marketplace

We're excited to announce that BlueVoyant's Third-Party Risk Management (TPRM) solution is now available on Google Cloud Marketplace. This milestone makes it easier than ever for organizations to purchase, deploy, and start managing supply chain cyber risk while getting more value from their existing Google Cloud Platform (GCP) investment.

When the Data Center Closes: A Complete Cloud Migration Story

Staying healthy sounds easy, but it’s often a daunting and complex process. It involves balancing diet, exercise, sleep, and routine doctor visits, among other things. For many, this lifelong commitment can cause fear, worry, and anxiety. Similarly, migrating a production environment to the cloud is a complex process. When a data center closure is on the horizon, the pressure mounts quickly.

Is Icedrive Safe to Store Your Personal Files?

If you’re tired of big tech cloud companies profiting from your data, fortunately, you have a variety of options available to make the switch from Google Drive, OneDrive, iCloud, and others. From cloud companies like Internxt, which was founded as a secure and private alternative to Google Drive, to Icedrive, a cloud storage company from the UK, you may be considering which option is best for you. But, is Icedrive safe?

Standing up for the open Internet: why we appealed Italy's "Piracy Shield" fine

At Cloudflare, our mission is to help build a better Internet. Usually, that means rolling out new services to our millions of users or defending the web against the world’s largest cyber attacks. But sometimes, building a better Internet requires us to stand up against laws or regulations that threaten its fundamental architecture.

The AWS logs you miss during an incident

Incident response in the cloud is derailed not by a lack of skill, but by a lack of visibility. Security teams frequently discover critical blind spots only after an incident is already underway, leading to delayed containment, inaccurate attribution, and incomplete forensic analysis. This report walks through six realistic, real-world inspired scenarios where missing log sources prevented effective investigations.

AWS GuardDuty Modules Explained: Features, Coverage, and How Customers Benefit with Coralogix

As organizations continue to scale their AWS environments, security teams face increasing challenges in detecting cloud-native threats such as compromised credentials, misused APIs, container breaches, and malicious workload behavior. Traditional perimeter-based controls and legacy endpoint tools are often insufficient in dynamic, cloud-first architectures. AWS GuardDuty provides native,intelligent threat detection for AWS environments.

AI Workload Security on AWS: Evaluating Native Tools vs Third-Party Solutions

Your Bedrock agent running on EKS receives a prompt through your RAG pipeline. CloudTrail logs it as a normal bedrock:InvokeModel event—status 200, authorized IAM role, expected endpoint. But inside the container, the agent’s response triggers a tool call that spawns curl to an external IP, exfiltrating the context window. GuardDuty doesn’t flag it because the connection routes through a permitted VPC endpoint. You open your AWS console and see a healthy API call.

5 Key Benefits of a Cloud Data Security Solution

Implementing cloud security policies and technologies has seen sustained growth in recent years. However, despite the widespread adoption of cloud security services, many companies have yet to fully recognize the critical importance of cloud security or still find themselves wondering: what is cloud security and why should it matter to their business? Migrating to the cloud provides organizations with the ability to move faster and more efficiently.

Why Legacy Security Tools Fail to Protect Cloud AI Workloads

Your CNAPP flags a misconfigured service account. Your CSPM warns about an overly permissive IAM role. Your container scanner reports vulnerabilities in a model-serving image. But none of these tools can tell you that an AI agent just called an internal admin API it has never touched before — or that a prompt injection caused your LLM to leak customer data through a RAG connector.

Inside Fidelis CNAPP: A Detailed Look at the Features That Strengthen Cloud Security

Cloud adoption is accelerating, but cloud security complexity is growing just as fast. Security teams now manage hybrid workloads, multi-cloud environments, containerized applications, and sensitive cloud-native data. Traditional tools designed for on-prem environments often struggle to provide consistent visibility across these dynamic systems. This creates operational pressure. Teams deal with fragmented alerts, inconsistent policies, and uncertainty about real cloud risk exposure.

Announcing Cloudflare Account Abuse Protection: prevent fraudulent attacks from bots and humans

Today, Cloudflare is introducing a new suite of fraud prevention capabilities designed to stop account abuse before it starts. We've spent years empowering Cloudflare customers to protect their applications from automated attacks, but the threat landscape has evolved. The industrialization of hybrid automated-and-human abuse presents a complex security challenge to website owners.

An Overview of Amazon S3 Browser for Windows

Amazon S3 is a popular cloud storage that is widely used around the world. You can manage Amazon S3 cloud storage in the web interface by using a web browser. We have explained the alternative methods to manage files stored in S3 buckets in the blog post about mounting Amazon S3 as a drive for cloud file sharing, but in that blog post the emphasis was on the command line interface of operating systems such as Linux, Windows, and macOS.

Backing Up Microsoft 365 SharePoint Data to Amazon S3: A Comprehensive Guide

SharePoint backup and Office 365 backup, in general, are an essential part of an organization’s data protection and security strategy. Microsoft 365 backups can be stored on-premises, but the recommended practice is to follow the 3-2-1 backup rule and store backup copies in the cloud too. With the NAKIVO solution, you can implement this effective backup strategy to protect Microsoft 365 data in SharePoint Online as well as in Exchange Online, Microsoft Teams, and OneDrive for Business.

AI Security for Apps is now generally available

Cloudflare’s AI Security for Apps detects and mitigates threats to AI-powered applications. Today, we're announcing that it is generally available. We’re shipping with new capabilities like detection for custom topics, and we're making AI endpoint discovery free for every Cloudflare customer—including those on Free, Pro, and Business plans—to give everyone visibility into where AI is deployed across their Internet-facing apps.

Netskope One AI Guardrails and Netskope One AI Gateway Demo

This is a demo of Netskope One AI Guardrails and the Netskope One AI Gateway. Netskope One AI Guardrails provides real-time content moderation for every interaction, securing the enterprise against emerging AI-specific threats including prompt injection and jailbreak attempts, and unsafe use. Netskope One AI Gateway secures the API traffic fueling your AI-powered applications. By centralizing authentication, traffic management, and content inspection between private apps and LLMs, we ensure autonomous agentic data flows remain governed and secure.

Measure and Manage Cloud Identity Risk with CyberArk Cloud Discovery Service

Most security teams cannot confidently answer a simple question: who has access to which cloud resources right now? Human identities and accounts now span across thousands of services, subscriptions, and SaaS platforms. The result is a vast, decentralized environment riddled with “unknown unknowns” that security teams cannot fully map, and that traditional security controls weren’t designed to address. Attackers count on these identity blind spots.

How to Compare Cloud Security Tools for Incident Response

Why do traditional incident response playbooks break in Kubernetes? Pods spin up and disappear in seconds, destroying forensic evidence before you can investigate. Attackers exploit service account tokens and move laterally through east-west traffic that perimeter tools never see—over 50% of ransomware deploys within 24 hours of initial access, leaving no time for manual investigation methods built for static servers.

Complexity is a choice. SASE migrations shouldn't take years.

For years, the cybersecurity industry has accepted a grim reality: migrating to a zero trust architecture is a marathon of misery. CIOs have been conditioned to expect multi-year deployment timelines, characterized by turning screws, manual configurations, and the relentless care and feeding of legacy SASE vendors. But at Cloudflare, we believe that kind of complexity is a choice, not a requirement. Today, we are highlighting how our partners are proving that what used to take years now takes weeks.

Active defense: introducing a stateful vulnerability scanner for APIs

Security is traditionally a game of defense. You build walls, set up gates, and write rules to block traffic that looks suspicious. For years, Cloudflare has been a leader in this space: our Application Security platform is designed to catch attacks in flight, dropping malicious requests at the edge before they ever reach your origin. But for API security, defensive posturing isn’t enough. That’s why today, we are launching the beta of Cloudflare’s Web and API Vulnerability Scanner.

Fixing request smuggling vulnerabilities in Pingora OSS deployments

In December 2025, Cloudflare received reports of HTTP/1.x request smuggling vulnerabilities in the Pingora open source framework when Pingora is used to build an ingress proxy. Today we are discussing how these vulnerabilities work and how we patched them in Pingora 0.8.0. The vulnerabilities are CVE-2026-2833, CVE-2026-2835, and CVE-2026-2836. These issues were responsibly reported to us by Rajat Raghav (xclow3n) through our Bug Bounty Program.

AI Deepfakes & Laptop Farms: Inside the 2026 Cloudflare Threat Report

In this episode of This Week in NET, host João Tomé is joined by Cloudflare threat intelligence experts Brian Carter and Chris Pacey to break down the 2026 Cloudflare Threat Report and what it reveals about today’s cyber threat landscape. We discuss how threat intelligence helps organizations prioritize risks, how attackers are increasingly leveraging automation and AI tools, and why botnets, supply-chain attacks, and credential-theft campaigns continue to evolve.

From the endpoint to the prompt: a unified data security vision in Cloudflare One

Cloudflare One has grown a lot over the years. What started with securing traffic at the network now spans the endpoint and SaaS applications – because that’s where work happens. But as the market has evolved, the core mission has become clear: data security is enterprise security. Here’s why. We don’t enforce controls just to enforce controls.

A QUICker SASE client: re-building Proxy Mode

When you need to use a proxy to keep your zero trust environment secure, it often comes with a cost: poor performance for your users. Soon after deploying a client proxy, security teams are generally slammed with support tickets from users frustrated with sluggish browser speed, slow file transfers, and video calls glitching at just the wrong moment. After a while, you start to chalk it up to the proxy — potentially blinding yourself to other issues affecting performance.

Always-on detections: eliminating the WAF "log versus block" trade-off

Traditional Web Application Firewalls typically require extensive, manual tuning of their rules before they can safely block malicious traffic. When a new application is deployed, security teams usually begin in a logging-only mode, sifting through logs to gradually assess which rules are safe for blocking mode. This process is designed to minimize false positives without affecting legitimate traffic. It’s manual, slow and error-prone.

Defeating the deepfake: stopping laptop farms and insider threats

Trust is the most expensive vulnerability in modern security architecture. In recent years, the security industry has pivoted toward a zero trust model for networks — assuming breach and verifying every request. Yet when it comes to the people behind those requests, we often default back to implicit trust. We trust that the person on the Zoom call is who they say they are. We trust that the documents uploaded to an HR portal are genuine. That trust is now being weaponized at an unprecedented scale.

Protect your OCI resources with Datadog Cloud Security

Organizations adopt multi-cloud architectures for many reasons, including compliance requirements, business strategy, and resiliency. Regardless of the cloud provider, the security challenges remain the same: Identify the most critical risks, prioritize them with business context, and remediate them before they are exploited by a bad actor.

Is TeraBox Safe for Your Cloud Storage in 2026?

TeraBox is a Japanese cloud storage company, offering the most free cloud storage available, at 1TB. While this may seem like an attractive offer, in exchange for this storage, your free plan includes promotional advertising, speed restrictions, and privacy concerns that may cause you to reconsider for a more private alternative. To help you understand more about Terabox, what it offers, its restrictions, and potential alternatives, we will cover the following throughout this article.

Azure VNET Outbound Access - Important Changes March 2026

Microsoft is making a fundamental change to how outbound internet connectivity works for virtual machines within Azure Virtual Networks. From March 2026, default outbound access will be retired for new virtual networks, requiring organisations to explicitly design and configure outbound connectivity for their workloads.

Evolving Cloudflare's Threat Intelligence Platform: actionable, scalable, and ETL-less

For years, the cybersecurity industry has suffered from a "data gravity" problem. Security teams are buried under billions of rows of telemetry, yet they remain starved for actionable insights. A Threat Intelligence Platform (TIP) is a centralized security system that collects, aggregates, and organizes data about known and emerging cyber threats. It serves as the vital connective tissue between raw telemetry and active defense.

Modernizing with agile SASE: a Cloudflare One blog takeover

Return to office has stalled for many, and the “new normal” for what the corporate network means is constantly changing. In 2026, your office may be a coffee shop, your workforce includes autonomous AI agents, and your perimeter is wherever the Internet reaches. This shift has forced a fundamental change in how we think about security, moving us toward a critical new architecture: agile SASE.