Cloudflare adds an evidence-first AI workflow for security alerts

Cloudflare described a new Managed Defense workflow on 7 October that collects investigation data before asking AI models to analyse it. Application code fixes the customer scope, retrieves telemetry and records sources and gaps. The company said this design followed problems with an earlier single-agent prototype that made unsupported claims and confused missing evidence with negative results.

Specialist models analyse the prepared evidence, while software checks their citations and scope. The early beta supports eligible application-security alerts and cases. Managed Defense analysts can inspect the findings, revise recommendations and decide on mitigations. Cloudflare describes an assisted investigation process: the model does not receive authority to cross customer boundaries or independently apply its proposed response.