Cloudflare pairs OpenAI models with live traffic data to prioritize vulnerabilities

How the service works

The service is called Vulnerability Discovery and Remediation. Cloudflare combines OpenAI models, accessed through Daybreak, with its global network and threat context. According to the source, Cloudflare proxies roughly 20% of the web's traffic, which gives it a broad view of what is happening in production.

The models investigate customer-authorized code, identify potential vulnerabilities and check the evidence supporting each finding. Cloudflare then adds live traffic data, security signals and validation to prioritize the results. The service prepares proposed code patches and, where appropriate, custom web application firewall rules to reduce exposure while developers review a fix.

Cloudflare runs automated checks on these proposals, and its team reviews them before sharing them with customers.

Connecting code flaws to production activity

Mark Anderson, President of Revenue at Cloudflare, describes the problem as one of capacity. "Traditional security teams have a ton of useful data. They just don't have the people and time to deal with it," he says.

Cloudflare's approach is to link a vulnerability in source code to what is happening in production. The source lists the questions this answers:

• Is the affected route active?
• Is it receiving suspicious traffic?
• Are existing security controls already protecting it?

These signals give security teams more context for deciding what to investigate first. Customers receive evidence to prioritize vulnerabilities, proposed edge protections to reduce exposure and code fixes to review. They keep control over which changes are implemented.

Codex inside Cloudflare's engineering teams

OpenAI's role at Cloudflare also extends to Codex, which developers there use to increase output and improve code quality. Anderson says a third of the company are software developers and that "100% of them use Codex to boost their output and deliver better code."

He gives one example: a rebuild the team had postponed because, in his words, "we didn't have the manpower to do it." Anderson estimates the work would have required months of sequencing and "maybe 10x more developers." Instead, a team of four developers took it on. "We built it in three days, rolled it out and tested it, and spent $1,100 on tokens," he says. These figures are Anderson's own account and are not independently verified in the source.

What it means for security teams

Anderson says making AI part of everyday engineering means "rebuilding the internal process to build technology with machines in mind, not as a separate element, but as something that's integrated into the build process."

For Cloudflare customers, the early-access service offers a path from identifying a vulnerability to protecting the affected application, with evidence attached to each step. The stated goal is to give security teams the information to decide which vulnerabilities to prioritize and how to protect and fix affected applications. Humans stay in the loop: Cloudflare staff review proposals before they are shared, and customers decide what to deploy. The source does not give pricing or a general availability date.