Cloudflare links vulnerability discovery to defense with OpenAI

Cloudflare operates one of the world’s largest networks and proxies roughly 20% of the web’s traffic. Organizations depend on that network to keep their applications and services secure, fast, and reliable.

Cloudflare combines OpenAI models accessed through Daybreak with its global network and threat context in Vulnerability Discovery and Remediation⁠(opens in a new window), an early-access service offered through Cloudflare Managed Defense. The models investigate code and assess potential vulnerabilities. Cloudflare adds live traffic data, security signals, and validation to prioritize findings and prepare proposed mitigations and patches for customers to review.

Codex extends OpenAI’s role across Cloudflare’s engineering organization, where developers use it to increase output and improve code quality.

“The beauty of the automation that Daybreak and Codex provide is that you can assign machines to do the grunt work so humans can exercise their judgment on the most important engineering and security decisions.”

—Mark Anderson, President of Revenue, Cloudflare

Scaling security analysis with Daybreak

Security teams face a constant stream of vulnerability information and alerts. Manually sifting through that data takes time and effort, leaving teams with less capacity to investigate and address critical issues. “Traditional security teams have a ton of useful data. They just don’t have the people and time to deal with it,” Anderson says.

Cloudflare’s approach is to connect a vulnerability in source code to what is happening in production. Is the affected route active? Is it receiving suspicious traffic? Are existing security controls already protecting it? Those signals give security teams more context for deciding what to investigate first.

Through Vulnerability Discovery and Remediation⁠(opens in a new window), Cloudflare uses OpenAI models accessed through Daybreak to investigate customer-authorized code, identify potential vulnerabilities, and check the evidence supporting each finding. The service prepares proposed code patches and, where appropriate, custom web application firewall rules to reduce exposure while developers review a fix. Cloudflare runs automated checks on these proposals, and its team reviews them before sharing them with customers.

For Cloudflare customers, the benefit is a clear path from identifying a vulnerability to protecting the affected application. The service gives them evidence to prioritize vulnerabilities, proposed edge protections to reduce exposure, and code fixes to review, while they retain control over which changes to implement.

Rebuilding a product in 3 days with Codex

Protecting applications also depends on the code teams write and maintain. Anderson connects Cloudflare’s use of Codex to greater developer productivity, better code quality, and fewer bugs introduced during development.

“At Cloudflare, a third of our company are software developers building services and features for our platform, and 100% of them use Codex to boost their output and deliver better code.”

—Mark Anderson, President of Revenue, Cloudflare

Anderson describes a recent rebuild the team had postponed. “We were putting off building it because we didn’t have the manpower to do it,” he says. With Codex scaling developer productivity, the question shifts from “Can we take this on?” to “Why not?”

Anderson estimates that the work would have required months of sequencing and “maybe 10x more developers.” With Codex, a Cloudflare team of four developers took on the build. “We built it in three days, rolled it out and tested it, and spent $1,100 on tokens,” he says.

Shaping cyber defense around AI and human judgment

For Anderson, making AI part of everyday engineering means “rebuilding the internal process to build technology with machines in mind, not as a separate element, but as something that’s integrated into the build process.”

Cloudflare’s early-access security service puts that approach into practice by connecting code investigation with production evidence and proposed actions customers can review. The goal is to give security teams the information they need to decide which vulnerabilities to prioritize and how to protect and fix affected applications, while customers retain control over changes.