Over the course of his career, Jim Reavis has seen cloud and cloud security evolve, and it’s come a long way since being a niche technology in the early 2000s. Now it’s dominant in terms of being the IT foundation, he says, but while the tech is strong, the operating models is where things get messy. Cloud, security, and third-party risk teams look at different parts of the problem, of course, but challenges remain.
“Operational technology worries me a great deal,” he says. “A lot of those systems are isolated and not kept up to date. If we don’t modernize them, we’re going to have huge problems. In a lot of cases, things fall between the cracks and that’s where hackers like to exist.”
So much of what’s around the models is where cybersecurity has responsibility, rather than the provider covering everything. “Data, identity, and applications are shared responsibility areas, and in many cases, the tenant carries most of the control burden,” Reavis says. “If you use a hyperscaler, you may still have about 80% of the responsibility for the controls around what you build.”
And when it comes to AI, the model isn’t the whole problem. What matters is the context around it, the goals it’s given, and the oversight put in place, he says. “We need to think carefully about the harnesses we put around AI and the systems we use,” he adds.
The responsibility model, therefore, is a recurring issue in cloud security breaches tied to misconfiguration and accountability gaps, and some enterprises still aren’t clear about where responsibility begins and ends. “We spent a lot of time on a shared security responsibility model, but when this first started to gain popularity, there were a lot of organizations or SaaS providers you could work with who’d say it’s in the cloud, it’s at Amazon,” he says. “Look at their certifications and SOC2 and how they comply because they’re covering everything.” But when you look at the actual applications, data, and identity, he adds, there’s so much that’s shared responsibility, and the customer’s responsibility.
So how do we make sure information is encrypted properly so it doesn’t become a tenant issue? “There’s still a bit to do, and we think about this not only from whether it’s SaaS, infrastructure, or a particular provider, but at what level is it at the physical, network, or audit level,” he says. “And even from a role-based perspective, what’s the role of internal risk and role of providers?”
Reavis gives further detail about how AI adoption exposes weaknesses in identity, trust, and risk management, and the long-term implications of increasingly interconnected cloud ecosystems. Watch the full video below for more insights, and be sure to subscribe to the monthly Center Stage newsletter by clicking here.
On cloud risk management: When we had the Chat GPT moment, we knew it because AI had been around for a while, but that was a cloud delivered version of AI to the masses, so we saw this going to evolve and you could see it combining in many important areas.
But what we’ve learned is, because this is an interesting predictive rather than deterministic technology, we’re living in a world of two exponentials, and you’re seeing model capabilities growing so quickly. There’s this feeling from a security perspective that we have to look to the model itself and fix every hallucination and everything else when that’s built into how it works. It’s actually working as intended. So that’s a new lesson. Models are going to get more powerful, but it’s so much of what’s around the models where cybersecurity has responsibility, and we don’t rely on frontier model companies or using open-weight models. Rather, what’s the context, oversight, and information we’re providing them, what do we do in terms of goals we give them, and what are the harnesses we put around AI and the models we deal with?
These are going to be the big areas to think about, but we have to understand the parts we can control. We’ve got to think carefully about the harnesses, transparency, and using supply chain shared responsibility. SaaS and cloud providers are all AI enabled now. You’re not using any software of any significance that isn’t using AI to some degree.
On AI identity, trust, and control: One of the areas that we’ve championed is zero trust as a philosophy. It was initially more of a networking type of approach at the network layer, or an idea that you use identity to understand network access. But it’s evolved more to an idea that anything can be breached, so you assume that. Then you think about how to make systems resilient, and build up confidence and protection.
So zero trust tells us that with human identity, we can ask what our digital identity is, and now we’re in a very interesting area for identity management and associating that with agents and AI systems. People might have just one view of it, but agents are as diverse as humans. So we think about different identities and least privilege, and how to prevent them from escalating privileges. We need to introduce new concepts like least autonomy, and think about an agent that has certain tasks and use identity to make sure the actions it takes are within a defined scope. Because while we’ll see a lot of security incidents with AI, proportionately we’ll see more misconfiguration and bad things that happen because of broken processes. And the AI system just deletes things because it thought that’s what it’s supposed to do.
So it’s important to make strides in how we think about identity and agents, and the idea of digital workers. How do we manage and treat those? If we think about them too much in either one of those realms, we’re going to fail. So we have to understand what’s the right blend. It’s a new area and very exciting.
On risk and legacy systems: When I think about operational technology, sometimes systems are isolated and not kept up to date. That concerns me a great deal. We’re going to have huge problems there. We have concerns about existential risks, where people don’t want to use the latest technologies and be aggressive adopters of AI. I think that’s going to create real scale issues with organizations.
So we have to understand where we are, where we’re going, and have a vision that serves something between human and technology, maybe a hybrid, but we’ve got to make our peace with it and understand the appropriate harnesses and direction where humans should always be in the loop with control. But it’s appearing in some new areas of cybersecurity where we haven’t traditionally thought about. Software development looks very different now than it did 12 months ago, and 12 months from now, cybersecurity is going to be really different, too.
On cloud security and implementation: Cloud security is cybersecurity for all intents and purposes. We have so much tooling and technology that’s really good, but there’s a lot of inconsistencies with the operating models organizations have. Even way back with CSA and NIST defining this, it was clear that SaaS was a layer on top of infrastructure as a service. But we diverged, and you see in a lot of enterprises there’s diffused ownership where you have cloud and security teams, and then you have third-party risk that deals with the SaaS team. Then there are inconsistencies in how risks are managed, so internal development and expectations from our partners can really diverge. They have a lot of regulations to deal with, so it creates vetting and investment challenges while striving for consistent models.
Some security teams might still use older checklists to talk to their cloud teams, but scaling with new tech becomes an issue if you’re not thinking about operations. It ends up being a human and a structure problem that makes it harder to take advantage of all the great technology that’s out there.
Market clutter and threat flux complicate picks. We rank 2026’s top 10: specs, perks, real impacts dissected.Prioritizing usability, relevance for CISOs, IT pros, scaling firms.
CISO, manager, or tech enthusiast find your Zero Trust match. Per-tool: intros, tables, specs, buy drivers, features—your 2026 blueprint.
Comparison Table: Top 10 ZTNA Solutions (2026)
Tool Name (with Homepage)
Free Version
Cloud Support
MFA
Device Posture Check
SSO
OpenVPN Cloud Connexa
Yes
Yes
Yes
Yes
Yes
Zscaler Private Access
No
Yes
Yes
Yes
Yes
Palo Alto Prisma Access
No
Yes
Yes
Yes
Yes
Cloudflare Zero Trust
Yes
Yes
Yes
Yes
Yes
Google BeyondCorp Enterprise
No
Yes
Yes
Yes
Yes
NordLayer ZTNA
Yes
Yes
Yes
Yes
Yes
Ivanti Neurons ZTNA
No
Yes
Yes
Yes
Yes
Appgate SDP
No
Yes
Yes
Yes
Yes
Twingate
No
Yes
Yes
Yes
Yes
Fortinet FortiClient ZTNA
Yes
Yes
Yes
Yes
Yes
1. OpenVPN Cloud Connexa
Best for: Small and mid-sized businesses that want Zero Trust Network Access without an enterprise budget or a bundled security suite.
OpenVPN’s CloudConnexa is a cloud-delivered ZTNA for SMB platform built on the open-source OpenVPN protocol. Rather than shipping ZTNA as one module inside a sprawling security stack, CloudConnexa combines identity-based, least-privilege application access with a globally distributed Wide-area Private Cloud (WPC) that links remote users, on-premises sites, and AWS, Azure, and GCP networks in a single service.
Users and private resources connect through encrypted outbound tunnels to CloudConnexa Regions, while Access Groups decide exactly which applications, hosts, and networks each user can reach. Because Connectors only establish outbound tunnels, private applications never require open inbound firewall ports or direct exposure to the public internet.
OpenVPN’s network security platforms provide secure remote access through both self-hosted and cloud-delivered VPN solutions for business, with the core tenets of Zero Trust Network Access at their center. Alongside the self-hosted Access Server, CloudConnexa helps teams securely reach company resources, SaaS platforms, the web, and data across cloud environments.
Why Do We Recommend It?
ZTNA without the suite lock-in. You can add Zero Trust access on its own, without committing to a full security platform, complex contracts, or opaque enterprise pricing.
Access control plus private networking in one service. Granular Zero Trust application access and a globally distributed WPC come together, so remote users, cloud VPCs/VNets, on-premises networks, and branch sites connect through the same fabric.
Outbound-only Connector architecture. Connectors open encrypted outbound tunnels, keeping private applications off the public internet with no inbound port forwarding.
Layered contextual access decisions. SAML SSO/MFA is combined with Device Posture, Location Context, and Device Identity Verification & Enforcement (DIVE) for context-aware policy enforcement.
Integrated threat protection. Cyber Shield adds DNS-based domain/content filtering and IDS/IPS traffic inspection within the same service rather than limiting the platform to access control alone.
Application domain-based routing and segmentation. Traffic can be routed by application domain, environments with overlapping IP ranges are supported, and networks are automatically segmented to limit lateral movement.
Key Features
Identity-based, least-privilege access – Access Groups restrict users to only the applications, IP services, hosts, and networks they are authorized to use, with a default-deny model under Custom WPC topology.
Device Posture Checking – Evaluates operating system and OS version, antivirus status, disk encryption, client certificate validity, and more, and can block noncompliant devices.
SAML SSO and MFA – Integrates with SAML 2.0 identity providers such as Microsoft Entra ID, Okta, OneLogin, Google Workspace, and Keycloak; built-in TOTP 2FA is available for username/password and LDAP authentication.
Device Identity (DIVE) – Adds device-level identity verification and enforcement to every access decision.
Location Context – Applies geographic and location-based conditions to access policies.
Cyber Shield – DNS-based domain/content filtering plus IDS/IPS detection and blocking of malware, intrusion activity, and denial-of-service traffic, with policies based on threat category or severity.
SCIM 2.0 provisioning – Automated user and group provisioning with documented examples for Okta, Microsoft Entra ID, JumpCloud, and OneLogin, alongside private LDAP support for directory-based authentication and group mapping.
Deployment and Platform Support
Delivery model: Cloud-delivered ZTNA service built around a globally distributed WPC with CloudConnexa Regions.
Deployment options: Cloud, on-premises, and hybrid. Connectors (or IPsec where applicable) link AWS VPCs, Azure VNets, GCP VPCs, and on-premises networks into the WPC.
Supported devices: Windows, macOS, iOS, and Android via OpenVPN Connect; Linux via the supported open-source OpenVPN client.
Integrations: SAML SSO, SCIM 2.0, private LDAP, APIs and session data for external monitoring and security workflows, and device-posture checks for several EDR/antivirus products.
Primary Use Cases
Secure remote and hybrid-work access for employees and contractors without exposing the underlying network.
Secure access to cloud applications and workloads across AWS, Azure, GCP, and other environments.
Hybrid and multi-cloud connectivity between on-premises sites, private networks, cloud networks, and remote users.
Application-level access and network segmentation to reduce lateral movement.
Context-aware access for managed endpoints using Device Posture, DIVE, and Location Context.
Threat-protected private access with Cyber Shield DNS filtering and IDS/IPS.
Who Is It Best Suited For?
CloudConnexa is designed for small and medium-sized businesses that want scalable Zero Trust security without significant infrastructure or management overhead, but it also supports larger organizations with distributed, hybrid, or multi-cloud environments.
It is particularly relevant for technology, professional services, healthcare, financial services, retail, and other regulated or distributed organizations that need secure remote access, segmentation, and auditability. Its audit logs support compliance requirements such as GDPR, HIPAA, and PCI-DSS.
Comparison Table
Capability
CloudConnexa
Free version or trial
Yes – 14-day free trial, plus an always-free Starter plan (up to 5 seats, with some limitations)
Cloud deployment
Yes – Connect AWS VPCs, Azure VNets, and GCP VPCs via Connectors or IPsec
Multi-factor authentication
Yes – Built-in TOTP 2FA, or MFA via SAML IdPs (Microsoft Entra ID, Okta, OneLogin)
Device-posture checking
Yes – OS/version, antivirus, disk encryption, client certificate validation, and more
Single sign-on
Yes – SAML 2.0
Pricing
CloudConnexa uses seat-based pricing, where each activated user or Connector consumes a seat.
Free Starter plan and 14-day trial make evaluation low-risk.
What Could Be Better?
End-user access relies on the OpenVPN Connect client (open-source OpenVPN client on Linux); there is no agentless, browser-only option.
Device Posture checks vary by operating system and client, so organizations should confirm their required endpoint controls are supported.
Built-in TOTP 2FA applies to native and LDAP authentication only; with SAML SSO, MFA is handled by the identity provider.
ZTNA is delivered as part of a broader WPC/private-networking model, which may not suit buyers looking solely for an application-proxy-style ZTNA product.
Some advanced capabilities depend on subscription tier, so buyers should verify current plan entitlements.
Verdict
For SMBs that want to adopt Zero Trust principles without buying an entire security suite, OpenVPN CloudConnexa offers one of the most accessible paths available. It pairs granular, identity-driven access control with hybrid and multi-cloud connectivity, layers on device and location context, and includes Cyber Shield threat protection, all under straightforward seat-based pricing that starts free.
Continuous verification of user and device context
Seamless integration with IAM and endpoint solutions
High scalability for global organizations
Features
Application segmentation and least-privilege enforcement
Inline SSL inspection and advanced threat prevention
Continuous monitoring and policy adjustment
Supports hybrid and multi-cloud environments
Best For: Large organizations needing cloud-native, scalable Zero Trust access.
3. Palo Alto Prisma Access
Palo Alto Prisma Access delivers a comprehensive ZTNA solution as part of its SASE platform.
It secures remote and on-site users with consistent policies, advanced threat prevention, and real-time visibility into network traffic.
Prisma Access supports hybrid workforces and integrates with cloud, SaaS, and on-premises applications.
The platform offers autonomous digital experience management (ADEM), giving IT teams insights and remediation capabilities for end-user connectivity and security issues.
Its ZTNA 2.0 approach addresses modern attack surfaces and operational complexity.
Specifications
ZTNA Version: 2.0
Deployment: Cloud, Hybrid
Employee Size: Scalable for enterprises
Integration: SIEM, IAM, EDR
Policy Management: Centralized, Autonomous
Reason to Buy
Advanced threat prevention and policy enforcement
Autonomous experience management for end-users
Consistent security across cloud, SaaS, and on-premises
Scalable for large, distributed organizations
Features
ZTNA 2.0 for hybrid work and direct-to-app architectures
Real-time traffic visibility and autonomous remediation
Application and data protection with microsegmentation
Integration with advanced analytics and threat intelligence
Best For: Enterprises seeking advanced, autonomous Zero Trust with SASE integration.
4. Cloudflare Zero Trust
Cloudflare Zero Trust provides secure, fast, and reliable access to internal applications without a VPN.
Its platform is designed for ease of deployment and management, supporting identity-based policies, device posture checks, and robust threat intelligence.
Cloudflare’s global network ensures low latency and high availability.
The solution integrates with major identity providers, supports multi-factor authentication, and offers a free tier for small teams.
Cloudflare’s unified dashboard simplifies policy management and monitoring.
Specifications
Free Version: Yes
Deployment: Cloud
Supported Devices: Windows, macOS, Linux, Mobile
Integration: SSO, IAM, EDR
Pricing: Starts at $7/user/month
Reason to Buy
Rapid deployment and easy management
Global network for low-latency access
Free tier for small teams and startups
Strong integration with identity and endpoint security
Features
Identity-based access controls and device posture checks
Real-time threat intelligence and monitoring
Multi-factor authentication and SSO support
Unified dashboard for policy and user management
Best For: Organizations needing fast, easy-to-manage Zero Trust with global reach.
5. Google BeyondCorp Enterprise
Google BeyondCorp Enterprise brings Zero Trust to the cloud, enabling secure access to applications from any device, anywhere.
The platform leverages Google’s robust infrastructure, offering identity-aware proxies, device security checks, and continuous monitoring.
BeyondCorp supports granular access policies and integrates with Google Workspace and third-party identity providers.
The solution is suitable for organizations embracing cloud-first strategies and seeking seamless integration with Google services.
Specifications
Free Version: Yes
Deployment: Cloud-native
Supported Devices: Any (browser-based)
Integration: Google Workspace, SSO, IAM
Policy Controls: Granular, Identity-based
Reason to Buy
Seamless integration with Google cloud services
Browser-based access for any device
Continuous monitoring and device security checks
Granular, identity-aware access policies
Features
Identity-aware proxy for secure application access
Real-time device posture and risk assessment
Integration with Google Workspace and third-party IAM
Scalable for organizations of any size
Best For: Organizations leveraging Google Cloud and Workspace for Zero Trust.
6. NordLayer ZTNA
NordLayer ZTNA is designed for businesses looking for easy-to-use, scalable Zero Trust solutions.
The platform offers centralized management, multi-factor authentication, and device posture checks, with support for cloud and on-premises environments.
NordLayer’s intuitive interface and affordable pricing make it accessible for SMBs and enterprises alike.
NordLayer integrates with major identity providers and supports secure remote access for distributed teams.
Specifications
Pricing: Starts at $11/user/month
Deployment: Cloud, On-premises
Supported Devices: Windows, macOS, Linux, Mobile
Integration: SSO, MFA, IAM
Management: Centralized
Reason to Buy
Affordable and scalable for all business sizes
Easy deployment and intuitive management
Strong authentication and device security
Supports remote and hybrid workforces
Features
Centralized dashboard for user and policy management
Multi-factor authentication and device posture checks
Integration with identity providers and cloud platforms
Real-time monitoring and reporting
Best For: SMBs and enterprises needing affordable, easy-to-manage Zero Trust.
7. Ivanti Neurons ZTNA
Ivanti Neurons ZTNA focuses on secure remote access and user experience, supporting a wide range of devices and operating systems.
The platform emphasizes compliance and detailed reporting, making it suitable for regulated industries and organizations with diverse device fleets.
Ivanti’s solution integrates with existing security infrastructure, providing centralized management, policy enforcement, and real-time monitoring.
Specifications
Deployment: Cloud, On-premises
Supported Devices: Windows, macOS, iOS, Android
Compliance: Detailed reporting and auditing
Integration: IAM, EDR, SIEM
Policy Management: Centralized
Reason to Buy
Comprehensive remote access for all device types
Strong compliance and reporting capabilities
Integration with existing security tools
Centralized management and policy enforcement
Features
Secure access for hybrid and remote workforces
Detailed compliance and audit reporting
Real-time monitoring and threat detection
Flexible deployment and integration options
Best For: Organizations with diverse devices and strict compliance needs.
8. Appgate SDP
Appgate SDP delivers identity-centric ZTNA using a software-defined perimeter model.
It evaluates user and device context before establishing encrypted, one-to-one network connections.
The platform supports dynamic entitlements, real-time decisioning, and integration with SIEM, IAM, and EDR tools.
Appgate is designed for hybrid and multi-cloud deployments, offering granular policy controls and comprehensive visibility into network activity.
Specifications
ZTNA Model: Software-defined perimeter
Deployment: Cloud, On-premises, Hybrid
Integration: SIEM, IAM, EDR
Policy Controls: Identity and context-based
Encryption: End-to-end
Reason to Buy
Identity-centric access with dynamic policies
Support for hybrid and multi-cloud environments
Real-time monitoring and decision making
Comprehensive integration with security tools
Features
Encrypted, one-to-one network connections
Dynamic entitlements and policy enforcement
Real-time visibility into user and device activity
Scalable for complex enterprise environments
Best For: Enterprises requiring granular, identity-driven Zero Trust in hybrid environments.
9. Twingate
Twingate offers a modern, cloud-native ZTNA solution that replaces traditional VPNs with identity-based, per-application access controls.
It is designed for rapid deployment, requiring no changes to network infrastructure. Twingate integrates with SSO, MFA, and endpoint security, providing granular access policies and robust encryption.
The platform is suitable for both hybrid and cloud environments, with a user-friendly interface and support for Windows, macOS, Linux, and mobile devices.
Specifications
Free Version: Yes
Deployment: Cloud-native
Supported Devices: Windows, macOS, Linux, Mobile
Integration: SSO, MFA, EDR
Pricing: Starts at $5/user/month
Reason to Buy
Easy, rapid deployment with minimal configuration
Granular, identity-based access controls
Strong encryption and device authentication
Flexible for hybrid and multi-cloud environments
Features
Per-application access and least-privilege enforcement
Seamless integration with identity and endpoint solutions
Traffic encryption and compliance-ready auditing
Cross-platform support for diverse teams
Best For: Teams seeking a fast, flexible, and user-friendly ZTNA alternative to VPNs.
10. Fortinet FortiClient ZTNA
Fortinet FortiClient ZTNA integrates endpoint security with Zero Trust access, providing protection for devices and network resources.
Its zero trust agent supports multi-factor authentication, device posture checks, and split-tunneling for optimized user experience.
Centralized management via EMS or FortiClient Cloud enables streamlined deployment and real-time endpoint status.
FortiClient is ideal for organizations already invested in the Fortinet Security Fabric, offering seamless integration with FortiGate firewalls and FortiSandbox.
Specifications
ZTNA Agent: Yes
Deployment: Cloud, On-premises
Integration: Fortinet Security Fabric
Central Management: EMS, FortiClient Cloud
Web Filtering: Yes
Reason to Buy
Deep integration with Fortinet ecosystem
Centralized management and reporting
Advanced endpoint and network protection
Supports split-tunneling and web filtering
Features
Multi-factor authentication and device posture checks
Real-time endpoint monitoring and upgrades
Centralized logging for compliance and security analysis
Flexible deployment options for diverse environments
Best For: Organizations using Fortinet products seeking integrated Zero Trust.
Conclusion
ZTNA has surged essential amid remote shifts, cloud leaps, and threat twists.
Reviewed platforms from Check Point’s all-in-one guard to Google’s BeyondCorp cloud magic scale Zero Trust to fit any operation.
Vet choices by size, regs, stack synergy, and expansion horizon. Prime picks lock data/apps while unleashing anywhere-productivity.
ZTNA transcends upgrades: it’s resilience, compliance, and transformation fuel. Navigate to 2026’s best with this roadmap forge a tougher, sharper, nimbler enterprise.
Companies are running into a new version of an old problem. Take, for example, a marketing executive turns on an agent from Marketo but doesn’t tell their IT team. That shadow agent now has access to customer data with little oversight and no clear adherence to the company’s security or compliance policies.
That’s a real scenario that’s happening now. It’s also the same pattern that made shadow IT a headache for over two decades. Employees often adopted unapproved tools that helped them do their job faster and better because the company option just wasn’t as good.
With agentic AI, it’s different because of what an unauthorized agent can do. Shadow IT tools mostly accessed or handled data without proper authorization. Agents, on the other hand, can take it much further by acting on that data by pulling records, sending messages and making changes with little oversight. Forcing agent data interactions via model context protocol can help, but the fact is there’s an autonomous agent that IT has little to no visibility into.
Now multiply that one marketer by every department, plus every agent that your vendors in HR, finance and elsewhere run in your systems. It’s a situation that most companies have no way to see, let alone control. This can become hundreds of vendors each running multiple agents, moving between your company, their company and your supply chain. That’s many thousands of agents with no consistent way to track what they are doing.
I often ask security teams: Do you have a robust inventory of the agents operating on your network? For most companies, the answer is no. And even if a company scanned its network, it’s not clear that agents are what they claim to be. So, there can be an unknown number of agents from unverified provenance performing a multitude of tasks and data exchanges on your network. This unfortunately is the current state of affairs at most companies.
Old problem, higher stakes
Shadow IT used to be technology that was used for work without explicit IT approval. Ten years ago, that meant a personal Dropbox folder or an unsanctioned project board. Today, it can mean an agent with a login and a task list, who is working inside your systems. That’s what shadow agents are.
When an agent gets access, it can quickly pull a record, draft a reply, update a field, move a file — the list goes on. This can happen before anyone even notices anything happening.
Security teams often say you can’t protect what you can’t see. That was true when the invisible thing was a spreadsheet. But it reaches another level when that agent has a login and knows what to do with it.
The precedent: DMARC solved this for email
How do you know an email that looks like it’s from Uber is actually from Uber? I ran into this problem, years before AI was an issue.
Say you get an email after an Uber ride saying, “Thanks for riding, click here for your receipt.” It says it’s from Uber. It’s actually sent by a vendor like SparkPost, on Uber’s behalf. Uber authorized it. The vendor is doing what Uber asked it to do. But nothing in the email told your inbox that there was permission, so your inbox just trusted the “from” line. Worse, it could’ve easily been a phishing attack from a criminal purporting to be Uber.
To address this, the email sender should have been authenticated against a trusted source before the email lands in your inbox.
That’s DMARC. A decade and over 1 million domains later, it’s proof the model works at scale. Verify the sender against a record that the domain owner controls and the guessing goes away.
The same fix, one layer up, for agents
DNS is already the internet’s phone book and a secure, trusted and public-facing database representing the domain. An agent claiming to represent Salesforce or any vendor can be checked against Salesforce’s DNS-secured record before it’s ever granted access.
That one check answers a critical question: Is this agent who it says it is, and did the company it claims to represent actually authorize it?
Once an agent is verified via the domain owner’s DNS record, there’s a domain cryptographically attached to the agent, and accountability that didn’t exist before.
Right now, most organizations don’t have that. An agent shows up and asks for access. But if something goes wrong, no one is really responsible, because nobody checked in the first place. They “trust” that the agent is what it claims to be. This gets even more complex if the agent is from a known hyperscaler/AI company but acting on behalf of an untrusted/unknown user (e.g., a ChatGPT agent but getting instructions from a criminal)
Zero trust as a bouncer, not a detective
Most of security has worked the same way for years: Try to identify everyone who shows up, then decide if they’re trustworthy. That’s backwards, and email proved it over a decade ago. A layered approach with zero trust upfront and further interrogation of what’s left over combines the efficiency and low cost of zero trust with deep inspection as a second pass, providing a highly effective level of security.
Layer 1: Zero trust is like a bouncer at a nightclub. She doesn’t try to figure out which of the world’s 8.3 billion people you are. She checks a finite short list of a couple dozen guests. If you’re not on it, you don’t get in.
Layer 2+: Now that we’ve reduced the number of people by (usually) orders of magnitude, we can, if needed, run the remaining people through deeper inspection, say a metal detector, access credentials and so on.
With agents, the logic is the same: Don’t evaluate whether an agent is trustworthy after it’s already inside your systems. Check whether it’s on the list before it gets anywhere near the door.
This means a legitimate agent might get turned away because someone forgot to add it to the list. But that inconvenience is much better than the alternative of letting everything in and just hoping things go well.
Identity is not permission
There are two separate questions inside every access decision. Most conversations about AI governance conflate them. First, who is this? Second, what are they be allowed to do?
This is like a passport and a visa. The passport says who you are. The visa says what you’re permitted to do and where you’re permitted to go. They’re issued by different authorities for different reasons. Confusing the two is where a lot of security approaches go wrong.
Upfront agent authentication, also known as a passport, can tell you whether that agent claiming to be from Salesforce is really Salesforce’s. Next, you need to figure out if Salesforce is authorized to work in your system and what it’s allowed to do. Your approved list of vendors and the approved actions should be made on purpose rather than defaulting to whatever the agent claims about itself.
The identity layer has to get solved first and solved the same way for everyone. But the permission layer is where every company’s answer is different, based on what that specific agent actually needs to access. Complicating matters, agents can change their workload mid-process. So, the permissions need to be continuous and focus on ongoing workloads as they evolve. This is a growing, urgent problem.
Why this matters now
AI-generated phishing is now three times more effective than traditional campaigns, according to Microsoft.
A year ago, AI-written phishing attempts were easy to spot due to bad grammar or strange tone. That has changed on an exponential curve, a progression humans’ brains have a hard time grasping. The same category of tool getting better at impersonation is now showing up as unauthorized agents inside company systems. And improving exponentially. Better deception plus more access adds up to a problem that grows faster than we can even imagine.
Shadow IT taught the industry a lesson. Now, shadow agents are teaching it again. You can’t secure what you don’t know is running inside your systems. For the marketer turning on the Marketo agent, what would have caught it isn’t a smarter firewall or a longer policy document; it’s a check, run before access is granted, confirming that the agent is who it claims to be and that someone actually authorized it. It’s followed up with continuous permissioning and logging to make sure the agent does what it’s supposed to.
That’s the shift: Verify an agent’s identity before it gets anywhere near the door. Email already proved this model at scale across roughly 1 million domains. Shadow agents are the same problem showing up again in a new form. It doesn’t need a new fix. It needs the one that already works.
A few weeks ago, we wrote about Project Glasswing and what we observed when we pointed cyber frontier models at our own code. Since then, we’ve seen that the part of the post that has resonated most deeply is the argument that the architecture around the vulnerability matters more than the speed of the patch.
In the conversations we've had with CISOs and security teams since, the questions have been consistent: what does our architecture actually look like, what should we monitor for, where do we start, and how can Cloudflare help?
Before getting into the details: the architecture below is built almost entirely from Cloudflare's own products, because Cloudflare security is customer zero for the security products we build. The Cloudflare stack already exists in front of our code, employees, and customer-facing applications. If you're a Cloudflare customer, every layer below is available to you today. If you're not, the principles still apply to whatever stack you've built.
What a cyber frontier model actually changes
In the previous post, we showed how a cyber frontier model like Mythos changes the attacker’s timeline. It can find vulnerabilities, reason through exploit chains, and generate working proofs faster than earlier models. While models like Mythos do not change the shape of an intrusion — reconnaissance, initial access, lateral movement, persistence, and exfiltration still have to happen — the difference is in the speed and scale. When pointed at the open web, a model can find and hit low-hanging fruit quickly. Against a hardened target, it still has to probe, and adapt, and it often produces more noise than a careful human operator would.
Discovery, exploit chain construction, and proof-of-concept generation used to be the gating constraints on producing a working attack. A frontier model handles all three in a fraction of the time. Work that used to be slow and methodical is now fast and indiscriminate.
While AI is accelerating how fast developer teams at Cloudflare and many other companies can ship code, the security team’s work has not compressed the same way. An attacker only needs one opening to get in, while security teams need to find and close them all. Writing a fix, regressing it, and shipping it without breaking the code around it has constraints that AI doesn't remove. We learned this the hard way when we let an AI coding assistant write its own patches against our own bugs, as we described at the end of the previous post. Some of those patches fixed the original bug while quietly breaking something else the code depended on.
As these models become more competent and capable, our main focus from a threat standpoint comes down to three things. Each one shapes the architecture we walk through in the rest of this post.
The first is the speed of discovery. Frontier models make it easier to search large bodies of public code, including the open-source libraries that many companies depend on. That does not mean every bug in a library is exploitable, or that library bugs are where most vulnerabilities live. Exploitability still depends on how the code is used, whether attacker-controlled input can reach the vulnerable path, and the protections that sit around it. But widely used open-source libraries and frameworks give attackers a shared surface to study at scale. When a real, reachable vulnerability exists there, a model can help find it, reason about possible exploit paths, and generate proof-of-concept variants faster than maintainers and defenders can review every downstream use. The gap between when an attacker discovers a vulnerability and when defenders learn it exists is what worries us most. If you are not running these models against your own code, it is safe to assume someone else is.
The second is exploitvolume and adaptation. A model can produce thousands of variations of a single exploit and run reconnaissance at the same scale. All that volume gives an attacker an advantage, but it won’t necessarily get them past signature-based detections. Many of those iterations will have the same underlying signature, so a rule that catches the first one will catch the rest. Adaptation is how they will get past signature-based detections. Ask a model to show you a SQL injection, and it will return a textbook example. Tell it there is a WAF in the way, and it will start probing, learning what gets blocked, and rewriting the payload until it can slip past the rule blocking it.
The third is the impact when a vulnerability is inevitably exploited. No architecture catches everything. After the vulnerability is exploited, the question we ask ourselves is: where can the attacker get to with one identity, one path, or one credential, before something else stops them? If the answer is "anywhere they want," the vulnerability was never the problem. The architecture around the vulnerability was.
Cloudflare’s superpower: visibility
We see roughly a fifth of the web and that tells us, in real time, which payloads are mutating, which patterns are picking up, and where attacker tooling is moving next. Two teams turn that visibility into defense.
First is Cloudforce One, our threat intelligence, research, and operations team, which sits within the Cloudflare security organization. They turn what we see across the network into insights the rest of the stack can act on: tracked adversaries, emerging campaigns, and indicators of compromise (IOCs). The hard part of this work was never knowing what is malicious — it was the delay in mitigation. Knowledge of a new threat normally has to travel from a threat report, into a feed, and then into a company’s defense before it can be used to block anything. Attackers have learned to move faster than that. Our network closes that gap: Cloudflare customers can now use Cloudforce One threat intelligence directly within the WAF to block high-risk traffic.
Second is the team that owns the WAF engine that does the actual detecting: the managed rulesets that run in front of our own properties and are available to every Cloudflare customer, the machine learning behind WAF Attack Score, and the relationships that sometimes let us ship a rule before a CVE is publicly disclosed. The team is globally distributed and moves fast, releasing rules within hours of a proof-of-concept of an attack becoming known. Once a detection is deployed, it reaches our entire network, along with every Cloudflare customer, in under 30 seconds. React2Shell is a recent example: a managed WAF rule was protecting our own properties, and everyone else's on Cloudflare, hours before the official advisory was published.
The scoring layer, the defenses we put in front of the application, and the containment around the vulnerability all build on what these two teams see.
Scores over signatures
Signature-based defenses were built for a world where novel exploits were scarce and variations took weeks. Cloudflare's traditional SLA from a fresh proof-of-concept to a live, deployed rule has been 12 hours. With the advent of frontier models, this is not good enough anymore. Detections need to be in place before a CVE is discovered. This is why we layer ML-based detection in front of the traditional signature-based WAF.
The model is trained on a large body of past attack traffic, and it catches new variants of vulnerabilities before they're publicly known. A novel SQL injection or remote code execution chain is almost always a rearrangement of attack shapes the model has seen before, even when the specific exploit is brand new. We run the model on every request and assign a WAF Attack Score between 1 and 99, based on how closely the request resembles those underlying shapes, not against a list of known-bad signatures. The lower the score, the more aggressively we treat the request. That score determines whether we let the request through. We apply a similar scoring methodology to AI prompts with AI Security for Apps: rather than check each prompt against a list of known malicious prompts, we score how closely a prompt resembles an actual attack.
The architecture around the vulnerability
Those capabilities only matter once they're stacked in front of an application, and the first layer in our defense-in-depth approach is the WAF. Anything that matches a known-bad pattern gets dropped before it reaches the application, which clears the bulk of the obvious traffic and lets the more specialized layers below focus on what's left.
On the API surface, we run a positive security model through API Shield. Instead of trying to anticipate every bad request, we describe what a valid request to each API looks like, either from the API's own definition or learned from our real traffic, and anything that doesn't fit doesn't get through. This neutralizes the advantage of frontier AI models: because we only permit validated traffic, generating thousands of new attack variations fails to bypass the system.
Cloudflare’s layered architecture
Bot Management catches probing traffic on our network before frontier models can build a map. It scores every request on how likely it is to be automated, using the same signals across our whole network: how the client behaves, whether it looks like a real browser, and whether the connection matches a known-bad pattern. An attack only lands if it can find a soft spot.
Zero Trust Network Access is used for every internal application. The implicit trust of being inside the network is replaced with explicit per-request identity and policy for every employee accessing every tool. The value of this was clear when one of our engineers shipped a misconfigured tool. A flat network would have exposed everything on the same segment, but in our deployment, the exposure stopped at the tool itself. We built Require Access Protection afterwards so newly deployed or misconfigured applications can't be reachable before an access policy is in place.
IdP Federation makes that secure by default posture easier to keep consistent across every Cloudflare account — which becomes even more necessary when more people are shipping internal tools quickly. Instead of asking each team to wire up SSO separately, we configure our identity provider (IdP) once and share it across the organization. New accounts get SSO automatically, recipient-side IdP connections are read-only, and Access policies in each account still evaluate the resulting identity as part of the normal request flow.
MCP Server Portal gives teams a controlled way to connect AI agents to enterprise systems. Agents access MCP servers that are centrally managed through a single portal, with every action logged. That way when an agent acts on someone's behalf, we know what it did, what it touched, and whether it should have been allowed to. The full picture of how we built it is in our post on enterprise MCP.
AI Gateway runs in front of our internal AI tools the same way AI Security for Apps runs in front of customer-facing AI features, with the same scoring and the same visibility. Inside the company, the visibility piece is more useful than the blocking, because we needed to see what engineers were actually building before we could write meaningful policy on it.
Where your teams can start
Frontier models can help attackers find vulnerabilities, adapt payloads, and move faster, but they still have to pass through the layered defense you deploy in front of your application. That is where teams should start:
Put inspection in front of public applications.
Define what valid API traffic looks like.
Use bot detection to limit automated probing.
Require identity and access policy before any internal tool is reachable.
For AI and agentic systems:
Route model traffic through a gateway.
Keep agents connected through approved MCP servers.
Log what they do.
The goal is to make sure that when one layer misses, the next layer limits what the attacker can see, reach, or change.
That is the point of the architecture around the vulnerability: to limit the scope of an attack. The vulnerability may be what starts the attack, but the architecture determines how far it can go.
How do we know this approach works?
Plenty of security stacks look impenetrable on a whiteboard but fall over in practice. That is why we test ours continuously, both at the perimeter and inside our environment, with our red team involved across both.
At the perimeter, frontier models are one tool we use to test our application security stack as an adaptive attacker. These models sit alongside the rest of our red team and detection workflows including: manual testing, threat intelligence, observed traffic patterns, proof-of-concept analysis, and signals from our own network. Together, those inputs help us decide where to aim testing: newly launched products, recently changed surfaces, and the paths an attacker is most likely to probe first. The most important part is the process that follows. When something gets through, we identify the gap, use the right mix of tools to understand it, write the rule or mitigation, ship the update, and test again to make sure the gap is closed.
Inside the environment, our red team starts from the assumption that the perimeter has already failed. They look at what has changed, where sensitive systems carry risk, and whether one compromised identity, path, or credential can reach farther than it should. When we change the architecture based on what they find, they run the scenario again against the new version to confirm the gap is actually closed.
We confirm that this architecture is working by continuously testing its behavior during failures, rather than relying on the perfection of individual layers.
The paradox of edge security describes how technologies designed to strengthen network defenses can also create new vulnerabilities. Edge devices improve performance and support localized threat detection by processing data closer to its source, yet modern enterprise environments often operate thousands of distributed endpoints. This rapid expansion of edge infrastructure increases the number of systems..
We have thousands of internal apps at Cloudflare. Some are things we’ve built ourselves, others are self-hosted instances of software built by others. They range from business-critical apps nearly every person uses, to side projects and prototypes.
All of these apps are protected by Cloudflare Access. But when we started using and building agents — particularly for uses beyond writing code — we hit a wall. People could access apps behind Access, but their agents couldn’t.
Access sits in front of internal apps. You define a policy, and then Access will send unauthenticated users to a login page to choose how to authenticate.
Example of a Cloudflare Access login page
This flow worked great for humans. But all agents could see was a redirect to a login page that they couldn’t act on.
Providing agents with access to internal app data is so vital that we immediately implemented a stopgap for our own internal use. We modified OpenCode’s web fetch tool such that for specific domains, it triggered the cloudflared CLI to open an authorization flow to fetch a JWT (JSON Web Token). By appending this token to requests, we enabled secure, immediate access to our internal ecosystem.
While this solution was a temporary answer to our own dilemma, today we’re retiring this workaround and fixing this problem for everyone. Now in open beta, every Access application supports managed OAuth. One click to enable it for an Access app, and agents that speak OAuth 2.0 can easily discover how to authenticate (RFC 9728), send the user through the auth flow, and receive back an authorization token (the same JWT from our initial solution).
Now, the flow works smoothly for both humans and agents. Cloudflare Access has a generous free tier. And building off our newly-introduced Organizations beta, you’ll soon be able to bridge identity providers across Cloudflare accounts too.
How managed OAuth works
For a given internal app protected by Cloudflare Access, you enable managed OAuth in one click:
Once managed OAuth is enabled, Cloudflare Access acts as the authorization server. It returns the www-authenticate header, telling unauthorized agents where to look up information on how to get an authorization token. They find this at https://<your-app-domain>/.well-known/oauth-authorization-server. Equipped with that direction, agents can just follow OAuth standards:
The agent dynamically registers itself as a client (a process known as Dynamic Client Registration — RFC 7591),
The agent sends the human through a PKCE (Proof Key for Code Exchange) authorization flow (RFC 7636)
The human authorizes access, which grants a token to the agent that it can use to make authenticated requests on behalf of the user
Here’s what the authorization flow looks like:
If this authorization flow looks familiar, that’s because it’s what the Model Context Protocol (MCP) uses. We originally built support for this into our MCP server portals product, which proxies and controls access to many MCP servers, to allow the portal to act as the OAuth server. Now, we’re bringing this to all Access apps, so agents can access not only MCP servers that require authorization, but also web pages, web apps, and REST APIs.
Mass upgrading your internal apps to be agent-ready
Upgrading the long tail of internal software to work with agents is a daunting task. In principle, in order to be agent-ready, every internal and external app would ideally have discoverable APIs, a CLI, a well-crafted MCP server, and have adopted the many emerging agent standards.
AI adoption is not something that can wait for everything to be retrofitted. Most organizations have a significant backlog of apps built over many years. And many internal “apps” work great when treated by agents as simple websites. For something like an internal wiki, all you really need is to enable Markdown for Agents, turn on managed OAuth, and agents have what they need to read protected content.
To make the basics work across the widest set of internal applications, we use Managed OAuth. By putting Access in front of your legacy internal apps, you make them agent-ready instantly. No code changes, no retrofitting. Instead, just immediate compatibility.
It’s the user’s agent. No service accounts and tokens needed
Agents need to act on behalf of users inside organizations. One of the biggest anti-patterns we’ve seen is people provisioning service accounts for their agents and MCP servers, authenticated using static credentials. These have their place in simple use cases and quick prototypes, and Cloudflare Access supports service tokens for this purpose.
But the service account approach quickly shows its limits when fine-grained access controls and audit logs are required. We believe that every action an agent performs must be easily attributable to the human who initiated it, and that an agent must only be able to perform actions that its human operator is likewise authorized to do. Service accounts and static credentials become points at which attribution is lost. Agents that launder all of their actions through a service account are susceptible to confused deputy problems and result in audit logs that appear to originate from the agent itself.
For security and accountability, agents must use security primitives capable of expressing this user–agent relationship. OAuth is the industry standard protocol for requesting and delegating access to third parties. It gives agents a way to talk to your APIs on behalf of the user, with a token scoped to the user’s identity, so that access controls correctly apply and audit logs correctly attribute actions to the end user.
Standards for the win: how agents can and should adopt RFC 9728 in their web fetch tools
RFC 9728 is the OAuth standard that makes it possible for agents to discover where and how to authenticate. It standardizes where this information lives and how it’s structured. This RFC became official in April 2025 and was quickly adopted by the Model Context Protocol (MCP), which now requires that both MCP servers and clients support it.
But outside of MCP, agents should adopt RFC 9728 for an even more essential use case: making requests to web pages that are protected behind OAuth and making requests to plain old REST APIs.
Most agents have a tool for making basic HTTP requests to web pages. This is commonly called the “web fetch” tool. It’s similar to using the fetch() API in JavaScript, often with some additional post-processing on the response. It’s what lets you paste a URL into your agent and have your agent go look up the content.
Today, most agents’ web fetch tools won’t do anything with the www-authenticate header that a URL returns. The underlying model might choose to introspect the response headers and figure this out on its own, but the tool itself does not follow www-authenticate, look up /.well-known/oauth-authorization-server, and act as the client in the OAuth flow. But it can, and we strongly believe it should! Agents already do this to act as remote MCP clients.
To demonstrate this, we’ve put up a draft pull request that adapts the web fetch tool in Opencode to show this in action. Before making a request, the adapted tool first checks whether it already has credentials ; if it does, it uses them to make the initial request. If the tool gets back a 401 or a 403 with a www-authenticate header, it asks the user for consent to be sent through the server’s OAuth flow.
Here’s how that OAuth flow works. If you give the agent a URL that is protected by OAuth and complies with RFC 9728, the agent prompts the human for consent to open the authorization flow:
…sending the human to the login page:
…and then to a consent dialog that prompts the human to grant access to the agent:
Once the human grants access to the agent, the agent uses the token it has received to make an authenticated request:
Any agent from Codex to Claude Code to Goose and beyond can implement this, and there’s nothing bespoke to Cloudflare. It’s all built using OAuth standards.
We think this flow is powerful, and that supporting RFC 9728 can help agents with more than just making basic web fetch requests. If a REST API supports RFC 9728 (and the agent does too), the agent has everything it needs to start making authenticated requests against that API. If the REST API supports RFC 9727, then the client can discover a catalog of REST API endpoints on its own, and do even more without additional documentation, agent skills, MCP servers or CLIs.
Each of these play important roles with agents — Cloudflare itself provides an MCP server for the Cloudflare API (built using Code Mode), Wrangler CLI, and Agent Skills, and a Plugin. But supporting RFC 9728 helps ensure that even when none of these are preinstalled, agents have a clear path forward. If the agent has a sandbox to execute untrusted code, it can just write and execute code that calls the API that the human has granted it access to. We’re working on supporting this for Cloudflare’s own APIs, to help your agents understand how to use Cloudflare.
Coming soon: share one identity provider (IdP) across many Cloudflare accounts
At Cloudflare our own internal apps are deployed to dozens of different Cloudflare accounts, which are all part of an Organization — a newly introduced way for administrators to manage users, configurations, and view analytics across many Cloudflare accounts. We have had the same challenge as many of our customers: each Cloudflare account has to separately configure an IdP, so Cloudflare Access uses our identity provider. It’s critical that this is consistent across an organization — you don’t want one Cloudflare account to inadvertently allow people to sign in just with a one-time PIN, rather than requiring that they authenticate via single-sign on (SSO).
To solve this, we’re currently working on making it possible to share an identity provider across Cloudflare accounts, giving organizations a way to designate a single primary IdP for use across every account in their organization.
As new Cloudflare accounts are created within an organization, administrators will be able to configure a bridge to the primary IdP with a single click, so Access applications across accounts can be protected by one identity provider. This removes the need to manually configure IdPs account by account, which is a process that doesn’t scale for organizations with many teams and individuals each operating their own accounts.
What’s next
Across companies, people in every role and business function are now using agents to build internal apps, and expect their agents to be able to access context from internal apps. We are responding to this step function growth in internal software development by making the Workers Platform and Cloudflare One work better together — so that it is easier to build and secure internal apps on Cloudflare.
Expect more to come soon, including:
More direct integration between Cloudflare Access and Cloudflare Workers, without the need to validate JWTs or remember which of many routes a particular Worker is exposed on.
wrangler dev --tunnel — an easy way to expose your local development server to others when you’re building something new, and want to share it with others before deploying
More announcements to come during Agents Week 2026
Enable Managed OAuth for your internal apps behind Cloudflare Access
Managed OAuth is now available, in open beta, to all Cloudflare customers. Head over to the Cloudflare dashboard to enable it for your Access applications. You can use it for any internal app, whether it’s one built on Cloudflare Workers, or hosted elsewhere. And if you haven’t built internal apps on the Workers Platform yet — it’s the fastest way for your team to go from zero to deployed (and protected) in production.
RSA opened RSAC 2026 with a new deployment model for its ID Plus identity platform, aimed squarely at government agencies, financial services firms, and critical infrastructure operators that need identity security to work even when everything else fails. RSA ID Plus Sovereign Deployment is a “deploy anywhere” identity and access management solution that gives organizations..
Summary of Google’s H1 2026 Cloud Threat Horizons findings arguing identity failures, weaponized local AI tooling, and collapsing exploitation windows require AI-native security architectures and automated identity governance.
Analysis of the Trump administration’s concise 2024 cybersecurity strategy arguing for policy-led government, private-sector implementation, deregulation to spur innovation, and elevation of AI security as a national priority.
Email security has always been defined by impermanence. It is a perpetual call-and-response arms race, where defenses are only as strong as the last bypass discovered and attackers iterate relentlessly for even marginal gains. Every control we deploy eventually becomes yesterday’s solution.
What makes this challenge especially difficult is that our biggest weaknesses are, by definition, invisible.
This problem is best illustrated by a classic example from World War II. Mathematician Abraham Wald was tasked with helping Allied engineers decide where to reinforce bomber aircraft. Engineers initially focused on the bullet holes visible on planes returning from missions. Wald pointed out the flaw: they were reinforcing the areas where planes could already take damage and survive. The true vulnerabilities were on the planes that never came back.
Email security faces an identical hurdle: our detection gaps are unseen. By integrating LLMs, we advance email phishing protection and move from reactive to proactive detection improvement.
The limits of reactive defense
Traditional email security systems improve primarily through user-reported misses. For example, if we marked a spam message as clean, customers can send us the original EML to our pipelines for our analysts to analyze and update our models. This feedback loop is necessary and valuable, but it is inherently reactive. It depends on someone noticing a failure after the fact and taking the time to report it.
That means detection improvements are often driven by what attackers already succeeded at, rather than by what they are about to exploit next.
To close this gap, we need a way to systematically observe the “planes that didn’t make it back.”
Mapping the threat landscape with LLMs
Large Language Models (LLMs) hit the mainstream market in late 2022 and early 2023, fundamentally changing how we process unstructured data. At their core, LLMs use deep learning and massive datasets to predict the next token in a sequence, allowing them to understand context and nuance. They are particularly well-suited for email security because they can read natural language and characterize complex concepts (like intent, urgency, and deception) across millions of messages.
Every day, Cloudflare processes millions of unwanted emails. Historically, it was not feasible to deeply characterize each message beyond coarse classifications. Manually mapping emails to nuanced threat vectors simply did not scale.
Now, Cloudflare has integrated LLMs into our email security tools to identify threats before they strike. By using the power of LLMs, as we’ll describe below, we can finally see a clear and comprehensive picture of the evolving threat landscape.
Our LLM-driven categorization shows clear spikes and persistent trends across several distinct categories, including "PrizeNotification" and "SalesOutreach".
These LLM-generated tags provide Cloudflare analysts with high-fidelity signals in near real time. Tasks that previously required hours of manual investigation and complex querying can now be surfaced automatically, with relevant context attached. This directly increases the velocity at which we can build new targeted Machine Learning models or retrain existing ones to address emerging behaviors.
Because Cloudflare operates at global Internet scale, we can gather these insights earlier than ever before, often before a new technique becomes widely visible through customer-reported misses.
The Sales Outreach threat
One of the clearest patterns we’ve identified using this new intelligence is the continued persistence of malicious messages structured to look like Sales Outreach-style phishing. These emails are designed to mimic legitimate B2B communication, often presenting opportunities to purchase or receive "special deals" on unique items or services, to lure targets into clicking malicious links or providing credentials.
Once LLM categorization surfaced Sales Outreach as a dominant vector, we moved from broad visibility to targeted data collection.
Using LLM-generated tags, we began systematically isolating messages that exhibited Sales Outreach characteristics across our global dataset. This produced a continuously growing, high-precision corpus of real-world examples, including confirmed malicious messages as well as borderline cases that traditional systems struggled to classify. From this corpus, we built a dedicated training pipeline.
First, we curated training data by grouping messages based on shared linguistic and structural traits identified by the LLMs. These traits included persuasive framing, manufactured urgency, transactional language, and subtle forms of social proof.
Next, we focused feature extraction on sentiment and intent rather than static indicators. The model learns how requests are phrased, how credibility is established, and how calls to action are embedded within otherwise normal business conversations.
Finally, we trained a purpose-built sentiment analysis model optimized specifically for Sales Outreach behavior. This avoided overloading a general phishing classifier and allowed us to tune precision and recall for this threat class.
Turning language into enforcement
The output of this model is a risk score that reflects how closely a message aligns with known Sales Outreach attack patterns. That score is evaluated alongside existing signals such as sender reputation, link behavior, and historical context to determine whether a message should be blocked, quarantined, or allowed.
This process is continuous. As attackers adapt their language, newly observed messages are fed back into the pipeline and used to refine the model without waiting for large volumes of user-reported misses. LLMs act as the discovery layer by surfacing new linguistic variants, while the specialized model performs fast and scalable enforcement.
This is what an all-out offensive looks like in practice. It is a feedback loop where large-scale language understanding drives focused, high-precision detection. The result is earlier intervention against a threat class that thrives on subtlety, and fewer malicious sales emails reaching the inbox.
Results of the undertaking
The visibility unlocked by LLM-driven mapping fundamentally changed how we improve detections. Instead of waiting for attackers to succeed and relying on downstream user reports, we gained the ability to identify systemic gaps earlier and address them at the source. This shift from reactive remediation to proactive reinforcement translated directly into measurable customer impact.
The most immediate signal of success was a marked reduction in customer friction. Sales Outreach–related phishing has historically generated a high volume of user-reported misses, largely because these messages closely resemble legitimate business communication and often evade traditional rule-based or reputation-driven systems. As our targeted models came online and were continuously refined using LLM-derived insights, fewer of these messages reached end users in the first place.
The data reflects this change clearly. Average daily Sales Outreach submissions — messages that we labeled as clean but were in fact Sales Outreach phishing emails, flagged by end users — dropped from 965 in Q3 2025 to 769 in Q4 2025, representing a 20.4% reduction in reported missesin a single quarter.
This reduction is not just a metric improvement; it represents thousands fewer disruptive moments per day for security teams and end users alike. Each avoided submission is a phishing attempt that was stopped before it could erode trust, consume analyst time, or force a user to make a security judgment mid-workflow. We have seen this trend continue in Q1 of 2026 with average daily submissions decreasing by two-thirds.
In effect, LLMs allowed us to “see” the planes that never made it back. By illuminating previously invisible failure modes, we were able to reinforce defenses precisely where attackers were concentrating their efforts. The result is a system that improves not only detection rates, but also the day-to-day experience of the people relying on it.
The next front in the arms race
Our work with LLMs is just beginning.
To stay ahead of the next evolution of attacks, we are moving toward a model of total environmental awareness by refining LLM specificity to extract forensic-level detail from every interaction. This granular mapping allows us to identify specific tactical signatures rather than relying on broad labels.
Simultaneously, we are deploying specialized machine learning models purpose-built to hunt for emerging, high-obfuscation vectors at the "fringes" that traditional defenses miss. By leveraging this real-time LLM data as a strategic compass, we can shift our human expertise away from known noise and toward the critical gaps where the next strike is likely to land.
By illuminating the "planes that didn't make it back," we are doing more than just reacting to missed email; we are systematically narrowing the battlefield. In the email arms race, the advantage belongs to the side that can see the invisible first.
Ready to enhance your email security?
We provide all organizations (whether a Cloudflare customer or not) with free access to our Retro Scan tool, allowing them to use our predictive AI models to scan existing inbox messages in Microsoft 365.
Retro Scan will detect and highlight any threats found, enabling organizations to remediate them directly in their email accounts. With these insights, organizations can implement further controls, either using Cloudflare Email Security or their preferred solution, to prevent similar threats from reaching their inboxes in the future.
If you are interested in how Cloudflare can help secure your inboxes, sign up for a phishing risk assessment here.
Explore how outdated data management practices hinder efficiency and innovation. By challenging familiar habits, organizations can simplify data processes, improve systems, and cultivate a culture of problem-solving.
Starkiller is a new SaaS-style phishing framework that runs real brand websites inside headless Chrome containers, acting as a live reverse proxy to steal credentials, session tokens, and MFA-protected accounts while evading traditional detection.
Discover how AI-driven systems are redefining application security. Research highlights the importance of focusing on inference layers, prompt control, and token management to effectively secure AI inference services and minimize risks associated with cost, latency, and data leakage.
Cloudflare launched fifteen years ago with a mission to help build a better Internet. Over that time the Internet has changed and so has what it needs from teams like ours. In this year’s Founder’s Letter, Matthew and Michelle discussed the role we have played in the evolution of the Internet, from helping encryption grow from 10% to 95% of Internet traffic to more recent challenges like how people consume content.
This year’s themes focused on helping prepare the Internet for a new model of monetization that encourages great content to be published, fostering more opportunities to build community both inside and outside of Cloudflare, and evergreen missions like making more features available to everyone and constantly improving the speed and security of what we offer.
We shipped a lot of new things this year. In case you missed the dozens of blog posts, here is a breakdown of everything we announced during Birthday Week 2025.
To support a diverse and open Internet, we are now sponsoring Ladybird (an independent browser) and Omarchy (an open-source Linux distribution and developer environment).
We are opening our office doors in four major cities (San Francisco, Austin, London, and Lisbon) as free hubs for startups to collaborate and connect with the builder community.
We are removing cost as a barrier for the next generation by giving students with .edu emails 12 months of free access to our paid developer platform features.
We are partnering with Coinbase to create the x402 Foundation, encouraging the adoption of the x402 protocol to allow clients and services to exchange value on the web using a common language
Our Automatic SSL/TLS system has upgraded over 6 million domains to more secure encryption modes by default and will soon automatically enable post-quantum connections.
We made our CSAM Scanning Tool easier to adopt by removing the need to create and provide unique credentials, helping more site owners protect their platforms.
Updates across Workers and beyond for a more powerful developer platform – such as support for larger and more concurrent Container images, support for external models from OpenAI and Anthropic in AI Search (previously AutoRAG), and more.
A deep-dive into how we’ve hardened the Workers runtime with new defense-in-depth security measures, including V8 sandboxes and hardware-assisted memory protection keys.
We announced the Cloudflare Email Service private beta, allowing developers to reliably send and receive transactional emails directly from Cloudflare Workers.
The TCP Connection Time (Trimean) graph shows that we are the fastest TCP connection time in 40% of measured ISPs – and the fastest across the top networks.
It turns out we've all been using MCP wrong. Most agents today use MCP by exposing the "tools" directly to the LLM. We tried something different: Convert the MCP tools into a TypeScript API, and then ask an LLM to write code that calls that API. The results are striking.
Come build with us!
Helping build a better Internet has always been about more than just technology. Like the announcements about interns or working together in our offices, the community of people behind helping build a better Internet matters to its future. This week, we rolled out our most ambitious set of initiatives ever to support the builders, founders, and students who are creating the future.
For founders and startups, we are thrilled to welcome Cohort #6 to the Workers Launchpad, our accelerator program that gives early-stage companies the resources they need to scale. But we’re not stopping there. We’re opening our doors, literally, by launching new physical hubs for startups in our San Francisco, Austin, London, and Lisbon offices. These spaces will provide access to mentorship, resources, and a community of fellow builders.
We’re also investing in the next generation of talent. We announced free access to the Cloudflare developer platform for all students, giving them the tools to learn and experiment without limits. To provide a path from the classroom to the industry, we also announced our goal to hire 1,111 interns in 2026 — our biggest commitment yet to fostering future tech leaders.
And because a better Internet is for everyone, we’re extending our support to non-profits and public-interest organizations, offering them free access to our production-grade developer tools, so they can focus on their missions.
Whether you're a founder with a big idea, a student just getting started, or a team working for a cause you believe in, we want to help you succeed.
Until next year
Thank you to our customers, our community, and the millions of developers who trust us to help them build, secure, and accelerate the Internet. Your curiosity and feedback drive our innovation.
It’s been an incredible 15 years. And as always, we’re just getting started!
(Watch the full conversation on our show ThisWeekinNET.com about what we launched during Birthday Week 2025 here.)
Entrar
.webp)
Best For: Large organizations needing cloud-native, scalable Zero Trust access.
.webp)
.webp)
.webp)
.webp)
.webp)
.webp)
