Cloudflare Launches AI-Powered Vulnerability Discovery and Remediation Service
Cloudflare introduces an invitation-only service leveraging OpenAI's Daybreak models to proactively scan codebases for vulnerabilities, contextualize risks, and suggest automated patches.
Cloudflare is rolling out early access to its new Vulnerability Discovery and Remediation (VDR) service, integrated into its Managed Defense offering. This invitation-only program aims to help customers proactively identify and address security weaknesses within their authorized codebases. By harnessing the power of advanced AI models, including OpenAI's GPT-5.6 Cyber from the Daybreak Defense Network, VDR promises to revolutionize how organizations approach vulnerability management.
The core challenge VDR addresses is the overwhelming volume of vulnerability alerts and the difficulty in prioritizing them. Traditional scanners often flag thousands of potential issues, leaving security teams struggling to determine which require immediate attention. Attackers, increasingly leveraging AI to accelerate their own discovery and exploitation processes, further compress the time available for defenders to act. VDR aims to cut through this noise by providing critical context that transforms generic findings into actionable intelligence.
Cloudflare's approach integrates AI-driven code analysis with real-time production data. When a vulnerability is detected in a customer's authorized codebase, VDR doesn't just report the flaw; it analyzes the code's production exposure. This includes assessing whether the vulnerable code is actively deployed, how much traffic it handles, and if it's currently subject to attack activity. This contextualization is crucial for accurate risk assessment, allowing teams to focus on the vulnerabilities that pose the most immediate threat.
The service builds upon Cloudflare's internal "vulnerability harness" pipeline, designed for fleet-wide security scanning. VDR extends this capability to customer codebases. The process begins with collecting traffic and security data from Cloudflare's Web Application Firewall (WAF) and Web Assets. This snapshot reveals active routes, traffic volumes, and any associated security events. High-traffic "hot paths" and routes with recent security alerts receive heightened scrutiny.
Next, VDR employs AI agents for reconnaissance to map request paths to specific code sections. Hunter agents then delve into these sections, searching for vulnerabilities while pulling in the relevant network context. This context helps prioritize areas of the code that are actively used and potentially targeted. Crucially, all findings must be corroborated by evidence directly within the source code, ensuring accuracy.
Following detection, a validation stage verifies proposed mitigations and assigns an initial risk rating based on the source code. Network evidence, such as high traffic or active probing, can further elevate this rating. The output is a prioritized list of vulnerabilities, each accompanied by a recommended code patch. In many cases, VDR also suggests custom Cloudflare WAF rules to provide immediate protection while code fixes are being developed and reviewed.
Customers retain full control over the remediation process. While VDR proposes patches and mitigations, the final decision on implementation rests with the user. This ensures that automated suggestions align with organizational policies and development workflows. The service is designed to work seamlessly with Cloudflare Workers and proxied applications, offering a comprehensive solution for cloud-native environments.
By combining AI-powered discovery with deep production context and automated remediation suggestions, Cloudflare's Vulnerability Discovery and Remediation service represents a significant advancement in proactive cybersecurity. It aims to empower organizations to stay ahead of threats in an increasingly complex and rapidly evolving threat landscape.