Cloudflare is trying to solve this noise problem by launching early access to Vulnerability Discovery and Remediation, a new component of their Managed Defense suite. Instead of just handing you a list of CVEs, they are integrating code analysis with real-world edge telemetry.
How the AI-driven workflow actually works #
The system relies on the OpenAI Daybreak Defense Network, specifically leveraging models like GPT-5.6 Cyber. The workflow isn't a simple "scan and report" loop; it operates through a multi-pillar pipeline:
Reconnaissance and Hunting: The models scan authorized codebases (Cloudflare Workers or proxied applications) to find potential weaknesses.Contextual Validation: This is the differentiator. The system pulls a snapshot of traffic and security data from Web Assets and the WAF. It checks which routes are active, the volume of traffic they carry, and whether there is recent malicious activity targeting those specific endpoints.Automated Patch Proposing: If a vulnerability is confirmed to be "live" and unprotected, the system proposes both code patches and custom WAF mitigations.Verification: Before a human even sees the suggestion, the system automatically checks the proposed patch to ensure it actually fixes the issue without breaking the logic.
By combining these layers, a generic "high severity" finding gets re-ranked. A vulnerability on a high-traffic, unshielded route with active attack signatures becomes a "fix now" priority, while a vulnerability in a dead code path gets pushed down the list.
Deployment and Control #
It is worth noting that this is an invitation-only service hosted within the Managed Defense ecosystem. While the AI does the heavy lifting of reconnaissance and validation, the human engineer remains the gatekeeper. The system proposes the code and the WAF rules, but nothing is implemented in your production environment without manual approval.
The technical foundation for this is based on an internal "vulnerability harness" Cloudflare uses to secure its own fleet. They’ve essentially productized that adversarial validation pipeline, shifting it from scanning their own infrastructure to scanning customer-authorized code.
For teams struggling with the sheer volume of LLM-generated findings in their security pipelines, this approach moves the needle from "finding everything" to "fixing what matters." It effectively turns a massive pile of raw model output into a prioritized, actionable remediation roadmap.
[GPT-6 Astra is live — but the benchmarks tell a more complicated 2h ago](/en/news/8750/)
[OpenAI is claiming GPT-6 Astra might actually be the start of 3h ago](/en/news/8746/)
The big three LLM providers went down at the exact same time 3h ago
ChatGPT, Grok & Claude: Triple AI Outage Across Platforms 6h ago Sam Altman thinks the current massive data center buildout is 10h ago
The US government might have just handed OpenAI a massive legal 21h ago
Next Nvidia's new PAIR software turns your idle desktop into a local →