Evidence First, Then AI: Inside Cloudflare Managed Defense's Agentic Security Harness

Hi, it's Shii-chan! Today is about designing AI agents you can actually trust.

Cloudflare Blog blog.cloudflare.com

What was announced?

The Cloudflare Blog describes how Cloudflare Managed Defense uses a team of specialized AI agents built on Workers and global network telemetry to analyze security alerts. It separates deterministic evidence collection from model inference to deliver grounded recommendations to Managed Defense Analysts. The output is an advisory that analysts review and decide on.

Why it matters

The post says a single agent produced several problems.

• Unsupported claims
• Detections blurred with proof
• Drift in scope
• Hidden failed lookups

So evidence collection and scope enforcement now run in application code before any model sees data.

What changes

Analysts get recommendations backed by evidence whose citations have been checked, not just model guesses. Recommendations can include rate-limiting rules, WAF custom rules, or DDoS changes. For fully managed customers analysts apply them, and others see them in the dashboard or alert path.

Dive Deep

The pipeline looks like this.

• Deterministic recon: versioned API workflows collect the customer's identity, detection history, traffic baseline, enforcement outcomes, and network observations, stored with source, version, and timestamp so runs can be replayed
• Lightweight triage: Clef, running on Workers AI, scores each alert for likelihood of being a false positive. Known high-volume noise is marked passive and kept out of the active queue
• Specialist analysis: a coordinator runs four specialist agents in parallel
• Synthesis: a synthesis agent combines typed findings into one advisory. It cannot fetch new evidence or pick a classification outside the approved vocabulary
• Decision scoring: Clef scores whether evidence is sufficient and consistent, then picks from a reduced list of classifications

The four specialists are:

• Traffic analysis: request behavior, historical changes, enforcement
• Customer context: prior alerts, dispositions, analyst decisions
• Global telemetry: privacy-preserving, aggregate Internet-wide signals
• Threat intelligence: indicators already attached to the alert or case

Before analysis, a versioned evidence package is built, and specialists must cite items in it. Application code checks that each citation exists, belongs to the investigation, and supports its claim. Invalid findings are corrected or recorded as limitations.

The Cloudflare products involved:

• Workers: admit evidence and validate results
• Workflows: coordinate stages and save completed work, so a failed stage reuses validated results
• D1: investigation and advisory state
• R2: bounded context and evidence artifacts
• Durable Objects: case-chat state, built with Flue
• AI Search: enriches case chat

Other design decisions:

• Detections are treated as hypotheses, and models are told whether a pattern has a benign track record
• The advisory distinguishes "not checked," "checked with no match," and "checked with evidence of absence"
• Without sufficient evidence, no classification or disposition is recommended
• The global telemetry specialist sees only aggregates, never other customers' records or identities
• Models have no authority to cross tenant boundaries or act for analysts

The post reports no measured gains in time saved or accuracy. As for status, an early beta is available for eligible application-security alerts and cases, and planned work includes a Custom Managed tier and continuous agents that watch traffic for patterns fixed rules might miss.

Wrap-up

• Evidence collection is deterministic code, and judgment is left to models
• Four specialist agents run in parallel, and a synthesis agent combines the results
• Citations are verified by code, and no recommendation is made without enough evidence
• Built on Workers, Workflows, D1, R2, and Durable Objects
• An early beta is available

This is a great read for anyone putting AI agents into security operations or studying how to make agents reliable!