Surprise Behavior Analysis! Cloudflare's Precursor Exposes Bots Completely!

Hey everyone, it's Shiichan! Cloudflare's latest security announcement was so interesting that I just have to share it with you.

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare's Blog announced Precursor, a new continuous behavioral validation engine for Bot Management. It watches a user's behavior across an entire session, from arrival to departure, to tell humans and bots apart. It complements Turnstile and becomes available as part of Enterprise Bot Management.

Why it matters

Traditional bot defenses have mostly relied on one-shot checkpoints like CAPTCHAs. But today's bots can drive a real browser and execute JavaScript, so they can slip past individual challenges. What's still hard for bots to fake, according to Cloudflare, is consistent "human" behavior sustained across an entire session. Precursor is built to close that visibility gap.

What changes

Once you enable Precursor, a lightweight, obfuscated script is automatically injected into HTML responses — no extra configuration, network connections, or third-party embedding required — and it starts collecting pointer movement, keyboard activity, focus changes, and visibility events. That data is run through multiple evaluators at the edge that cross-check the signals, for example confirming that pointer activity correlates with how long the page was visible, or that keyboard events only fire while a text field is focused. Because data accumulates throughout the session, a bot can't just reset its "fingerprint" by refreshing the page.

Dive Deep

Cloudflare highlights mouse movement as a good example of what it looks at.

• Human hands are constrained by wrist range of motion and forearm rotation, so movement traces clean arcs
• There's a measurable cognitive delay between seeing something and clicking it
• Natural hand tremor adds a subtle physiological wobble

Bots, on the other hand, tend to give themselves away with linear interpolations or mathematically perfect Bézier curves — being too precise is what exposes them.

Privacy is also considered: keyboard input is recorded only as timing and rhythm, not the actual keys pressed, and evaluation happens on aggregate patterns rather than individual actions.

For analysis, Precursor also ships session-based Security Analytics dashboards that can answer questions like "What does a typical session on my site look like?" and "Which sessions show signs of automation over time?"

Precursor is rolling out now and will be free to use until its GA release later this year. You can enable it from the dashboard, and choose between a background-observation mode and a mode that enforces challenge verification. For context, Cloudflare processes over 1 trillion requests a day — more than 20% of the entire web — and Turnstile alone runs nearly 3 billion times a day.

Wrap-up

• Cloudflare announced Precursor, a new continuous behavioral validation engine for Bot Management
• Instead of a one-shot check like a CAPTCHA, it continuously watches session-wide behavior to tell humans and bots apart
• It combines multiple "human" signals: the physical constraints of mouse movement, cognitive delay, and hand tremor
• It also ships session-based Security Analytics dashboards, and is rolling out now for free ahead of GA

If sophisticated automation or agent-like traffic has been giving your security team headaches, and you use Bot Management, this is a launch worth checking out!