User Risk Scoring now catches high-risk browsing with Gateway DNS signals!
Hey everyone, it's me, Shii-chan! Today I found an update that security folks are going to love.
Cloudflare Changelog
developers.cloudflare.com
What was announced?
Over on Cloudflare's Changelog, there's an update to Risk Score (User Risk Scoring). Starting now, it pulls direct signals from Gateway DNS traffic patterns, so a user's risk score automatically climbs when they visit high-risk or malicious domains.
The story so far
Until now, risk scoring had a fairly limited set of signals for judging a user's suspicious behavior. But which sites someone visits is actually a key sign of a possible compromise.
What changes
By tying Gateway DNS logs to individual users, admins can now spot people interacting with dangerous domains. Here's the nice part: even if a Gateway policy is set to Block the traffic, the interaction is still captured as a "hit." So it's not "we blocked it, all good" — the very attempt to go there shows up in the user's risk profile.
Dive Deep
Two new risk behaviors are now available in the dashboard:
- Suspicious Security Domain Visited: fires when a user visits a domain in the security threats or security risk categories, like malware, phishing, or C2 (command-and-control).
- High risk domain visited: fires when a user visits domains categorized as questionable content, violence, or CIPA.
Want the details? Check out the User Risk Scoring documentation.
Wrap-up
- User Risk Scoring now ingests Gateway DNS signals
- Visiting dangerous domains automatically raises the risk score
- Blocked traffic still counts as an "attempt"
- Two new behaviors: "Suspicious Security Domain Visited" and "High risk domain visited"
If you're a security team running Zero Trust on Cloudflare One, this one quietly makes your visibility a lot sharper!
