See Where Sensitive Data Goes Before You Even Write a Policy! Cloudflare DLP Gets Passive Detection

Hi everyone, I'm Shiichan! Today's news is about Cloudflare's DLP (Data Loss Prevention) tools. Now you can find out what sensitive data is actually flowing through your traffic before you do anything else. Let's take a look!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced Passive Detection, a new feature for Cloudflare Data Loss Prevention (DLP). It analyzes a sampled subset of HTTP request and response bodies from your Gateway traffic and brings the findings together in one dashboard, showing what kinds of sensitive data are present and where they're headed.

The key point: you get these insights without having a Gateway DLP policy in place. Existing Gateway policies keep working exactly as before, so turning this on doesn't change how your traffic is handled.

Why it matters

Until now, DLP required you to decide in advance what sensitive data to watch for, where, and how to handle it, then build a policy around that. In practice, though, teams often don't even know what sensitive data types are flowing through their traffic, or where, before they can design that policy. Passive Detection fills that gap: it's a discovery tool for the stage before policy design.

What changes

From Zero Trust's Insights & Logs > Dashboards, selecting Passive Detection gives you a dashboard with detection totals, a breakdown by data type, policy coverage, and a table of detection entries.

Here's what you can do with it:

• Select a detection entry to trace how it trends over time
• See which destinations (grouped by host and path) that entry's data is heading to
• Check whether each detection is covered by an existing policy (Covered / Partly covered / Not covered)

That lets you understand, concretely, which data types are going where, and where your coverage gaps are, before designing a targeted policy.

Dive Deep

There are a few prerequisites to using Passive Detection:

• Route HTTP traffic through Cloudflare Gateway
• Turn on Gateway HTTP filtering
• Turn on TLS decryption for HTTPS traffic
• Make sure each detection entry you want to scan is enabled in at least one DLP profile in your account (Passive Detection scans entries enabled in any profile in your account, not just the ones selected for a policy)

The dashboard summary shows three metrics: Total detections (counted once per HTTP body), Unique traffic with detections (bodies with at least one detection), and Entries detected (unique DLP entries matched). The detection table lets you compare entries by profile, detection count, number of destinations, confidence (high/medium/low), policy coverage, and last-seen time.

There are also some limitations to keep in mind:

• Scanning covers only a random sample of eligible Gateway HTTP traffic, not everything
• Counts for high-volume detections may be estimated due to analytics sampling
• The dashboard doesn't report total sampled traffic volume or detection rates
• Destinations are scoped to a single detection entry, not an account-wide inventory
• Results don't include user identity

Worth remembering: an empty dashboard doesn't prove sensitive data is absent.

Passive Detection is generally available now, and which detection entries you can see depends on your Zero Trust plan. Full usage details are in the Passive Detection documentation.

Wrap-up

• Cloudflare DLP's new Passive Detection feature surfaces where sensitive data is flowing, even without a Gateway policy
• The dashboard shows destinations, confidence, and policy coverage per detection entry
• It's sampling-based, so it won't catch everything, but it's plenty useful for understanding your traffic before designing policies
• It's generally available now and doesn't affect existing Gateway policies

If you're already running Cloudflare Zero Trust Gateway and have been unsure how to design your DLP policies, this one's for you!