Cloudflare has introduced an early-access service called Vulnerability Discovery and Remediation, folding it into Cloudflare Managed Defense and pairing it with OpenAI Daybreak models to help customers find, prioritize and fix security issues in codebases they authorize for review. The company says the goal is not just to surface more vulnerabilities, but to use real traffic and security context to decide which ones matter most.
Cloudflare Managed Defense adds context-aware vulnerability discovery
The new service is invitation-only during early access and is designed for customers dealing with the familiar problem of triage: a scanner may find thousands of vulnerabilities, but not all of them are equally urgent. Cloudflare’s pitch is that code findings become more actionable when they are linked to live application signals such as active routes, traffic volume, recent attack activity and existing WAF protections.
That context is especially important, Cloudflare argues, because attackers can now use AI to speed up both vulnerability discovery and exploitation. Security teams and developers have less time to assess risk, so the company is positioning its service as a way to narrow the list to the code that is actually exposed and likely to matter in production.
How the Cloudflare vulnerability workflow is supposed to work
Cloudflare says Vulnerability Discovery and Remediation works across Cloudflare Workers and proxied applications. It starts by collecting a traffic and security snapshot from Web Assets and WAF, which shows which routes are active, how much traffic they receive and whether security events are associated with them.
From there, source code vulnerability analysis looks for weaknesses in the authorized codebase. Cloudflare says that analysis alone is not enough to determine priority, because it does not reveal whether the code is deployed, whether it sits behind a heavily used route, or whether protections are already in place. Routes with high request volume are treated as hot paths and receive stricter security profiling.
From reconnaissance to validation
For Workers, Cloudflare says it retrieves the latest source version and configured routes, then maps those routes to Web Assets and request metadata from Workers Observability. That ties the code under review to the endpoints it serves in production and keeps the surrounding network context available during the investigation.
The company’s internal vulnerability harness then takes over. A reconnaissance agent maps request paths to the parts of the codebase that handle them, and hunter agents look for vulnerabilities in those sections while pulling in relevant network context when needed. Cloudflare says the hunters may pay closer attention to code behind active or recently targeted routes, but that context by itself does not prove a vulnerability exists.
Any finding must still be corroborated by evidence in source code. After the hunters return their results, a validation stage checks proposed mitigations and assigns an initial risk rating based on the code. Network evidence can increase that rating if the affected endpoint carries significant traffic or shows signs of active probing.
OpenAI Daybreak models are used for reconnaissance and validation
Cloudflare says the system uses the OpenAI Daybreak Defense Network and OpenAI Daybreak models, including GPT-5.6 Cyber, for reconnaissance, hunting and validation against codebases customers authorize it to access. Prompts are sent from Workers through Cloudflare AI Gateway to OpenAI’s servers, with the responses returning to Cloudflare’s harness so the workflow can continue.
The company says no model inference runs at Cloudflare’s edge, and the model cannot apply any patch or rule it proposes. Instead, every proposal is checked by systems outside the model before it is shown to the customer.
What customers get back
The output is a prioritized list of findings that can include:
- a recommended code patch
- a proposed Cloudflare WAF Custom rule, when the evidence supports one
- an initial risk rating informed by code and network evidence
If a customer has authorized Cloudflare’s VDR to defend the zone, the company says it can deploy WAF rules that are scoped conservatively around the method, path and other request details needed to reach the vulnerable code. If the route pattern only contains variables and wildcards, Cloudflare says it will not suggest a rule, preferring to avoid claims the evidence cannot support.
Why the product is positioned as evidence-based remediation
Cloudflare says the main difference between this service and a traditional scanner is evidence. A static finding might identify a vulnerable handler, but not whether it is deployed, frequently used or already protected. By combining application context, bounded code investigation, automated checks and customer review, the company is trying to make the output more specific and easier to act on.
The company also points to its own internal work on “Build your own vulnerability harness,” describing this new service as an extension of the system it uses to scan its own fleet and validate findings before engineers trust the results. In that internal setup, the harness helps turn model output into fixes at fleet scale. Vulnerability Discovery and Remediation applies the same approach to customer-authorized code.
Controls, checks and customer oversight
Cloudflare says the process is deliberately bounded. Before any investigation begins, it limits the scope to the source code and evidence the customer has authorized. It also removes information the investigation does not need and applies the redaction controls configured for the engagement.
Tool access is logged and checked against the investigation’s access policy before it runs, and every patch or rule proposal must pass checks implemented outside the model. If a check fails, the workflow stops before the proposal reaches customer review. Even after validation, Cloudflare says nothing is changed in the customer environment unless the customer decides to act on it.
Validation before presentation
For an edge-defense recommendation, Cloudflare says it validates rule syntax and runs the rule against synthetic fixtures that represent expected requests, rather than against customer traffic. If the check fails or the result remains unclear, the output is held back and routed for diagnosis.
That means the service is semi-automated, but not fully autonomous. Cloudflare presents the output, but the customer remains in control of whether code patches are implemented or WAF changes are tested and deployed.
Early access is limited to selected customers
Vulnerability Discovery and Remediation is available only to selected customers by invitation during early access through Cloudflare’s Managed Defense team. Each engagement starts with one application whose codebase the customer authorizes the company to investigate.
To connect findings to production, Cloudflare says it uses authorized read access to the Web Assets operation inventory, relevant WAF controls and Workers Trace Events Logpush where available. The company says customers review every result before deciding whether to test or deploy a change.
For security teams overwhelmed by large vulnerability lists, the appeal is straightforward: less noise, more context and a path from finding to mitigation. Whether that approach proves valuable will depend on how well Cloudflare’s traffic signals and model-assisted validation hold up in real customer environments.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: September 5, 2026 at 1:54 am
3 views
