The news
Cloudflare (NET) on September 29 made Cloudflare Threat Signals, a new tool that uses AI to read public security research and pull out indicators of attacks, free for every Cloudflare account, according to a company blog post.
The tool runs on what Cloudflare calls agentic skills, sets of detailed instructions meant to capture how an experienced analyst handles one part of the job. It monitors RSS feeds of threat research, fetches each article, summarizes the report and extracts indicators, the telltale details such as malicious infrastructure, phishing campaigns, malware families or vulnerabilities that defenders can act on. It then normalizes those indicators, tags them using the account's own labels and keeps a link back to the source report.
PPC Land, which reviewed the launch on September 29, reported that the pipeline polls feeds through Cloudflare Workflows, converts articles with its Browser Run service and stores text in its R2 storage. The system records whether each tag was applied automatically or by a person, and it limits tags to each account's existing catalog, one of several design choices PPC Land said came out of Cloudflare's testing.
Every account gets dashboard and API access to Threat Signals, the ability to select one RSS feed, and a private dataset built from that feed and stored for up to 30 days. Free users can also investigate the resulting events, indicators and tags in Cloudflare's Threat Events Platform, part of its Cloudforce One threat intelligence unit.
Cloudflare's Essentials, Advantage and Elite enterprise tiers unlock more RSS feeds, Cloudforce One's proprietary datasets, custom skills, longer storage and custom web application firewall (WAF) rules built from open-source and proprietary threat events. The blog says indicators can be applied in a WAF policy, but it attributes custom WAF rules only to the enterprise tiers, a gap PPC Land also flagged. The post does not name the AI model behind the skills or give accuracy, error-rate or volume figures.
The numbers
- Price for every Cloudflare account
- Free
- RSS feeds on the free tier
- 1
- Free-tier dataset retention
- Up to 30 days
- Paid tiers with expanded features
- 3 (Essentials, Advantage, Elite)
- Feed formats supported
- RSS 2.0, Atom, RSS 1.0/RDF
Why CEOs should care
For CISOs and security operations leads, the free tier is a low-risk way to test whether AI can take over the tedious part of threat research: reading reports, pulling out indicators and filing them in the right format. Pick the one feed your analysts read most, run it for a few weeks and compare the output with what your team would have extracted by hand. Because Cloudflare has published no accuracy data, keep a human check in place before any extracted indicator is used to block traffic. A wrong IP address or domain on a block list can cut off real customers.
There is also a security question worth raising with Cloudflare directly. Threat Signals reads content from the open web, and public pages can be written by anyone, including attackers. Ask how the system handles reports that contain misleading indicators or hidden instructions aimed at the AI, since the blog post does not address it.
For CFOs heading into budget reviews, read the tiers carefully before treating this as a replacement for paid intelligence. The free version processes one public feed you choose. Proprietary Cloudforce One data, more feeds and custom WAF rules sit in the enterprise plans. The fair comparison is the cost of those tiers against current feed subscriptions and analyst hours, measured after a pilot, not before.
The bigger picture
Cloudflare is folding threat intelligence into the same platform that already filters its customers' web traffic, which shortens the path from reading about an attack to blocking it. That convenience also concentrates more of a company's defenses with one vendor, so buyers should ask how easily indicators and datasets can be exported to other tools. The Cloudflare post does not mention support for common intelligence-sharing formats such as STIX. The launch landed the same day as other Cloudflare security announcements, including its plan to become a public certificate authority.
What’s next
Watch whether Cloudflare publishes accuracy data for its extraction skills, clarifies what free accounts can do with WAF policies, and adds export formats that let the output feed other security tools. For now, the free tier is best treated as a trial run for automating analyst reading time.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
Companies in this story
