Cloudflare Managed Defense beta: how its AI alert reviews work

Cloudflare announced an early beta of AI-assisted alert reviews in Managed Defense on October 7, 2026, and updated the post on October 8. It covers only eligible application-security alerts and cases. Fixed code gathers the evidence before any model runs. Cloudflare's own Clef model scores each alert, and likely false positives skip the deeper review. Alerts that need more work go to four specialist agents, and code checks every citation they make against a locked evidence package. A synthesis agent writes one advisory. A Managed Defense Analyst still makes the decision and owns any mitigation. Nearly everything below comes from one source: Cloudflare's engineering post, "Building an evidence-grounded agentic security operations harness on Cloudflare" by Deanna Tran and Blake Darché.

What Managed Defense is

Managed Defense is Cloudflare's expert-led monitoring and response service. On its product page, Cloudflare says its Cloudforce One engineers monitor customer environments around the clock, write detection rules, and recommend and implement mitigations. The page promises that "every alert is triaged within 30 minutes," and offers a "< 30-minute response SLA" on urgent incidents. Supported products listed there:

• Core applications: DDoS, Rate Limiting, WAF, Bot Management (beta), Turnstile (beta)
• Network: Magic Transit, Cloudflare Network Firewall, Advanced TCP & DNS protection

The AI beta adds a layer to how these analysts handle alerts. It does not replace them.

Why Cloudflare dropped the single-agent design

The post opens with a failed prototype. "Our first prototype showed the limits of one general-purpose agent," the authors write. Given a whole investigation in one prompt, the agent "hallucinated claims the evidence did not support." Cloudflare lists three problems with that design:

• Detection treated as proof. "A detection is a hypothesis, not proof that an exploit succeeded or an attack occurred," and one broad agent blurred the two.
• Scope drift. An agent "can query the wrong account, time range, or source," and "you can't rely on a language model prompt to be a boundary."
• Hidden failures. When a lookup timed out, the result might not tell "not checked" apart from "checked and not found."

Every later design choice targets one of these three problems.

Step 1: reconnaissance runs before any model

Deterministic code runs fixed workflows built on versioned API calls. These collect the customer's identity, detection history, traffic baseline, enforcement outcome and network observations. Each item is stored with its source, version and timestamp. Cloudflare says the snapshot can be replayed. So when two specialists disagree, the cause is how they read the evidence, not different inputs.

Recon also records each alert's track record: how often it fired, how many times it was dismissed as a false positive, and what analysts concluded. Related alerts are grouped into cases. The code joins and correlates the data, but analysts confirm the real scope of a case.

Step 2: triage with Clef

A lightweight model scores each alert against the recon data. It considers prior detections, earlier analyst decisions and whether the traffic looks human. That model is Clef, which Cloudflare calls its "open-source decision model," running on Workers AI. Cloudflare released Clef on October 1, 2026, under Apache 2.0. Clef does not generate text. It reads an input and a set of typed questions, then returns a probability for each allowed answer. The 27B Clef and the 9B Clef-flash are both on Workers AI.

Alerts that score as likely false positives skip the specialist agents. Known high-volume noise "is deterministically classified as passive when it arrives". It stays available as context but never enters the active queue.

Step 3: four specialists in parallel

For alerts that need deeper review, a coordinator runs four specialist agents at once:

The global telemetry specialist draws on aggregate patterns from Cloudflare's CDN, WAF, DDoS, Turnstile, Rate Limiting and Cloudforce One threat intelligence. Cloudflare says it works only with aggregates and never sees another customer's individual records or identity. A pattern that is common worldwide is weighed against the customer's own history. It does not automatically mean a broad campaign.

For extra context, the post says Cloudflare uses "the OpenAI Daybreak Defense Network and our partnership with Anthropic," including the models GPT-5.6 Cyber and Mythos.

Step 4: the evidence package and citation checks

Before analysis starts, the system builds a versioned evidence package. It holds the investigation's subject, scope and time anchor, plus the admitted evidence, policy versions, sources and coverage gaps. Specialists can only cite items from that package. Application code then checks three things for every citation:

1. The cited item exists.
2. It belongs to this investigation.
3. It supports the claim attached to it.

Findings that fail are corrected or recorded as limitations. This is the fix for scope drift: the boundary is enforced in code, not left to the prompt.

Step 5: scoring, synthesis and "not enough evidence"

Clef runs a second time to judge whether the evidence is sufficient and whether it contradicts itself. It then picks from "a deterministically reduced list of attack classifications and dispositions." A synthesis agent merges the specialists' typed findings into one advisory. It cannot fetch new evidence or choose a classification outside the approved vocabulary.

The advisory separates three states:

• Not checked
• Checked, with no matching result
• Checked, with evidence supporting absence

If the evidence is insufficient, the system makes no classification or disposition recommendation at all. This fixes the hidden-failure problem: a timed-out lookup can't pass as a clean result.

Who acts on the advice

Suggested actions can include a rate-limiting rule, a WAF custom rule or a change to DDoS protection. For fully managed customers, Managed Defense Analysts can apply these themselves. Other customers get recommendations in the dashboard and through their chosen alert path. In both cases, Cloudflare says, "the Managed Defense Analyst remains responsible for the decision and any mitigation."

What it runs on

According to the post, Workers handle evidence admission and validation. Workflows coordinates the stages and saves finished work so a failed stage can resume. D1 stores investigation and advisory state, and R2 holds context and artifacts. Durable Objects keep case-chat state, Flue powers the chat, and AI Search enriches it.

Questions to ask of any AI alert-review tool

The design suggests a checklist for security teams comparing similar products:

• Is evidence collected before inference, and can it be replayed? If not, disagreements between runs can't be traced.
• Are citations checked by code? A prompt telling the model to cite sources is not a check.
• Does the tool separate "not checked" from "found nothing"? Missing data should show up as a gap, not as a negative result.
• Can the model abstain? An explicit "insufficient evidence" outcome is safer than a forced label.
• Who approves a mitigation? Find out who owns the final action, and whether the vendor's staff or your own team applies it.

Availability and what's next

Cloudflare says "the early beta is available in Cloudflare Managed Defense for eligible application-security alerts and cases." Customers on WAF, DDoS protection, Magic Transit or another supported product are told to contact their enterprise account team about adding Managed Defense. Over the next few quarters, Cloudflare plans to add a "Custom Managed" level with more per-organization flexibility. It also plans to explore continuous AI agents that monitor Cloudflare traffic for patterns fixed rules and thresholds may miss.

Limitations: this account rests on Cloudflare's own post, which gives no alert volumes, accuracy figures, time savings, pricing or independent test results for the beta.