Introducing Precursor: detecting agentic behavior with continuous client-side signals

Cloudflare's Precursor adds behavior between security checkpoints to its assessment of whether a visitor is automated. An injected script collects signals such as pointer movement, interaction timing, focus and page visibility throughout a session. Server-side evaluators combine them with existing bot detections, rather than relying only on a login or checkout challenge. The announcement describes it as an optional Enterprise Bot Management feature.

Cloudflare says keyboard signals capture timing and rhythm rather than the keys pressed. The intended benefit is a richer basis for detecting automation across a visit; the announcement supplies no measured accuracy or false-positive rate.

“At the network level, we analyze over 1 trillion requests per day to understand reputation, patterns, and anomalies across more than 20% of the web.”

“Today, Turnstile runs nearly 3 billion times per day on some of the most sensitive endpoints on the Internet, helping verify users at key moments like login, signup, and checkout.”

“What remains difficult to replicate is consistent human behavior over time.”

“Session scoping is important because it means a bot cannot reset its behavioral signature by refreshing the page or starting over with a new challenge.”