Intel / post

Your scanner just flagged 4,000 vulnerabilities.

Source: x.com
Date: Published Sep 3, 2026

Thread · 6 parts

Your scanner just flagged 4,000 vulnerabilities. 78 are critical. Which one do you fix first? We built a service that answers that question using production evidence. Early access starts today. (1/6) https://t.co/TkfTWPq5Lk

Sep 3, 2026

The problem: Your scanner tells you there's a vulnerability in a handler. It doesn't tell you whether that code is deployed, whether anyone is hitting that route, what security activity surrounds it, or what controls you already have in place. (2/6)

Sep 3, 2026

Cloudflare sees the other side. We see which routes are active, how much traffic they carry, and what security events surround them. We see what WAF rules are already applied and actively blocking attacks. That context turns a generic finding into a specific priority. (3/6)

Sep 3, 2026

Built on three pillars: • Our vulnerability harness (the one we use internally) • Web Assets for production operations • WAF for edge defense • Powered by GPT-5.6 Cyber via @OpenAI's Daybreak Cyber Partner program (4/6)

Sep 3, 2026 View on X

Read the full thread on X

Context

Cloudflare describes a new triage service that takes a vulnerability scanner's raw findings, using its own example of 4,000 flagged issues with 78 marked critical, and ranks them using signals a scanner cannot see: whether the flagged code is actually deployed and receiving traffic, what security events surround that route, and which WAF rules are already blocking related attacks. The service is built on Cloudflare's internal vulnerability plus its Web Assets and WAF products, and for the AI analysis it uses OpenAI's GPT-5.6 Cyber model through OpenAI's Daybreak Cyber Partner program, which Cloudflare and OpenAI describe in more detail in a joint post the same day.

Once a finding is prioritized, the service can propose a WAF custom mitigation to block the issue at the edge or hand an engineer a source-code patch. Cloudflare says nothing is deployed until a person reviews and approves it. Access is invitation-only through Cloudflare's Managed Defense team, covering Cloudflare Workers and proxied applications.

Terms in this piece · Glossary

agent harness — The scaffolding around a model that turns it into a working agent — the loop, the tools it can call, and the rules for when to stop.

Read the source x.com