Cloudflare puts vulnerability hunting inside the codebase: no finding without evidence in the source
Cloudflare Managed Defense now offers vulnerability discovery and remediation that reads source code alongside production traffic and security signals. The bar is explicit: every finding must be corroborated by evidence in the source code. Reconnaissance and validation use OpenAI's GPT-5.6 Cyber, wi
Cloudflare has announced vulnerability discovery and remediation for Managed Defense, its enterprise security service. It reviews a customer's source code alongside production traffic and security signals, ranks findings by evidence of real exposure, and proposes code patches and WAF mitigations. The decision to apply them stays with the customer. The post went up on 3 September; access is invitation only for now.
The evidence rule
Cloudflare states the bar in one sentence: "Every vulnerability finding has to be corroborated by evidence in the source code." In the example the post opens with, the problem is not the count: a scan produces 4,000 new vulnerabilities and 78 criticals, and the team cannot tell which are actually reachable. Large language models, the company says, can surface weaknesses across a codebase in minutes; what is missing is tying that list to evidence of exposure.
What it reads
- The Web Assets inventory, with authorized read access
- WAF controls and rules
- Workers Trace Events Logpush, where available
- Traffic metadata and security event snapshots showing active routes and triggered detections
- Source code, within the scope the customer authorizes
Where the model runs
Reconnaissance, hunting and validation use OpenAI's Daybreak models, specifically GPT-5.6 Cyber. Cloudflare writes that inference runs on OpenAI's servers through Cloudflare AI Gateway, not at Cloudflare's edge. The model cannot apply the patch or rule it proposes.
For the corporate reader
This is an attempt to move from "scan and file a thousand findings" to "corroborate and prioritize", which is the right question for teams living with alert fatigue. The other half of the decision sits in the contract: source code leaves for a third-party model within an authorized scope. The questions to ask are which repository, for how long, and with what retention. Cloudflare has said plainly where inference runs; the rest depends on your own data classification.
Sources
- Primary source: Cloudflare blog, 3 September: blog.cloudflare.com/vulnerability-discovery-remediation
- Cloudflare Managed Defense
- OpenAI on putting frontier cyber models in more trusted hands
