Cloudflare Wants to Prioritize Vulnerabilities by Real Exposure, Not Severity Alone#
Finding vulnerabilities is no longer necessarily the main bottleneck for security teams. Deciding which ones need immediate attention is becoming just as important. Cloudflare is targeting that problem with Vulnerability Discovery and Remediation, an early-access Managed Defense service that combines AI-based code investigation with production traffic and security context.
The invitation-only service uses OpenAI Daybreak models, including GPT-5.6 Cyber, for reconnaissance, hunting, and validation against codebases that customers explicitly authorize Cloudflare to inspect.
Code Findings Meet Production Traffic#
The key distinction from a code-only scanner is operational context. Vulnerability Discovery and Remediation pulls information from Web Assets and Cloudflare’s WAF to determine which routes are active, how much traffic they receive, and whether recent security activity is associated with them.
Cloudflare then connects those signals to source-code analysis. A vulnerability sitting behind a heavily used endpoint or one showing signs of active probing can receive a higher priority than an issue with little evidence of current production exposure.
Network context alone does not establish that a vulnerability exists. Cloudflare says every finding still has to be corroborated by evidence in the source code.
GPT-5.6 Cyber is used during reconnaissance, hunting, and validation. Prompts travel from Workers through Cloudflare AI Gateway to OpenAI’s Daybreak models running on OpenAI infrastructure; model inference does not run at Cloudflare’s edge.
From Finding to Checked Mitigation#
Once a finding is validated, the service can recommend a code patch and, when the evidence supports it, propose a custom WAF rule designed to reduce exposure while engineering teams review the underlying fix.
Those proposals do not move directly into a customer environment. Patches and mitigations must pass checks implemented outside the model before Cloudflare’s team validates the output. For edge-defense proposals, Cloudflare checks rule syntax and tests behavior against synthetic fixtures rather than customer traffic.
The model itself cannot apply the patch or rule it generates. Investigations remain semi-automated, and customers review results before deciding whether to test or deploy a change. Cloudflare can deploy certain WAF mitigations only when the customer has explicitly authorized the service to defend the relevant zone.
Conclusion#
Vulnerability Discovery and Remediation reflects a broader shift in AI-assisted security: the objective is not simply to discover more vulnerabilities, but to connect findings with real production exposure and help teams decide what deserves attention first. Combining GPT-5.6 Cyber, source-code evidence, Web Assets, and WAF signals can provide more operational context than severity scores alone. The limitations matter just as much: the service remains in early access, operates only on authorized code and evidence, and keeps technical and human controls around deployment. Its value will depend on how reliably it can turn additional vulnerability discovery into better prioritization and usable mitigations.
Original source: cloudflare