# AI-Powered Vulnerability Discovery and Remediation: How Cloudflare Helps Teams Prioritize and Fix Critical Code Weaknesses
## The Problem: Too Many Findings, Not Enough Time
Security scanning tools have become remarkably efficient. Modern scanners can now surface thousands of potential weaknesses across a codebase in mere minutes. But efficiency without context creates a new bottleneck: engineering and security teams are left staring at massive lists of alerts with no clear picture of which vulnerabilities actually matter, which ones are reachable in production, and which ones attackers are most likely to exploit.
Traditional vulnerability scanners often flag issues without answering fundamental questions. Is this vulnerable code actually deployed? Is the affected endpoint receiving real traffic? Has there been suspicious activity targeting this route? What protections are already in place around it? Without these answers, prioritization becomes guesswork, and the most dangerous flaws can easily get buried beneath hundreds of lower-risk findings.
To address this gap, Cloudflare has introduced **Vulnerability Discovery and Remediation** — a new, invitation-only service now part of Cloudflare Managed Defense. The service is designed to help customers detect vulnerabilities in their codebases, understand their real-world exposure, and receive tailored remediation recommendations, all while keeping the customer firmly in control of what gets changed.
## How the Service Works
### Combining Code Analysis with Production Context
The core innovation of this service is its ability to merge static code analysis with live production data. When a customer opts in, the service begins by collecting a snapshot of traffic and security telemetry from the customer’s web assets and Web Application Firewall (WAF) configurations. This snapshot reveals which routes are actively serving traffic, how much load they handle, and whether there have been recent security events tied to them.
Routes that receive high volumes of requests — often referred to as “hot paths” — are flagged for deeper scrutiny. The service then pulls in source code vulnerability analysis to identify potential weaknesses, but critically, it maps those code-level findings back to the specific endpoints they affect in production. This contextual layer transforms a generic scanner alert into an evidence-backed security priority.
For customers running Cloudflare Workers, the service goes a step further. It retrieves the most recent version of the Worker source code and its configured routes, then ties that source to the endpoints it actually serves in production using observability data. This means every finding comes with a clear picture of its real-world attack surface.
### AI-Driven Discovery Pipeline
Once the production context is gathered, the service deploys an AI-powered investigation pipeline. A reconnaissance agent first maps incoming request paths to the relevant sections of the customer’s codebase. Specialized hunting agents are then dispatched into those code sections to probe for vulnerabilities, pulling in network context along the way to focus their attention on high-traffic or recently targeted endpoints.
Importantly, the AI agents treat the code, logs, and request metadata they receive as evidence to inspect — not as instructions to follow. Every vulnerability finding must be corroborated by concrete evidence in the source code. A pattern is only flagged as a weakness if it meets a strict evidentiary standard.
### Automated Validation Before Anything Reaches You
Before any finding is presented to the customer, it goes through a rigorous validation stage. The service automatically checks every proposed code patch and any accompanying WAF mitigation rule to ensure correctness. For WAF rules, this includes validating syntax and testing the rule against simulated request fixtures — not against live customer traffic.
The model itself runs entirely within Cloudflare’s infrastructure. Prompts are sent from Cloudflare Workers through Cloudflare AI Gateway to the underlying AI models on external servers. No model inference happens at the network edge, and the model cannot directly apply any patch or rule it suggests. Every tool call is logged and checked against the investigation’s access policy before it executes. If any automated check fails or produces an ambiguous result, the output is held back and routed for manual diagnosis.
The result is a prioritized list of vulnerabilities, each accompanied by a recommended code fix and, when the evidence supports it, a Cloudflare WAF custom rule that can be deployed to reduce exposure while the code patch is being reviewed and shipped. WAF rules are scoped conservatively — limited to the specific HTTP methods, paths, and request characteristics needed to reach the vulnerable code — and rules are never suggested for route patterns that contain only variables and wildcards, since claiming a connection the evidence cannot support would be worse than missing one.
### The Customer Always Decides
Throughout the entire workflow, the customer retains full control. The service proposes patches and mitigations, but the final decision about whether to implement them rests entirely with the customer’s engineering team. The process is semi-automated by design: it accelerates discovery and prioritization, but every result is reviewed and approved by a human before any change reaches production.
## Why This Matters Now
The speed at which AI can now analyze codebases means that the volume of vulnerability findings is growing rapidly. At the same time, attackers are also leveraging AI to accelerate their own discovery and exploitation workflows, compressing the window of time that security teams have to identify what matters and act on it.
This service is built to counter that asymmetry. By combining code-level analysis with production telemetry, it answers the questions that traditional scanners leave unanswered — turning a flood of generic alerts into a targeted, evidence-backed remediation roadmap.
## Getting Started
Vulnerability Discovery and Remediation is currently available to selected customers by invitation during early access through Cloudflare’s Managed Defense team. Each engagement begins with one application whose codebase the customer authorizes the service to investigate. To enable production context, the service uses authorized read access to the customer’s web assets inventory, WAF controls, and Workers Trace Events Logpush where available.
Organizations interested in learning more can reach out to their Cloudflare account team to inquire about participation.
—
## Frequently Asked Questions
**Q: What types of applications does this service support?**
A: The service works across Cloudflare Workers and proxied applications. It is designed to analyze the code that runs behind Cloudflare’s edge and connect findings to the routes those applications serve in production.
**Q: Does the AI model get access to all of my code?**
A: No. The investigation is scoped strictly to the source code and production evidence that the customer explicitly authorizes. Before any context reaches the model, the service removes data that is not relevant to the investigation and applies the redaction controls configured for the engagement.
**Q: Will the AI automatically push code changes or WAF rules to my environment?**
A: Absolutely not. The model cannot apply any patch or rule it proposes. Every finding, patch, and WAF rule goes through automated validation checks and manual review by Cloudflare’s team before it is ever presented to the customer. The customer makes the final decision about whether to test or deploy any suggested changes.
**Q: How are vulnerabilities prioritized?**
A: Prioritization is based on a combination of factors: the severity of the code-level weakness, the production exposure of the affected endpoint (including traffic volume), and signs of active security events such as recent attack attempts. A vulnerability in code that receives heavy traffic and shows probing activity will rank higher than an identical code flaw in an unused route.
**Q: What happens if a WAF rule is incorrectly scoped or misses the right connection?**
A: The service is conservative with rule suggestions. If a route pattern contains only variables and wildcards — making it impossible to confidently link a rule to a specific code path — no rule is suggested. The service would rather not propose a rule than make a claim that the evidence cannot fully support.
**Q: Is this service available to all Cloudflare customers?**
A: No. Vulnerability Discovery and Remediation is currently in early access and available by invitation only, managed through Cloudflare’s Managed Defense team. Interested customers should contact their Cloudflare account representative for more information.
**Q: How does the AI model get its context during an investigation?**
A: The model receives a curated set of information drawn from the authorized codebase, production telemetry, and security event data. This context is used by the reconnaissance and hunting agents to map request paths to code sections and to assess the relevance of potential findings. The model itself does not pull additional data on its own — all tool calls are logged and gated by the investigation’s access policy.
—
## Conclusion
Vulnerability Discovery and Remediation represents a significant evolution in how teams approach code security. Rather than treating vulnerability scanning as a passive, volume-driven exercise, this service bridges the gap between static analysis and dynamic production context. By combining AI-powered code investigation with real-time telemetry from traffic patterns, attack activity, and existing WAF protections, it delivers a prioritized, evidence-backed view of what truly matters — and gives teams the tools to act on it with confidence.
The philosophy behind the service is straightforward: speed up discovery, ground every finding in evidence, validate every recommendation automatically, and always leave the final call in the hands of the people who own the code. In an era where both defenders and attackers can leverage AI at scale, that disciplined, human-centered approach may be the most important differentiator of all.
Thank you for reading
