CONCEPT Cited by 1 source

Positive security model

Definition

A positive security model defines what valid traffic looks like and rejects everything that does not conform — the inverse of the traditional negative model (block known-bad signatures, permit everything else).

In API security, this means describing every valid request shape (from an OpenAPI spec or learned from observed traffic) and dropping anything that doesn't fit. The model is fundamentally resilient to novel attack variants because the attacker must produce a request that is valid, not merely one that avoids known-bad patterns.

Why it matters for frontier-model threats

Frontier AI models can generate thousands of novel payload variants in seconds. Against a negative (signature-based) model, some variants may slip through rules that haven't been written yet. Against a positive model, all variants fail unless they happen to be valid requests — the volume advantage is neutralised.

Production shape (Cloudflare API Shield)

Cloudflare's API Shield implements the positive model: either from the API's own definition or learned from real traffic, it builds a schema of valid requests per endpoint. Anything non-conforming is dropped before reaching the origin.

(Source: sources/2026-06-09-cloudflare-defend-against-frontier-cyber-models)

Seen in

• sources/2026-06-09-cloudflare-defend-against-frontier-cyber-models — "instead of trying to anticipate every bad request, we describe what a valid request to each API looks like… and anything that doesn't fit doesn't get through"