SYSTEM Cited by 1 source

Cloudforce One

Overview

Cloudforce One is Cloudflare's threat intelligence, research, and operations team — sits within the Cloudflare security organisation. It turns what Cloudflare sees across its network (~20% of global web traffic) into actionable intelligence: tracked adversaries, emerging campaigns, and indicators of compromise (IOCs).

Architectural role

The key contribution is closing the gap between knowing a threat exists and blocking it in production. Traditional threat-intel lifecycle:

threat report → feed → company ingests feed → deploys defence

Cloudforce One shortens this: intelligence is generated from the same network that enforces defences. Cloudflare customers can now use Cloudforce One threat intelligence directly within the WAF to block high-risk traffic — no intermediate feed-ingestion step.

Network-scale advantage

Cloudflare's visibility (~1/5 of web traffic) means the team sees payload mutations, pattern upticks, and attacker-tooling shifts in real time — before they appear in public feeds or advisory databases.

(Source: sources/2026-06-09-cloudflare-defend-against-frontier-cyber-models)

Seen in

• sources/2026-06-09-cloudflare-defend-against-frontier-cyber-models — "Cloudforce One… turns what we see across the network into insights the rest of the stack can act on"