← Thursday, October 8, 2026AgentsCase study

Cloudflare uses a multi-agent harness to triage security alerts

blog.cloudflare.com by Deanna Tran et al. 8 min read Editor score 7/10

Cloudflare's Managed Defense harness gathers evidence, connects detections, and accounts for missing data sources as new alerts arrive, using Clef for initial scoring and external models for deeper analysis. The workflow offers practical design points for agents operating in security workflows.

What

Cloudflare’s multi-agent security operations harness triages alert spikes for Managed Defense analysts.

How

Before model inference, deterministic workflows use versioned API calls to gather identity, detection history, traffic baselines, and enforcement outcomes.

Why it matters

Moving evidence collection and scope enforcement into application code aims to reduce unsupported claims, wrong-scope queries, and ambiguous lookup failures.

Read on blog.cloudflare.com →

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.