Cloudflare has spent years selling organizations the tools needed to protect websites, applications, networks, and employees. Internally, however, the company has taken a markedly different approach: it has replaced most third-party security products with software built by its own teams, increasingly using artificial intelligence to accelerate development and automate work that once required substantial human effort.
The strategy offers an unusually direct glimpse into how a technically sophisticated company believes AI may reshape enterprise cybersecurity. It also comes with an important warning from Cloudflare itself: most organizations should not attempt to copy it.
Cloudflare Chief Security Officer Grant Bourzikas said the company has developed more than 200 autonomous agents to support its internal security operations. Those systems now perform tasks ranging from processing vulnerability reports to helping build specialized applications tailored to Cloudflare’s infrastructure and threat model. The effort has allowed the company to abandon almost all of the external security tools it previously used in favor of internally developed alternatives. (theregister)
This is not simply a cost-cutting exercise.
Cloudflare operates one of the world’s largest internet networks, placing its infrastructure between users and millions of websites, applications, APIs, and online services. That position exposes the company to a combination of security challenges that few conventional enterprises encounter at comparable scale. Standard commercial products may not always provide the flexibility, performance, or integration required to protect such an environment.
Building internally allows Cloudflare to design security systems around its own network architecture, data sources, operational processes, and response requirements. The company can alter those tools quickly, integrate them directly with existing infrastructure, and remove features that would otherwise add cost or complexity without providing meaningful value.
Artificial intelligence has made that model considerably more practical.
One of the clearest examples is Cloudflare’s bug bounty program. Security researchers regularly submit vulnerability reports describing suspected weaknesses in the company’s products and infrastructure. Each submission must be reviewed, checked for duplication, evaluated for credibility, and prioritized before security engineers decide whether it deserves further investigation.
That process once depended heavily on manual labor.
Cloudflare now uses Anthropic’s Claude Sonnet model to review incoming reports, identify potential duplicates, and assess whether a submission is sufficiently credible to warrant human attention. Bourzikas said the system costs approximately $58 per month to operate. By comparison, he estimated that using Anthropic’s more specialized security model, Mythos, for the same workload could cost roughly $200,000 per month. (theregister)
The dramatic difference illustrates a lesson that extends beyond Cloudflare: the most specialized or technically impressive AI model is not necessarily the most appropriate choice for every task.
Bug bounty triage requires language comprehension, classification, comparison, and risk assessment, but it does not always require the most expensive model available. Matching model capability to operational need can be more important than simply purchasing the most advanced option.
Cloudflare’s experience suggests that enterprise AI economics will depend heavily on this kind of discipline.
Organizations adopting autonomous agents must decide which workflows genuinely require advanced reasoning, which can be handled by smaller or cheaper models, and where deterministic software remains more reliable. Without that distinction, AI automation can quickly become more expensive than the manual processes it was intended to replace.
For Cloudflare, the resulting system removes repetitive work from security teams without eliminating human judgment. The AI filters and prioritizes submissions, while experienced specialists remain responsible for investigating credible vulnerabilities and deciding how to respond.
That division of labor reflects a broader transformation across security operations.
Cybersecurity teams have traditionally relied on large collections of commercial products covering endpoint protection, identity, network monitoring, vulnerability management, cloud security, data loss prevention, incident response, and threat intelligence. Each tool generates alerts, dashboards, policies, and operational overhead. Integrating them into a coherent defensive program can require significant engineering effort.
AI-assisted software development may enable some organizations to replace portions of that stack with smaller, purpose-built systems.
Instead of adapting business processes to the limitations of packaged software, companies could increasingly create applications designed around their specific workflows. Security teams might generate custom detection logic, investigation tools, data pipelines, or response automation without waiting for vendors to add the necessary functionality.
Cloudflare’s leadership believes this shift will change the relationship between enterprise customers and software suppliers.
Chief Strategy Officer Stephanie Cohen argued that vendors may move away from simply selling standardized applications. Instead, they could place engineers directly with customers and continuously develop software adapted to each organization’s changing requirements. Under that model, the product would become less of a fixed package and more of an evolving service built jointly by vendor and customer. (theregister)
The concept resembles the growing use of forward-deployed engineers in AI companies and enterprise software providers. These specialists work closely with customers, integrating technology into operational environments and adapting it to specific business problems.
AI makes that approach more scalable because engineers can produce and modify software far faster than through conventional development alone.
Yet Bourzikas cautioned against interpreting Cloudflare’s strategy as evidence of an approaching “SaaS apocalypse.” The company does not believe every bank, retailer, manufacturer, or government agency should replace commercial platforms with internally developed software. Cloudflare’s ability to do so depends on its unusual concentration of engineering talent and its experience building security technology. (theregister)
For most organizations, the economics remain very different.
Developing a security tool is only the beginning. Internal systems must be tested, documented, monitored, patched, integrated, audited, and maintained throughout their entire lifecycle. They must continue working when employees leave, infrastructure changes, regulations evolve, and new attack techniques appear.
Commercial security vendors distribute those costs across thousands of customers. An individual organization building its own platform must absorb them directly.
There is also a significant risk that AI-generated software creates an illusion of simplicity.
Modern coding assistants can rapidly produce functioning applications, but generating code is not equivalent to building a dependable security product. Defensive systems require precise authorization models, secure data handling, resilient architecture, reliable telemetry, careful failure modes, and protection against adversarial manipulation.
A tool may appear successful in normal conditions while failing dangerously during an actual intrusion.
Internally developed security applications also lack some of the external scrutiny applied to widely used commercial platforms. Vendors face customer testing, independent research, regulatory obligations, competitive pressure, and repeated exposure to diverse environments. A private tool may never receive equivalent evaluation.
Cloudflare can mitigate some of those concerns because security engineering sits at the center of its business. A conventional company may lack the expertise needed to recognize weaknesses in the software it builds, particularly when that code is generated quickly with AI assistance.
The strategy also raises questions about how automation is changing technology employment.
Cloudflare recently announced approximately 1,100 job cuts. Cohen linked some of those reductions to roles that no longer made sense as AI enabled greater automation and new forms of customer engagement. She nevertheless predicted that the company’s total workforce could eventually return to its previous level as hiring shifts toward different capabilities. (theregister)
This reflects a more complicated labor transition than the straightforward replacement of employees with machines.
AI can reduce demand for certain repetitive or coordination-heavy roles while increasing demand for people capable of defining systems, supervising autonomous agents, validating output, and translating operational requirements into technical instructions.
Bourzikas suggested that traditional experience alone may no longer determine who is best suited to some technology positions. A recent graduate with strong prompting and AI orchestration skills could, in certain circumstances, be more effective than a developer with five to ten years of conventional experience.
The claim is provocative because cybersecurity has historically placed enormous value on accumulated technical knowledge. Experienced professionals understand how systems fail, how attackers behave, and how apparently harmless design decisions create hidden risk.
Prompting ability cannot replace that judgment.
But AI may change how expertise is applied. The most valuable employee may increasingly be the person who can precisely define a problem, choose an appropriate model, supervise its work, and recognize when the resulting software is unsafe or incorrect.
Cloudflare’s internal transformation therefore represents more than a decision to replace security vendors.
It suggests that enterprise software may become increasingly fluid, customized, and generated close to the point where it is used. Instead of purchasing a tool and adapting operations around it, companies with sufficient technical maturity may build narrower systems that change continuously alongside their business.
That future will not arrive uniformly.
Highly technical organizations may benefit from owning more of their security stack, particularly when their infrastructure differs substantially from standard enterprise environments. Other companies will continue relying on established vendors because the cost and risk of maintaining defensive software remain far beyond their internal capabilities.
The most realistic outcome is likely a hybrid model.
Organizations will retain commercial platforms for foundational functions while using AI to build integrations, automate investigations, customize workflows, and fill gaps between existing tools. Vendors, meanwhile, may increasingly offer adaptable components and embedded engineering support rather than rigid, one-size-fits-all applications.
Cloudflare’s experience shows what becomes possible when a company combines extensive security expertise, large-scale infrastructure, proprietary operational data, and AI-assisted development.
It does not prove that every organization should become its own cybersecurity vendor.
The distinction matters. Artificial intelligence can make software easier to create, but it does not make security easier to guarantee. Cloudflare can replace most third-party tools because building and defending internet infrastructure is already central to its identity. For companies without that foundation, abandoning established security products could exchange vendor dependency for something considerably more dangerous: a defensive system they built quickly, understand poorly, and must protect entirely on their own.