Cloudy AI enhances threat analysis and response for security teams

2025-08-29 | 5 min read

Security teams often struggle with the sheer volume of data needed to detect threats, which can slow down response times. Cloudflare has addressed this challenge by integrating Cloudy, its first AI agent, with security analytics and Cloudforce One threat intelligence. This enhancement allows users to quickly analyze threats like APTs, DDoS attacks, and cybercrime through a conversational interface, making investigations faster and more intuitive.

A New Conversational Interface for Faster Threat Analysis

Cloudy’s new chat interface enables users to perform root cause analysis (RCA) by asking questions in natural language. For example, users can start with broad queries like:

• "What caused this traffic spike?"
• "Focus on login endpoints only."
• "Are any of these IPs known to be malicious?"

This feature eliminates the need for complex queries and dashboard navigation, streamlining the process from detection to mitigation.

Since its launch in March, Cloudy has been adopted by 54,000+ users, with 31% deploying its suggested custom rules. In Cloudflare Gateway, Cloudy’s log explainers have been used 30,000+ times in the past month, with 80% positive feedback.

Leveraging Global Threat Intelligence

Cloudy now integrates with Cloudforce One’s Threat Events platform, which provides real-time data on adversary activity, including:

• APT infrastructure
• Cybercrime groups
• Compromised devices
• DDoS attacks

Users can query this dataset to uncover threats relevant to their industry or region. Examples include:

• "Who is targeting my industry vertical?"
• "What are the top IOCs to block right now?"
• "How has this adversary progressed over time?"

Powered by Agents SDK and Workers AI

Cloudy’s capabilities are built on and the , ensuring rapid deployment and high accuracy. Importantly, Cloudy train on customer data, relying instead on publicly available models. For more on Cloudflare’s responsible AI approach, see .