Cloudflare Inc. today launched Adaptive Intelligence, a detection engine inside Cloudflare Bot Management that writes and discards its own blocking rules while an attack is underway.
The engine trains continuously on live traffic moving across Cloudflare’s network, which the company said carries more than a trillion web visits a day. New bot frameworks and bypass techniques get folded into the model as they show up. The rules it produces are short-lived and narrow, each one aimed at a specific threat, and they rotate often enough that an attacker probing a site is mapping a defense that has already changed.
Cloudflare’s case for the product starts with cost. Renting a network of compromised devices no longer takes much skill or money. Attackers can route traffic through real home internet addresses, and free software covers the rest of the impersonation.
Failed attempts are close to free at volume. Security teams do not have that margin, and Cloudflare said conventional tools still rely on scheduled updates that can take weeks or months to deploy, while attacker tooling turns over in hours.
Chief Technology Officer Dane Knecht said “building taller walls fails when the cost of scaling an attack is effectively zero.” A fixed defense is a problem attackers can eventually solve, he said, and the aim of Adaptive Intelligence is to keep the target moving so that engineering work put into a bypass is obsolete before the operation gets to scale.
The engine also widens the window it looks at. Behavior is analyzed across several timeframes at once, which Cloudflare said surfaces the slow campaigns that hide under rate thresholds, among them drawn-out credential stuffing and scraping runs.
Feeding it is Precursor, the browser-level system Cloudflare made generally available in July, which logs how a visitor moves, scrolls and types across an entire session instead of testing them once on arrival. Cloudflare said the combination of those session signals and telemetry from its global edge will let the system judge visitor intent beyond a binary pass or fail at the door.
Cloudflare said new detections test themselves against live traffic in the background, verifying accuracy and screening for false positives before they deploy, with no downtime.
Automated traffic has been a growing share of Cloudflare’s product roadmap and of the web itself. Cloudflare said in July that bots accounted for roughly 57% of web requests when Precursor reached general availability. Bot management is also a wholesale business for Cloudflare, and WP Engine Inc. built the bot controls in its Global Edge Security service on top of the network.
Adaptive Intelligence is available to Cloudflare Bot Management customers now. Cloudflare did not disclose pricing.