Building an Evidence-Grounded Agentic Security Operations Harness on Cloudflare
Cloudflare, Wednesday, October 7th, 2026
Cloudflare details the multi-agent AI harness behind its Managed Defense service that triages and correlates security alerts with evidence.
Cloudflare describes the multi-agent AI harness its Cloudflare Managed Defense analysts use to gather data, correlate related detections and account for missing sources, with its open-source Clef decision model handling initial scoring and approved OpenAI and Anthropic models doing deeper analysis.
An early single-agent prototype hallucinated unsupported claims, drifted in scope and hid failed lookups.
Cloudflare fixed this by moving evidence collection and scope enforcement into application code before model analysis, giving analysts a consolidated view of related alerts, evidence, gaps and recommended next steps.