Cloudflare Rolls Out Self-Updating Bot Defense That Rewrites Rules in Real Time

Cloudflare Inc. unveiled Adaptive Intelligence on Thursday, a detection system embedded in its Bot Management offering that dynamically creates and removes its own blocking rules as attacks unfold. The system learns from live traffic flowing through Cloudflare's infrastructure, which processes more than a trillion web visits daily, absorbing new bot techniques and evasion methods as they emerge. The rules generated by the engine are temporary and targeted, designed to address individual threats and shift frequently enough that attackers find their defenses constantly shifting.

Economics drive Cloudflare's pitch for the product. Assembling botnets from compromised residential devices has become inexpensive and straightforward. Attackers can channel requests through legitimate home internet connections, with freely available tools handling the spoofing. The cost of failed attack attempts at scale is negligible. Security operations teams lack such flexibility, and Cloudflare contends that existing solutions depend on periodic updates requiring weeks or months to roll out, while attacker infrastructure refreshes in hours.

building taller walls fails when the cost of scaling an attack is effectively zero

Dane Knecht, Cloudflare Chief Technology Officer

Knecht elaborated that static defenses represent a puzzle attackers can eventually crack, and Adaptive Intelligence aims to keep the target in motion so that work invested in circumventing the defense becomes worthless before an operation reaches scale.

The system expands its analytical scope by examining behavior patterns across multiple time intervals simultaneously. This capability enables Cloudflare to detect slow-moving campaigns that slip beneath rate-based thresholds, including extended credential stuffing operations and gradual data harvesting.

Precursor, Cloudflare's browser-based tracking tool that became widely available in July, powers the system. Rather than evaluating visitor behavior at a single checkpoint, Precursor monitors how users navigate, scroll and interact throughout their entire session. Cloudflare stated that combining session-level signals with data from its worldwide edge infrastructure enables the system to assess visitor intent more accurately than traditional binary admit-or-deny decisions.

Cloudflare noted that fresh detections validate themselves against actual traffic in the background, testing for precision and weeding out false positives before activation, without requiring service interruptions.

Bot traffic has increasingly occupied Cloudflare's development priorities and represents a growing portion of overall web activity. When Precursor launched broadly in July, Cloudflare reported that automated traffic represented approximately 57% of all web requests. The bot management sector also functions as a revenue stream for Cloudflare, with WP Engine Inc. constructing its bot defenses within its Global Edge Security offering using Cloudflare's platform.

Adaptive Intelligence is rolling out immediately to existing Bot Management subscribers. The company has not announced pricing details for the new capability.