CloudflareJacob CrispAnnouncement
Cloudflare introduced Threat Signals, a free agentic skill layer for open-source threat intelligence available to every account. The product targets the unstructured-reporting problem: converting research posts into indicators that security tools can consume while preserving the context that explains their relevance. A skill encodes detailed instructions that capture how an experienced analyst handles one part of the job, and it runs identically on every report. The agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags within a private, account-scoped dataset. This approach standardizes analyst expertise into repeatable, context-preserving processing for threat reports.
Cloudflare positions Threat Signals as a free addition to its security platform, addressing the difficulty of turning unstructured threat-research posts into structured indicators without losing the context that explains why the indicators matter.
Threat Signals uses agentic skills, defined as sets of rich, detailed instructions that capture how an experienced analyst handles one part of the job. The skills run the same way on every report and operate within a private, account-scoped dataset.
Threat Signals is free for every Cloudflare account.
Its agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags.
Processing happens within a private, account-scoped dataset, keeping the threat-intelligence work account-scoped.
It addresses the difficulty of turning unstructured research posts into indicators that security tools can use, without losing the context that explains why those indicators matter.
A skill is a set of rich, detailed instructions that captures how an experienced analyst handles one part of the job, and it runs the same way on every report.
They summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags, all within a private, account-scoped dataset.
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
Application security is a closed loop: discover and prioritize risk, govern access and agent behavior, protect at runtime, then investigate and feed findings back into the next cycle.
Keep reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
