---
title: "Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account"
description: "Cloudflare introduced Threat Signals, a free agentic skill layer for open-source threat intelligence available to every account. The product targets the unstructured-reporting problem: converting research posts into indicators that security tools can consume while preserving the context that explains their relevance. A skill encodes detailed instructions that capture how an experienced analyst handles one part of the job, and it runs identically on every report. The agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags within a private, account-scoped dataset. This approach standardizes analyst expertise into repeatable, context-preserving processing for threat reports."
---

# Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account

[Cloudflare](https://yomu.fyi/company/cloudflare) · Jacob Crisp · Sep 29, 2026

**Type:** Announcement

## Summary

Cloudflare introduced Threat Signals, a free agentic skill layer for open-source threat intelligence available to every account. The product targets the unstructured-reporting problem: converting research posts into indicators that security tools can consume while preserving the context that explains their relevance. A skill encodes detailed instructions that capture how an experienced analyst handles one part of the job, and it runs identically on every report. The agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags within a private, account-scoped dataset. This approach standardizes analyst expertise into repeatable, context-preserving processing for threat reports.

## Context

Cloudflare positions Threat Signals as a free addition to its security platform, addressing the difficulty of turning unstructured threat-research posts into structured indicators without losing the context that explains why the indicators matter.

## Approach / What changed

Threat Signals uses agentic skills, defined as sets of rich, detailed instructions that capture how an experienced analyst handles one part of the job. The skills run the same way on every report and operate within a private, account-scoped dataset.

## Takeaways

- Threat Signals is free for every Cloudflare account.
- Its agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags.
- Processing happens within a private, account-scoped dataset, keeping the threat-intelligence work account-scoped.

## FAQ

### What problem does Threat Signals solve?

It addresses the difficulty of turning unstructured research posts into indicators that security tools can use, without losing the context that explains why those indicators matter.

### How do agentic skills work in Threat Signals?

A skill is a set of rich, detailed instructions that captures how an experienced analyst handles one part of the job, and it runs the same way on every report.

### What do the agentic skills do?

They summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags, all within a private, account-scoped dataset.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [Cloudflare](https://yomu.fyi/topic/cloudflare), [Threat Intelligence](https://yomu.fyi/topic/threat-intelligence)

- Source: [Cloudflare](https://blog.cloudflare.com/threat-signals)
- Source URL: https://blog.cloudflare.com/threat-signals
- Ingested by Yomu: 2026-09-29T15:00:12.132Z

[Read original post](https://blog.cloudflare.com/threat-signals)