The same intelligence we’re gathering to expedite and refine abuse report processing isn’t just for abuse response; it’s also used to empower our customers. By analyzing patterns and trends of abusive behaviors — such as identifying common phrases used in phishing attempts, recognizing infrastructure used by malicious actors or spotting coordinated campaigns across multiple domains — we enhance the efficacy of our application security, email security, and threat intelligence products.
For our Brand Protection customers, this translates into a significant advantage: the ability to easily report suspected abuse directly from the Cloudflare dashboard. This feature ensures that potential phishing sites are addressed rapidly, minimizing the risk to your customers and brand reputation. Furthermore, the Trust and Safety team can use this information to take action on similar threats across the Cloudflare network, protecting all customers, even those who aren't Brand Protection users.
Alongside our network-wide efforts, we’ve also been partnering with our customers, as well as experts outside of Cloudflare, to understand trends they are seeing in their own phishing mitigation efforts. By soliciting intelligence regarding the abuse issues that affect the attack’s targets, we can better identify and prevent abuse of Cloudflare products. We’ve been able to use these partnerships and discussions with external organizations to craft highly targeted rules that head off emerging patterns of phishing activity.
\n
\n
It takes a village: if you see something, say something
If you believe you’ve identified phishing activity that is passing through Cloudflare’s network, please report it via our abuse reporting form. For technical users who might be interested in a programmatic way to report to us, please review our abuse reporting API documentation.
We invite all of our customers to join us in helping make the Internet safer:
Enterprise customers should speak with their Customer Success Manager about enabling Brand Protection, included by default for all enterprise customers.
For existing users of the Brand Protection product, update your brand's assets, so we can better identify the legitimate websites and logos of our customers vs. possible phishing activity.
As a Cloudflare customer, make sure your abuse contact is up-to-date in the Cloudflare dashboard.
"],"published_at":[0,"2025-03-17T13:00+08:00"],"updated_at":[0,"2025-03-17T13:00:02.656Z"],"feature_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/79K5MBfrIKb7JizOLPOOsU/fca64d5c71ac39ffaff623b310a7e3f1/image2-2.png"],"tags":[1,[[0,{"id":[0,"3DmitkNK6euuD5BlhuvOLW"],"name":[0,"Security Week"],"slug":[0,"security-week"]}],[0,{"id":[0,"2yskwsCS0bVLjzbIJrpFuZ"],"name":[0,"Abuse"],"slug":[0,"abuse"]}],[0,{"id":[0,"6hv2Z69PGr0qU411KfQNUE"],"name":[0,"Threat Intelligence"],"slug":[0,"threat-intelligence"]}],[0,{"id":[0,"21DTsaKOfe5jbKfPDzYIBX"],"name":[0,"Phishing"],"slug":[0,"phishing"]}]]],"relatedTags":[0],"authors":[1,[[0,{"name":[0,"Javier Castro"],"slug":[0,"javier"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/3hJsvxP0uRGmk4DjS9IdSW/0197c661fe20e1ebc9922768d727df02/javier.png"],"location":[0,null],"website":[0,null],"twitter":[0,null],"facebook":[0,null]}],[0,{"name":[0,"Justin Paine"],"slug":[0,"justin"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/6tEloK6bIo2UEa1LXmziIj/391e7bd2b61dbf99e26aa9c6341b176d/justin.jpg"],"location":[0,null],"website":[0,"https://www.linkedin.com/in/justinpaine/"],"twitter":[0,null],"facebook":[0,null]}],[0,{"name":[0,"Rachael Truong"],"slug":[0,"rachael-truong"],"bio":[0],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/qzwTKN43tcA5I7uV1Q9oV/7f2f780757812b9fd8c66113a09d1f46/_tmp_mini_magick20230518-2-vw2zdi.jpg"],"location":[0],"website":[0],"twitter":[0],"facebook":[0]}]]],"meta_description":[0,"How Cloudflare is using threat intelligence and our Developer Platform products to automate phishing abuse reports."],"primary_author":[0,{}],"localeList":[0,{"name":[0,"blog-english-only"],"enUS":[0,"English for Locale"],"zhCN":[0,"No Page for Locale"],"zhHansCN":[0,"No Page for Locale"],"zhTW":[0,"No Page for Locale"],"frFR":[0,"No Page for Locale"],"deDE":[0,"No Page for Locale"],"itIT":[0,"No Page for Locale"],"jaJP":[0,"No Page for Locale"],"koKR":[0,"No Page for Locale"],"ptBR":[0,"No Page for Locale"],"esLA":[0,"No Page for Locale"],"esES":[0,"No Page for Locale"],"enAU":[0,"No Page for Locale"],"enCA":[0,"No Page for Locale"],"enIN":[0,"No Page for Locale"],"enGB":[0,"No Page for Locale"],"idID":[0,"No Page for Locale"],"ruRU":[0,"No Page for Locale"],"svSE":[0,"No Page for Locale"],"viVN":[0,"No Page for Locale"],"plPL":[0,"No Page for Locale"],"arAR":[0,"No Page for Locale"],"nlNL":[0,"No Page for Locale"],"thTH":[0,"No Page for Locale"],"trTR":[0,"No Page for Locale"],"heIL":[0,"No Page for Locale"],"lvLV":[0,"No Page for Locale"],"etEE":[0,"No Page for Locale"],"ltLT":[0,"No Page for Locale"]}],"url":[0,"https://blog.cloudflare.com/how-cloudflare-is-using-automation-to-tackle-phishing"],"metadata":[0,{"title":[0,"How Cloudflare is using automation to tackle phishing head on"],"description":[0,"How Cloudflare is using threat intelligence and our Developer Platform products to automate phishing abuse reports."],"imgPreview":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/5jGBI5EKR84zQ2ZgNF4uG1/6e3fd70e5a9d4991f256f9c773dc588d/OG_Share_2024__4_.png"]}]}],[0,{"id":[0,"6r04i7Ke1lNGEWK4u3pRK1"],"title":[0,"Cloudflare’s 2024 Transparency Reports - now live with new data and a new format"],"slug":[0,"cloudflare-2024-transparency-reports-now-live-with-new-data-and-a-new-format"],"excerpt":[0,"Cloudflare’s 2024 Transparency Reports are now live — with new topics, new data points, and a new format, consistent with the EU’s Digital Services Act"],"featured":[0,false],"html":[0,"
Cloudflare’s 2024 Transparency Reports are now live — with new topics, new data points, and a new format. For over 10 years, Cloudflare has published transparency reports twice a year in order to provide information to our customers, policymakers, and the public about how we handle legal requests and abuse reports relating to the websites using our services. Such transparency reporting is now recognized as a best practice among companies offering online services, and has even been written into law with the European Union’s Digital Service Act (DSA).
While Cloudflare has been publishing transparency reports for a long time, this year we chose to revamp the report in light of new reporting obligations under the DSA, and our goal of making our reports both comprehensive and easy to understand. Before you dive into the reports, learn more about Cloudflare’s longstanding commitment to transparency reporting and the key updates we made in this year’s reports.
Cloudflare started issuing transparency reports early on, because we have long believed that transparency is essential to earning trust. In addition to sharing data about the number and nature of requests we receive, our transparency reports have provided a forum for Cloudflare to articulate the principles we apply in approaching legal requests for customer information and how we handle abuse.
Grounded in Cloudflare’s principles, our transparency reports have necessarily evolved over time as the scale and complexity of our services has grown. While our initial reports were focused on governmental requests for customer information, our reports have expanded to cover a broader set of issues, including civil requests for customer information, legal requests to limit or terminate services, and our process for handling reports of abuse on websites using our services.
A key driver of this year’s updates was the transparency reporting obligations in the EU’s Digital Services Act (DSA). As we have written about previously, the DSA replaced a 20-year-old law called the e-Commerce Directive, providing an important framework for addressing the legal responsibilities of online service providers.
While the DSA addresses a number of topics, an important one is transparency. The DSA sets different transparency reporting obligations for different services, establishing baseline reporting requirements for all intermediary services, more detailed reporting for hosting services, and the most extensive reporting for online platforms like social media sites and search engines. Most of Cloudflare’s services are pass-through (intermediary) services related to security and performance with limited transparency reporting requirements under the DSA, while our hosting services have some additional requirements related to our abuse-related actions.
The DSA transparency obligations align with Cloudflare’s longstanding practices and company principles toward transparency. Because Cloudflare has always strived to provide meaningful transparency into its approach to these issues, we are well positioned to comply with the specific reporting obligations set forth in the DSA. That said, while we believe that our existing reports already satisfied much of the DSA, we identified changes we wanted to make to match specific types of data or formatting called for under the DSA.
Our 2024 Transparency Reports include more information than ever before, all in a new format that we believe will make the information easier to understand.
Prompted by the DSA’s requirements and the continued expansion of services we offer, the 2024 reports includes new information, including additional categories of hosted content abuse, automated steps Cloudflare has taken to mitigate phishing and technical abuse, the mean time to take action on different types of abuse reports, and information about additional types of requests for customer information that we have received. You’ll find a machine-readable version of the data alongside our transparency reports, consistent with DSA requirements. We also introduced "additional context" boxes to call out trends or notable developments during the reporting period.
To try to make all of this information as digestible as possible, we divided our transparency report into two parts. Our report on Legal Requests for Information addresses the law enforcement, government, and civil requests for customer information that Cloudflare receives in the United States and around the world. Our report on Abuse Processes addresses Cloudflare’s processes for handling reports of abuse on websites using our services and our response to legal requests to terminate or restrict access to our users.
Because we divided the report into two parts, you’ll find our ‘warrant canaries’ on the transparency report landing page of our Trust Hub and no longer in the reports themselves. The warrant canary statements about things we have never done as a company are an essential part of our commitment to transparency in how we handle both customers’ information in response to legal requests and abuse reports. All of our warrant canaries remain intact, meaning we still haven't done any of these things.
We’ll continue to publish transparency reports twice a year, available on the Transparency page of our website as well as through an RSS feed. Our approach to these reports will continue to evolve in order to provide meaningful transparency in line with our company principles, product portfolio growth, and in line with the new regulatory environment.
"],"published_at":[0,"2025-02-28T14:00+00:00"],"updated_at":[0,"2025-02-28T14:00:05.206Z"],"feature_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/6Xc4RLGbRtbN4S4yfrhxPS/202821db82d993c4d3a0990413a3daa3/BLOG-2750-hero.png"],"tags":[1,[[0,{"id":[0,"4uYyN5Ip7exz8LFNtQgNIZ"],"name":[0,"Trust & Safety"],"slug":[0,"trust-and-safety"]}],[0,{"id":[0,"1KPfUVOpIs5y5iIl16r9Tq"],"name":[0,"Transparency"],"slug":[0,"transparency"]}],[0,{"id":[0,"16yk8DVbNNifxov5cWvAov"],"name":[0,"Policy & Legal"],"slug":[0,"policy"]}]]],"relatedTags":[0],"authors":[1,[[0,{"name":[0,"Abby Vollmer"],"slug":[0,"abby-vollmer"],"bio":[0],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/56GlLx21qqy37d3tibCahJ/11beec9ef67f0b02525215d402b697e7/Abby-Vollmer.jpg"],"location":[0],"website":[0],"twitter":[0],"facebook":[0]}],[0,{"name":[0,"Despina Papageorge"],"slug":[0,"despina-papageorge"],"bio":[0],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/4gBP0m7P0XtKghQFLMZ9dO/507e5efb49eb0a2c9affc24609b1adef/Despina_Papageorge.jpg"],"location":[0],"website":[0],"twitter":[0],"facebook":[0]}]]],"meta_description":[0,"Cloudflare’s 2024 Transparency Reports are now live — with new topics, new data points, and a new format, consistent with the EU’s Digital Services Act. Read on to learn more about Cloudflare’s longstanding commitment to transparency reporting and the key updates we made in this year’s reports."],"primary_author":[0,{}],"localeList":[0,{"name":[0,"blog-english-only"],"enUS":[0,"English for Locale"],"zhCN":[0,"No Page for Locale"],"zhHansCN":[0,"No Page for Locale"],"zhTW":[0,"No Page for Locale"],"frFR":[0,"No Page for Locale"],"deDE":[0,"No Page for Locale"],"itIT":[0,"No Page for Locale"],"jaJP":[0,"No Page for Locale"],"koKR":[0,"No Page for Locale"],"ptBR":[0,"No Page for Locale"],"esLA":[0,"No Page for Locale"],"esES":[0,"No Page for Locale"],"enAU":[0,"No Page for Locale"],"enCA":[0,"No Page for Locale"],"enIN":[0,"No Page for Locale"],"enGB":[0,"No Page for Locale"],"idID":[0,"No Page for Locale"],"ruRU":[0,"No Page for Locale"],"svSE":[0,"No Page for Locale"],"viVN":[0,"No Page for Locale"],"plPL":[0,"No Page for Locale"],"arAR":[0,"No Page for Locale"],"nlNL":[0,"No Page for Locale"],"thTH":[0,"No Page for Locale"],"trTR":[0,"No Page for Locale"],"heIL":[0,"No Page for Locale"],"lvLV":[0,"No Page for Locale"],"etEE":[0,"No Page for Locale"],"ltLT":[0,"No Page for Locale"]}],"url":[0,"https://blog.cloudflare.com/cloudflare-2024-transparency-reports-now-live-with-new-data-and-a-new-format"],"metadata":[0,{"title":[0,"Cloudflare’s 2024 Transparency Reports - now live with new data and a new format"],"description":[0,"Cloudflare’s 2024 Transparency Reports are now live — with new topics, new data points, and a new format, consistent with the EU’s Digital Services Act. Read on to learn more about Cloudflare’s longstanding commitment to transparency reporting and the key updates we made in this year’s reports."],"imgPreview":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/7keIHYJ4VOWvPxerRuCEXT/db2c5b7836904f119700ffff38c7d6ca/Cloudflare_s_2024_Transparency_Reports_-_now_live_with_new_data_and_a_new_format-OG.png"]}]}],[0,{"id":[0,"63yGQGTniOUOFneFLwTb7a"],"title":[0,"Cloudflare meets new Global Cross-Border Privacy (CBPR) standards"],"slug":[0,"cloudflare-cbpr-a-global-privacy-first"],"excerpt":[0,"Cloudflare is the first organization globally to announce having been successfully audited against the ‘Global Cross-Border Privacy Rules’ system and ‘Global Privacy Recognition for Processors’."],"featured":[0,false],"html":[0,"
Cloudflare proudly leads the way with our approach to data privacy and the protection of personal information, and we’ve been an ardent supporter of the need for the free flow of data across jurisdictional borders. So today, on Data Privacy Day (also known internationally as Data Protection Day), we’re happy to announce that we’re adding our fourth and fifth privacy validations, and this time, they are global firsts! Cloudflare is the first organisation to announce that we have been successfully audited against the brand new Global Cross-Border Privacy Rules (Global CBPRs) for data controllers and the Global Privacy Recognition for Processors (Global PRP). These validations demonstrate our support and adherence to global standards that provide for privacy-respecting data flows across jurisdictions. Organizations that have been successfully audited will be formally certified when the certifications officially launch, which we expect to happen later in 2025.
Our participation in the Global CBPRs and Global PRP joins our roster of privacy validations: we were one of the first cybersecurity organizations to certify to the international privacy standard ISO 27701:2019 when it was published, and in 2022 we also certified to the cloud privacy certification, ISO 27018:2019. In 2023, we added our third privacy validation, undergoing a review by an independent monitoring body in the European Union (EU) and declared to be adherent to the first official GDPR code of conduct — the EU Cloud Code of Conduct.
Taking these privacy certifications together, Cloudflare demonstrates that we are meeting key official privacy validations in 39 jurisdictions around the world, from Australia and Austria to Sweden and the United States. An additional four jurisdictions (United Kingdom, Bermuda, Mauritius, and the Dubai International Finance Centre) are also in the process of joining and recognising the Global CBPR certifications. That's important for Cloudflare customers as it provides reassurance that the privacy practices we have built are recognised by governments around the world.
In the last three years, governments across the world have been busy preparing two brand-new international privacy standards. A major milestone was achieved on April 30, 2024 when the Global CBPR System was established. The CBPRs are a voluntary, enforceable, international, accountability-based system that facilitates privacy-respecting data flows among members’ economies. They provide a baseline level of privacy protection for consumers through a set of rules on how to handle people’s personal information. This facilitates the free flow of data by upholding consumer privacy across participating members, despite each jurisdiction having their own individual data protection laws.
The CBPR System was developed by the Global CBPR Forum, an intergovernmental forum between the governments of Australia, Canada, Japan, Republic of Korea, Mexico, Philippines, Singapore, Chinese Taipei, and the United States. The United Kingdom is also an associate member of the CBPR Forum, as are Bermuda, Mauritius, and the Dubai IFC, signifying their intent to join as full members in the future.
Over the last year, we have been busy preparing for the launch of the Global CBPR System. On May 1, 2024 — the very first day after the establishment of the system — Cloudflare applied to join. And we have now achieved the major milestone of successfully completing audits against the requirements, meaning we expect to be the first organization in the world to be newly certified to the Global CBPR system, as well as the related Global Privacy Recognition for Processors, when companies can officially be certified, which is expected later in 2025.
The Global CBPR System contains a detailed list of fifty requirements that organizations must meet in order to be certified under the scheme. The requirements derive from the nine Global CBPR Privacy Principles, which are consistent with the core principles of the Organisation for Economic Co-operation and Development (OECD)Guidelines on the Protection of Privacy and Trans-Border Flows of Personal Data. The fifty requirements cover how organizations should collect, manage, and safeguard personal information in their custody. Organizations must meet every one of the fifty requirements in order to be Global CBPR certified. The nine principles underlying the requirements are:
Preventing Harm
Notice
Collection Limitation
Uses of Personal Information
Choice
Integrity of Personal Information
Security Safeguards
Access and Correction
Accountability
The nine Global CBPR Privacy Principles
The Global CBPR certification covers the handling of personal information controlled by the organization, such as the personal details of customers, employees, and job applicants. For Cloudflare, this also includes network information — our observations about how our global cloud platform handles server, network, or traffic data generated by Cloudflare in the course of providing our services.
The related Global Privacy Recognition for Processors (PRP) certification covers the handling of personal information processed by the organization on behalf of a different organization, usually their customer. The eighteen requirements of the PRP relate to the two privacy principles most relevant when processing this information on behalf of another organization: Security Safeguards and Accountability. For Cloudflare, this covers the processing of data pursuant to the Data Processing Addendum we sign with all of our customers, chiefly, the Customer Content flowing across our network and the Customer Logs generated by those data flows. Organizations must meet every one of the eighteen requirements in order to be Global PRP certified.
\n
\n
A deeper dive into some of the requirements of the Global CBPRs
As noted, the key requirements of the Global CBPRs and the Global PRP cover the well-known data protection principles of notice, choice, collection limitation (data minimization), the right of data subject access and correction, providing adequate security, preventing harm, integrity of personal information, accountability, and uses of personal information. There are dozens of requirements that cover these principles, so we’ll just touch on a few of them here.
Let’s first look at the principle of notice. One of the more obvious requirements from the CBPRs is question 1:
Do you provide clear and easily accessible statements about your practices and policies that govern the personal information described above (a privacy statement)?
Being transparent about the collection and use of personal information is a key principle of privacy and data protection, and transparency is one of Cloudflare’s core commitments. Documenting our practices and policies in regard to how we use personal information allows individuals to decide if they want to provide their information, and that’s why it’s best practice for the privacy notice to be available and visible at the time the information is being collected. Indeed, this concept of providing notice is clear from Article 13 of the EU’s GDPR. Cloudflare meets this CBPR requirement by providing a clear and accessible privacy notice visible from the footer of each page on our website. We also provide a link to the notice when we collect personal data such as through a form on a webpage.
In terms of how we use personal information, question 8 asks:
Do you limit the use of the personal information you collect (whether directly or through the use of third parties acting on your behalf) as identified in your privacy statement?
It has long been a commitment of Cloudflare’s that we only use the personal information we collect for the purposes of providing the services we offer. Our business is built on providing customers with the tools to protect their network applications and to make them faster, more secure, more reliable, and more private. In our Privacy Policy, we commit that we will “only share or otherwise disclose your personal information as necessary to provide our Services or as otherwise described in this Policy, except in cases where we first provide you with notice and the opportunity to consent.” And we maintain internal documentation (in keeping with the CBPR’s accountability principle) to document the data we are processing and the purposes for which we process it.
Another key set of requirements in both the Global CBPRs and the Global PRP have to do with security safeguards. CBPR requirement question 27 asks:
Describe the physical, technical and administrative safeguards you have implemented to protect personal information against risks such as loss or unauthorized access, destruction, use, modification or disclosure of information or other misuses?
The similar requirement in the Global PRP is question 2:
Describe the physical, technical and administrative safeguards that implement your organization’s information security policy.
Cloudflare has implemented an information security program in accordance with the ISO/IEC 27000 family of standards. Details of Cloudflare’s security program are documented in Annex 2 (“Technical and Organizational Security Measures”) of Cloudflare's Customer Data Processing Addendum, including the physical, technical and administrative safeguards implemented to protect personal information.
Related to the Accountability principle, question 46 asks:
Do you have mechanisms in place with personal information processors, agents, contractors, or other service providers pertaining to personal information they process on your behalf, to ensure that your obligations to the individual will be met?
When we have vendors who handle any of our, or our customers’, personal information, we require them to sign a Data Processing Addendum with us. This ensures the commitments we make to our customers in our customer agreements in turn flow through to our vendors, including the security requirements — holding them, and us, accountable.
We are excited about the launch of the Global CBPR certifications, expected later in 2025, and we are proud that on this Data Privacy Day, we can yet again demonstrate our commitment to universally held principles for protecting the privacy of personal data.
You can find more about the Global CBPR System, the Global PRP, download a full copy of the requirements, and keep up to date with related news at globalcbpr.org.
For the latest information about our certifications, please visit our Trust Hub. Customers can also find out how to download a copy of Cloudflare’s certifications and reports from the Cloudflare dashboard.
\n \n \n "],"published_at":[0,"2025-01-28T00:00+00:00"],"updated_at":[0,"2025-02-03T16:07:08.820Z"],"feature_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/4SJhJ9Vtg6wCK1SPhlLs75/95ce4ff10ba8cf1e1197ec5abfe52e8b/image3.png"],"tags":[1,[[0,{"id":[0,"4NRwgGJnSZwfl5aeAPjvOe"],"name":[0,"Certification"],"slug":[0,"certification"]}],[0,{"id":[0,"3BWeMuiOShelE7QM48sW9j"],"name":[0,"Privacy"],"slug":[0,"privacy"]}],[0,{"id":[0,"6twWoAUd2y0j3cAMfKjwcW"],"name":[0,"Compliance"],"slug":[0,"compliance"]}],[0,{"id":[0,"6Mp7ouACN2rT3YjL1xaXJx"],"name":[0,"Security"],"slug":[0,"security"]}],[0,{"id":[0,"16yk8DVbNNifxov5cWvAov"],"name":[0,"Policy & Legal"],"slug":[0,"policy"]}]]],"relatedTags":[0],"authors":[1,[[0,{"name":[0,"Rory Malone"],"slug":[0,"rory"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/2bKOaTS3yX5KSIZXsCwLS4/81eed0f0e7ce7b3a6b5c2683c30a8205/rory.png"],"location":[0,"London, UK"],"website":[0,"https://www.cloudflare.com/trust-hub/compliance-resources"],"twitter":[0,"@roryinlondon"],"facebook":[0,null]}],[0,{"name":[0,"Emily Hancock"],"slug":[0,"emily-hancock"],"bio":[0,null],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/6WoITZeDW2tg5JO91UOF0Y/0510a8ee70b2daeb2cb325aa6f8e0ceb/emily-hancock.jpg"],"location":[0,null],"website":[0,null],"twitter":[0,null],"facebook":[0,null]}]]],"meta_description":[0,"Cloudflare is the first organisation globally to announce we have been successfully audited against the brand-new international ‘Global Cross-Border Privacy Rules’ system and the brand new ‘Global Privacy Recognition for Processors’. Cloudflare will be certified from day one when the certifications launch later in 2025."],"primary_author":[0,{}],"localeList":[0,{"name":[0,"LOC: New Global CBPR and Global PRP privacy certifications"],"enUS":[0,"English for Locale"],"zhCN":[0,"Translated for Locale"],"zhHansCN":[0,"No Page for Locale"],"zhTW":[0,"No Page for Locale"],"frFR":[0,"Translated for Locale"],"deDE":[0,"Translated for Locale"],"itIT":[0,"No Page for Locale"],"jaJP":[0,"Translated for Locale"],"koKR":[0,"Translated for Locale"],"ptBR":[0,"No Page for Locale"],"esLA":[0,"No Page for Locale"],"esES":[0,"Translated for Locale"],"enAU":[0,"No Page for Locale"],"enCA":[0,"No Page for Locale"],"enIN":[0,"No Page for Locale"],"enGB":[0,"No Page for Locale"],"idID":[0,"No Page for Locale"],"ruRU":[0,"No Page for Locale"],"svSE":[0,"No Page for Locale"],"viVN":[0,"No Page for Locale"],"plPL":[0,"No Page for Locale"],"arAR":[0,"No Page for Locale"],"nlNL":[0,"No Page for Locale"],"thTH":[0,"No Page for Locale"],"trTR":[0,"No Page for Locale"],"heIL":[0,"No Page for Locale"],"lvLV":[0,"No Page for Locale"],"etEE":[0,"No Page for Locale"],"ltLT":[0,"No Page for Locale"]}],"url":[0,"https://blog.cloudflare.com/cloudflare-cbpr-a-global-privacy-first"],"metadata":[0,{"title":[0,"Cloudflare meets new Global Cross Border Privacy standards"],"description":[0,"Cloudflare is the first organisation globally to announce we have been successfully audited against the brand-new international ‘Global Cross-Border Privacy Rules’ system and the brand new ‘Global Privacy Rules for Processors’. Cloudflare will be certified from day one when the certifications launch later in 2025."],"imgPreview":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/8yWeBIDbBGS88QDJHOQGd/c71c0b1ff73bfda977bb0597bcf5c5aa/OG_Share_2024__6_.png"]}]}],[0,{"id":[0,"4j7FBBC7QJi59ZFzmAG5Sx"],"title":[0,"Demonstrating reduction of vulnerability classes: a key step in CISA’s “Secure by Design” pledge"],"slug":[0,"cisa-pledge-commitment-reducing-vulnerability"],"excerpt":[0,"Cloudflare strengthens its commitment to cybersecurity by joining CISA's \"Secure by Design\" pledge. In line with this, we're reducing the prevalence of vulnerability classes across our products."],"featured":[0,false],"html":[0,"
In today’s rapidly evolving digital landscape, securing software systems has never been more critical. Cyber threats continue to exploit systemic vulnerabilities in widely used technologies, leading to widespread damage and disruption. That said, the United States Cybersecurity and Infrastructure Agency (CISA) helped shape best practices for the technology industry with their Secure-by-Design pledge. Cloudflare signed this pledge on May 8, 2024, reinforcing our commitment to creating resilient systems where security is not just a feature, but a foundational principle.
We’re excited to share an update aligned with one of CISA’s goals in the pledge: To reduce entire classes of vulnerabilities. This goal aligns with the Cloudflare Product Security program’s initiatives to continuously automate proactive detection and vigorously prevent vulnerabilities at scale.
Cloudflare’s commitment to the CISA pledge reflects our dedication to transparency and accountability to our customers. This blog post outlines why we prioritized certain vulnerability classes, the steps we took to further eliminate vulnerabilities, and the measurable outcomes of our work.
\n
\n
The core philosophy that continues: prevent, not patch
Cloudflare’s core security philosophy is to prevent security vulnerabilities from entering production environments. One of the goals for Cloudflare’s Product Security team is to champion this philosophy and ensure secure-by-design approaches are part of product and platform development. Over the last six months, the Product Security team aggressively added both new and customized rulesets aimed at completely eliminating secrets and injection code vulnerabilities. These efforts have enhanced detection precision, reducing false positives, while enabling the proactive detection and blocking of these two vulnerability classes. Cloudflare’s security practice to block vulnerabilities before they are introduced into code at merge or code changes serves to maintain a high security posture and aligns with CISA’s pledge around proactive security measures.
Injection vulnerabilities are a critical vulnerability class, irrespective of the product or platform. These occur when code and data are improperly mixed due to lack of clear boundaries as a result of inadequate validation, unsafe functions, and/or improper sanitization. Injection vulnerabilities are considered high impact as they lead to compromise of confidentiality, integrity, and availability of the systems involved. Some of the ways Cloudflare continuously detects and prevents these risks is through security reviews, secure code scanning, and vulnerability testing. Additionally, ongoing efforts to institute improved precision serve to reduce false positives and aggressively detect and block these vulnerabilities at the source if engineers accidentally introduce these into code.
Secrets in code is another vulnerability class of high impact, as it presents significant risk related to confidential information leaks, potentially leading to unauthorized access and insider threat challenges. In 2023, Cloudflare prioritized tuning our security tools and systems to further improve the detection and reduction of secrets within code. Through audits and usage patterns analysis across all Cloudflare repositories, we further decreased the probability of the reintroduction of these vulnerabilities into new code by writing and enabling enhanced secrets detection rules.
Cloudflare is committed to elimination of these vulnerability classes regardless of their criticality. By addressing these vulnerabilities at their source, Cloudflare has significantly reduced the attack surface and the potential for exploitation in production environments. This approach established secure defaults by enabling developers to rely on frameworks and tools that inherently separate data or secrets from code, minimizing the need for reactive fixes. Additionally, resolving these vulnerabilities at the code level “future-proofs” applications, ensuring they remain resilient as the threat landscape evolves.
\n
\n
Cloudflare’s techniques for addressing these vulnerabilities
To address both injection and embedded secrets vulnerabilities, Cloudflare focused on building secure defaults, leveraging automation, and empowering developers. To establish secure default configurations, Cloudflare uses frameworks designed to inherently separate data from code. We also increased reliance on secure storage systems and secret management tools, integrating them seamlessly into the development pipeline.
Continuous automation played a critical role in our strategy. Static analysis tools integration with DevOps process were enhanced with customized rule sets to block issues based on observed patterns and trends. Additionally, along with security scans running on every pull and merge request, software quality assurance measures of “build break” and “stop the code” were enforced. This prevented risks from entering production when true positive vulnerabilities were detected across all Cloudflare development activities, irrespective of criticality and impacted product. This proactive approach has further reduced the likelihood of these vulnerabilities reaching production environments.
Developer enablement was another key pillar. Priority was placed on bolstering existing continuous education and training for engineering teams by providing additional guidance and best practices on preventing security vulnerabilities, and leveraging our centralized secrets platform in an automated way. Embedding these principles into daily workflows has fostered a culture of shared responsibility for security across the organization.
To operationalize the more aggressive detection and blocking capabilities, Cloudflare’s Product Security team wrote new detection rulesets for its static application security testing (SAST) tool integrated in CI/CD workflows and hardened the security criteria for code releases to production. Using the SAST tooling with both default and custom rulesets allows the security team to perform comprehensive scans for secure code, secrets, and software supply chain vulnerabilities, virtually eliminating injection vulnerabilities and secrets from source code. It also enables the security team to identify and address issues early while systematically enforcing security policies.
Cloudflare’s expansion of the security tool suite played a critical role in the company’s secure product strategy. Initially, rules were enabled in “monitoring only” mode to understand trends and potential false positives. Then rules were fine-tuned to enforce and adjust priorities without disrupting development workflows. Leveraging internal threat models, the team writes custom rules tailored to Cloudflare’s infrastructure. Every pull request (PR) and merge request (MR) was scanned against these specific rule sets, including those targeting injection and secrets. The fine-tuned rules, optimized for high precision, are then activated in blocking mode, which leads to breaking the build when detected. This process provides vulnerability remediation at the PR/MR stage.
Hardening these security checks directly into the CI/CD pipeline enforces a proactive security assurance strategy in the development lifecycle. This approach ensures vulnerabilities are detected and addressed early in the development process before reaching production. The detection and blocking of these issues early reduces remediation efforts, minimizes risk, and strengthens the overall security of our products and systems.
Cloudflare continues to follow a culture of transparency as it provides increased visibility into the root cause of an issue and consequently allowing us to improve the process/product at scale. As a result, these efforts have yielded tangible results and continue to strengthen the security posture of all Cloudflare products.
In the second half of 2024, the team aggressively added new rulesets that helped detect and remove new secrets introduced into code repositories. This led to a 79% reduction of secrets in code over the previous quarter, underscoring Cloudflare’s commitment to safeguarding the company's codebase and protecting sensitive information. Following a similar approach, the team also introduced new rulesets in blocking mode, irrespective of the criticality level for all injection vulnerabilities. These improvements led to an additional 44% reduction of potential SQL injection and code injection vulnerabilities.
While security tools may produce false positives, customized rulesets with high-confidence true positives remain a key step in order to methodically evaluate and address the findings. These reductions reflect the effectiveness of proactive security measures in reducing entire vulnerability classes at scale.
Cloudflare will continue to mature the current practices and enforce secure-by-design principles. Some other security practices we will continue to mature include: providing secure frameworks, threat modeling at scale, integration of automated security tooling in every stage of the software development lifecycle (SDLC), and ongoing role based developer training on leading edge security standards. All of these strategies help reduce, or eliminate, entire classes of vulnerabilities.
Irrespective of the industry, if your organization builds software, we encourage you to familiarize yourself with CISA’s ‘Secure by Design’ principles and create a plan to implement them in your company. The commitment is built around seven security goals, prioritizing the security of customers.
The CISA Secure by Design pledge challenges organizations to think differently about security. By addressing vulnerabilities at their source, Cloudflare has demonstrated measurable progress in reducing systemic risks.
Cloudflare’s continued focus on addressing vulnerability classes through prevention mechanisms outlined above serves as a critical foundation. These efforts ensure the security of Cloudflare systems, employees, and customers. Cloudflare is invested in continuous innovation and building a safe digital world.
You can also find more updates on our blog as we build our roadmap to meet all seven CISA Secure by Design pledge goals by May 2025, such as our post about reaching Goal #5 of the pledge.
As a cybersecurity company, Cloudflare considers product security an integral part of its DNA. We strongly believe in CISA’s principles issued in the Secure by Design pledge, and will continue to uphold these principles in the work we do.
"],"published_at":[0,"2025-01-14T14:00+00:00"],"updated_at":[0,"2025-01-14T17:06:30.597Z"],"feature_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/7aewL4nISFGuNtgogBCTbI/8c0fa941bb3093326c29723b34d751a0/image1.png"],"tags":[1,[[0,{"id":[0,"29dKBVc2xQYNE2rUt98i6r"],"name":[0,"CISA"],"slug":[0,"cisa"]}],[0,{"id":[0,"16yk8DVbNNifxov5cWvAov"],"name":[0,"Policy & Legal"],"slug":[0,"policy"]}],[0,{"id":[0,"6QVJOBzgKXUO9xAPEpqxvK"],"name":[0,"Reliability"],"slug":[0,"reliability"]}],[0,{"id":[0,"6Mp7ouACN2rT3YjL1xaXJx"],"name":[0,"Security"],"slug":[0,"security"]}]]],"relatedTags":[0],"authors":[1,[[0,{"name":[0,"Sri Pulla"],"slug":[0,"sri-pulla"],"bio":[0],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/6cKPZaeRNPlluNFkxGsLjM/992cdee3e4948bbb2e23e2f9fc6f5610/unnamed.webp"],"location":[0],"website":[0],"twitter":[0],"facebook":[0]}],[0,{"name":[0,"Trishna"],"slug":[0,"trishna"],"bio":[0],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/4wonOgoxwHRvqvB9bqZG40/3d7cbfc1b9415ee4f5f149eb65771435/unnamed__1_.webp"],"location":[0],"website":[0],"twitter":[0],"facebook":[0]}],[0,{"name":[0,"Jordan Lilly"],"slug":[0,"jordan-lilly"],"bio":[0],"profile_image":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/4Z6hLBngN8fabemgRiMI69/2408993e356539e9fbfb7dfe5233942f/Jordan_Lilly.jpg"],"location":[0],"website":[0],"twitter":[0],"facebook":[0]}]]],"meta_description":[0,"Cloudflare strengthens its commitment to cybersecurity by joining CISA's \"Secure by Design\" pledge. In line with this commitment, we're reducing the prevalence of vulnerability classes across our products. Through these efforts, we are ensuring that Cloudflare’s systems, employees, and customers remain secure — no matter what."],"primary_author":[0,{}],"localeList":[0,{"name":[0,"blog-english-only"],"enUS":[0,"English for Locale"],"zhCN":[0,"No Page for Locale"],"zhHansCN":[0,"No Page for Locale"],"zhTW":[0,"No Page for Locale"],"frFR":[0,"No Page for Locale"],"deDE":[0,"No Page for Locale"],"itIT":[0,"No Page for Locale"],"jaJP":[0,"No Page for Locale"],"koKR":[0,"No Page for Locale"],"ptBR":[0,"No Page for Locale"],"esLA":[0,"No Page for Locale"],"esES":[0,"No Page for Locale"],"enAU":[0,"No Page for Locale"],"enCA":[0,"No Page for Locale"],"enIN":[0,"No Page for Locale"],"enGB":[0,"No Page for Locale"],"idID":[0,"No Page for Locale"],"ruRU":[0,"No Page for Locale"],"svSE":[0,"No Page for Locale"],"viVN":[0,"No Page for Locale"],"plPL":[0,"No Page for Locale"],"arAR":[0,"No Page for Locale"],"nlNL":[0,"No Page for Locale"],"thTH":[0,"No Page for Locale"],"trTR":[0,"No Page for Locale"],"heIL":[0,"No Page for Locale"],"lvLV":[0,"No Page for Locale"],"etEE":[0,"No Page for Locale"],"ltLT":[0,"No Page for Locale"]}],"url":[0,"https://blog.cloudflare.com/cisa-pledge-commitment-reducing-vulnerability"],"metadata":[0,{"title":[0,"Demonstrating reduction of vulnerability classes: a key step in CISA’s “Secure by Design” pledge"],"description":[0,"Cloudflare strengthens its commitment to cybersecurity by joining CISA's \"Secure by Design\" pledge. In line with this commitment, we're reducing the prevalence of vulnerability classes across our products. Through these efforts, we are ensuring that Cloudflare’s systems, employees, and customers remain secure — no matter what."],"imgPreview":[0,"https://cf-assets.www.cloudflare.com/zkvhlag99gkb/2wVinvNgV0jwDfPPPE6RCy/2aa6447482a80a14b374f5b2c8df1d86/Demonstrating_reduction_of_vulnerability_classes-_a_key_step_in_CISA_s__Secure_by_Design__pledge-OG.png"]}]}]]],"locale":[0,"ja-jp"],"translations":[0,{"posts.by":[0,"リーク元"],"footer.gdpr":[0,"GDPR"],"lang_blurb1":[0,"この投稿は{lang1}でも表示されます。"],"lang_blurb2":[0,"この投稿は{lang1}および{lang2}でも表示されます。"],"lang_blurb3":[0,"この投稿は{lang1}、{lang2}、{lang3}でも表示されます。"],"footer.press":[0,"プレス"],"header.title":[0,"Cloudflare ブログ"],"search.clear":[0,"消去"],"search.filter":[0,"フィルター"],"search.source":[0,"ソース"],"footer.careers":[0,"キャリア"],"footer.company":[0,"会社"],"footer.support":[0,"サポート"],"footer.the_net":[0,"theNet"],"search.filters":[0,"フィルター"],"footer.our_team":[0,"Cloudflareのチーム"],"footer.webinars":[0,"ウェビナー"],"page.more_posts":[0,"その他の投稿"],"posts.time_read":[0,"{time}分で読了"],"search.language":[0,"言語"],"footer.community":[0,"コミュニティ"],"footer.resources":[0,"リソース"],"footer.solutions":[0,"ソリューション"],"footer.trademark":[0,"商標"],"header.subscribe":[0,"登録"],"footer.compliance":[0,"コンプライアンス"],"footer.free_plans":[0,"Freeプラン"],"footer.impact_ESG":[0,"インパクト/ESG"],"posts.follow_on_X":[0,"Xでフォロー"],"footer.help_center":[0,"ヘルプセンター"],"footer.network_map":[0,"ネットワークマップ"],"header.please_wait":[0,"お待ちください"],"page.related_posts":[0,"関連ブログ投稿"],"search.result_stat":[0,"{search_keyword}の結果{search_range}/{search_total}"],"footer.case_studies":[0,"導入事例"],"footer.connect_2024":[0,"Connect 2024"],"footer.terms_of_use":[0,"利用規約"],"footer.white_papers":[0,"ホワイトペーパー"],"footer.cloudflare_tv":[0,"Cloudflare TV"],"footer.community_hub":[0,"コミュニティハブ"],"footer.compare_plans":[0,"プラン比較"],"footer.contact_sales":[0,"営業担当へのお問い合わせ"],"header.contact_sales":[0,"営業担当へのお問い合わせ"],"header.email_address":[0,"メールアドレス"],"page.error.not_found":[0,"ページが見つかりません"],"footer.developer_docs":[0,"開発者ドキュメント"],"footer.privacy_policy":[0,"プライバシーポリシー"],"footer.request_a_demo":[0,"デモ依頼"],"page.continue_reading":[0,"続きを読む"],"footer.analysts_report":[0,"アナリストレポート"],"footer.for_enterprises":[0,"エンタープライズ向け"],"footer.getting_started":[0,"利用開始"],"footer.learning_center":[0,"ラーニングセンター"],"footer.project_galileo":[0,"プロジェクトGalileo"],"pagination.newer_posts":[0,"次の投稿"],"pagination.older_posts":[0,"以前の投稿"],"posts.social_buttons.x":[0,"Xで議論"],"search.icon_aria_label":[0,"検索"],"search.source_location":[0,"ソース/ロケーション"],"footer.about_cloudflare":[0,"Cloudflareについて"],"footer.athenian_project":[0,"Athenianプロジェクト"],"footer.become_a_partner":[0,"パートナープログラム"],"footer.cloudflare_radar":[0,"Cloudflare Radar"],"footer.network_services":[0,"ネットワークサービス"],"footer.trust_and_safety":[0,"信頼性と安全性"],"header.get_started_free":[0,"まずは無料プランから"],"page.search.placeholder":[0,"Cloudflareを検索"],"footer.cloudflare_status":[0,"Cloudflareステータス"],"footer.cookie_preference":[0,"Cookieの設定"],"header.valid_email_error":[0,"有効なメールアドレスを入力してください。"],"search.result_stat_empty":[0,"検索結果 {search_total}件中{search_range}件を表示"],"footer.connectivity_cloud":[0,"コネクティビティクラウド"],"footer.developer_services":[0,"開発者サービス"],"footer.investor_relations":[0,"IR"],"page.not_found.error_code":[0,"エラーコード:404"],"search.autocomplete_title":[0,"クエリを挿入し、Enterキーを押して送信してください"],"footer.logos_and_press_kit":[0,"ロゴとプレスキット"],"footer.application_services":[0,"アプリケーションサービス"],"footer.get_a_recommendation":[0,"推奨製品"],"posts.social_buttons.reddit":[0,"Redditで議論"],"footer.sse_and_sase_services":[0,"SSEサービスとSASEサービス"],"page.not_found.outdated_link":[0,"古いリンクを使われたか、アドレスを誤って入力された可能性があります。"],"footer.report_security_issues":[0,"セキュリティの問題を報告"],"page.error.error_message_page":[0,"お探しのページは見つかりませんでした。"],"header.subscribe_notifications":[0,"新規投稿のお知らせを受信されたい方は、サブスクリプションをご登録ください:"],"footer.cloudflare_for_campaigns":[0,"Cloudflare for Campaigns"],"header.subscription_confimation":[0,"サブスクリプションが確定されました。ご登録ありがとうございます!"],"posts.social_buttons.hackernews":[0,"Hacker Newsでの議論"],"footer.diversity_equity_inclusion":[0,"多様性、公平性、包摂性"],"footer.critical_infrastructure_defense_project":[0,"重要インフラ防衛プロジェクト"]}],"localesAvailable":[1,[[0,"en-us"],[0,"zh-cn"],[0,"fr-fr"],[0,"de-de"],[0,"es-es"]]],"footerBlurb":[0,"Cloudflareは企業ネットワーク全体を保護し、お客様がインターネット規模のアプリケーションを効率的に構築し、あらゆるWebサイトやインターネットアプリケーションを高速化し、DDoS攻撃を退け、ハッカーの侵入を防ぎ、ゼロトラスト導入を推進できるようお手伝いしています。
Cloudflare’s 2024 Transparency Reports are now live — with new topics, new data points, and a new format, consistent with the EU’s Digital Services Act...
Cloudflare is the first organization globally to announce having been successfully audited against the ‘Global Cross-Border Privacy Rules’ system and ‘Global Privacy Recognition for Processors’....
Cloudflare strengthens its commitment to cybersecurity by joining CISA's "Secure by Design" pledge. In line with this, we're reducing the prevalence of vulnerability classes across our products....