Introducing the 2026 Cloudflare Threat Report
This post introduces the 2026 Cloudflare Threat Report, detailing the evolution of the threat landscape towards 'high-trust exploitation' and a focus on 'Measure of Effectiveness' (MOE) by adversaries. Key findings include AI automating attacker operations, state-sponsored pre-positioning, over-privileged SaaS integrations, weaponization of trusted cloud tooling (e.g., Google Drive, Dropbox, GitHub, Amazon SES, SendGrid) for C2 and payload hosting, deepfake personas for espionage, token theft bypassing MFA, relay blind spots for brand spoofing, and hyper-volumetric DDoS attacks. Cloudforce One's methodology includes using AI coding agents for self-vulnerability analysis (discovering CVE-2026-22813), analyzing Phishing-as-a-Service (PhaaS) with DMARC failures, and tracking DDoS baseline traffic. The report advocates for autonomous defense to counter threats moving at machine speed and announces an upgrade to Cloudflare's threat events platform.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack