Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account
Sep 29, 2026Emilia Yoffie, Victor Niño, Brian Seel, Jacob Crisp

Summary
Introduces Threat Signals, a new capability that leverages agentic skills to automate the processing of open-source threat intelligence reports (via RSS feeds) into actionable threat events. This includes summarizing reports, extracting and normalizing indicators of compromise (IOCs), applying account-specific tags, and storing contextualized indicators in a private, account-scoped dataset. Threat Signals integrates with Cloudflare Workflows, Browser Run, R2, and the Threat Events Platform, allowing for the creation of WAF rules from these events. This expands the AI-assisted vulnerability discovery and threat intelligence capabilities by automating the conversion of unstructured threat reporting into structured, actionable intelligence.
More from the AI-assisted Vulnerability Discovery trail
- Adaptive application security for the AI era: how Cloudflare connects code, traffic, and intelligence to stop attacks
- Agents can now set up your website’s security with Turnstile Spin
- Project Glasswing: what Mythos showed us
- From reactive to proactive: closing the phishing gap with LLMs
- A simpler path to a safer Internet: an update to our CSAM scanning tool