Toxic combinations: when small signals add up to a security incident

This post introduces the concept of 'toxic combinations' in security incidents, defined as the convergence of multiple minor signals (bot traffic, sensitive application paths, request anomalies, misconfigurations) to indicate a potential breach. It details how Cloudflare's platform can detect these combinations by analyzing these signals and provides specific examples of toxic combinations related to probing administrative endpoints and unauthenticated API endpoints with predictable identifiers. It also outlines mitigation strategies for these vulnerabilities.