Two significant updates from Cloudflare
Cloudflare has announced two security capabilities that deserve attention from organisations running infrastructure or web applications at scale. The first gives Magic Transit customers the ability to write their own DDoS mitigation logic. The second opens up an AI-powered client-side security toolset to all Cloudflare users.
Both updates reflect a broader shift: security controls are becoming more programmable, more intelligent, and more accessible.
Programmable Flow Protection for Magic Transit
Magic Transit customers can now deploy custom DDoS mitigation logic directly across Cloudflare's global network. This is a meaningful step for organisations that rely on custom or proprietary UDP protocols.
Standard DDoS mitigation works well for common traffic patterns. But if your environment uses non-standard protocols, the generic rules often fall short. They either block legitimate traffic or let malicious flows through. Programmable Flow Protection addresses this by letting network teams define their own stateful mitigation rules, tailored to the specific protocols they run.
For organisations in gaming, telecommunications, financial services, or IoT, where bespoke UDP protocols are common, this removes a real friction point. You no longer need to accept a one-size-fits-all approach to volumetric attack mitigation.
What to consider
- If you are a Magic Transit customer using custom protocols, this is worth evaluating now. The ability to encode protocol-specific logic into your DDoS defence layer is a significant improvement.
- Teams will need the expertise to write and maintain these rules. Programmability is powerful, but it also shifts responsibility. Poorly written mitigation logic can cause as many problems as the attacks it aims to stop.
- This capability reinforces the case for organisations to document and deeply understand their own traffic patterns before building custom rules.
Client-Side Security with cascading AI detection
Cloudflare's Client-Side Security tools, previously limited to enterprise tiers, are now available to all users. The standout feature is a cascading AI detection system that combines graph neural networks with large language models to identify malicious scripts running in users' browsers.
Client-side attacks, such as Magecart-style skimming and supply chain compromises through third-party JavaScript, remain a persistent threat. They are difficult to detect because the malicious code executes in the browser, outside the reach of traditional server-side security controls.
Cloudflare reports that the new detection pipeline has reduced false positives by up to 200x compared to earlier methods, while also catching sophisticated zero-day exploits. That reduction in noise matters. High false-positive rates have historically been one of the biggest barriers to adopting client-side monitoring effectively.
What to consider
- If your organisation handles payments, customer data, or sensitive form inputs on the web, client-side security should be part of your security programme. PCI DSS 4.0 requirements around script monitoring make this particularly relevant.
- The fact that these tools are now available on all Cloudflare plans lowers the barrier significantly. Smaller organisations that previously could not justify the cost now have access to capable detection.
- AI-driven detection is not infallible. Teams should still review flagged scripts and maintain an inventory of approved third-party resources.
Metaphor's perspective
These updates highlight two trends we see regularly in our work with clients.
First, the network edge continues to absorb more security logic. Programmable DDoS mitigation is another step towards infrastructure-as-code for network defence. This is good, but it requires mature operational practices. Writing mitigation rules that run across a global network is not something to approach casually.
Second, AI is starting to deliver practical value in security detection, not just hype. A 200x reduction in false positives is the kind of outcome that changes whether a tool gets used or ignored. We are cautiously optimistic about this direction.
For organisations already using Cloudflare, both capabilities are worth reviewing with your security and infrastructure teams. For those evaluating their broader security posture, these developments are a useful reference point for what modern edge security looks like.
If you would like help assessing how these capabilities fit into your environment, we are happy to talk it through.
Sources: Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customers, Cloudflare Client-Side Security: smarter detection, now open to everyone