How Cloudy translates complex security into human action (opens in new tab)

Cloudy is Cloudflare’s LLM-powered explanation layer for Cloudflare One, translating complex security detections into clear, actionable guidance. It helps security teams understand why emails or SaaS findings were flagged and helps end users make better decisions in real time. Its integration with Phishnet aims to reduce unnecessary SOC submissions while preserving strong protection against genuine threats.

Turning Complex Detections into Human Guidance

• Email and CASB systems analyze numerous signals, including sender reputation, authentication, links, infrastructure, behavior, misconfigurations, and exposed data.
• Traditional detections may correctly identify risk without clearly explaining the reasoning.
• Cloudy converts machine-learning outputs into concise explanations for both administrators and nontechnical users.
• For Email Security, it explains why messages are classified as Malicious, Suspicious, Spam, Bulk, or Spoof.
• For CASB, it is intended to clarify the risk and remediation path for SaaS findings.

The Challenge for Email Users and SOC Teams

• Users increasingly serve as an additional defense layer against social engineering and impersonation attacks.
• Periodic security training and phishing simulations do not provide enough context when users encounter real messages.
• This creates two problems:
  • Some users report nearly every questionable email, overwhelming SOC queues.
  • Others interact with risky messages because no clear warning appears at the moment of decision.
• Excessive reporting creates backlogs and slows investigations of genuinely dangerous emails.

Cloudy in Phishnet

• Cloudy will be integrated into the Phishnet reporting workflow for Microsoft.
• When users report a message, they will receive a simplified, plain-language explanation of the relevant security signals.
• The goal is to help users decide whether a message is truly suspicious and reduce unnecessary escalations.
• This allows SOC teams to focus on messages requiring investigation while making users more effective participants in security operations.

How the Explanation Pipeline Works

• A Phishnet report triggers a Cloudflare Workers-based workflow.
• The workflow aggregates outputs from multiple detection models, including:
  • Sender reputation
  • Domain and infrastructure characteristics
  • SPF, DKIM, and DMARC authentication results
  • Link and content analysis
  • Behavioral indicators
• Workers AI processes these structured signals using purpose-built prompts.
• The prompts generate a natural-language explanation rather than changing the original message classification.
• The experience is optimized for end users, avoiding overly technical terms such as ASNs, IP reputation, and raw authentication failures.

Translating Technical Signals

• An SPF failure becomes: “This email failed a sender verification check.”
• A DKIM failure is explained as a failed message-integrity check that may indicate tampering.
• A DMARC failure indicates that the sender’s domain could not confirm the email’s legitimacy.
• These translations preserve the meaning of the underlying detections while making them understandable to nontechnical recipients.

Cloudy’s practical value is its ability to connect sophisticated security analysis with immediate human decision-making. Embedding understandable explanations directly into Phishnet should improve user judgment, reduce SOC noise, and make complex detections more actionable without altering the underlying security verdict.