cloudflareMay 21, 2026

Announcing Claude Compliance API support with Cloudflare CASB (opens in new tab)

Cloudflare is adding Claude Compliance API support to CASB, giving security teams visibility into Claude usage without endpoint agents or inline traffic inspection. The integration scans Claude organizations, projects, conversations, files, and artifacts for sharing issues and sensitive data, then surfaces findings in the Cloudflare dashboard. It also connects those findings to Cloudflare Gateway policies so teams can move from detection to enforcement. ## The Security Challenge of Enterprise AI - AI adoption has outpaced governance, leaving organizations with limited visibility into sanctioned tools. - Traditional controls may block unauthorized applications but cannot inspect activity inside approved AI platforms. - AI-specific risks include: - Employees entering customer or confidential data into prompts - Developers exposing API keys - AI-generated content containing company secrets - Files and data being shared through persistent conversations and agent workflows - Effective protection must cover the full lifecycle of AI data, including API usage, content handling, and data stored within applications. ## Cloudflare’s Layered AI Security Model - **Cloudflare AI Gateway** monitors requests, token usage, and model performance while supporting rate limits, caching, and routing controls. - **Cloudflare Gateway and Data Loss Prevention** inspect AI traffic and can block prompts containing personally identifiable information or confidential material. - **Cloudflare Access with MCP server portals** protects connections between agents and corporate systems, with centralized access control and audit logging. - **Cloudflare CASB** scans data stored inside Claude for misconfigurations and sensitive content through API integrations. ## Claude Compliance API Findings Cloudflare CASB connects to Anthropic’s Compliance API and displays findings alongside those from applications such as Microsoft 365, Google Workspace, and Salesforce. - **Projects:** Detect projects shared with an organization or selected users and groups. - **Project attachments:** Identify files and documents violating DLP policies. - **Chat files:** Scan user-uploaded and provider-generated files. - **Chat messages:** Inspect prompts and provider responses for sensitive data. - **Artifacts:** Detect sensitive information in AI-generated documents and files. - Findings are categorized, prioritized by severity, and handled through existing triage, assignment, and remediation workflows. ## Coverage for Claude Enterprise and Platform - For **Claude Enterprise**, CASB retrieves information about organizations, projects, chats, roles, messages, and uploaded files using read-only endpoints. - For **Claude Platform**, it continues to monitor member and workspace changes, API key creation, and file creation or download events. - Support for the Claude Platform Activity Feed is planned for a future release. ## From Detection to Enforcement - A finding such as a sensitive file upload can be converted into a Cloudflare Gateway policy. - Administrators can: - Block uploads to Claude for specific users - Restrict access to Claude entirely - Limit application functionality until the issue is resolved - This combines CASB’s visibility into stored data with Cloudflare’s inline policy enforcement. ## Getting Started - Organizations need a Claude Enterprise account. - They must request Compliance API access from Anthropic. - Once access is granted, the integration can be connected through Cloudflare CASB. Cloudflare’s recommendation is to combine CASB monitoring with Gateway, DLP, AI Gateway, and Access controls to govern AI usage across both traffic and stored data.

saas-securitymcpdata-loss-preventionanthropic+4

cloudflareMar 6, 2026

From the endpoint to the prompt: a unified data security vision in Cloudflare One (opens in new tab)

Cloudflare One presents data security as a unified problem spanning networks, SaaS applications, endpoints, and AI prompts. Its strategy is to follow data wherever it moves, combining visibility, policy controls, and enforcement rather than relying on siloed products. The latest updates extend this model from browser-based RDP clipboard controls to SaaS operation logging, endpoint DLP, and Microsoft 365 Copilot scanning. ### Browser-Based RDP Clipboard Controls - Administrators can control whether users copy or paste data between local devices and browser-based RDP sessions. - Policies can be directional and context-specific: - Allow copying into a remote session for productivity. - Block copying sensitive information out to unmanaged endpoints. - The feature is configured through Access Application Policies for browser-based RDP applications. - Granular controls aim to reduce risky workarounds such as screenshots, manual retyping, or use of unsanctioned tools. ### Operation-Level Visibility in SaaS Logs - Cloudflare’s operation-mapping process interprets HTTP request details as recognizable actions, such as `SendPrompt` in ChatGPT. - Related operations are grouped into higher-level Application Controls such as “Share” or “Upload.” - These mapped operations now appear automatically in log events for matching SaaS traffic. - Log details include both the application control and the specific operation, helping teams investigate activity and refine policies more quickly. ### Endpoint DLP for Data in Use - The Cloudflare One Client now provides Endpoint DLP enforcement, beginning with clipboard-based data movement. - This protects sensitive content after it leaves a browser or managed SaaS application and enters the operating system clipboard. - The feature addresses risks such as copying customer records or proprietary code into personal tools or unauthorized AI assistants. - Organizations can extend existing Gateway, DLP, CASB, and API-based controls without deploying a separate endpoint agent. ### Microsoft 365 Copilot Scanning - API CASB can now analyze Microsoft 365 Copilot activity for data-security risks. - Scanning covers Copilot chats and uploads that match configured DLP detection profiles. - Findings include contextual information such as referenced files, matching DLP profiles, and interaction metadata. - This extends Cloudflare’s existing API integrations for OpenAI ChatGPT, Anthropic Claude, and Google Gemini. Cloudflare’s recommendation is effectively to treat data movement as one continuous security problem: control access in transit, monitor activity in SaaS, enforce protections on endpoints, and inspect how data is used in AI prompts. Together, these capabilities are intended to keep policy attached to the data rather than limited to a particular application or product boundary.

saas-securitydatabase-designai-securitycloudflare-one+4

cloudflareMar 3, 2026

How Cloudy translates complex security into human action (opens in new tab)

Cloudy is Cloudflare’s LLM-powered explanation layer for Cloudflare One, translating complex security detections into clear, actionable guidance. It helps security teams understand why emails or SaaS findings were flagged and helps end users make better decisions in real time. Its integration with Phishnet aims to reduce unnecessary SOC submissions while preserving strong protection against genuine threats. ## Turning Complex Detections into Human Guidance - Email and CASB systems analyze numerous signals, including sender reputation, authentication, links, infrastructure, behavior, misconfigurations, and exposed data. - Traditional detections may correctly identify risk without clearly explaining the reasoning. - Cloudy converts machine-learning outputs into concise explanations for both administrators and nontechnical users. - For Email Security, it explains why messages are classified as Malicious, Suspicious, Spam, Bulk, or Spoof. - For CASB, it is intended to clarify the risk and remediation path for SaaS findings. ## The Challenge for Email Users and SOC Teams - Users increasingly serve as an additional defense layer against social engineering and impersonation attacks. - Periodic security training and phishing simulations do not provide enough context when users encounter real messages. - This creates two problems: - Some users report nearly every questionable email, overwhelming SOC queues. - Others interact with risky messages because no clear warning appears at the moment of decision. - Excessive reporting creates backlogs and slows investigations of genuinely dangerous emails. ## Cloudy in Phishnet - Cloudy will be integrated into the Phishnet reporting workflow for Microsoft. - When users report a message, they will receive a simplified, plain-language explanation of the relevant security signals. - The goal is to help users decide whether a message is truly suspicious and reduce unnecessary escalations. - This allows SOC teams to focus on messages requiring investigation while making users more effective participants in security operations. ## How the Explanation Pipeline Works - A Phishnet report triggers a Cloudflare Workers-based workflow. - The workflow aggregates outputs from multiple detection models, including: - Sender reputation - Domain and infrastructure characteristics - SPF, DKIM, and DMARC authentication results - Link and content analysis - Behavioral indicators - Workers AI processes these structured signals using purpose-built prompts. - The prompts generate a natural-language explanation rather than changing the original message classification. - The experience is optimized for end users, avoiding overly technical terms such as ASNs, IP reputation, and raw authentication failures. ## Translating Technical Signals - An SPF failure becomes: “This email failed a sender verification check.” - A DKIM failure is explained as a failed message-integrity check that may indicate tampering. - A DMARC failure indicates that the sender’s domain could not confirm the email’s legitimacy. - These translations preserve the meaning of the underlying detections while making them understandable to nontechnical recipients. Cloudy’s practical value is its ability to connect sophisticated security analysis with immediate human decision-making. Embedding understandable explanations directly into Phishnet should improve user judgment, reduce SOC noise, and make complex detections more actionable without altering the underlying security verdict.

saas-securityllmmachine-learningcloudflare+4