Cloudflare has mostly ditched third party security tools, suggests not trying that at home

Cloudflare has used AI to automate processing of incoming reports to its bug bounty program for $58 a month using Anthropic's Claude Sonnet model and chose it partly because using the AI company's security-specific Mythos model would burn through around $200,000 a month to do the same job. The company's chief security officer (CSO) Grant Bourzikas shared those numbers with The Register last week during a press lunch in Sydney, Australia, where he said Cloudflare used to manually process all incoming bug reports. Sonnet now sifts through submissions, assesses them to ensure they aren't duplicates, and evaluates the likelihood each represents something worthy of human consideration. Bourzikas said the result is a more efficient bug bounty program that requires less scutwork, and proof that AI users need to learn how to match the right model to the right job. The CSO said Cloudflare gained experience making those matches while creating over 200 autonomous agents it uses to handle its own security needs - and which have seen the company ditch almost all third-party security tools and replace them with home-grown applications, some coded with help from AI. The CSO recommended not trying that at home, saying that Cloudflare's business and unique infosec challenges mean its buy vs. build calculus is different from other organizations'. We have expertise in building security software," he said. That's why I would just want to make sure we've got one takeaway from this: We are not believers in the SaaSpocalypse. We do not think every bank on the planet should start building all their own software systems." Stephanie Cohen, Cloudflare's Chief Strategy Officer, then chimed in with her view that AI will mean the way vendors work with their customers will fundamentally change" away from selling packaged software. She thinks vendors will instead place forward-deployed engineers at their clients and charge them with constantly making software that works for you." Cohen explained Cloudflare's recent round of 1,100 job cuts as a similar AI-induced change, because some of the people let go were in roles she said make no sense" now that AI enables more automation and different styles of customer engagements. She added her guess" that Cloudflare will end up with the same headcount as it did before the layoffs. But Bourzikas added his view that even some early-career IT pros don't have the skills Cloudflare now needs, such as developers with five to ten years' experience, because when he is using AI to develop a new piece of software, he can describe what he wants but that desire can be lost in translation when explaining it to a coder. He said a very recent college graduate with a year of experience, but excellent skills writing potent prompts, can be more appropriate for some jobs. Kindly building a business model for AI While Cloudflare enjoys using AI, Cohen thinks the technology doesn't have a business model. Today's web, she said, thrives on an advertising-based business model. While AI companies are making billions from subscriptions, she feels they are yet to properly address the fact that they do not pay to access most of the content scraped to feed their large language models and search services. Some of those services, such as Google's AI-powered search, deliver fewer clicks to publishers and therefore make it harder for them to monetize their content. Cloudflare is offering itself as an intermediary to build that business model for publishers and AI companies alike, by using the fact it already sits between users and content providers. The company hopes to offer AI companies the chance to pay publishers to access their content, possibly using micropayments. Cloudflare will of course charge for this service. The Register put it to Cohen that many organizations have been burned, often multiple times, by big tech companies that make themselves all-but essential parts of an ecosystem and then change the rules. We pointed out that social media platforms can redirect traffic on a whim, and sometimes close e-commerce companies' accounts with little warning and scant chance of appealing to secure restoration. Changes to search engine algorithms can make a once-prominent website invisible. We therefore asked why publishers or content creators should trust Cloudflare's ambition to run a content tollbooth, given it would create a relationship ripe for future exploitation. Cohen pointed to the company choosing to add SSL connections for all customers, an act she said was an expensive choice" but one that also reflects Cloudflare's desire to build a better internet. Later at the event, she shared her view that Silicon Valley companies often make the mistake of thinking that people want internet companies to relentlessly optimize products and services. Most people aren't working 20 hours a day and don't want to outsource everything," she said, before observing that on her travels she often sees people shopping in actual real-world stores because they enjoy that experience and find it valuable - never mind that an e-tailer might offer a better price. For the record, and in the context of Cloudflare's content intermediary ambitions, we note that the company calls San Francisco home. (R)