Artificial intelligence is becoming a new interface to enterprise data, applications, and actions. Employees are adopting public AI tools, developers are embedding models into products, and agents are beginning to call business systems on a user's behalf. The opportunity is significant, but the security model must evolve with it.
Safe adoption does not mean blocking AI. It means giving people and teams an approved path to use it while preserving control over sensitive data, identities, applications, models, and connected tools.
Cloudflare provides a unified control plane across the network paths where AI is used and delivered. Organizations can discover AI activity, apply identity and data policies, protect AI-powered applications, govern model access, and control agent connections without forcing traffic through disconnected security stacks.
The goal: accelerate useful AI adoption while making access explicit, data use observable, and risk manageable.
AI introduces familiar security concerns in unfamiliar forms. Sensitive data can leave through a prompt. An application can be manipulated with prompt injection. A model endpoint can be abused at machine speed. An agent can reach tools and data with more authority than intended. At the same time, blunt restrictions often push users toward unmanaged alternatives.
A durable AI security program should answer four questions:
Cloudflare addresses these requirements across four connected surfaces:
| Adoption surface | Primary risk | Cloudflare control |
|---|---|---|
| Workforce AI | Shadow AI and sensitive-data disclosure | Gateway, AI Security Report, DLP, CASB, Browser Isolation |
| AI-powered applications | Prompt injection, unsafe input, data exposure, abuse | AI Security for Apps, WAF, API Security, Bot Management, rate limiting |
| Models and providers | Uncontrolled access, cost, reliability, and fragmented logs | AI Gateway, DLP, Guardrails, rate limiting, caching, retries and fallback |
| AI agents and tools | Excessive authority, unmanaged MCP connections, weak auditability | Cloudflare Access, MCP server portals, Gateway policy, request logs |
Traditional applications expose predefined inputs and deterministic workflows. AI systems accept natural language, interpret intent probabilistically, and increasingly decide which tools to call. This expands the attack surface in three ways.
Data becomes conversational. A user can disclose source code, credentials, customer records, or financial information in a prompt as easily as attaching a file. Responses can also contain sensitive or inappropriate content.
Instructions become an attack vector. Prompt injection and jailbreak techniques attempt to override application intent, reveal hidden context, or induce unsafe behavior. Exact-match rules alone cannot reliably identify every variation.
Access can become action. Agents connect models to APIs, repositories, SaaS platforms, and internal systems. A compromised prompt or overprivileged tool can turn an incorrect answer into an unauthorized action.
The right response is defense in depth: identity before access, inspection during exchange, application protection at the edge, least privilege for tools, and telemetry across every layer.
Start with evidence, not policy assumptions. Establish which AI applications employees use, where AI-powered endpoints exist, which providers development teams call, and which MCP servers or agent tools are connected.
Cloudflare Gateway provides visibility into outbound AI application traffic. The AI Security Report summarizes organizational AI use so security teams can identify popular services, users, and activity patterns. AI Security for Apps can discover LLM-related endpoints on protected applications and add AI-specific analytics. AI Gateway centralizes telemetry for model calls made by applications. Gateway can also identify MCP traffic, subject to feature availability.
Outcome: an inventory of workforce applications, AI-enabled application endpoints, model providers, and agent connections, with owners assigned.
Create approved paths rather than relying on blanket bans. Segment use by identity, group, device posture, application, action, and data sensitivity.
Cloudflare Gateway can allow, block, or isolate AI applications and apply granular controls to specific in-app actions. Cloudflare DLP can inspect prompts and web traffic for PII, source code, credentials and secrets, financial information, customer data, and organization-defined patterns or topics. Prompt analysis can also identify risky intent such as jailbreak attempts or requests for malicious code. API-based CASB integrations can assess supported enterprise AI tenants for posture issues and sensitive data exposure.
For agent access, Cloudflare Access can place identity-aware policy in front of MCP servers. MCP server portals can present an approved catalog of servers, tools, and prompts to specific users while logging tool requests. Direct server access should also be protected so that users cannot bypass portal policy.
Outcome: users have a clear sanctioned route to AI, sensitive data is governed in context, and agent tools are exposed by least privilege.
AI-specific controls should complement, not replace, established application and API security.
AI Security for Apps extends Cloudflare's WAF operating model with model-agnostic detections for LLM traffic. It can identify prompt injection and jailbreak attempts, PII in prompts, and unsafe or custom topics. Teams can use these signals in WAF custom rules and rate limiting policies. Because the service sits in front of the application, the model can remain on Cloudflare, in another cloud, or on-premises.
The surrounding application should retain standard protections: DDoS mitigation, WAF managed rules, API discovery and schema controls, bot management, authentication, and rate limiting. Together, these controls reduce conventional web attacks, automated abuse, model scraping, denial-of-wallet patterns, and AI-specific manipulation.
For outbound model calls, AI Gateway creates a consistent control point across providers. Teams can apply observability, DLP, content guardrails, rate limits, caching, retries, and model fallback without rebuilding those controls separately for each application.
Outcome: every AI request passes through layered controls appropriate to the application, model, user, and data involved.
AI governance is a continuous operating process. Begin in visibility mode, baseline normal behavior, test policy with representative prompts, and move controls to enforcement in measured stages.
Send Gateway, Access, WAF, and AI Gateway telemetry to existing security and observability workflows. Track exceptions with an owner and expiration date. Review newly adopted AI applications, changes in prompt topics, blocked data events, model error and fallback rates, agent tool activity, and AI endpoint attack signals.
Outcome: policy evolves with use, product changes, and emerging threats instead of becoming a one-time compliance exercise.
| Phase | Actions | Evidence of progress |
|---|---|---|
| Days 0–30: Observe | Route relevant workforce and application traffic through Cloudflare; enable reports and logging; inventory AI apps, endpoints, providers, data classes, and MCP connections | Named owners, baseline usage, prioritized risks |
| Days 31–60: Govern | Publish sanctioned-use policy; pilot DLP in log mode; define application and action controls; place identity policy in front of agent tools; standardize new model integrations through AI Gateway | Approved service catalog, tested policy, documented exceptions |
| Days 61–90: Enforce | Block high-confidence sensitive-data events; restrict unsanctioned applications and MCP paths; activate AI application mitigations and abuse controls; connect alerts and logs to operations | Measured enforcement, lower unmanaged use, incident playbooks |
The central challenge of AI adoption is not choosing between innovation and control. It is designing a path where both reinforce each other.
Cloudflare applies security at the points where users, applications, models, data, and agents connect. A unified platform helps organizations replace fragmented controls with consistent policy and shared visibility, while preserving flexibility across AI applications, model providers, clouds, and deployment locations.
Organizations can begin with discovery, establish approved paths, enforce controls according to risk, and improve continuously. The result is not simply safer AI. It is an operating model that allows AI to move from isolated experiments to trusted, enterprise-scale use.
Run a focused AI security workshop to map one workforce use case, one AI-powered application, and one agent workflow. Document data paths, identities, tools, current controls, and a 90-day policy plan. This creates a practical starting point while establishing a pattern that can scale.