Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Cloudflare Radar already offers a wide array of security insights — from application and network layer attacks, to malicious email messages, to digital certificates and Internet routing. And today we’re introducing even more. We are launching several new security-related data sets and tools on Radar.

Internet traffic relies on the Border Gateway Protocol (BGP) to find its way between networks. However, this traffic can sometimes be misdirected due to configuration errors or malicious actions. When traffic is routed through networks it was not intended to pass through, it is known as a route leak. We have written on our blog multiple times about BGP route leaks and the impact they have on Internet routing, and a few times we have even alluded to a future of path verification in BGP.

Why does traditional Kubernetes security fall short? Static scanners flag thousands of CVEs but can’t tell you which ones are actually loaded into memory and exploitable—only about 15% are loaded at runtime. Traditional tools also create siloed visibility, with CSPM, vulnerability scanners, and EDR each seeing only one slice of your environment. This makes it impossible to spot lateral movement or connect events across cloud, cluster, container, and application layers.

Working at the Black Hat Network Operations Center (NOC) as a data scientist makes me a bit of an outlier (pun intended) among network engineers and hard-core threat hunters.

With the holiday season all wrapped up (pun definitely intended), I finally have time to sit down and digest what we saw in the network traffic at Black Hat Europe 2025 while working alongside the other Network Operations Center (NOC) partners: Arista, Cisco, Jamf, and Palo Alto Networks. As usual, there is a mix of the expected, a dash of the unexpected, and some lessons for newcomers and greybeards alike. Let’s get into it.

LimaCharlie's SecOps Cloud Platform is built around a simple idea: everything connects via API. That includes AI. Rather than locking you into a proprietary and limited AI SOC, LimaCharlie lets you bring your own LLM and put it to work directly inside your security environment. With LimaCharlie, AI can execute operations across your detections, sensors, and integrations. Because LimaCharlie operates entirely via API, every AI action is transparent and auditable.

When we think of spring, we think of things in bloom; flowers, ideas, maybe even hope for the snow to melt here in our US headquarters Boston, MA. But regardless of the snow, we've chosen to embrace the idea of spring and letting your workflow creativity grow! What better way to let that creativity shine than with another round of You Did WHAT With Tines?! (YDWWT) For the Spring 2026 round of YDWWT, we want to know what your team can achieve with a Tines workflow.

Software-defined networking (SD-WAN) has transformed enterprise infrastructure, enabling dynamic connectivity between sites with centralized management and control. But when the control plane itself becomes vulnerable, network integrity is no longer a given.

Microsoft has made significant gains in the cybersecurity market, earning top rankings from leading analyst firms such as IDC and Forrester for its endpoint protection and threat detection and response capabilities. Solutions like Microsoft Defender XDR and Microsoft Sentinel provide powerful, integrated security across endpoints, identities, email, cloud workloads, and data. But technology alone does not deliver outcomes.

Today, most security reporting is trapped in a defensive cycle: detect a threat, react to it, report how serious it was. Rinse and repeat. The problem? Executive fatigue. Boards and leadership teams are tired of hearing about noise. They don’t want another dashboard of inbound attacks. They want to understand how cybersecurity protects revenue, sustains operations, and strengthens governance. It’s time to stop reporting on threats—and start reporting on business continuity.