Each engagement begins with one application the customer nominates [17], and access is invitation only, held to selected enterprise customers, with no pricing disclosed and no date for anything wider [16][19]. So before a model runs, somebody has to name, to a vendor, the app they are least confident about. That upfront targeting step is the one a scanner never asks for.
What teams say about their vulnerability backlog is that it is a triage problem. What they do is put a mitigation in front of the vulnerable route and leave the code ticket open. Cloudflare has built the product around the second behaviour. The firewall rule is the thing that goes live, scoped to the method, path and request details needed to reach the vulnerable code, and the patch is a draft handed to engineers [7]. Both wait on explicit human approval, and Cloudflare says the models cannot apply either one by themselves [8].
The volume argument behind it holds up. Cloudflare cites 60,475 vulnerabilities taken into the National Vulnerability Database by September against 48,185 for all of 2025 [11]. Read as nine months, that is roughly 6,719 a month versus 4,015 a month last year, about 1.67 times the rate [12]. The real cleverness of the design sits downstream of that volume number. A finding is validated first, and its risk rating then moves up when production evidence shows heavy traffic or active probing against the affected route [5][6]. That is a re-ranking service wearing a discovery service's name, and re-ranking is what a team drowning in scanner output actually needs. Cloudflare's own framing of the gap is that scanners hand over thousands of findings without showing which ones matter in production [24].
On the word edge, some precision is owed. Prompts travel through Cloudflare AI Gateway to OpenAI servers, and no inference runs on Cloudflare's own network [9]. Enforcement happens at the edge; the reasoning happens in someone else's data centre, with redaction deciding how much request context travels [9]. Every proposal must also clear checks written outside the model, and a failed check ends the workflow before the customer sees anything [10]. That redaction step, and what it lets through before a request reaches OpenAI's servers, is the detail a security review needs to interrogate closely.
The capability figure deserves the same care. OpenAI reports GPT-5.6-Cyber completing 95% of advanced cybersecurity requests on its own benchmark against 1.5% for GPT-5.6 Sol [14], about 63 times as many [15]. That measures the model's willingness to attempt the work, a separate question from whether the fix it produces is correct. Palo Alto Networks put the same models into Unit 42 consulting engagements last month [20], which is the research-services shape of this capability. Cloudflare's version ends in a rule that blocks traffic.
For anyone weighing an invitation, the grid has two axes: whether the route has production evidence behind it, and whether you control the code. Evidence plus your code, take the rule as a bridge and ship the patch. Evidence plus code you do not control, a vendor library or a third-party route, and the rule is the permanent answer, which means it needs an owner and a review date in writing. No evidence but your code, and it stays in the queue where it already was. No evidence and no control, and you are looking at a scanner finding with a better paragraph attached.
