Cloudforce One customers are protected by deep phishing and brand protections to mitigate risks of spoofing and brand impersonation attacks. Learn more

Cloudforce One

Cloudflare Threat Intelligence and Operations

Cloudforce One packages the vitals aspects of modern threat intelligence and operations to make organizations smarter, more responsive, and more secure. Cloudforce One is led by a world-class threat research team, experienced at disrupting global-scale threat actors.  

Learn more about Cloudforce One

Why Cloudforce One is different
Threat data at breathtaking scale

Only Cloudflare protects ~20% of the world's websites, allowing us to analyze a stunning amount of global data that nobody else has. We convert this data to finished, actionable threat intelligence.

Proven threat analytics and models

We run our vast threat data through dozens of layers of analytics and threat models to refine it into actionable threat intelligence, ready to be ingested into security tools.

World-class threat researchers

Cloudforce One calls on a world-class team of researchers, steeped in expertise analyzing and stopping nation-state and commercial-state cyber actors.

The Cloudforce One offering

Insights on adversaries

We empower security teams to make faster, more informed decisions through compelling research and insights about adversaries.

  • Threat briefings
  • In-depth attacker profiles including IoCs
  • Research on nation-state and commercial-state adversary TTPs
  • Industry-specific briefings

Finished threat intelligence

Incorporate differentiated, finished threat intelligence into your security postures and tools for more effective security.

  • Finished Threat feeds (STIX/TAXII)
  • Phishing and brand protections
  • Brand/phishing takedown service
  • Sinkholes and honeypots API

Threat Research RFIs

Make our threat researchers an extension of your team. Directly access our experts for bespoke threat intelligence reports that profile any attack, threat or threat actor of interest.

  • RFI process for threat
  • Streamlined three-step process
  • Progress tracking
  • Unlimited threat lookups in Cloudflare Security Center
Threat data analyzed

million HTTP/S requests processed per second


trillion DNS requests analyzed per day


billion preemptive email campaign threat signals assessed daily

Cloudforce One tools for security analysts

As part of Cloudflare One, customers have access to powerful tools to strengthen security postures.

Threat investigation portal

Speed threat investigations with instant threat queries in Cloudflare Security Center's Investigate tab for context on IPs, domains, ASN, URLs and more.

Automated Sinkhole API

Sinkholes created on-demand to monitor hosts infected with malware and prevent them from communicating with command-and-control (C2) servers.

Brand and phishing protections

Brand and phishing protections preserve brand trust by identifying “confusable” domains created specifically for phishing your brand.

A Cloudforce One discussion

Tune into our Cloudflare TV session on Cloudforce One. Blake Darché, Head of Threat Intelligence for Cloudflare Area 1, Patrick Donahue, VP Product of Application Security, and Engineering Manager Jesse Kipp discuss Cloudforce One in detail.

What you gain with Cloudforce One

  • Reduced organizational security risk
  • More confident threat investigations and responses
  • Fresh insights on the actors/TTPs targeting your industry
  • Easy to operationalize threat feeds you can't get elsewhere
  • Cloudflare threat analysts that expand your team's capability
  • Tailored research on any pressing threat or actor

Trusted by millions of Internet properties