Democratizing Security for the Agentic Web with Cloudflare CTO Dane Knecht

“AI has become the tool that's causing this kind of security apocalypse. It is also the tool that can help us solve it faster as well. It went from having to get everyone just using AI, now all of a sudden everyone's racing to figure out what AI security means.”

Claim: AI is contributing to a security crisis and can also help address that crisis faster.

“Well, I mean, this past year, uh, it, it, it feels like 10 years compacted into one. Uh, so th- those priorities are, uh, constantly shifting, but, you know, it all goes back to our mission of helping build a better internet, and, uh, that really hasn't changed over the last 15 years, uh, where we wanna make sure that, uh, uh, the internet's secure, uh, that everyone has access to, uh, be able to, uh, get their content online easily, and, uh, s- scale it up.”

Claim: Cloudflare's mission to help build a better internet has remained unchanged for 15 years.

“Well, I mean, this past year, uh, it, it, it feels like 10 years compacted into one. Uh, so th- those priorities are, uh, constantly shifting, but, you know, it all goes back to our mission of helping build a better internet, and, uh, that really hasn't changed over the last 15 years, uh, where we wanna make sure that, uh, uh, the internet's secure, uh, that everyone has access to, uh, be able to, uh, get their content online easily, and, uh, s- scale it up.”

Claim: Cloudflare aims to make the internet secure and accessible, and to make publishing and scaling online content easy.

“Uh, and, uh, just, you know, over the arc of, uh, the AI, um, changes in the past year, you know, it, it went from, you know, how do you get everyone just using AI, how do you make it easy for them to deploy and their agents deploy, uh, to, like most technical transitions, uh, security is kind of an afterthought.”

Claim: During the recent AI transition, security initially received less attention than AI adoption and deployment, as often happens in technical transitions.

“And, uh, now all of a sudden, uh, everyone's racing to figure out what AI security means. And, uh, it means, uh, things are... You know, different sides, uh, uh, view it kinda differently.”

Claim: Organizations are rapidly trying to define AI security, and different groups understand it differently.

“Uh, you know, uh, one side is, you know, as a, as a company is how, how do you keep your data safe from, uh, uh, AI leaking the data out, uh, but it's also how do you keep people from getting in as well too.”

Claim: A company's AI security concerns include preventing AI from leaking company data and preventing unauthorized access by people.

“And, you know, o- over the last, uh, I would say three to six months, uh, just the number of vulnerabilities, uh, that, uh, uh, are getting reported in CDEs, uh, has, has just gone up exponentially.”

Claim: The number of vulnerabilities reported in CDEs increased exponentially over the preceding three to six months.

“Um, you know, previously on the internet, we would see these Log4j moments, uh, or these Shellshock or, uh, uh, type of, uh, incidents maybe once a year, and it would be all hands on deck internally at Cloudflare to make sure how we protect not just, uh, um, you know, uh, our, our enterprise customers, but also all of our free customers, 'cause we, you know, view it as a, kind of as a, a, a public good and making sure that the internet stays safe, uh, to these things are now happening weekly.”

Claim: Major internet vulnerability incidents that previously occurred roughly once a year are now occurring weekly.

“Um, you know, previously on the internet, we would see these Log4j moments, uh, or these Shellshock or, uh, uh, type of, uh, incidents maybe once a year, and it would be all hands on deck internally at Cloudflare to make sure how we protect not just, uh, um, you know, uh, our, our enterprise customers, but also all of our free customers, 'cause we, you know, view it as a, kind of as a, a, a public good and making sure that the internet stays safe, uh, to these things are now happening weekly.”

Claim: Cloudflare views protecting enterprise and free customers from major vulnerabilities as a public good that helps keep the internet safe.

“Uh, not all of them are publicly reported on, uh, but there are things that, uh, uh, uh, you know, are as serious as the, like, the Log4j-type things, but, uh, uh, just happening at a, a greater frequency.”

Claim: Some serious vulnerabilities comparable to Log4j are not publicly disclosed and are occurring at greater frequency.

“Um, you know, and I, I expect that, you know, through the rest of this year, uh, and into next year, by the next 18 months, uh, majority of, uh, uh, teams' time is gonna be spent on security.”

Claim: The speaker expects that, over the next 18 months, security will consume most teams' time.

“You know, uh, you... I think there was a stat that was put up, uh, earlier today that, uh, during one of our keynotes, uh, uh, where it, it was showing that, uh, I think, uh, over 50% of, uh, um, uh, engineering time is gonna be start to be spent, uh, on, uh, uh, security.”

Claim: The speaker recalls a keynote statistic suggesting that more than 50% of engineering time would begin to go toward security.

“And I don't think that'll last forever. I think that'll be a, uh, a short transition. Uh, you know, uh, at some point the AI will have, uh, surveyed the majority of the code and found most of the bugs, uh, or found most of the shortcuts.”

Claim: The speaker expects AI eventually to inspect most code and identify most bugs or shortcuts.

“And I don't think that'll last forever. I think that'll be a, uh, a short transition. Uh, you know, uh, at some point the AI will have, uh, surveyed the majority of the code and found most of the bugs, uh, or found most of the shortcuts.”

Claim: The speaker expects the current increase in security workload to be temporary rather than permanent.

“Um, you know, there, there's a, uh, a one that's kind of, uh, coming out today and has been started to, uh, be, uh, blogged about and tweeted about, uh, where, uh, one of the keys, uh, on the internet, uh, is, uh, uh, that protects, uh, all TLS and Web PK- Web, WebPKI, uh, which just secures all your connections, uh, was, uh, um, was secured by the number four.”

Claim: The speaker says that an internet key protecting TLS and WebPKI connections was secured using the number four.

“Uh, literally, uh, the num- they basically, uh, used, uh, uh, y- you know about cryptography. Uh, uh, I mean, uh, it's all about randomness, right?”

Claim: Cryptography relies on randomness.

“Uh, you know, that's why Cloudflare has our lava lamps is so that, uh, uh, you can get good randomness. Uh, and when, uh, uh, a key out there is, uh, they use the seed, they use the initial, uh, uh, thing to, uh, uh, kind of create it, uh, with a single number four, uh, uh, it's, it's gonna be, uh, uh, reverse engineered.”

Claim: Cloudflare uses lava lamps as a source of randomness.

“Uh, you know, that's why Cloudflare has our lava lamps is so that, uh, uh, you can get good randomness. Uh, and when, uh, uh, a key out there is, uh, they use the seed, they use the initial, uh, uh, thing to, uh, uh, kind of create it, uh, with a single number four, uh, uh, it's, it's gonna be, uh, uh, reverse engineered.”

Claim: A key generated from a seed consisting only of the number four can be reverse engineered.

“Um, you know, uh, and, and AI can just do all these things, uh, you know, that doesn't sleep. It's not like the one engineer you had that was, uh, red teaming things.”

Claim: AI can perform security analysis continuously without sleeping, unlike an individual engineer conducting red-team work.

“Um, you know, uh, last week I, uh, I think OpenAI, uh, found the seeds, uh, for, uh, the NIS- the, the NIS curves, uh, that were, uh, back in 2000, uh, that, that were released.”

Claim: The speaker believes OpenAI found the seeds for NIS curves that had been released in 2000, reportedly last week.

“Um, so just, you know, these things are just moving so fast, uh, and, uh, the bar is going up, and, uh, the models are just getting so good at, uh, you know, uh, uh, uh, cybersecurity.”

Claim: AI models are rapidly improving at cybersecurity as the capability bar rises.

“You know, MITOS was just kind of the, uh, tip of the iceberg there, uh, where, you know, it, it... and since then, it's, uh, not just been the, the models getting better, it's the harnesses.”

Claim: MITOS was only an early indication of broader progress, and both AI models and their harnesses have improved since then.

“It's, uh, how people know how to, how humans know how to use them and use those frontier models, uh, in order to, uh, find those exploits.”

Claim: Human users have developed ways to use frontier AI models to discover exploits.

“Uh, well, I actually think for some of these, uh, um, the, s- some of these large vulnerabilities that have come out re- more recently actually, uh, haven't been nation states. They've, they've been, uh, um, you know, high school kids even, uh, that are, uh-”

Claim: The speaker believes some recently disclosed major vulnerabilities were discovered by people such as high school students rather than nation-state actors.

“Uh, you know, uh, there's also, you know... And there's just financial reward for them. There's, uh, bug bounties that, uh, they get paid, uh, out, uh, you know, sizable amounts. Um, uh, but, uh, it's, it's given the tools that honestly the nation states have had in some form, uh, for much longer.”

Claim: Security researchers who use agents to find vulnerabilities can receive sizable bug-bounty payments.

“Uh, you know, uh, there's also, you know... And there's just financial reward for them. There's, uh, bug bounties that, uh, they get paid, uh, out, uh, you know, sizable amounts. Um, uh, but, uh, it's, it's given the tools that honestly the nation states have had in some form, uh, for much longer.”

Claim: Nation-states have had comparable security tools in some form for much longer.

“Humans, uh, we, we are pretty adaptable, and we, uh, can move fast when we need to. Um, uh, and, uh, you know, I, I've seen the industry, uh, uh, kind of partner together, and when things like this happen, uh, uh, people that you usually think of competitors just are, are no longer competitors.”

Claim: Humans are adaptable and can act quickly when circumstances require it.

“Humans, uh, we, we are pretty adaptable, and we, uh, can move fast when we need to. Um, uh, and, uh, you know, I, I've seen the industry, uh, uh, kind of partner together, and when things like this happen, uh, uh, people that you usually think of competitors just are, are no longer competitors.”

Claim: During major security events, organizations that normally compete may work together.

“We are just literally protecting critical infrastructure, as you said. Um, and, uh, a- a- and I think when those kind of critical moments happen, uh, uh, uh, people and, uh, will, will rise to, to that challenge.”

Claim: The speaker expects people to rise to the challenge during critical moments involving infrastructure protection.

“Uh, um, so I'm a little less doomsday. I, I do think that, uh, a lot of the things that we've done over the past, you know, 5 to 10 years, uh, moving away from a kind of a castle and moat infrastructure for security to moving to more of a zero trust, uh, does put a lot of companies in a better position, where, uh, you know, you, you're not saying, "This office is completely air-gapped."”

Claim: The move from castle-and-moat security to zero-trust security over the past 5 to 10 years has put many companies in a better position to handle security threats.

“Uh, um, so I'm a little less doomsday. I, I do think that, uh, a lot of the things that we've done over the past, you know, 5 to 10 years, uh, moving away from a kind of a castle and moat infrastructure for security to moving to more of a zero trust, uh, does put a lot of companies in a better position, where, uh, you know, you, you're not saying, "This office is completely air-gapped."”

Claim: The speaker is less pessimistic than the doomsday outlook being discussed.

“You're saying, you know, "These devices, these, these, these flows are, uh, secured in a, in a different way." Um, uh, and, and everything's gonna be tightened.”

Claim: Organizations will tighten their security measures.

“You're saying, you know, "These devices, these, these, these flows are, uh, secured in a, in a different way." Um, uh, and, and everything's gonna be tightened.”

Claim: A zero-trust approach secures individual devices and flows rather than relying on an entirely air-gapped office.

“Just emergency, right? So you're gonna move forward all your security spend, uh, over the next 18 months, uh, both from, uh, uh, the red team side, uh, which is, uh, more the offensive, uh, uh, trying to actively try to exploit things, as well as, uh, the defensive side, uh, uh, uh, h- how you prepare things.”

Claim: The speaker expects emergencies to accelerate security spending over the next 18 months, including both offensive red-team work and defensive preparation.

“Um, but I, I, I, I don't think that's gonna be... Last forever. Uh, you know, I, I see a world in, like, 18 months, uh, where, uh, you know, uh, new software productivity goes way up 'cause, you know, all those resources are back f- uh, focused on that.”

Claim: The speaker does not expect the period of accelerated security spending to last indefinitely.

“Um, but I, I, I, I don't think that's gonna be... Last forever. Uh, you know, I, I see a world in, like, 18 months, uh, where, uh, you know, uh, new software productivity goes way up 'cause, you know, all those resources are back f- uh, focused on that.”

Claim: The speaker expects productivity in producing new software to rise substantially in about 18 months as resources shift back toward software development.

“Uh, but there's, there's definitely this, this period, uh, uh, where, uh, security is, is needs to be on everybody's mind.”

Claim: The speaker says that security needs to be a priority for everyone during the current period.

“Yeah. Um, well, so I mean, for one, w- we're, we're right now we're patching 70 years of, of s- uh, software, uh, out, out there, so, so some of it, it is just catch-up.”

Claim: The speaker says current security work includes catching up by patching software accumulated over 70 years.

“Uh, and then on, on a go-forward basis, you know, uh, uh, I think this, you know, the software development life cycle, the agent development life cycle is gonna need to change. Uh, uh, and, you know, s- uh, luckily the s- the same way that we can use security right now, uh, for red team and things like that, it'll just be built into the process every step of the way.”

Claim: The speaker expects software and agent development life cycles to change going forward.

“Uh, and then on, on a go-forward basis, you know, uh, uh, I think this, you know, the software development life cycle, the agent development life cycle is gonna need to change. Uh, uh, and, you know, s- uh, luckily the s- the same way that we can use security right now, uh, for red team and things like that, it'll just be built into the process every step of the way.”

Claim: The speaker expects security practices to be integrated into every step of the software and agent development process.

“Um, uh, and I think, you know, software will just get more secure o- over time.”

Claim: The speaker expects software security to improve over time.

“I kind of go back to first principles there is you want to reduce your, uh, uh, s- attack surface area. The easiest thing you can do is to give, uh, uh, less, uh, places for there to be vulnerabilities.”

Claim: Reducing the number of potential vulnerability locations is the easiest way to reduce attack surface area.

“So, you know, looking at all your software and saying, "How can I simplify this? How can I, uh, uh, re- reduce, uh, the, you know, the, the footprint, the code?" Um, uh, a- and, and then, you know, beyond that, I mean, things like formal verification, like, and, uh, I think things that, uh, you know, safer programming languages and just things that are kind of built into the runtimes that, uh, make everything safer will come.”

Claim: Organizations should simplify their software and reduce its code footprint as part of improving security.

“So, you know, looking at all your software and saying, "How can I simplify this? How can I, uh, uh, re- reduce, uh, the, you know, the, the footprint, the code?" Um, uh, a- and, and then, you know, beyond that, I mean, things like formal verification, like, and, uh, I think things that, uh, you know, safer programming languages and just things that are kind of built into the runtimes that, uh, make everything safer will come.”

Claim: The speaker expects formal verification, safer programming languages, and runtime-level safety features to become part of software security practices.

“But, you know, I think it just starts with, uh, uh... And, you know, AI, at least, you know, uh, for the, uh, the early AI is, is, uh, very verbose. It likes to create complexity.”

Claim: The speaker says early AI systems are very verbose and tend to create complexity.

“So, you know, uh, A- AI in a sense of what we've been dealing with has actually, uh, uh, not been kind of, uh, helping build a, a, a more secure stuff right now.”

Claim: The speaker says current AI systems have not yet helped build more secure software.

“But I, I think it will get there, and I think, uh, uh, the, you know, that, that's where humans still come in and human judgment comes in in, uh, making sure that we design the software i- in a way that, uh, uh, it can stand on, you know, its own securely.”

Claim: The speaker expects AI to eventually help build secure software, while human judgment remains necessary to ensure software is designed to be secure on its own.

“The, the way that humans did it before agents, uh, it, it needs to be solved kind of a- at all levels. You need to train, uh, the, uh, engineers that are writing the, the code, the product engineers.”

Claim: Product engineers who write code need to be trained.

“The, the way that humans did it before agents, uh, it, it needs to be solved kind of a- at all levels. You need to train, uh, the, uh, engineers that are writing the, the code, the product engineers.”

Claim: Security for software built with agents needs to be addressed at all levels, as it was before agents.

“Uh, you need the security teams still need to be involved into making sure that, uh, they're getting a, you know, checks and balances, second set of eyes on things. You need to build in processes.”

Claim: Security teams need to remain involved in reviewing software built with agents, providing checks and balances and a second set of eyes.

“Uh, you need the security teams still need to be involved into making sure that, uh, they're getting a, you know, checks and balances, second set of eyes on things. You need to build in processes.”

Claim: Teams need to build processes for developing software with agents.

“Uh, we've gone to a, a, um, a defining things a lot more internally on, on how we build at Cloudflare, uh, writing down our principles.”

Claim: Cloudflare has increasingly formalized its internal software-building practices and documented its principles.

“Uh, we have a, uh, a document called the Codex, which is kind of like, uh- Uh, uh, uh, you know, a build-up of a lot of RFCs that the teams have built for it.”

Claim: Cloudflare's Codex is a document compiled from many RFCs created by its teams.

“Here's how you build secure software at Cloudflare. Here's how you build available software at Cloudflare. Here's our best practices. And then it kinda gets bundled up into some Ten Commandments that, uh, the, uh, agents know how to follow, and, uh, uh, u-use at every part of the review process, uh, that can help and, and enforce those things.”

Claim: Cloudflare's Codex documents practices for building secure and available software.

“Here's how you build secure software at Cloudflare. Here's how you build available software at Cloudflare. Here's our best practices. And then it kinda gets bundled up into some Ten Commandments that, uh, the, uh, agents know how to follow, and, uh, uh, u-use at every part of the review process, uh, that can help and, and enforce those things.”

Claim: Cloudflare gives agents a set of Ten Commandments derived from its best practices to follow throughout software review, helping enforce those practices.

“So, you know, you, you have agents out there that are, you know, just writing a lot of the, the slop, and then you have, deeper down in the factory, you have, uh, uh, people that are, you know, doing the performance runs and the secure, security runs.”

Claim: In the software-development process described by the speaker, agents write much of the low-quality code, while people further down the process run performance and security checks.

“And just like how the company operated before, you, you need those ad-adversarial, uh, uh, uh, re-reviews.”

Claim: Software developed with agents still needs adversarial reviews, as it did before agents.

“Yeah. Um, I mean, uh, I kinda think of it as we're in the m-messy middle right now, where, uh, humans and agents are, uh, uh, riding the same rails, uh, uh, on the internet. Uh, where, you know, uh, agents are trying to, uh, parse a hu- uh, a human web, uh, when that's just, you know, one, it's just inefficient.”

Claim: Agents trying to use a web designed for humans encounter an inefficient experience.

“Yeah. Um, I mean, uh, I kinda think of it as we're in the m-messy middle right now, where, uh, humans and agents are, uh, uh, riding the same rails, uh, uh, on the internet. Uh, where, you know, uh, agents are trying to, uh, parse a hu- uh, a human web, uh, when that's just, you know, one, it's just inefficient.”

Claim: The speaker characterizes the current internet as a messy middle in which humans and agents use the same infrastructure.

“Uh, you know, and, uh, was d-designed for humans, like, to do things at different speeds. Uh, you know, going to a website and being able to, uh, read and, uh, uh, you know, uh, see the ads and, uh, participate in more of the econo- full economic model, versus an agent that now can go to 1,000 web pages i-in the same period of time.”

Claim: The web was designed for human-paced use, including reading websites, viewing ads, and participating in its economic model.

“Uh, you know, and, uh, was d-designed for humans, like, to do things at different speeds. Uh, you know, going to a website and being able to, uh, read and, uh, uh, you know, uh, see the ads and, uh, participate in more of the econo- full economic model, versus an agent that now can go to 1,000 web pages i-in the same period of time.”

Claim: An agent can visit 1,000 web pages in the time a human uses to visit one website.

“Uh, which is, which is, which is great. It's just you need to find a, a new economic model, uh, to support that. Um-”

Claim: A new economic model is needed to support agents' use of the web.

“Yeah. I mean, yes. I, I, I, I, I think we do. I think, I think, uh, um, we find ways to deliver the content, uh, and, and, and meet, and meet agents and humans where they are, as opposed to trying to meet them in the same place.”

Claim: The speaker expects content delivery to diverge into approaches tailored separately to agents and humans, rather than serving both in the same place.

“Um, and, uh, uh, uh, right now, there's, like, translation layers. You know, there's a lot of companies that, like, you know, help you, uh, uh, uh, you know, an agent view a web page.”

Claim: Some companies currently provide translation layers that let agents view web pages.

“Uh, these are just all extra, you know, burning of tokens for things that probably don't need to be... need, need to happen. You know, the, the website usually knows what data... And, and, you know, we've had things like this call- you know, we've had APIs, uh, you know- ... ways that computers talk to each other for years.”

Claim: APIs have long provided a way for computers to communicate with each other.

“Uh, these are just all extra, you know, burning of tokens for things that probably don't need to be... need, need to happen. You know, the, the website usually knows what data... And, and, you know, we've had things like this call- you know, we've had APIs, uh, you know- ... ways that computers talk to each other for years.”

Claim: A website usually knows what data it has.

“Uh, these are just all extra, you know, burning of tokens for things that probably don't need to be... need, need to happen. You know, the, the website usually knows what data... And, and, you know, we've had things like this call- you know, we've had APIs, uh, you know- ... ways that computers talk to each other for years.”

Claim: The speaker thinks agent-facing web translation layers consume tokens on processing that probably could be avoided.

“Uh, it's just, um, you know, APIs only covered a small fraction of the information on the internet. Uh, and, uh, agents, uh, have a thirst to, to, you know, understand everything.”

Claim: Agents seek to understand information broadly across the internet.

“Uh, it's just, um, you know, APIs only covered a small fraction of the information on the internet. Uh, and, uh, agents, uh, have a thirst to, to, you know, understand everything.”

Claim: APIs have covered only a small fraction of the information available on the internet.

“Uh, and so they're going out and trying to explore the, the human internet. Um, and you know, we need to make it, uh, easier for them. Uh, we need to make it, you know, less costly for the, the site owners, and we need to find a, a way for, uh, um, uh, them to get compensated.”

Claim: The cost of serving agents should be reduced for website owners.

“Uh, and so they're going out and trying to explore the, the human internet. Um, and you know, we need to make it, uh, easier for them. Uh, we need to make it, you know, less costly for the, the site owners, and we need to find a, a way for, uh, um, uh, them to get compensated.”

Claim: Agents are exploring the human-oriented internet, and the web needs to be made easier for them to access.

“Uh, and so they're going out and trying to explore the, the human internet. Um, and you know, we need to make it, uh, easier for them. Uh, we need to make it, you know, less costly for the, the site owners, and we need to find a, a way for, uh, um, uh, them to get compensated.”

Claim: Website owners need a way to be compensated for agents' access to their sites.

“You know, uh, you know, uh, I think, I think it's in a world where it can get very simple. You know, a, a, you know, most like... Since, like, a content website, like a Substack, you know, they know what their CPM, uh, is for how much money they should be making on ads, uh, uh, um, for that site.”

Claim: A content website such as Substack knows its advertising CPM and expected ad revenue.

“And so, uh, if a, if an agent's reading that site, uh, I, I think there is a world where you get to the point where, uh, uh, an agent can decide whether or not they want to read the content, and then they can decide, uh, if they want to pay the, the CPM rate, right?”

Claim: The speaker sees a possible future in which an agent chooses whether to read a website's content and whether to pay its CPM rate.

“And you know, that's where you need to then get new payment rails for the internet, uh, that, uh, can do, you know, millions of transactions a second, uh, for, uh, these, all these little micropayments.”

Claim: The internet needs new payment rails that can process millions of micropayment transactions per second.

“Uh, all these things that we've been talking about for years. Uh, you know, uh, micropayments, you know, always are two years, two years away. And, uh, um, uh, you know, uh, I, I, I think agents will, will actually push that forward, and actually, I think we will see a world where, where actually there is a new economic model for content creators.”

Claim: The speaker expects a new economic model for content creators to emerge.

“Uh, all these things that we've been talking about for years. Uh, you know, uh, micropayments, you know, always are two years, two years away. And, uh, um, uh, you know, uh, I, I, I think agents will, will actually push that forward, and actually, I think we will see a world where, where actually there is a new economic model for content creators.”

Claim: The speaker expects agents to advance micropayments, a technology that has repeatedly been described as two years away.

“It, it didn't kill Main Street. There, you know, small businesses are, are still, uh, uh, thriving. Um, uh, but you know, there were people that were displaced, and so there, there's always kind of some skepticism there.”

Claim: The internet did not kill Main Street; small businesses continue to thrive, although some people were displaced by the transformation.

“And so, you know, there's some nat-natural inclination, uh, to, like, just block them out, right? Uh, you know, you saw Amazon just say, uh, "No, no personal, no personal shopping there, uh, from an agent."”

Claim: Businesses may be inclined to block personal agents; Amazon has said it will not allow personal shopping by agents.

“Um, uh, I, I mean, I think these are all people that, uh, are, are, are, are, are, you know, this, that messy middle, but they're trying to figure out, uh, what, what that path forward is and, uh, trying to keep some of their n-you know, negotiation, uh, uh, leverage there.”

Claim: Businesses navigating the transition to personal agents are trying to find a path forward while preserving some negotiating leverage.

“Um, I, I think we will get to a place where, uh, uh, uh, Muse and, uh, Dots and, uh, all those personal agents, uh, will be able to, uh, accomplish tasks, uh, seamlessly as you as a human could do, e-even, even easier.”

Claim: The speaker expects Muse, Dots, and other personal agents eventually to accomplish tasks as seamlessly as humans, or more easily.

“But, uh, I, I don't know if the technology's quite, quite caught up to that yet, and the, uh, business models either.”

Claim: The speaker is unsure whether the technology and business models are yet mature enough for personal agents to perform tasks as seamlessly as humans.

“Um, well, yeah, I mean, absolutely. On, on the, uh, uh, content side, you know, we've, we've released a, a, a, a conference monetization gateway, where we make it easy for people to put their sites behind us and, uh, uh, uh, take microtransactions, uh, uh, uh, for their content.”

Claim: Cloudflare has released a content monetization gateway that enables site owners to use Cloudflare and accept microtransactions for content.

“Uh, we, uh, um, including, uh, providing, uh, wallets for agents to use, um, uh, with, uh, and, uh, and, and a stablecoin that's gonna be able to help kind of, uh, facilitate that transaction as well.”

Claim: Cloudflare is providing agent wallets and a stablecoin to facilitate transactions.

“Um, you know, we're also doing things, uh, with OpenAI, uh, uh, a project called Signals, where, uh, we're making it easier for, uh, um, agents to actually discover content.”

Claim: Cloudflare and OpenAI are working on Signals, a project intended to help agents discover content.

“Instead of having to crawl the entire internet and, uh, continually go back to pages, we're making it easier for them to, uh- Uh, know what's new content and actually kind of more proactively do that.”

Claim: Signals is intended to help agents identify new content without crawling the entire internet and continually revisiting pages.

“So, you know, it, it's a, it's a win for the, uh, AI labs as, as well as a win for, uh, uh, the site owners not having to get, uh, constantly crawled and pay, pay for that infrastructure.”

Claim: The speaker says the content-discovery approach benefits AI labs and site owners by reducing repeated crawling and the infrastructure costs associated with it.

“Um, so, you know, there's a whole set of, uh, kind of new laws on the internet, uh, that I, I think, uh, really excited to see, uh, all those, uh, uh, kind of grow to see, uh, you know, the, uh, you know, X.402 from, uh, when Stripe came out with it, I loved it because, uh, it went back to, uh, the 402, uh, uh, error, uh, HTTP code, uh, which was, uh, uh, you know, um, uh, Tim Berners-Lee created, uh, you know, twenty-plus years ago, or thirty-plus years ago, uh, for payments.”

Claim: The speaker welcomed the growth of new internet payment protocols, particularly X.402, because it recalls the HTTP 402 code that he said Tim Berners-Lee created decades ago for payments.

“So like, you know, kind of always knew that you needed a payments, a better payments rail on the internet, uh, but we haven't been able to, you know, kind of figure it out. And, uh, uh, I, I think agents will lead us to that as well.”

Claim: The speaker says the internet has long needed a better payments rail and predicts that agents will help bring one about.

“Uh, well, I mean, I think we're... In- instead of, uh, them paying us, we're, we're paying them, right?”

Claim: Cloudflare's content monetization approach is to pay content creators rather than charge them.

“You know, uh, uh, where it's, it's covering their infrastructure costs, it's providing, uh, uh, money that, uh, uh, uh, that, uh, uh, supports their livelihood.”

Claim: The speaker says payments to content creators should cover their infrastructure costs and support their livelihoods.

“Um, uh, you know, if, you know, we can actually increase the number of content creators out there, which, uh, you know, the l- the last generation of, of the internet has done very well, like with YouTube and TikTok and, uh, X, uh, um, uh, I, I think we can actually make it even exponentially larger.”

Claim: The speaker believes the new internet monetization approach could increase the number of content creators exponentially.

“It was kind of transitioning a little to a new release we built, Cloudflare OS. Uh, and Cloudflare OS was, uh, is our internal, uh, um, platform for, uh, how our employees, uh, use AI every day.”

Claim: Cloudflare OS is Cloudflare’s internal platform for employees’ everyday use of AI.

“It was kind of transitioning a little to a new release we built, Cloudflare OS. Uh, and Cloudflare OS was, uh, is our internal, uh, um, platform for, uh, how our employees, uh, use AI every day.”

Claim: Cloudflare OS is Cloudflare's internal platform for employees' everyday use of AI.

“Uh, where, uh, we, you know, and it, it actually goes back to security roots where, uh, you know, uh, uh, we were very worried about, uh, customer data, internal data leaking out, and we wanted to make sure that our employees, uh, could, you know, uh, use all the new AI, uh, tools and models, uh, but have a way to, uh, safely, uh, uh, deploy them internally, uh, to understand, uh, uh, how that data is being used and flowing, um, and, uh, uh, have, have, you know, kind of good governance o-over that.”

Claim: Cloudflare developed Cloudflare OS so employees could use AI tools and models internally while monitoring data use and flows and maintaining governance over that data.

“Uh, where, uh, we, you know, and it, it actually goes back to security roots where, uh, you know, uh, uh, we were very worried about, uh, customer data, internal data leaking out, and we wanted to make sure that our employees, uh, could, you know, uh, use all the new AI, uh, tools and models, uh, but have a way to, uh, safely, uh, uh, deploy them internally, uh, to understand, uh, uh, how that data is being used and flowing, um, and, uh, uh, have, have, you know, kind of good governance o-over that.”

Claim: Cloudflare developed Cloudflare OS to let employees use AI tools and models internally while managing data leakage risks, tracking how data is used and flows, and maintaining governance.

“Uh, in addition, uh, the reason we come up with Cloudflare OS is, uh, um, we, we started to, uh, realize that, uh, you know, as we have more and more agents, uh, you know, uh, we needed to be able to teach them, uh, what made Cloudflare special, how we build at Cloudflare.”

Claim: Cloudflare recognized that as it deployed more agents, it needed to teach them what distinguishes Cloudflare and how the company builds.

“Uh, in addition, uh, the reason we come up with Cloudflare OS is, uh, um, we, we started to, uh, realize that, uh, you know, as we have more and more agents, uh, you know, uh, we needed to be able to teach them, uh, what made Cloudflare special, how we build at Cloudflare.”

Claim: As Cloudflare adopted more agents, it recognized a need to teach those agents what distinguishes Cloudflare and how Cloudflare builds.

“Um, you know, and for humans, we did that through, like, Cloudflare University and, uh, the onboarding process and, you know, meeting your colleagues and working with them. Uh, but we needed to kind of more clearly define that and document that, uh, for agents.”

Claim: Cloudflare taught human employees through Cloudflare University, onboarding, and collaboration, and needed to define and document comparable company knowledge more clearly for agents.

“Um, you know, and for humans, we did that through, like, Cloudflare University and, uh, the onboarding process and, you know, meeting your colleagues and working with them. Uh, but we needed to kind of more clearly define that and document that, uh, for agents.”

Claim: Cloudflare teaches human employees through Cloudflare University, onboarding, and collaboration, and needed to define and document that organizational knowledge more clearly for agents.

“And so Cloudflare OS is both the s- the platform where our employees can build anything that they want, uh, in a secure way without having, like, you know, security stuff they have to think about.”

Claim: Cloudflare OS lets Cloudflare employees build what they want in a secure environment without needing to manage security details themselves.

“And so Cloudflare OS is both the s- the platform where our employees can build anything that they want, uh, in a secure way without having, like, you know, security stuff they have to think about.”

Claim: Cloudflare OS lets Cloudflare employees build what they want in a secure environment without needing to manage security themselves.

“Um, you know, the b- the BR that's trying to create a call list, uh, they don't have to worry about, uh, security. Um, it, it is just built in there, um, for them.”

Claim: On Cloudflare OS, a business representative creating a call list does not need to handle security because security is built into the platform.

“Um, you know, the b- the BR that's trying to create a call list, uh, they don't have to worry about, uh, security. Um, it, it is just built in there, um, for them.”

Claim: In Cloudflare OS, an employee creating a call list does not need to manage security because security is built into the platform.

“Uh, but they also know that it's being done in a way that is, uh, consistent with, uh, the themes and values of, uh, how Cloudflare works.”

Claim: Cloudflare OS is designed to ensure employees' work aligns with Cloudflare's themes and values.

“Uh, but they also know that it's being done in a way that is, uh, consistent with, uh, the themes and values of, uh, how Cloudflare works.”

Claim: Employees know that work done through Cloudflare OS follows Cloudflare’s themes and values.

“for one, it was, uh, it, it's kind of a reference architecture really. Uh, it's, uh, you know, we, over the past ten years, we've built some, uh, uh, our developer platform where we started with just a simple, uh, serverless compute primitive, uh, and, and now, you know, over a hundred different, uh, uh, uh, developer platform tools, uh, from storage to databases to durable objects.”

Claim: Over ten years, Cloudflare expanded its developer platform from a simple serverless compute primitive to more than 100 tools, including storage, databases, and durable objects.

“for one, it was, uh, it, it's kind of a reference architecture really. Uh, it's, uh, you know, we, over the past ten years, we've built some, uh, uh, our developer platform where we started with just a simple, uh, serverless compute primitive, uh, and, and now, you know, over a hundred different, uh, uh, uh, developer platform tools, uh, from storage to databases to durable objects.”

Claim: Cloudflare OS serves as a reference architecture.

“Um, uh, we wanted to show someone, show how you can build it completely on, on Cloudflare, um, and how we build things internally and kind of, uh, uh, uh, give people the option to, uh, you know, fork it and build, uh, their own, uh, version of, uh, their own company OS on top of it.”

Claim: Cloudflare intended Cloudflare OS to demonstrate that a platform can be built entirely on Cloudflare and to show how Cloudflare builds its internal tools.

“Um, uh, we wanted to show someone, show how you can build it completely on, on Cloudflare, um, and how we build things internally and kind of, uh, uh, uh, give people the option to, uh, you know, fork it and build, uh, their own, uh, version of, uh, their own company OS on top of it.”

Claim: Cloudflare intended to let users fork Cloudflare OS and build a customized operating system for their own company.

“Uh, it's actually used more by, uh, uh, our go-to-market teams and our GNA teams, uh, uh, than it is even used by our engineering teams. Uh, you know, uh, uh, it, it, it's, you know, giving them a, a very fast, uh, you know...”

Claim: Cloudflare’s go-to-market and G&A teams use Cloudflare OS more than Cloudflare’s engineering teams do.

“Early on, I thought, you know, we, we saw training was the biggest gap for people using, uh, AI. And when you just kind of point them at a, a chat interface, um, or, uh, uh, ano- another bi-putting tool, uh, it's too much of a, a blank slate for them.”

Claim: A generic chat interface or similar AI tool can leave users with too little guidance and feel like a blank slate.

“Early on, I thought, you know, we, we saw training was the biggest gap for people using, uh, AI. And when you just kind of point them at a, a chat interface, um, or, uh, uh, ano- another bi-putting tool, uh, it's too much of a, a blank slate for them.”

Claim: Early in Cloudflare’s AI adoption, the speaker believed that lack of training was the biggest obstacle for people using AI.

“Uh, and so, uh, you know, this is a platform that's desi- you know, you, you design everything for it for how your business works, and you, they immediately can go there and, you know, get access to all the data that they need.”

Claim: Cloudflare OS can be configured for a business’s workflows and give users immediate access to the data they need.

“Uh, they can, uh, get guided and taken, taken through, uh, uh, where they quickly realize, "Oh, this is not, you know, trying to re- replace me. This is trying to make me better at my job."”

Claim: Cloudflare OS guides users to understand that its AI is intended to improve their job performance rather than replace them.

“Uh, and, and that's been really exciting to see, uh, just, uh, just all the different ways, uh, uh, people at the company have, uh, have done that. Uh, you know, a lot of the, the, uh, uh, how this conference got put together, uh, the marketing team, uh, I mean, built hundreds of internal tools where previously, you know, they would have, they would have to go out and, uh, uh, work with different agencies, but they can, you know, the speed that they can move with a smaller team now is just amazing.”

Claim: AI-enabled internal tools have allowed Cloudflare’s marketing team to move much faster with a smaller team.

“Uh, and, and that's been really exciting to see, uh, just, uh, just all the different ways, uh, uh, people at the company have, uh, have done that. Uh, you know, a lot of the, the, uh, uh, how this conference got put together, uh, the marketing team, uh, I mean, built hundreds of internal tools where previously, you know, they would have, they would have to go out and, uh, uh, work with different agencies, but they can, you know, the speed that they can move with a smaller team now is just amazing.”

Claim: Cloudflare’s marketing team built hundreds of internal tools for the conference instead of relying on different agencies as it would have previously.

“Yeah, I mean, so, uh, you know, the, the, the, the, the, uh, the restructuring was hard. Um, you know, saying goodbye to some of our colleagues. Uh, it was the first time Cloudflare ever did it.”

Claim: Cloudflare's AI-related restructuring was difficult, required saying goodbye to some colleagues, and was the first restructuring in the company's history.

“Um, you know, uh, we'd, we'd always been very, uh, careful not to over-hire and, uh, um, uh... Well, this was for different reasons. Uh, this was 'cause we, we saw the, uh, the, the way AI was transforming some teams, and how they work.”

Claim: Cloudflare had historically been careful not to over-hire, but its restructuring was driven by the way AI was transforming some teams and their work.

“Um, and you know, we, we kind of thought of it as, like, a factory floor where you needed to re- actually rebuild, rethink how things happen. You know, uh, the, there, there were some processes or some, you know...”

Claim: Cloudflare viewed the organizational change as requiring a fundamental redesign of how work processes operated.

“The way a product manager would send an email before to customers, it involved three teams. You know, it involved a team where, uh, you know, uh, you, you went to B- BI to go get a cohort of, uh, uh, the people that you wanted to send an email to. You went to the marketing team to help you design the email and, and get the voice right. Uh, you went to the marketing operations team to get the email out. Uh, where, you know, it...”

Claim: Before the process redesign, sending a customer email required a product manager to coordinate with business intelligence, marketing, and marketing operations for cohort selection, email design and voice, and delivery.

“You're never going to be able to, uh, actually redesign that process, unless you kind of, kind of make some hard changes and, uh, uh, force people to kinda rethink, well, what actually is the right way to do that?”

Claim: Redesigning the customer-email process required hard changes that prompted people to reconsider how the work should be done.

“Uh, and it, it might not involve those three teams at all. It might just involve, uh, a, a new way of doing things. And, you know, so what came out of that was, uh, a tool where a product manager now goes in and describes the cohort. Uh, they write an email. It rewrites it in Cloudflare's voice. It sends it to their manager. Uh, um, and the manager can click Approve if they like it, and it, it goes out.”

Claim: Cloudflare's new email tool lets a product manager specify a customer cohort and draft an email, rewrites the draft in Cloudflare's voice, and routes it to a manager for approval before sending.

“Uh, and it, it might not involve those three teams at all. It might just involve, uh, a, a new way of doing things. And, you know, so what came out of that was, uh, a tool where a product manager now goes in and describes the cohort.”

Claim: The redesigned customer-email process might eliminate the involvement of the three previous teams by using a different approach.

“Uh, where, you know, we can go from three teams getting faster at, uh, doing that, we went to, you know, uh, one tool that can kind of, uh, uh, let a pro- product manager now have a superpower they didn't have before.”

Claim: Cloudflare replaced a three-team customer-email workflow with one tool that gives product managers a new capability.

“Yeah, I mean, Cloudflare's always had 1,000 more things that we could, we could ever do, uh, whether it was, you know, products and features, or things like this. And so, uh, we, we, we, we always look for people that, uh, uh, are gonna take initiative and ownership.”

Claim: Cloudflare has consistently had more potential work than it could complete and therefore looks for people who take initiative and ownership across product, feature, and process work.

“Um, and so, you know, it doesn't really matter if you're ordering it, you know, one to 100 and trying to prioritize it. Any one of those 100 things, uh, are, are probably, uh, safe, if someone's passionate about it.”

Claim: Cloudflare considers any of its many potential initiatives probably safe to pursue when someone is passionate about it, without requiring a strict ranking of every initiative first.

“So, you know, w- we, we, we, we kind of gave people at the beginning of last year the, uh, the tools, and started seeing how they were experimenting. And you know, uh, people quickly kind of, uh, broke out into different cohorts of people that were really leaning in and, uh, um, you know, just naturally doing those things and taking ownership of them.”

Claim: At the beginning of the previous year, Cloudflare provided employees with tools and observed experimentation, after which groups of employees naturally emerged who were actively adopting the tools and taking ownership.

“Uh, so, you know, I, I think it was very, uh, bottoms up from the, uh, how, how we're going to, uh, uh, do those things.”

Claim: Cloudflare's approach to deciding how to redesign work processes was largely bottom-up.

“It, it's definitely changed. Uh, you know, uh, uh, and each model kind of w- makes you re- rethink it as, like, the, the cost dynamics change. But, uh, um, you know, it...”

Claim: Cloudflare's approach to AI token use has changed, with each model prompting reconsideration as model costs change.

“In, in general, uh, um, uh, you know, I think it's kinda silly that we're actually asking humans to decide which model to do each task. Um-”

Claim: The speaker considers it inefficient or unreasonable to have humans manually choose which AI model performs each task.

“Like, hu- humans just aren't, aren't gonna ever be good at that, right? Like, uh, um, you know, uh, uh, um, but, you know, early on you do it kind of, uh, brute force, and you, you know, peop- you get people to experiment, and you say, "Hey, well, you know, let's try for the, uh, planning part.”

Claim: Humans will not be good at selecting the best AI model for each task.

“Like, hu- humans just aren't, aren't gonna ever be good at that, right? Like, uh, um, you know, uh, uh, um, but, you know, early on you do it kind of, uh, brute force, and you, you know, peop- you get people to experiment, and you say, "Hey, well, you know, let's try for the, uh, planning part. Let's use the, uh, you know, the, uh, the top frontier models for that." Um, and then, uh, you know, once the plan's written out, and agreed upon, and iterated on, then, you know, uh, potentially some more of the open source models, uh, can go do that.”

Claim: In the early stages of model use, Cloudflare encouraged experimentation and used top frontier models for planning.

“Let's use the, uh, you know, the, uh, the top frontier models for that." Um, and then, uh, you know, once the plan's written out, and agreed upon, and iterated on, then, you know, uh, potentially some more of the open source models, uh, can go do that.”

Claim: Once a plan has been written, agreed upon, and iterated on, open-source models may be able to execute it.

“And then you go back, and you have a, uh ... One of the frontier models do the, the, the reviews, and the red teaming, and, and things like that. Um, now, all that today is, you know, fairly manual.”

Claim: In the described workflow, a frontier model can review and red-team work after other models execute the plan.

“And then you go back, and you have a, uh ... One of the frontier models do the, the, the reviews, and the red teaming, and, and things like that. Um, now, all that today is, you know, fairly manual.”

Claim: Cloudflare's current process for assigning tasks to different AI models is fairly manual.

“Um, uh, but I think, I think, you know, as we start to learn and experiment, I think it will become intelligent. Uh, and, uh, you know, uh, uh, uh, and, and, you know, over time there'll be more governance on that.”

Claim: The speaker expects model selection and task allocation to become more intelligent through learning and experimentation, with governance increasing over time.

“You know, Cloudflare le- um, has been in a place where, uh, uh, you know, largely we've let people, uh, use the, the models and tools that, uh, they, they, they see fit, um, for the job.”

Claim: Cloudflare has largely allowed employees to choose the AI models and tools they consider suitable for their work.

“Uh, you know, we, we don't have, we don't have a token, uh, leaderboard. Uh, we don't encourage it. We encourage people to focus on the output. Um, the, uh, uh, uh, you know, they're not graded on, you know, if they used, uh, it.”

Claim: Cloudflare does not maintain or encourage a leaderboard of employee token consumption and instead encourages employees to focus on their output.

“They're graded on, you know, what they've shipped and what they've built. Um, but then, uh, um, you know, we do have some kind of, uh ... We found, like, just kind of, like, giving people notices.”

Claim: Cloudflare evaluates employees based on what they ship and build rather than whether or how much they use AI tokens.

“They're graded on, you know, what they've shipped and what they've built. Um, but then, uh, um, you know, we do have some kind of, uh ... We found, like, just kind of, like, giving people notices. Like, you know, i- if you happen to use 300 a day, you'll just get an email, right? Like, it says, "Hey, did you know..." And, and, 'cause most of the time, people didn't realize they were doing it.”

Claim: Cloudflare sends employees a notice, such as an email, when their token use reaches a high level—for example, 300 per day—because users often do not realize their consumption.

“... still so early. Uh, um, you know, uh, uh, Cloudflare did something, uh, you know... Two years ago we had about 200 interns, and, uh, what we saw was those interns, uh, I think were, you know, uh, really the first, you know, fully kind of AI native cl- uh, you know, were...”

Claim: Cloudflare had about 200 interns two years before the conversation, whom Dane Knecht viewed as among the first fully AI-native cohorts.

“The, if you took AI away from them, I don't think they would be able to work.”

Claim: Dane Knecht thinks Cloudflare's AI-native interns would not be able to work without AI.

“I, actually I think it is. I, I think they know how to use the tools better than us. It's just like if you took Google away from me, you know, over the last 10 years, I, you know, like, uh, like, you know, how would I learn anything, right?”

Claim: Dane Knecht considers the interns' reliance on AI beneficial and thinks they use AI tools better than employees like him.

“Like, uh, uh, th- that's just, that's, that's where they reached to first. Um, and, and, and we actually saw the managers that had interns that, from that, uh, that, that summer, uh, actually adopt AI faster.”

Claim: At Cloudflare, managers who had interns during that summer adopted AI faster.

“Yeah, and, uh, it- it's- it's just been amazing 'cause, you know, uh, one, uh, uh, just the number of ideas that come from the interns. Uh, y- you know, that's something that, you know, with AI lets people experiment faster, and so having more ideas, uh, getting more people in there, but also, uh, just seeing the, the way that they, uh, uh, use AI, like, uh, you know, um, i- if they need to fill out a form, uh, they, they, they reach for AI.”

Claim: Dane Knecht says AI enables people to experiment faster and generate more ideas.

“Yeah, and, uh, it- it's- it's just been amazing 'cause, you know, uh, one, uh, uh, just the number of ideas that come from the interns. Uh, y- you know, that's something that, you know, with AI lets people experiment faster, and so having more ideas, uh, getting more people in there, but also, uh, just seeing the, the way that they, uh, uh, use AI, like, uh, you know, um, i- if they need to fill out a form, uh, they, they, they reach for AI.”

Claim: Cloudflare interns use AI for tasks such as filling out forms.

“Um, and, and I, and I still find myself, you know, there are so many things where I'm like, "Oh, wait, I've just been doing this manually still." Uh, and- and- then I'm like, "Yeah, oh wait, actually I should be using AI."”

Claim: Dane Knecht sometimes realizes he has been doing tasks manually when he could use AI instead.

“And, and I, I don't think that that's a natural, uh, um, uh, natural for most of us yet. Um, uh, and I think that will, that will take time. And, uh, so yeah, I think we're still very early, uh, in, in our AI journey.”

Claim: Dane Knecht believes Cloudflare remains at an early stage of adopting AI.

“And, and I, I don't think that that's a natural, uh, um, uh, natural for most of us yet. Um, uh, and I think that will, that will take time. And, uh, so yeah, I think we're still very early, uh, in, in our AI journey.”

Claim: Dane Knecht thinks using AI as a natural default is not yet habitual for most people and will take time to become so.

“Yeah. And, and I think it's great for them as well too. I mean, you see these schools like W- Waterloo and Northeastern, like with these, uh, these co-op programs. Uh, um, and, and you know, from what we've seen is, uh, uh, people that get that type of real work experience, uh, just, you know, uh, are some of our, our best employees, uh, uh, m- many years in and go on to do, you know, uh, great things.”

Claim: Dane Knecht says people who gain real work experience through co-op programs can become some of Cloudflare's best employees years later and go on to do great things.

“Yeah, and then, and then brute force and just try things. Uh, you know, early on, uh, um, uh, we, uh, had an email, uh, alias called agents@cloudflare where we, uh... This was back in January of last, uh, of this year, where we, uh, just told people to, uh, uh, you know, if you were curious, can I use AI for this? You know, email in your jobs to be done.”

Claim: In January of the year discussed, Cloudflare invited employees to email jobs they wondered whether AI could help with to agents@cloudflare.

“You know, d- uh, and uh, uh, that email would, this would reply back in a skill file. Um, uh, and for a while, people thought it was, uh, actually, you know, thought it was all AI and automated.”

Claim: Cloudflare's agents@cloudflare initiative replied to employees with skill files, and some employees initially believed the replies were entirely AI-automated.

“It was actually, uh, a bunch of interns that were, uh, uh, you know, uh, uh, uh, helping people write skill files. Uh, uh, but that let us kind of get to see, uh, uh, you know, in, in, in a, a way that's not going out and like, you know, uh, hiring a consulting firm to come out and like catalog every single thing to be done is, you know, people that, uh, are recognizing, "Hey, this seems harder than it needs to be. I wonder if an agent can help me here."”

Claim: Cloudflare interns helped employees write skill files, revealing tasks employees considered unnecessarily difficult and potentially suitable for agent assistance.

“Um, well, I mean, one of the biggest things we always look for is curiosity. And so, you know, if, if people aren't using AI at home in their personal life and all that, I mean, that's a pretty big red flag.”

Claim: Cloudflare considers curiosity one of its most important qualities when evaluating people.

“Um, well, I mean, one of the biggest things we always look for is curiosity. And so, you know, if, if people aren't using AI at home in their personal life and all that, I mean, that's a pretty big red flag.”

Claim: Dane Knecht regards a candidate's not using AI in their personal life as a significant red flag.

“Like, I mean, just, uh, how, how can you not, uh, uh, be e-embracing AI if you have, you know, a level of curiosity out there? So, uh, um, you know, uh, I think just double down, d- double down on some of those, uh, uh, uh, kind of, uh, key characteristics of, you know, drive and curiosity and empathy, uh, um, uh, uh, probably even better for, uh, uh, this next set of, uh, people.”

Claim: Dane Knecht thinks hiring should place particular emphasis on drive, curiosity, and empathy in the next generation of employees.

“Yeah. I mean, I mean, a lot of things we're doing, we're not, you know, uh, uh, w- we're, we're inventing new ways of doing things. I mean, the scale that we operate at, uh, uh, for the, uh, number of sites behind us, uh, um, and the, the amount of, uh, free, uh, services we give away, it's just not possible with off-the-shelf technology.”

Claim: Cloudflare says its scale, number of sites served, and free services make off-the-shelf technology insufficient for many of its activities.

“Uh, um, so you, you need people that can come in and literally invent new things and, and, uh, that, I mean, that, that starts with curiosity.”

Claim: Cloudflare needs people who can invent new things, and Dane Knecht says that begins with curiosity.

“Yeah, I mean, I- I- I think largely, uh, you know, we're, uh, you know, today we have one red team. I, I think by the end of the, you know, the end of the year next year, we will probably have four or five red teams.”

Claim: Dane Knecht expects Cloudflare to grow from one red team today to probably four or five by the end of next year.

“Uh, so, uh, you know, break people out into, uh, groups that are actually, um, uh, you know, being more adversarial and actually like, uh, uh, going out and actively trying to find, uh, uh, vulnerabilities.”

Claim: Cloudflare organizes people into adversarial groups that actively search for vulnerabilities.

“I mean, processes and those things can always be better.”

Claim: Dane Knecht says Cloudflare’s processes can always be improved.

“Uh, uh, we have a vuln process. We have a patching process. Uh, are they perfect? No. Uh, but uh, uh, you know, the best way I've found for those sorts of things to get better is to o- out of, out of crisis kind of comes, uh, uh, uh, uh, that, that, that, that has...”

Claim: Cloudflare has vulnerability-management and patching processes, and Knecht says they are not perfect.

“Uh, are they perfect? No. Uh, but uh, uh, you know, the best way I've found for those sorts of things to get better is to o- out of, out of crisis kind of comes, uh, uh, uh, uh, that, that, that, that has... That's how you get those things fixed. You know, when the vulns get too big for, uh, the engineering team to just do them on using their normal processes, you know, uh, engi- you know, engineers are inherently lazy in a good way.”

Claim: Dane Knecht believes a crisis caused by vulnerabilities exceeding engineers’ normal processes can prompt those processes to be fixed.

“That's how you get those things fixed. You know, when the vulns get too big for, uh, the engineering team to just do them on using their normal processes, you know, uh, engi- you know, engineers are inherently lazy in a good way.”

Claim: Dane Knecht characterizes engineers as inherently lazy in a beneficial way.

“Uh, and so they, they will, they will automate, uh, a way those, those things as they, as they, as they need to, as they kind of realize that there's no other way, way, way to do that.”

Claim: Dane Knecht says engineers will automate work when they realize there is no other way to handle it.

“Um, so, you know, uh, you know, I think the focus needs to be on the discovery side. Uh, and, uh, uh, uh, you know, people will do the right thing and figure out how to patch it in, in a scalable way over time.”

Claim: Dane Knecht says the focus should be on vulnerability discovery, while people will work out scalable patching over time.

“Uh, I, I mean, I, I think, uh, you, you need to figure out how to do both.”

Claim: Dane Knecht says companies need to both address security and continue shipping new features.

“Um, you know, it, it, it might come at the expense of, uh, cost optimization or other things, but I mean, uh, uh, companies, uh, if, if you're not shipping, you're dying.”

Claim: Dane Knecht says security work might displace cost optimization or other priorities, but companies that stop shipping are dying.

“Oh, no, a- absolutely not. You know, uh, you need to be, you, you need to be able to continue, uh, um, building and shipping new things. Um, but you need to be able to, uh, uh, make sure that you're doing it, you know, uh, securely and patching and, and fixing bugs.”

Claim: Dane Knecht says Cloudflare will continue building and shipping new things while securing them, patching vulnerabilities, and fixing bugs, rather than freezing development.

“And, uh, um, uh, uh, I, I think if we do it right, we'll actually be able to do them both faster, uh, with AI. I mean, while, while AI has become the, uh, the, the tool that's causing this kind of security apocalypse, uh, uh, vuln apocalypse, uh, to happen, uh, it, it, it, it is also the tool that, uh, can help us, uh, solve it faster as well, right?”

Claim: Dane Knecht thinks that, if Cloudflare uses AI well, it can do security work and other work faster.

“And, uh, um, uh, uh, I, I think if we do it right, we'll actually be able to do them both faster, uh, with AI. I mean, while, while AI has become the, uh, the, the tool that's causing this kind of security apocalypse, uh, uh, vuln apocalypse, uh, to happen, uh, it, it, it, it is also the tool that, uh, can help us, uh, solve it faster as well, right? So, so it's, so it's on both sides of it.”

Claim: Dane Knecht says AI is contributing to a security and vulnerability crisis while also offering a way to address it faster.

“Yeah, I mean, uh, I think every, o- over time, uh, it all has to be open because everyone's gonna get access to it anyways. And, uh, um, uh, you know, the-”

Claim: Dane Knecht believes that over time all relevant models or capabilities must be open because everyone will gain access to them regardless.

“The, the, the bad guys, the bad guys are, are gonna find a way to get it. Um, so all UR's, uh, and, and the, you know, the, the top companies will have a way of getting it as well.”

Claim: Dane Knecht says bad actors and top companies will find ways to access the capabilities under discussion.

“So, uh, uh, y- you're, you're just, uh, excluding a, a, a, a, a mass population that just, uh, doesn't have, have the access that, that probably needs it.”

Claim: Dane Knecht argues that restricting access excludes a large population that probably needs the capabilities.

“Well, so, uh, you know, uh, uh, I, I would say put your sights behind Cloudflare. Uh, put your infrastructure behind Cloudflare, build on Cloudflare. Uh, you know, uh, when these major vu- vulnerabilities come out, uh, like the React one, uh, uh, last year, uh, we don't just give it to our paid customers, uh, who have, like, the advanced firewall and WAF capabilities. We, we give it to everyone.”

Claim: Cloudflare provides protections for major vulnerabilities to all customers, not just paid customers with advanced firewall and WAF capabilities.

“Uh, we view those kind of things as a, um, a part of the utility that we offer. Um, and, uh, you know, uh, uh, um, uh, we wanna provide that just like, you know, uh, we wanna provide performance for everyone.”

Claim: Cloudflare considers protection against major vulnerabilities part of its utility offering.

“Uh, we view those kind of things as a, um, a part of the utility that we offer. Um, and, uh, you know, uh, uh, um, uh, we wanna provide that just like, you know, uh, we wanna provide performance for everyone.”

Claim: Cloudflare aims to make performance services available to everyone.

“You know, when, before Cloudflare started, uh, you know, uh, there were probably 3,000 sites in the world that had a large-scale CDN, uh, to cache their stuff at the edge.”

Claim: Before Cloudflare began, approximately 3,000 sites worldwide had a large-scale CDN for edge caching.

“You know, now there's, uh, uh, hundreds of millions of sites that do. Uh, so, uh, you know, Cloudflare's always viewed our, uh, our, our goal as providing, uh, democratizing the security and performance for everyone.”

Claim: At the time of the conversation, hundreds of millions of sites used large-scale CDNs for edge caching.

“You know, now there's, uh, uh, hundreds of millions of sites that do. Uh, so, uh, you know, Cloudflare's always viewed our, uh, our, our goal as providing, uh, democratizing the security and performance for everyone.”

Claim: Cloudflare's stated goal is to make security and performance accessible to everyone.