The Agentic Internet: Building and securing what comes next (Part 2)

great music hey nothing like a beat to get going there you go uh jorn thank you so much for joining us thanks for being our partner easy question there's so much that's gone on in the last year why don't you tell me what you're most excited about well right now standing in front of an audience here is pretty exciting i think thanks for having me here in san francisco fantastic event and these guys know how to put up a show and But look, so much is happening. We spoke about this this morning. Agentec is exploding both for consumers and maybe more importantly, we're seeing agents or machines interacting with other machines, interacting, collaborating, buying and selling, compute, inference, other types of resources. And to us, we believe that we're at the start of what is a Cambrian explosion of innovation. where lots of you here in the room will create services and resources for machines to consume. That will open up a whole new economy. But for that to work well, it needs payments. Nadea is launching a new health bar. Its agency handles the campaign. I think they're going to show us how. Its agent makes it happen and pays for it. Listen. Meet MasterCard agent pay for machines. One prompt, a few product photos, and the agent gets to work it finds certified providers on the MasterCard network scripts images voices video and comes back with a proposal it asks for a $400 budget the agency approves bank account card wallet or line of credit with MasterCard agent pay for machines that approval becomes a verified spending limit recorded in a smart contract up to that limit nothing beyond it contracts work a script eight cents an image 42 cents a voice sample 55 cents commissioned in real time payments secured by mastercard moments later the creative assets are ready to review the agency stays in control its agent runs the production mastercard agent pay for machines runs the payments each provider is paid in the currency chain or rail it prefers and just like that the is ready to go so so that that got a little ahead of our skis here what this video is showing is what i'm actually about to demo in production in live production now my mentor used to tell me very wise man never bring live animals or live production demos to a big audience but hey this is a developer conference let's live a little let's try this and so what you will see is us making a payment or a series of payments that are secure that are permissioned that are interoperable and most importantly that are accessible to everyone as as matthew prince earlier said today we need to develop this in a way that is truly open and truly accessible for the largest company and the smallest one so let's try this um so i'm all here my friend will will will drive the demo as you can see similar to the video So, a real company, Hype, which is a marketing agency, has a task here for creating a marketing campaign for that new Nutella brand. When Amol presses the bottom, the agent gets to work. This is an agent on AWS Agent Core, which starts with three things. They break down the task. They identify the resources that can actually complete the task. In this case, I... which is a marketing or the research agency and cloudflare AI gateway that can provide the resources and it proposes a budget as you can see the budget proposed for those tasks is $3 .50 I have a number of funding sources in this case I choose my digital wallet because I have some stable coin laying around and as I'm all proceeds and uh with with with the with the with the payment again two things happening firstly three dollar fifty are moved into escrow we do that so that we can guarantee to the seller that that payment will happen payment guarantee really important the second one we write a smart contract on base in order to create the permissions so that that agent can only use the 3 .5 and nothing more for only that task It takes about 20 seconds, because that is actually happening live on base. But as soon as that is happening, the agent can then go to work. That has now happened. The agent goes to work. As you can see on the left here, a HTTP message goes out to the seller. The seller responds with a 402 payment request. As soon as that's done, the payment channel is being opened. And for every resource that is being delivered, to the buyer a voucher cryptographically signed by the agents goes to the seller and that represents the payment guarantee for that resource that is being delivered at the end of this as you can see there's about nine vouchers that are being sent to the seller at the end of this the seller can then move the money can settle the money in an aggregated way all this happens at machine speed in a few seconds is fully fully secured fully credentialed by by machine to machine payments very quickly this has actually happened in real life real money has moved as you can see in base scan more or less in the middle of the page the ERC 20 tokens have moved from one wallet to another and that seller has been paid so that is life that is input I would really invite you all to check out downstairs at 235 the kind of breakout that unpacks this a little bit more with our partners Cloudflare and financial and and more and our toolkits our sandbox our documentation is available for people to kind of poke at it to learn and to help us develop that roadmap but this is truly the start of a new era in machine-to-machine payments and the start of a whole new economy that I think will be built up. Thank you, Amol. Thank you. Bow to the demo gods. Well, thank you, Jorn. Thanks so much for being here. So we are thrilled to be partnering with MasterCard to enable the agentic Internet. We've now covered build. We're going to move on to secure. Wesley is going to show you how you can meet sovereignty requirements without sacrificing performance. And Grant, our CISO, will take you through how we are helping to protect the internet and our customers. Wesley? Thank you, Stephanie. Trust is the- foundation of security. You trust your vendors, your tools, and your people to protect you and your business. Trust is also at the root of data sovereignty and data residency, and it's even more important in the agentic internet. Data sovereignty and data residency have become operational requirements around the globe. No matter where you operate, it's likely that they're thinking about where you process information, where you store it. how you handle it because we operate with region earth we have a unique point of view on residency and its effect on the internet it has us asking questions like how do we make trust more transparent how do we create systems that are localized resilient and performant how do we help the internet move beyond the idea that to trust something you have to physically control where it's located These are the questions we've been grappling with and we believe the answer to them is encryption Encryption is going to change the way the world thinks about data residency and data sovereignty and we're reimagining our infrastructure around it Encryption works. We know that every single one of this room is a developer and you've used encryption every single day to protect your most sensitive information Encrypted information is just noise Until you can decrypt it. This is the foundation of the next-generation systems architecture for Cloudflare, and we call it the data residency architecture, and it's going to transform our networks and our products, enabling you to meet data residency requirements around the world while building the agentic Internet. The data residency architecture protects our most critical systems, our control plane, and our logging systems. We're reimagining them so that region Earth can be region anywhere by making them more resilient, faster, and highly localizable by running them on our own developer platform that Rita, Evan, and Matt told you so much about today, by moving them to workers and durable objects. This shift means that not only could you run a worker or a WAF rule or a durable object in region Earth, you could now deploy them with the exact same product experience in exactly where you need them to run, logging information exactly where you need it stored, and ensuring that you can do this all with the click of a button. when you want to change it it's just another click no going back and changing a major region setting not only does this make our network more resilient and faster for everyone on our network it provides the verifiable trust that you need to provide to government and regulated markets around the world so that they can trust you and by extension cloudflare with their most sensitive information if encryption is going to be the foundation of trust and security in the agentic internet, then it needs to be ready for the next threat, quantum computers. Quantum computers are going to change the world, and they're coming much sooner than you can imagine. And we know they're going to break traditional cryptography. That's why Cloudflare has been advocates for post-quantum cryptography since 2017. And I'm proud to announce that 100 % of our on -ramps for our edge and our CDN and our Cloudflare One products are protected with quantum secure encryption today. But we're not stopping there. There's a whole roadmap in front of us that gets us to 2029 to ensure that every product, every service at Cloudflare is protected with quantum secure encryption and quantum secure authentication to make sure that we're ready for the threat of quantum computers. Our next major milestone is coming very soon in 2020. around quantum secure authentication and certificates. We will be launching Merkle Tree certificates, which we believe is the answer to how to do fast and efficient quantum secure authentication on the Internet at global scale. We believe in one agentic Internet, an Internet built with performance, security, and trust throughout Connect. We're going to be going deep on data residency, data sovereignty, and post-quantum cryptography. Come to talks with Sharon Goldberg. Emily Hancock and Alyssa Starzak to go deep and learn more. The data residency architecture itself is moving quickly. Pull up the Connect app and go to this session to express interest in our private beta. Now, to tell you about how we're building trust and security together in Europe, I'd like to welcome to the stage Dr. Alexandra Heidel from Deutsche Telekom. Wow, what a great event, I'm so thrilled. to be here. Well, so who is actually Deutsche Telekom? I'm pretty sure you all know T -Mobile US, right? Who knows T -Mobile US? Yes, thank you. So we are all part of the Deutsche Telekom group and we have over 273 million mobile customers and over 22 million broadband customers. And for that, we are one of the leading integrated telecommunication companies worldwide. So, what is actually our mission? Our mission is to provide access to the internet for everybody. To create access to the world's knowledge and imagination. And we won't stop until everybody is connected. At home, at work, at school, just everywhere. And because of our values being reliable, trustworthy, competent, and sustainable, we became the most valuable telecommunication brands in the whole world. And the most valuable German brand of all times. So... Today I'm actually thrilled and so happy and honored to speak about something very, very close to my heart. So I'm proud now to finally be able to announce that Cloudflare and Deutsche Telekom just have recently joined forces for a secure and resilient internet. And on that map behind me, you actually see our direct interconnections, which ensure ensure secure and direct paths for the data and believe me this is just going to improve security control and enable better performance for our future joint offerings however this partnership is not just about technical connectivity it's way more than that so deutsche telecom will expand its enterprise portfolio with cloudflare security connectivity offerings so we want to make customers into fans we are true digital company we are way more than just being infrastructure telco we are a digital telco and how do we make customer into fans well by providing a end-to-end value chain that is Brazilian, secure, and industry-specific. And believe me one thing, serenity is not just a buzzword for us. It's lived reality for us, our partners, and our customers. So beyond the plant portfolio partnership that Deutsche Telekom and Cloudflare just have engaged in, we intend to collaborate on new approaches. to address evolving security and sovereignty requirements for European enterprises. And believe me one thing, I think sovereign AI is going to be a huge playing field for us. So what does serenity actually mean? It seems like a difficult concept, but actually it's not. Serenity means having a choice. So we can decide which technologies, partners, or rules are right for us. But it also does mean keeping control. We understand where our data infrastructure and critical services are. And choice and control create freedom. Freedom to act in our own interests without becoming dependent. So, let me tell you one thing. I am a skydiver, you know? And you want to control the air surrounding you, not the other way around. So, on my final notes, I brought you a picture of our headquarters in Bonn. And now you're asking yourself, why is she bringing a picture of an upside-down elephant? What the heck is that? Well, actually, that's a good idea. Elephant is an art installation and it has been gifted to us for our 30th anniversary last year. And it is not an upside-down elephant. He is dancing on his trunk. And actually, for us, this elephant is all about attitude and optimism, and it is a reminder to all Deutsche Telekom employees. that everything is about acting in agile strength, pushing for transformation, and it is about to deploy courage to make the impossible possible every single day, to make customers, partners, you into fans. Thank you so much. much for having me. Enjoy the day. Thank you, Alexandra. Knowing where your data lives is half of trust. The other half is knowing who's trying to get at it. To tell you all about it, here's Cloudflare's Chief Information Security Officer, Grant Borzykis. All right. Good morning. That was terrible. Can we try that again? Good morning. All right. I think the right side, which would be stage right, won, just for the record. That way we're keeping points. But I'm Grant Porzekis. I am Cloudflare's chief security officer. And I'm excited to be here in San Francisco. So when Matthew came on the stage, he talked about this new user, right? The new user as an agent. which is fascinating, but most of us are security people here, right? And we love Internet users, but we have two new types of users, right? A new attacker, one that never sleeps, scans everything you find. We have a new defender, right? We have to keep up with it, which is fascinating, right? We're changing the way that we do things. But what's interesting is we're trying to do things. What's interesting about this, everybody has the same AI, but there's a different advantage to each one of us, right? If I'm an attacker, I can scan, build, and exploit things in minutes, and we see that. We're going to talk about that. And for us defenders, we've got change management, right? Oh, you've got to put a ticket in, right? And we have to find it, we have to test it, we have to patch it to go through this process. And so the difference between where we are. today in this convergence is the difference between agility and time right and so let's actually kind of boil into that and think what is actually occurring with this change right attacks are increasing has anybody seen that i think it's fascinating this year we're seeing on average 310 billion with a b attacks right last year was 190 so we're up 63 percent just this year right and 3x from where we were just two years ago and one thing we talked about earlier in the year which was the largest ddos attack at 31 .4 terabits a second that was my favorite question to ask your ddos provider can you handle that right and what is generating this ai agents we just all talked about which is fascinating but there are two things that i think we're all facing with this types of attacks because there's these new attacks that are occurring right and so the unknown vulnerability right the vulnerability sitting in your code that's been there for years that we've been trying to find have we found it no have the attackers found it not yet right but there's no cve there's no patch and and now we know the attackers are hunting for you every day right and we thought right traditional testing I think about this maybe I'm a little older you know 20 years ago when we tried to do dynamic testing and static testing and this stuff was going to work we're fix all the vulnerabilities we did find a lot of vulnerabilities we found a lot of false positives with things and that was kind of the status quo of where we were and then mythos came I always like to say it made our lives. We got a lot of hugs from our executives and our board and our CEO. Big, tight hugs. I think our board's sitting right here. They gave me a big hug about Mythos. And so we had the preview, and I felt really good about what we did with Mythos. We found thousands of bugs. We fixed them. We built a harness. We've written four blogs. Problem solved. I can move on to something more fun. But that's not right. And I've not said this publicly. Because we saw something that was interesting, right? The bug bounty program started to increase. Now, we saw it increase par for par for what we had found in our testing harnesses. But we've started to see amazing things from a runtime standpoint. Researchers that we were just talking about with the 310 billion attacks are launching attacks at us With new types of harnesses, right? And so what I thought The silver bullet was not silver. It was not a bullet. And so what did we turn to? All the things you should turn to Is we had to think about how we're going to drive autonomous attacks, right? There's a race against who finds the vulnerability before us. And I think that's interesting. And so we built an Atomic Red Team capability, and we're running it. And we are finding different things. We're finding the things the researchers found by doing this. And so I thought, well, it's kind of like deja vu a little bit. The Mythos, amazing model, it's wonderful, it's kind of like static analysis, works really well. And the Atomic Red Team, with what we've done with the Daybreak models and OpenAI, is amazing, but now it's a race, and it's a race against who? It's a race against the adversaries that are attacking us, right? The nation states. But what's a little concerning about this is nation states have always had finite sets of resources, and that's been the problem. They can't attack everybody because they don't have enough people, because it's still hard to find sight. security people. So it's good to be in demand, right? But now, with what we've just seen in our bug bounty program, that they actually can focus their effort on the harness, the red team harness, the automation, the agents, the change in internet behavior that Matthew and everybody's talked about on this stage, right? They have the infrastructure, they have the capabilities, they have the models. And that's what's occurring today. Right, we're seeing that loud and clear, and it's a challenge, right? And so there's the second kind, and these are actually more fun. These are the ones that make us work weekends, the unpatched vulnerability, you know, publicly reported CVEs that have to be patched, which I think we all call the vuln apocalypse. Has anybody said that? I hate that word, but it's kind of fun. Because it's... there's been a swing of vulnerabilities introduced and if there's a vulnerability introduced you're going to get scanned for it right that's just going to be what's happened so we have to be very good at it and how many conversations have you all had about how fast we patch the vulnerability and that's for you know companies that finding the vulnerabilities and patching them right is part of their disclosure process but there's two things that are somewhat concerning as we look at this right. We're actually seeing, and we saw this just a couple of weeks ago, a CVE released and 22 minutes later, it was being exploited. 22 minutes. Can you patch in 22 minutes? Who can do that? And what's interesting about that is that's stressing the system. We're seeing it. I did something with AI where I can just create a web. But you can do the same thing with the CV and try to create an exploit. And this is what's occurring. And this is a problem we can solve, but this one is more problematic, right? So anybody saw the Citrix vulnerability from NetScaler? There wasn't a patch. It was a remote code execution vulnerability that you could gain access to it. We saw more than 22 threat actors, it's actually 20. 22 threat actors launching attacks. Well, what do you do, right? Where does it, how do we address this? There's no patch. Do I take it offline? Now there's stress in the system, right? And so how do we think about this? Because that 310 billion number is a direct correlation of these two things. And so how do we think about it, right? It's really about the vulnerability cue and how do we address it, right? It's how do we make. good solid patch decisions and how do we make good architecture changes I think we've always relied on patch we've we need to rely more on architecture but it's something that's there even for me right I think I have a world -class engineering team I have a world -class executive team that pushes and drives this right it's amazing but we've seen a significant increase in CVEs just this year right 500 % increase in our bug mounting now we automated it but we're still seeing 5x growth in it and then thousands of bots scanning right so when I think about unknowns like well I feel we're pretty good feels not good but we have these harnesses and we're testing it's a race of the unknowns of what we're doing and there's only one reasonable to think about this and luckily if you if you've I think everybody said this the one thing I have that's a superpower so I have more than 20 % of the internet coming through us we see everything everything it's quite interesting and so we thought how do we come up with this threat intelligence capability where we can see all the attacks right how do we actually see it and then start to search where are we seeing it how Often is it occurring, right? Where is it? We're doing that internally to protect ourselves, which I think is fascinating. But when we got closer to it, we said, well, here's our simple methodology, right? Fix what's being exploited. You got to know what's exploited, though, right? Two, like schedule, plan, prioritize what is being exploitable. Not exploit. exploit a bull right we don't see it on the internet and schedule what is no sign of exploitation and that may be something you know that nobody else does and this is what we've tried to do and so we thought we can't share that we can't just keep this it's a superpower right so we put it into our products we released a product called security insights and now you have that same capability to understand being exploited across the internet today put it into your vulnerability management program prioritize it right the products work we're building all the technology that you've heard from the machine learning and the ai across the stack to be able to do it and what makes me feel good is it works so since i've been on stage 1.1 billion attacks we've blocked. I think that's really cool, right? No, quietly, right? Quickly, no human intervention. You take care of it. It just works. You need vendors. That's what I think. That's why I came here. It just works. And it's super cool. And so, because... works. I'm going to bring Raj from Oracle out on stage. And he's going to talk about how it just works for Oracle. Nearly half a century ago, Oracle transformed how the world managed data. More than a decade ago, we reimagined how business works in the cloud. And now, as AI reshapes how we operate, compete, and innovate, Oracle is once again leading the way. That data, it's now your AI fuel. That cloud, it now trains and runs the world's most powerful AI models. And those models, they power the Gen AI built into your business processes and the AI agents that automate it all. Hi, Raj. Hello. Wow, crazy times, huh? Yeah, crazy. Welcome to ThoughtFlare Connect. It's great to have you here. It's great to be here and I hope it's still... Humans in the audience are not agents. Yeah, there's one. So tell us about your role and how you're using Cloudflare. Oracle's so iconic. It's such a massive organization. Tell us how you're using us. Just about my role itself. So I lead networking for Oracle Cloud Infrastructure, OCI. So my team and I are responsible for building and operating the global network infrastructure that powers Oracle Cloud. As you'd imagine, it's an exciting... to be doing that right now about considering the pace at which oci is growing we are constantly evolving the global network footprint global network infrastructure more cloud regions are coming online and you know more and more mission critical workloads are coming onto the cloud so talking about the workloads themselves it's kind of interesting how they are evolving we are seeing more and more enterprise data and applications coming onto the cloud alongside with enormous growth of AI infrastructure. So AI is fundamentally changing the equation on both the sides. So on one side, we have the scale and sophistication of the applications that we need to support, the kind of workloads we need to support. On the other side, the scale and sophistication of the threats that we need to defend against. And as a cloud provider, we are responsible for... you know, earning the trust of our customers. So they are putting sensitive workloads and data on our cloud. So protecting that is like our top most priority. And so our strategy and the challenge that we are actually like going after is to see how we can protect, you know, from against these threats as far away from our infrastructure as possible. So not even let any of this malicious traffic actually get on our cloud. And that's where the partnership also comes in. That's awesome. So one of the things I think is... and Oracle is just, it is an iconic company and we started from databases and now you have all this massive infrastructure and one thing we think is, well, we're protecting Oracle, but we're actually helping you protect your customers of Oracle. Can you talk about what's going on in that partnership? Sure, I mean, it's a bit of both, right? It's protecting our infrastructure and protecting our customers as well while doing so. So look, as a global hyperscale cloud, going to always have to assume that the threats are going to grow in size and complexity and sophistication. So the strategy cannot be like a single layer of defense. It's got to be defense in depth strategy that grows along with the infrastructure. And that's where partnership with Cloudflare also comes in. What I saw in Stephanie's slides when she was presenting, you've got a very impressive global network of, what, 340 plus cities or something like that. That puts you in a vantage position in terms of understanding the evolving threat landscape as well. So that's where we are partnering with you to put on the Magic Transit solution product that we're actually using as an extra layer of protection closer to our network edge. And again, the strategy is simple. So we want to be able to protect, expand or extend our defensive perimeter as far away from our... cloud infrastructure as possible and also leverage some of the capabilities that you guys produce from the security capabilities and the overall global edge that you've got so that we can actually provide the needed resiliency for our customers as far away from our cloud as possible. So that's where it comes in. That's cool and it's interesting you think we protect you at the edge, right? So it doesn't come to the data center and fill the pipes up. So what's next for Cloudflare and Oracle as we continue this great partnership with you all? There's a lot on the agenda, right? So our network infrastructure is going to continue to grow. Our overall global infrastructure is going to grow. Security infrastructure is going to grow because we have to be ahead of the kind of landscape or the workloads that are actually coming out of the cloud, especially to support the next generation of the AI workloads. That's going to be very demanding in terms of the performance, in terms of resiliency, security, all of that. So we need to stay ahead of that, and we do that by actually partnering. with strategic partners like Cloudflare and continuing on the innovation journey. So by the way, Oracle does not partner with Cloudflare just on the Magic Transit solution alone. So we've got many other web resources that we're actually trying to move to the Cloudflare product portfolio. We are also offering a broad portfolio of Cloudflare products like around the connectivity and security solutions to our customers through the Oracle portal as well as through our marketplace. So the strategy is pretty simple. So we just need to be, like, you know, protecting our infrastructure, innovating jointly, protecting our customers as well, and provide a resilient cloud and looking at as many capabilities as possible for the next generation of the workloads. Well, that's wonderful. Well, I appreciate you coming in this week and spending time with us, and you have a big job to protect a lot of things at Oracle, and we appreciate you spending the time with us. And I appreciate the partnership as well. Thank you. Appreciate it. So we've covered outside in, right? I think the thing I always think about it is I always want products to just work. And that's good. And I think that's really a positive thing. And it's instrumental in my 20 years of being a CISO. And so, but the thing I'm really excited about, right, is inside out. And there's two reasons why I think inside out. One is we've talked about AI. We've talked a lot on the Internet. But the way organizations are changing is from the inside, right? And we talk about governance or how do we enable agentic AI. You saw what Lovable did. You've seen what Deutsche Telekom is doing. But I think you have the things of how do you enable business and how do you protect the business, I think is what we're going to see over the next 6 to 12 months. We've not seen many. of these are the largest breaches are going to be originated from the inside out, major agentic types of attacks. And so I think that's the big thing that's there. The one thing I'm super proud of at Cloudflare is 100 % of every employee is using AI. Across the board. And if you don't believe me, find the nearest cloud. their person and ask them. And so as we think about this, right, that is the new normal of where it is. And to get to this place, we had to figure out how to do it, because agents operate differently than humans. And the question I get from everyone is how? How do we do this? How? We're going to talk about that. At 11 o'clock, I have a session on how we do it in security. But how do we enable this across the board? that's interesting and we took the principles that we applied for humans identity access data visibility and applied them to agents right same principles implemented differently want that same exposure and that's where it's being driven but the one thing that we think is more important is the visibility we need to understand what agents do i can't have 100 of everybody at cloudflare do things unless i understand what they're doing right and that's the essential component and when we think about this I need to see every step in the process I need to understand and trace it to be able to see every step and the visibility that we've always wanted for people we have now is the foundation for governing agents and that is one of the most powerful things that I can think about is how do we do it we have complete visibility around it and so now can see the intent of the agent, the action of the agent, the outcome, all in a log that I can do things with, right? And that's where we start with governing, right? I need to be able to see things, I can act, I can respond, I can drive. And then, right, when I think about it, you know, is that agent got the right identity? What are they trying to do? Who owns it? What should it be doing, right? All those things we're driving as part of our ecosystem. the products. Access. This is the one everybody talks about. Can it access the things we needed to do? Who approved it? Did it try to access something it didn't? Did it try to make an MCP call? Did it try to scrape something? We need that visibility. And data, right? Is it trying to inject something? Is it trying to take code? Is it trying to put something on a model? Or is it trying to send it to a model? None of this is new for us. But we've tried to put 25 solutions together. We build a big governance model to try to traction it, and we never get to the real result of where we are. And I think the thing that we think about zero trust for our people, right, we didn't want to buy a new set of tools. We simply wanted to extend it to agents because that's where we want to be. Because every step of the way, we need to be able to drive and see what it looks like. And so when we come back... to this controls in the process throughout the whole thing, we needed to see what's allowed, what's limited, what's blocked, right? That's what we need. It can't just run random and there's an agent going on. We need to see different control points throughout the network, and that's where we drive. And this was built by Cloudflare, right? Built on Cloudflare, the same platform you heard, using, or Deutsche Hörn, or MasterCard. That's what we're running, right? It's the platform where we build, run, and secure agents. It's all built into workers. Super scale. We built it for a reason. We built it for us. We, as Cloudflare, Matthew and Michelle, where we need to make this company iconic. We need to transform this company. The only way we're going to do it is AI. Build this, right? Engineering team did an amazing thing for it. We got the benefit of it, but now It's ready for all of you. It's for yours to buy yours to enable and I'd love to see what you can do to really drive this forward All right, thank you. I'm gonna bring Stephanie back on stage and we're gonna continue Thank you Okay, you don't get to leave quite yet. I have a quick question for you. So you've been working for a little while on a Citrix vulnerability and it's a really big deal there's a lot going on give us the quick version yeah so Citrix we love Citrix it's a great product it helps enable but we've had historical problems with it and there was a remote control vulnerability you kind of heard me talk about a little bit earlier in which you could basically bypass all Citrix environments with and there was no patch right and that was a huge problem and so one of the things that we did was we took we initially took a WAF rule And we're able to block it, but the patches kept coming and we said, that's not going to work. So we front ended Citrix with our zero trust access platform. And so now we're forcing them to authenticate with us. We're using the waffle to block everything and see what's coming at them. And we're using our threat intelligence along with DDoS and various other technology to completely stop it. And the coolest thing was, this was just a couple of weeks ago, one of the largest companies in the world deployed about 100 ,000. employees in one weekend. And so if anybody has Citrix, and we just wrote a blog about this yesterday, it's something to do because it will, you still need to patch, but you don't have to patch, you know, today or tomorrow, you can patch in a month. And to be able to re-architect how you're doing remote access within the platform of in and out is amazing. So something I think is really impressive that the engineering team built. We're so happy to have you here, protecting all of us. We'll see you. So that's security for your data, your network, and your people. So far this morning, you've seen the network, how to build on it, and how to keep what you build safe. Those are the building blocks. Our next two speakers took those building blocks and put them together inside of their company so that their employees could build whatever it is that they wanted. First, Steve from TELUS is going to talk to us about how he used... Cloudflare platform to help their people build. Then our CIO Sam will show you how we did the exact same thing inside of Cloudflare. Please welcome, Steve. Hey, how's it going? Thanks for checking around. I know we're running a few minutes late here. So, at TELUS, we wanted to make sure that we could understand what I was doing. We have 100,000 people here. And we needed to make sure that every single one can be a builder. It doesn't matter whether you're a network technician, you're in sales, you're in marketing. We want every single person to be able to be a builder. And so, we decided to build something to help us do this safely and securely. And we need this to be as easy as just asking. Ask in plain language, no spec, no ticket. You don't need permission to deploy. Your agent can just publish it as and when you need it. Nobody files an infrastructure request. And you can share it like a dock. We wanted to use the same ideas that people are comfortable, who non-traditional builders are comfortable already using in their language. We wanted to make sure that every single person can share it just for you, for your team, or for everyone. And every single gizmo gets the hard parts done for free for you. Every single gizmo knows who you are before it shows you anything. Nobody can see it until the owner shares it. It needs to remember something, the data has somewhere to go, and no one at TELUS ever has to run a server for it. No one ever has to patch anything, no one has to maintain everything. So what happens when you hand this to a company of 100,000 people around the world? In the four months since we started this. More than 11,000 gizmos have been built by the people who use them. More than 1 in 10 people at TELUS have already built one of these. And agents use gizmos every single day as much as people do over MCP every single day. We have been very quickly replacing tools that we had been paying for for years and years and years. Every single thing can get built in an afternoon by someone who knows exactly what they want and never knew how to build it before now. These aren't toy apps either. These all run real workloads at Telus today. Someone plays tools we paid for, someone plays spreadsheets and email chains, which is the one that makes me the happiest. I'm a big fan of killing load-bearing spreadsheets, and I'm very happy to say this has been very successful at Telus over the last while. And I want to tell you one story, and it's very much how we actually run AI at Telus. Our entire AI FinOps practice is now running on Gizmos. Gizmos runs how we do AI at Telus. This allowed us to replace a . of Looker dashboards, some IBM Apptube over here, a whole bunch of access now requests, a whole sort of dog's breakfast of tooling that we had to cobble together across multiple identity systems in order to make it work for us. So here's what's under the hood for all of this. Gizmos is built on Cloudflare. It came out of a joint hackathon this spring. Our people can sign in once whatever identity system they're already using at work, and each Gizmo is its own worker isolated from everyone else. The best part of this is that not a single person has to configure any infrastructure to tell us to understand this. I want everyone to be able to build safely. We have a saying we like to say, which is let people do dangerous things safely. And this is very much what we get with Gizmos. The agent asks for a database, files, or background jobs, and they appear. Live state, SQL, storage, even full containers want to play away. All of this brings me just one thing to remember. That's gizmos, gizmos.run. Thank you to the Cloudflare team who built it with us. It's been a great joy to have. And I'd quickly like to welcome back Stephanie to the stage. Thanks, Steve. Thank you, Steve. Well, tell us built that for its own people. Inside Cloudflare, Sam used our platform to solve the same problem for our people and for all of our agents. Come on, Sam. Thank you. Thank you, Stephanie. Good morning, y'all. AI is changing the shape of the internet, and it's also changing how we work together. If your job, like mine, is to equip and enable people to do their best work, we now have the tools to make dreams come true. Seriously, the drudgery that your finance team always hated, we can automate it. The paperwork that got in the way of your sellers spending more time with customers, we can get rid of it. We now have the ability to speak into existence the tools that we always wanted. And you just heard from Telus how they've done that for their own team members. At Cloudflare, we also went on our own journey rethinking how we work with AI. And to do that, we created a project that we called Cloudflare OS. We didn't need just another chatbot. We needed an AI workspace where people could build tools and agents that safely connect to systems of record. No local config or setup required. Cloudflare OS became that workspace for us. We built it for ourselves, but we started talking to customers and friends of ours, and it turns out a lot of other organizations shared this challenge. So what we've done is we've taken what we built, we've packaged it up into an open-source project that we also call Cloudflare OS, but you can rename it to whatever you'd like, and we're making it available to every team who wants to go on this journey with us. We did this because when we talk to CIOs and CISOs, we hear that most everybody shares the same challenge right now, and it really breaks out into three categories. People need a safe place to build, organizations need to keep that secure, and it needs to scale from both a usage and impact perspective, but also a cost perspective. So we set out to fix all these challenges with Cloudflare OS. First, building. AI can help everyone build the tools they always needed. Your teams know the outcomes they want to achieve, they just need a place to do it. But not every lawyer or marketer or every member of your team should need to become an expert in version control and technology selection and software deployment. They should be able to focus on their work. So we solved this in Cloudflare OS by giving every user a workspace where they can use AI to define the agents they need and the solution handles everything else. Everyone gets the best of Cloudflare's developer platform while they get to focus on their specific jobs to be done. But second, security. Agents and applications need access to data to actually do something. And the last thing that anyone here wants to do, myself included, is hand out a dozen API keys to every system of record from Salesforce to Jira to email to anyone who asks. So to In Cloudflare OS, we introduced a connector concept that we call a gatekeeper. It's a safe way to take a user's permission and authenticate what they built against a system of records API, and it works great for agent use cases and more deterministic tools that you can build. And all of it runs in a controlled environment where you have total visibility, where the session has access to just the data that it needs, and protected behind our zero-trust access control rules because nobody wants to accidentally publish to publish these tools to the public Internet. And third, scale. Your agents and applications should keep working, even when you're doing something else. Cloudflare OS continues to run in the background safely getting jobs done, but there's another kind of scale we wanted to solve here. And this, in particular, keeps CFOs up at night, the challenge of scaling token cost, a rising token cost. So to do that, we took two approaches. The first is Cloudflare OS comes with our AI gate. which routes inference to the right model for the right job, giving you efficiency and optionality. And second, what we learned in our own journey is that what a lot of people really need is a mostly deterministic tool with a little bit of AI. So Cloudflare OS lets you use AI to write code that just executes and uses inference just when it needs to. And we're partnering with the applications you love to make it easy to connect them into Cloudflare OS so that you can seamlessly build. Canva is a great example. Their new integration makes it super easy to create beautiful assets and content right inside of Cloudflare OS. Now, this platform brings together all of the best primitives and technologies that you've heard about today from Cloudflare, including durable objects. And you can deploy it yourself in just a couple of clicks, or you can take the project and edit it and make it your own, or you can use it as inspiration if you want to borrow some of the... concepts or some of the tools and how we think about this, you can do that in a way that makes sense for you. We're so excited to continue to go on this journey with you, rethinking how we work together as the shape of the internet is changing. We are here all week, so please come find me. We would love to help you explore Cloudflare OS, and we also have incredible deployment partners available who can help you get it set up and rolled out to your own organization. Thank you all for being here today, and with that, I'm going to hand it back off to Thanks Sam. We made it. This morning, Matthew said that he wants an internet that still has room for a teenager who's launching their first app, the deli where they remember your name, and whoever is building the next Cloudflare. So I'm going to quickly check in on all three. The teenager has never had it better. I'm sure every parent in this audience agrees with me on that one. Rita showed you agents writing code and using what gets built. Lovable showed you the person with the idea building the app themselves. And Evan showed you the last step, one command, and it's running in more than 340 cities. Building used to be gated behind knowing how to code. That gate is now gone. The deli. Well, here we still have a little bit of work to do. Agents might send them more customers. Or as Matthew put it, the agent doesn't care who remembers your name. Matt Conroy showed you the tools so that humans get to decide. It hasn't all played out yet. Providing you the tools for transparency and control is where we start. The teenager, the deli, whoever's building the next Cloudflare, Matthew said all three will need a network that can reach everyone. In 2010, we had to build our own. The people building the next Cloudflare won't have to. They get to start on ours, and it comes with everything that you saw this morning. Matthew reminded us that our mission is to help build a better internet. Help is the important word. Look who's been on stage, and they're only a small fraction of the many companies that are building with us. We told one story this morning, so we left a bunch of products out. If you came for one, we didn't mention. don't worry about it, it's in a breakout. They run the next two days and so do we. Please come find us. AI will be as good as the internet lets it be. The people who help build the internet are right here in this room. This is where the agentic internet gets built. We're super excited to build it together with you. Thanks for being here. Welcome to Cloudflare Connect 2026. We'll be right back.