Connecting Cloudflare One data protection and secure AI

All right. Hi, everyone. My name is Abe Carryl, and I'm a product manager here at Cloudflare. Super excited to be speaking with you all today about Cloudflare One. For those of you who don't know, Cloudflare One is our suite of products that connects and protects users, applications, networks, data, and increasingly the agents connecting to those internal resources. I've been at Cloudflare for about six years. I've spent the majority of that time working on our networking and security products and now focus mostly on our data protection suite and specifically how we're applying that to AI and AI applications. Rob, do you want to introduce yourself real quick? Yeah. Hi, Rob Danz. I am a specialist solutions engineer. I've been with Cloudflare a little over four years. Started off in the core side, so I've done all the WAF and CDN things, and then I made a move over to the specialist team, and I support strategic accounts, enterprise, and even in my early days, the mid-market commercials. Awesome. So what we're going to do today is do a quick presentation about Cloudflare One and our SaaS suite in general, focusing on data protection, and then I'm going to pass it over to Rob, who's going to show you a little bit of a demo of what the admin and end-user experience actually looks like, so you can get a glimpse of how you create some of these policies and the way that your end-users would experience those things. But before we do that, I want to level set a little bit and talk about some of the common pain points that we're typically trying to solve within this use case. And it really kind of bubbles into two different buckets. The first is around discovery, and that really is all about trying to understand what AI applications and use cases our end-users are trying to solve, because ultimately, as security and network professionals, what we're trying to do is solve problems for our end-users and help enable them to do their best work. And right now, in most cases, that means using AI in order to accomplish the things that you're trying to build. Around discovery, that normally comes with a whole host of different questions. So that's things like, have we reigned in shadow AI? What does our shadow AI footprint look like? What kind of AI applications are users gravitating towards? For MCP services, it's who's using different MCP servers? Are those local? Are they remote? How are people handling authentication? Have we centralized that? Are they baking in API keys? Are these being downloaded from vetted resources? All those kinds of things. And how do we get visibility into that in general? And then, of course, the last one is, what are the actual prompts that users are sending to these applications themselves? Do those contain sensitive data? And how do I make sure that I have auditability and logging whenever those users are sending that data to these services? On the other side of that, you have the controls that you're trying to build. And that really is around, how do I make sure that I'm thinking about which users need access to which tools? So as an example, you might have your technical team, and they might need access to a very different set of AI applications and harnesses and models than maybe your non-technical team does. So how do I make those identity and device-based rules to make sure that those users can access only what they need to? And then on the other side of that, you have the actual data that is being sent to those applications and making sure they're controlling that, locking that down. And then last but not least is actually logging and classifying the prompts themselves. And that's all in service of accelerating AI adoption. And one of the things that we talk about and that me and my team think a lot about is, how do we make that as progressive and intuitive as possible? And really, what I mean by that is, how do we make sure that every policy that you're putting in place in your organization is data-backed and that you have a good idea of what the impact of that policy will be first? There's all kinds of dashboards and reports and different ways that we analyze the data that's going over your network to make sure that's something that's really easy for end users. And again, that's really what we built our Zero Trust services for. And every time that I think about our Zero Trust or our SASE platform, I think about it in three different pieces. So the first is around on-ramp. So how do I get my traffic to the Cloudflare network? Within the Cloudflare network, I typically have two different things. So security policies and routing policies, who can access what? And then how do they ingress and egress? And on the other side of that, you have your off-ramp. So how does traffic get, how does it egress to the public Internet? Or how do I ingress that to my private network? Within the Cloudflare network, there's a whole host of different benefits that we have there. And the first is visibility. So because all that traffic is going through a single pane of glass, and you have a single enforcement point, we have visibility into every request that's going over the network, and we can help log and classify that for you. The second is around access controls. So we can help determine who can reach what. And then the next is data security. So the way that we think about data security is typically by defining pattern matching rules for your data in your organization. So those are predominantly regular expressions that we use to match a particular pattern of user traffic that's going over the network. And then we'll do other things like algorithmic checks, like checksums. So if you see something like a credit card as an example, then we want to run a run on that to make sure that it actually is a credit card. And then we have different ways that we want to prove materiality of that data. So not just saying like, hey, this is a Visa credit card, but this is your Visa credit card. There's some really cool things that we're doing around external validation checks and integrating with Cloudflare Workers, which you heard a lot about this morning, and just making sure that we have a really high degree of confidence in what the detection actually is. We then have prompt guardrails as well, because we want to make sure that the way that users are interacting with these applications is safe. So obviously, you don't want your end users to be able to say something like, what's the easiest way to lie on my expense report or how much my coworkers make? So making sure there's some sort of safety controls around that as well. And then last but not least, is actually logging the prompts themselves. So we do this in a really cool way, which I'll get to in just a second, but actually making sure that we can look at the individual content and intent. So the content being what you're sending to that model, and making sure that that doesn't contain any sensitive information, but then the intent being what the user is trying to derive back from the model. I don't want a user sending an API key to the model, but I also don't want them asking for one to get sent back to me. So we want to make sure that we're protecting both sides of that transaction. So that all starts with what we call our application library. So we categorize hundreds and hundreds of different applications within Cloudflare 1. We take all the network intelligence that we see as Cloudflare, and then we break that into individual categories. We can then do really cool things with that. So if you look at Netflix as an example, rather than having to define Netflix, the application yourself, we have the 50 plus host names that are associated with that application. We then assign risk scores to those applications as well. So we look at things like funding, what are their training, or how do they, do they train on user data? What kind of certifications and accreditations do they have? So that when you choose to block something within your organization, you have some level of assurance that you can give to your leadership team about why that decision was made. And then of course, custom applications as well. So in the event that there is an application that we don't have defined, or that you want to kind of diverge from that application's definition, then you can go and build that yourself. That actually is what we then use to power all of the classification that happens. And we build that into different reports like Shadow AI, Shadow MCP, Shadow IT reports, of course. And you can start to see the users who are using certain applications, as well as the data that's being transferred between those. MCP discovery works a little bit differently. So rather than just looking at the traffic at a really high level, we actually look at the body of the request as well. So we can look for things like resource and tool calls, and then we can catalog those as well. So you can start seeing, here are all the applications that are in use in my organization. Here are the MCP services that they're connecting to. And then you can kind of control the state of that application as well. So you can deem whether or not that application should be sanctioned or unsanctioned within your environment. And then that allows you to create policies, which Rob will show you in just a second. But at a really high level, you can create a policy that looks something like this. If the application status is unapproved, and the application is in the category of artificial intelligence, or is an MCP service, then I want to block that traffic. Or in this case, I say redirect that traffic to my agentic workspace, which Philip was just talking about in the last session. So you can take different actions like that. And you can do that in a really quick way to immediately start to get control over your environment. Once you do that, you want to layer in data security policies. So you can actually control the kind of information that you want to be sent to the applications that you do approve. And we do that in a really interesting way. So we actually break down the application itself. And we look at kind of the micro interactions within that. So things like transcribing audio, or uploading a file, or sending a prompt. So you can have some granularity in the way that you want us to be looking at that traffic. And then I'll draw your attention specifically to the toggle on the far right, which says capture generative AI prompt content in logs. Again, so you can actually have visibility into everything that happens within those micro interactions in the applications that you've sanctioned within your environment. That's a kind of high level overview of some of the concepts that we're going to talk about today. And now I'll hand it over to Rob, who will walk you through the demo itself. All right. Okay, of course. Okay, I just need to set where I know like I got one customer in here. So but where's everybody out in terms of Cloudflare? Is everybody familiar with our solution? And okay, some may not. So let's let me let me kind of level set here for a The one thing I left out in the demo is the identity piece. Okay, so we will integrate with your IDP. This is how we know who users are. All right, so the demo I'm going to do here is going to have our client on a device that's going to be connecting into Cloudflare, which enables us to do all the inspection. All right, so let's give this a go. I'm just going to narrate what you're going to see here on the screen. So we're going to follow a see, decide and protect workflow. Okay, and this is going to start off in Cloud, we're going to go into our Zero Trust section. I'm going to go down to insights and logs and into our dashboards. Okay, we're going to make use of the AI security report. And also the SAS Analytics shadow it report. Okay, we dig into this. And we've got our MCP traffic section here. This is showing me in my account number of requests we have number of users over the last seven days. Excellent. And then what are the distinct MCP servers? How are they being on ramp, WAN, ORP, etc. At traffic by user, MCP servers outside of a portal is like public ones. And then I've got some inside portal ones as well. And a list of all these that are in use, I can use these later on in the policy definitions. When I go to the AI usage section, this is showing me the top five AI applications that were in use that are being consumed by my users. Also, over the last seven days, it's showing me volume of data transferred. Again, the MCP servers by user count. This is the C part, right? So now to go into the decide, I'm going to go back into my dashboards, and I'm going to go to my SAS Analytics. This shortcuts the application library thing that I showed you. I go here, and I set my application statuses here. These are all the SAS applications that have been consumed by my users over the last 24 hours. I'm going to change this to seven days to match my last report. And since we're working with the AI, I'm going to change my application types here on this filter to AI. And here are the applications that we saw. All of these are in unreviewed status, and this is where I can start to make my decisions about these categorizations of do I allow these or not. So we will quickly here start setting these. Get there. Okay. I'm going to mark this one as approved. I will set deep seek to unapproved. We'll do perplexity. I'm going to leave this as in review. I should have sped this up, to be honest. Claude here, we're going to do approved, and we'll do that for Copilot and Gemini as well. Now, I've quickly went through and made these decisions. We can use the application libraries on another slide to help us make these decisions. Okay. So I can click in on these are in the application library, and if we go into our Zero Trust dashboard down in Teams and Resources right there, and we go to application library, these are all the applications Abe was referring to. And I'm going to go up here, and I'm going to mistype deep seek, and I'm going to backspace here and fix it. If you can't laugh at yourself, folks, this is me doing this. So if we look at this, I've got, there's the app confidence score. We'll have a blade that pops out here that will show you some of the security ranking compliance things Abe talked about. Not ISO compliant. Can't opt out of, that's the next opting out of training. They're marked pretty low. Okay. If we go to the Gen AI confidence score, you'll see here, not ISO 42001 compliant. You can't opt out of training. We've scored them a two out of five. So I've decided this is unapproved. Okay. Again, this is part of all of my decision parts. All right. So after doing this, now we need to create the policies. Okay. Oh no, sorry. You can get more details here. If I go to deep seek, he had talked about the host names, define the application. You can find those all here. We can see what past usage for the application was, and then a summary of that compliance report that we clicked into. Right. And now we're going to go over to putting policies and actions for these. Get there. Okay. We're going to go into my traffic controls now, and we're going to go into our firewall policies. And here we're going to go into HTTP. I've pre -created these first three. And we're going to go look at the first one for our block unsanctioned. Very easy policy. If it's AI and it's unapproved, I'm going to block it. I'm also going to send it to a custom block page, which I'm hosting on Cloudflare too. And when we send that policy context, there's some information about that block that goes along with it that makes it easy to customize this page. Okay. And you'll see this in the user experience section here in just a second. You can also send, we'll talk later about the prompt logging, but you can send DLP matches to your sim also. So for this one, if it's AI and it's not approved, we're going to send this to isolation. And when it's in isolation, policies I'm applying here is that you can copy out of it, but I'm not going to allow you paste. Okay. If you're not familiar with Cloudflare's browser isolation, it's a policy action that we can have, and it's a headless Chromium instance that spins up on the Cloudflare edge, and it streams the view back to the end user. So now I can apply additional policies and controls in that workflow that I couldn't do it was running in their own browser. Okay. If we're going to go explain that faster than I did. There we go. All right. We're going to go back to our firewall policies. This is in the lines of the, okay, we want to protect the allowed stuff. So now this one is, if this is AI and it matches our finance profiles, we're only looking for credit cards and things specifically on this, then I'm going to want to block this. Okay. I've done this specific one to just for uploads. You can, again, you can log the payload, you can send it to storage. There's another, and we can talk in a other session about logging the prompts as well in the response. But here I'm sending this as block page. I'm also going to send a notification to the client itself, because if this happens in a page where it doesn't refresh, you need to let the user know that something happened, right? If the page doesn't refresh to a block page, I need to give them some sort of notification. This will be a little toast notification that pops up in their system tray. Now we're going into the end user view. So this is my client. I'm going to connect this. You can force this to always on in your environment. I had this deep seek page already preloaded, but now I'm going to refresh this page. Now that I'm connected to Cloudflare, and I'm going to be taken to the block page that we redirected to. I pass that additional context, give myself information about user insights, and I've also given the user a list of approved things they're allowed to go to. So we click on Cloud. They can go to Cloud, and they can interact with the model as normal. Call me a dad joke. Okay. Skeletons fight each other because they don't have the guts. Here I'm just showing you that we're going to do a copy and paste. Like I can interact with this browser as normal. Everything works. Okay. What we're going to do next is look at where it's that in review. Okay. Where we're going to isolate the output. So we've already looked at blocking things. We've looked at allowing things. Now load perplexity, which you remember was in review. It pulls up. There's no indication that this is being isolated. I can interact with the model like I normally would. And so tell me a dad joke again. We're running in browser isolation. I remember I said that I was allowed to copy things, but I'm not allowed to paste. So I'll right click here. The context menu actually is different when you're in browser isolation. That's one of the ways somebody could tell. There's no paste action. And if I control V this, they're blocked. So this is doing the prevent the exfil. Okay. All right. So we looked at blocking unapproved things, redirecting people to, or advising people to success. These are good things. We have, you know, allowed them to, or, you know, sanction apps. We've isolated others. Let's look at the data protection. Okay. Let's look at DLP things. So we've got the finance stuff in there. So I'm going to go over to DLPtest.com and we're going to go pick up some sample data. I'm going to go pick up these credit card numbers here. And we're just going to copy this. And we go back to Claude. Remember, we applied these DLP to all of them. So I'm going to paste this in. And then I'm going to get a notification on there that says this has been blocked. Then if I go to the isolated one that we were allowing before, I can't paste. I can't paste that whole thing. But if I were to type in a known test credit card number, I'll click go. And it's intercepted. It actually never makes it to the model. So what we're doing here, we're keeping the data from actually getting to the model in the first place. From an admin standpoint, we're going to flip back over to Cloudflare and you can see what's available here. So we're going to go back into our dashboard. This time, I'm going to go into Insights and Logs. I'm going to get Zero Trust Insights and Logs. And we're going to go to logs this time. Let me go over to my HTTP request logs. Here, I'm just going to apply a quick filter to look at my blocked traffic. And I'm going to set my action to block. And these are all the things you just saw us go through. So Cloud A was blocked because of the DLP profile. Perplexity was blocked. Down there at the bottom, you can see the block from the sanction. If I drill into an individual record, this is all the data in that record. These are all the things that get sent to your SIEM. Optionally, you can add on sending prompt. You can send DLP as well and store that in your SIEM and vCode later. This is not hard. We talk about how Cloudflare is the easiest to deploy and getting those policies in place. It really is. If I were to sum this up, though, if you're already familiar with Cloudflare and you have this in place, you're just adding on to what you have. So extend what you have. Just start with looking at your logs and seeing what's there. And then use the same things you're doing for your SWIG and everything else to just extend this to the AI usage. I said this at the beginning. This is really just categorizing things into see, decide, and protect. Start with your logs. Know what's going on. Decide your policies. And then block the bad things and then control the good things of what they can do and what they can send out. Awesome. Thank you all so much for coming.