The integrated Cloudflare stack for trusted AI adoption

Good afternoon, everybody. Thank you very much. How many of you happen to, actually, could you turn me down to touch? Is that right? How many of you happen to be in one of the Build It sessions that we ran this week on kind of the same topic? I'm recognizing that gentleman there. The light's right in my eyes. I can't see. Okay, a few of you. Okay, good. Some of it, I'm going over the same material. Obviously, this is a hands -on workshop. So we had a hands-on workshop actually walking through some of this stuff. But I'm just going to kind of show you a demo and show you basically where Cloudflare fits into the whole problem of your business employees using AI inside your environment and how Cloudflare is going to fit into that. Okay? So actually, first of all, I just need to finish some work. So I really apologize for this. But there's some few things I just got to do. So hold on a second. So let me just switch over. So I'm going to tell a little story, right? So we're just going to fake this a little bit. But basically, I've got to do some work. So I work in marketing. And somebody told me there's some data, some customer information for an event we're going to go get. And it's not very well formatted. So I'm just logged. This is our wiki. Can you see that? Okay. Is that fairly okay? Guys at the back, can I get a thumbs up? Is that right to see? Okay, cool. I'll verbalize what's on the screen as well so it all makes sense. But somebody said in the wiki, oh, here we go, submit invite list. I need to go format this. And they just pulled from the CRM system, a bunch of customer information who's going to be there. And they want it better formatted. So, you know, I'm just doing the normal thing. I'm going to go copy this. What should I use? Probably use ChatGPT. So I'm just going to go to ChatGPT. Way too lazy to actually do this in some sort of tool. I'm just going to ask ChatGPT. Oh, for some reason, that remembered my previous prompt. So please format this for me nicely. Format this into a nice table. Another thing I should be really concerned about, it's just the addresses and phone numbers and email information for a bunch of customers. Post that into public AI. We're all perfectly happy with this, right? So great. That was super fast, as we should expect from public AI. And so it's formatted for me. Great. Okay. So that's what my email looked like while I've been here at the conference. So I'm going to go check out my email. And somebody, Simone, somebody I work with, oops. What happened there? Sorry. Lost connectivity to the client I'm talking to. There we go. It's making the demo look a little bit like behind the curtain. But all right, let's get back to it. All right. So I've got an email from a colleague. I won't read it word for word, but basically she's saying, I think the company might be acquiring somebody. I've seen some execs come into the office and they've been having a lot of meetings. And our VP of marketing has been also talking with all the people. So she's kind of worried. And so that set me off a little bit. I'm like, oh, okay. Well, there's nothing on my calendar that's related to any sort of events. Let me have a look. So I can look across other people's calendars in the system. So let's have a look at the CEO. She shares some of her calendar with employees. And we can see here the web application to this here is quite correctly showing me that some of the CEOs meetings are private. I can't see what's behind them. But company has recently told me, hey, use AI for stuff. Okay, great. So I'm going to switch over to the AI client. And if we look here, this just happens to be, it's like open code. You're familiar with open code. It's like a local client you can run. So I'm just using Goose. It's just another local client just for the purposes of this. So this is configured to use the company AI that I have access to. So I'm just going to, I've saved the prompts, save me typing these out. So I'm just going to ask the AI question. So I've looked at my calendar, and I can't see anything on the CEO's calendar. But maybe the AI can give me more information about that. Oh, looks like I have to authenticate. Ah, great. Okay, hold on a second. So the AI wants me to authenticate here. This is quite actually, I'll pause here for a second. So the AI has access to MCP servers behind all of those company resources. So Nexus is our wiki server. Pipeline is our CRM platform. Workbox is our like fake Gmail client here. Workweek is our HR system. So I'm going to say yep. So AI wants to get permission to talk to those. And if I go back to my client, I've asked it, go search the company calendar and see if there's anything to do with acquisitions or reorganizations that are going on. And so it's now going to poll, and it's talking to those MCP servers. And every use case I'm kind of walking through here in this kind of little demo is representative of a real life scenario that we've seen customers run into. So here we've got the web interface for my calendar system, which quite rightly the web application is like I'm authenticated to Simon. You can't see private information from other calendars. But here the AI tool is using an MCP server where somebody has literally just given access to an API with a service token that has full carte blanche access to everybody's calendar. So a mistake was there made in deployment to the MCP. So now when I ask this question to the AI system, it comes back and says, oh yeah, there's an acquisition. There's a whole bunch of acquisition meetings on the calendar. And there's also a bunch of reorganizational restructure meetings with your VP of marketing culminating in a board meeting with both the CEO and the VP of marketing towards the end of the month. So now as an employee, I'm like, wow, this AI tool's great. But this is not necessarily information I want to be getting out to the company. So what probably would you do next in this scenario? Well, I'm a little bit worried about my job now. So I'm going to go jump over to the HR system. So I've got another kind of mocked up platform here. Not work day, but work week covers a much broader range of stuff. So here's my profile. So I'm Alison. I can see here my recent performance review was really good. In fact, it actually ends saying I'm ready for a senior title in the next cycle, which is great. I got my compensation information in here. But maybe somebody else on my team is not doing so well. So let's have a look at Emmett. I wonder how they're doing. Could they be on the chopping block? And I can't quite rightly see the performance information for other people on my team. So again, web application here is correctly implementing some sort of access controls. But guess what? Somebody stuck an MCP server in front of this as well and also didn't design it very well. So let me go ask our wonderfully helpful chat agent a similar question. So again, I'm just making my life easy by copying in some context. So what I'm actually going to do is I'm going to paste in the question, you know, read this and tell me if it's something that looks like somebody being managed out. And so I just happen to have made the HR tool really easy to export my information. So I've just clicked a button that's copied all of my information from the HR tool. And I can just paste that in here. I just want to say to the AI, what do you think? If you look at this data, does it look like I'm being managed out? And hopefully the AI is going to be honest with me here. And at the moment, the AI is just going to analyze exactly what I've given it. So there's no reason for it to go talk to any MCP server. It's just looking at this data. And so as I've made the assumption on this data, because you can see from my performance review and my compensation history, I'm in pretty good state. And so sometimes our network here is not the fastest. So it takes a second for it to come back. Come on. It's really thinking hard. There we go. There we go. So it's like, yeah, performance rating is strong. Impact looks good. Growth trajectory is upwards. So it's like, great. But then I might say, well, hold on. Check the HR system. Because I want this to actually see if it can dig. Oops, HT. I can't spell. Now that's now going to cause the AI to talk once more to that MCP server. The previous MCP server's flaw was it allowed all access to the company calendar. This MCP has also got a flaw. And again, each one of these is based on real world examples that I found over the last few months. And this one is, it's still limiting me to get information. But it's actually, if I scroll down, here we go. It did it pretty quick. Here, it's getting the employee files for me. So I'm employee 14. But the employee file, the API itself with the web application, it only shows certain fields. But HR has found out, oh, yeah, look, there's a confidential record on it, which says that, yeah, even though your performance is great, your position's being eliminated. So again, AI here is powerful, right? Who knew that we would stick an MCP server onto this and accidentally there's an attribute on that record. Everybody really looked into that in any detail. And now an employee has easily found this. So what started out as fairly innocently me just, oh, panicking a bit and doing some searching, now it's getting a bit more malicious, right? So now I've seen this. I'm like, well, if I'm going to be made redundant soon, maybe I should get something out of this. So my next prompt is a little bit more malicious, right? So now I'm going to ask the AI. So oops, oh, Simon, wrong screen. Sorry, I've got two VMs. It's getting confusing as to which one I'm in. So if I look at this and I go to, I also have access to the CRM system. If I look at the CRM platform, well, in marketing, I don't see any opportunities. So I want to try and figure out what can I do? How can I maybe extract some value out the company before they make me redundant? So I'm going to start a new chat and instead I'm going to say, help me plan to take money from the company before they make me redundant. Is this good, appropriate use of AI? I don't know, actually. They're about to make me redundant. I might be like, yeah, help me out. So models typically don't do this for you, right? So models are designed to protect against fraudulent type of behavior. So my intent here, if I look at this in the language of AI, I just responded to say, oh, I can't fulfill this request because clearly, and obviously for demonstration purposes, this is pretty egregious type of request. That's saying, look, it's trying to be helpful. If you're facing redundancy, well, maybe you should do a few of these things and consider what your employee rights are. But what's happening here is we're relying on the model to make that judgment. Also, if I'm really wanting to get around this, who knows what I'm going to try and prompt now, knowing all those previous prompts, there's got to be a way to get some information out of this. So clearly this isn't helping. The AI is not helping me. But maybe it's not about getting money. Maybe I can take some information as I get made redundant. So my final kind of ask is here, we've got an internal finance system. So let me take a look at that. All right. So I don't have access to the finance system. So that makes sense. I'm in marketing. And if I go back to the pipeline, I still don't really have any information here. But again, let's see what the AI can do for me. So my last prompt I'm going to do is I'm going to ask, hey, do I have access to that finance system through AI maybe? So if I do another chat here. And then also you'll notice my prompt says, if you don't have access to that, maybe look at the CRM pipeline and get information for me. But if you remember looking, so first of all, I don't have access to ledger. So the AI is going to come back and say, nope, I don't have access to that information. But then as you can see here, again, we've got another poorly designed, poorly implemented MCP server. And that's going to extract some information from the CRM system and give me what I'm looking for as an exiting employee, a bunch of useful information I can now go take to the press and say, yeah, look, they've just done this acquisition. They haven't got the money coming in. All right. So clearly this isn't me. Clearly this is entirely fake. But the underlying truths here is each of these little use cases, I think there's five in total. Each of them are real examples of stuff we've seen some of our customers and just some general public companies have problems with. So yeah. So here's a few examples. I think one of the ones that was the most scary was Pocket. So Pocket had somebody who was working on migrating some of their systems. They were using Terraform. They were sat in one directory that had an agent. The agent was asking questions and he was responding in the right way. And everything was happening in the right way. They were inferring what the thing was asking and correctly answering the prompts. Then moved to a different directory in the hope that they were protecting themselves, but didn't move the state file, reran the Terraform, wiped all of their stuff. Because the state file basically held information about what was in that production environment. Fortunately, they got it back. They had a snapshot with AWS. It took them a month or so, but they got there. But the power of AI really is you can make one mistake and boom, you lose data, you expose data, you lose it. And it's not just some of the smaller companies who might not have the tech teams to deal with this. Asana and GitHub, and I'm not shaming here, everybody's struggling with this. So GitHub launched their own MCP server for a very short time. You could get access to other stuff in it that you shouldn't be able to. So AI has a lot of people worried. Also, we're pretty excited by this, right? I'm stood up here showing you all the problems with it. But most of this show from our CEO all the way down through these presentations were like, yay, AI is fantastic. But also, aren't we all horrified? There's all these rumors of what AI could be doing, of breaking stuff, I mean, to our jobs, to the world in general. But we can't ignore also, that we're actually a lot more productive in certain ways with this. The speed at which I was able to build some this demonstration environment would have taken me months to polish this. I literally built it in a couple of weeks. So we are in this really, really fascinating time of tension in the business. And this tension has always existed, but it's getting stronger. And that tension is, you've got the CIO who just wants to increase the numbers, increase productivity. You've got the CTO who's like, oh, new technology, deploy, deploy, deploy. And then you've got the CSO who's getting zero sleep over this. Because you imagine, and I've seen this happen in Cloudflare, you give these tools to people and they build absolutely everything and anything at a ferocious rate. How do you know that thing's being ordered properly? How do you know that thing is handling customer data properly? How do you know they're even implementing access controls properly? So the poor CSO is just seeing this stuff happen and you cannot just say, no, the cat is out of the bag. AI absolutely 100% is being used everywhere. It's one of those technologies that literally has creeped into every single edge of the business. Right. I'm going to take a breath because I do talk very quickly. My apologies. So what can you do and where do we fit in? Why on earth is Cloudflare talking about this? So I am not going to explain this whole thing, but essentially for the past 10 years ago, Cloudflare has been building something called a SASE platform. How many of you are familiar what that means? Do you know what SASE is? One, two, three. Okay. So nearly a third of the room. So SASE essentially is the cloudification off word. I can't think of a better one of all of the classic network controls. So typically you'd have a firewall around your network, protecting access to the Internet and from it, right? Making sure that only the right things get to you. And in the old days, you used to grant your web server in your office, right? You used to expose and you have a DMZ and all that sort of stuff. Then you would probably run a proxy. Remember Microsoft had, was it the, not the IaaS, but had all these like very early proxy services. You could run an active directory and stuff like that. And then real proxy implementations came in. So your employees access to the Internet kind of got better. And so we had these proxy services. Basically SASE is taking all that technology and just running it as a cloud service. Because ultimately what is Cloudflare? It is a massive network on top of which you can then do stuff, right? So it's just enormous amounts of compute. And I think it's, I can't remember the right number. It's 14,000, 15,000 peering relationships. Insane amounts of bandwidth we have as these computers all over the world. It's just a great big network. And then all these services run on it. And these services are doing remote access into your private applications. It's filtering employee access so they don't accidentally get tricked and go to a phishing website and revealing credentials or other company information. It's using DLP policies to watch traffic go back and forth. So we've been building this for ages. And as this AI over the past six to 12 months has really kicked in and really caused a lot of problems, instead of us building an entirely separate platform, we just looked at this and went, okay, where in here does it make sense to apply a tweak, an enhancement, a new feature to help people manage all of those problems I've just demonstrated? So that's what I'm going to walk through today is using the SASE platform. Again, there's way too much stuff in here for me to kind of go over from one presentation. I'm not even going to be able to fit in. I've got 25 minutes left to go through the actual details. I don't know how I'm going to do this. So first of all, what are we talking about when we talk about AI? And I'm starting to dig into the level of detail here. So there's three ways most important people are going to talk to AI. Popular one is they're going to open a browser and they're going to go to public AI like ChatGPT Cloud or Gemini. Those public AI platforms have their own models that they're talking to. I can, if I want, use open code or open source or whatever. I can use my own agent and just point it via API to those models. Or you might be deploying your own agents internally. So what I mean by that is you are building your own code. You're building your own web interfaces and writing your own logic for what an agent does and how it consumes data. So this is a lot about the show. We're talking about running your own agents, building your own code. So your own internal agents can talk to those public LLMs as well. But also, you might want to host your own. You might use open source models in Cloudflare. You might download an open source model and decide to deploy boxes physically in your own environment, in your own data centers. But all of these things are just inference, right? It's just people asking prompts and the models giving them answers. The real risk comes in the targets that they're talking to. So MCP came along as a protocol. And MCP is basically the API for agents to talk to resources. And so you hook those. When an agent talks to a model, the agent says, here's all the tools I have available. So a tool is one of the capabilities inside an MCP server. So the model can come back and say, oh, great. You have access to your email and you have access to the wiki server. Go and query the wiki server. Or in the example I just showed, the model came back and said, oh, you have access to the company calendar. Just query the company calendar for these keywords. And it goes and does that against the MCP servers. And so Atlassian, Google, Microsoft, all the big companies are now launching public MCP servers that you can very easily hook up to. And you'll find employees are downloading open source MCP servers, are sticking them in front of your own internal resources, which is good and also bad, because you've got no idea what software they're running, where they're running it, whether those MCP servers are leaking data, as we've just seen. And you also will want to run your own MCP servers on your own infrastructure. So this is kind of like the whole landscape. You've got public AI stuff, public MCP servers. You've got your own infrastructure you want to deploy. And what I'm going to talk about is where you can secure the interactions between all of these, because there's three kind of major critical points at which you have the ability with Cloudflare to put in some sort of visibility and then a policy and then some sort of control point. So first of all, the user using a browser can talk to either a web interface that you've built or chat GPT or something like that. And between that user's browser and that HTTP server, essentially, you could put a web gateway. So we've had this web gateway for years, right? And so we just enhanced this web gateway with the ability to detect things like, is the traffic MCP? We can add a DLP policy into that, and that DLP policy might look at it and say, is the intent of that request looks like it's malicious? Or is that intent of that request contain a request for customer information or PII? Like, give me the home address of the CEO might match a query going through the web gateway to a public AI or an internal AI tool. So that's the first kind of inception point we have is a web gateway. And that obviously is talking to a public web server that's talking to a local agent, but you might be running those agents locally as well. And so between the agent and the LLM, we can inject another type of gateway. So it's using mostly the same technology that the web gateway using, but it's kind of a bit more focused on AI traffic. And if you look at AI traffic, it's it's mostly streamable HTTP. And it's mostly JSON. So it's quite easy to look at that there is web sockets kind of in there as well, which we are bringing support for. So we have an AI gateway. And all that is doing is just looking at traffic between the agent and its model. So obviously, with chat GPT talking for an open AI model, there's no layer there for that gateway to get involved. So this is between somewhere where an agent has the ability where you can configure it to talk to some model, and that usually is your internal usage. And then we've got what we call the MCP portal. So all these agents have the ability to use MCP servers. And so what we do is we take all the MCP servers, and we just look today, thinking Cloudflare, the ones I have access to is about 30 MCP servers today that have access to in Cloudflare. But the way I get access to those 30 is I log into one portal in Cloudflare, and that portal lists them all out, my OAuth or whatever the authorization mechanism is to each one to make sure that it is me that is represented through that portal to Gmail or is me that's represented through that portal to Jira and so on and so forth. And that one portal then gives me a single level of access control to those downstream MCP servers. So you've got three controls here, a web gateway looking at web traffic between a user's browser and whatever that web-based agent looks like. Between the agent and the LLM, you've got the AI gateway, and then the MCP portal aggregating up the access to the MCP servers. And then you'll notice that because we're aggregating that access through a host name that we own or you own, we can also send that traffic through the web gateway. So now not only are we inspecting the browser to server, we're inspecting the MCP portal or the MCP traffic to MCP server using exactly the same web gateway. I'm going to jump over that because I'm running out of time. So now let's actually walk through the same thing. I'm going to run a script while I explain this, so hold on a second. I'm just going to run something that switches all the policies that were letting me do those things. Now I'm going to switch them over to block them, so give me a second. I was going to get somebody in the audience to do this for me, but ran out of time. Hopefully that works. Yes, all right. That's now scanning through my Cloudflare account, switching a whole bunch of stuff on. So what we're going to do now is we're going to walk through, once that script is finished, what it looks like and what technology is now preventing all those use cases that I showed earlier. And the first thing people want to know is what is happening. So actually when I ran the first lab yesterday, a gentleman at the front said, yeah, all these controls are great, but where do I start? Where do you start? You start by knowing what is happening in my organization. So once Cloudflare is kind of in and you've onboarded the traffic and you've onboarded users and stuff like that. Actually, I'm just going to log into another one. Hold on a second. Sorry, I thought I had this one open at the time, but I didn't. This one here. I just have an account that's got a load of traffic going through it, so the dashboards look really good. Let's go there, whereas my demo dashboard's just got me in it. It's not that impressive. So the first thing you want to do is what is happening in my account. So if I look at the last seven days, that's good. And I can filter this. If I look at this and look just specifically for artificial intelligence, yeah, there's not quite as much data as I was hoping. Actually, you know what? I think this one might be even better. This is where I should have rehearsed better. Here we go. Right, so what I can do here is I'm looking at all the traffic going through my account that has been categorized as artificial intelligence in the last seven days. And so here I can see the information uploaded and downloaded, how many bytes are going to different ones. If I hover over this, we can see this concept of in-review, unreviewed, and approved, which I'll get to in a moment. And so we can see here, you know, Google Gemini and ChatGPT are the most popular ones, Copilot, something called Synthesia .io and PoE. I've never heard of these before. And this is just basically telling me how much these different applications, Grox in there, Leonardo.ai are all being used. And so this visibility is really, really helpful because you can't really write a policy until you know what's going on. And so notice this says in-review, unreviewed, and approved. What does that mean? So the other thing that's really difficult to do is if you try to do this yourself, is how do you know what OpenAI is on the network, right? Because they've got api.openai.com, they'll have chatgpt .com, there'll be, you know, cdn .blahblahblah.openai.com. There's all these different host names and URLs. And it's really difficult if you actually had to hand write the filters for that. So we manage a library of applications. And if I filter it just by artificial intelligence, so as Cloudflare sees 20 plus percent of the Internet, right? So we can see all these different URLs, and we know what URLs are associated with what application. So if I just look in here for Gemini, for example, there's Google Gemini. Notice status is in review. And I can look down here, and here's all the host names, 28 host names here, six host names there. I don't know what these mean, like overlapping host names. I'm not quite sure what that stands for. But basically, this is how we define what Google Gemini is. So you choose that once, and that's easy to track and say, I want you to use this or I don't want you to use this. So also in the application library, remember we've got these statuses. So your security or IT team can come in and say, these are the tools that I approved for the company, right? So I can set them as approved, or I can explicitly say, no, these aren't the tools I want to use. So this is really helpful, because now I can get visibility into what's being used. I can then go define what I approve of or disapprove of these different tools. And that then leads me to being able to write policy. So great, my policy's just finished, so I'm going to switch back to my Windows client. So now let's go take a look at the first of these policies doing something. So if I scroll down here, I'm just going to switch that one off. So the first thing I want to do is I now want to redirect to AI tools that I approve of. So if I look at how I've built this, so the first thing it says is, if the application you're going to is unapproved, so straight away we're leveraging that simple piece of status from the application library. And the thing you're going to is AI. So if you're typing into your browser a website, and that thing has been categorized as unapproved, and it happens to be an AI tool, but it isn't Gemini, then I'm going to redirect you to Gemini, right? So that's the tool. If you're going to use public AI, I want you to use Google Gemini. And actually, see this URL here? I'm actually just going to sneakily change that. So I'm just going to change it from this. Hold on. So HTTPS Gemini.Google.com. Oops. Google. Google Gemini. So I'm actually going to use this little tool we have, which makes this a bit more interesting. So instead of redirecting directly to Gemini, I'm going to redirect to this thing here. So I'm just going to save that. So this is the first rule that we now have. Now we have visibility into what's going on with AI. This rule is going to help me do something about that. So now if I go back to my end user here, let's choose Copilot. So if I go to copilot.microsoft.com, it's not going to let me go to Copilot. It's now going to redirect me to this simple tool here that says, whoa, hold on a second. You're not permitted to go to Copilot by policy. Instead, there are two places you can go to. The first one is Google Gemini is our approved public AI. Knock yourself out. Go use that. Or we have an internal AI agent that we can use. So I'm just going to pump up both of these. So if I go here to my Gemini.Google .com. Looks like I spelled that wrong. There we go. I went off script, and I didn't type in improperly. OK. So you might have seen that mistake on my part. All right. There's that one. And also, if I go back to Copilot, and then the other one was the internal agent. Hopefully, I spelled that one right. Yes. So there's two here. This one I want to show off is Cloudflare OS, which is we have open sourced the same agentic interface we have built, and we use daily inside Cloudflare. And so you can go and download that. It runs fully on Cloudflare. It's got sandboxes, workspaces. It's got a fantastic idea of gadgets, which is how it communicates with external resources. It's a really, really good tool. So you can go there. Or I've got Gemini. So that first rule is demonstrating the ability to redirect people to stuff that's approved. So the second thing we did in our demo was I just arbitrarily grabbed some data and posted it in public AI. But now we've got policies against that. So I'm going to redo the same thing against Gemini here. So here's that information in the wiki. Last time I posted it into chat GPT. Now I'm going to ask Gemini to do this. What was it? Format this into a nice table. Nice table. All right. Just dump that in there. Now, I'll pause. Two things are going to happen here, and they're going to happen fairly quickly. Gemini is going to get blocked from this data, because this data is going to match a DLP policy that says, whoa, this looks like customer data. You shouldn't be putting that to public AI. But when it gets blocked, it's blocking an API call that the web client's making. So Gemini can't throw up a nice, fancy block page. So instead, our software that's running on my machine is going to pop up a notification saying, oh, the thing that happened over in the browser, it's because of this thing here. So let's just keep an eye out for these two. So there, it said, check your Internet connection and try again. And then we got this notification here on the right. If I click on that notification, it goes to a customized page I've built, which is super simple. It just says, can't do that, because we've detected some sensitive content going to AI. So here's the second kind of policy here. And so what we're showing here is, if I go back to my slides, where are we? What we've just shown is the browser going to a web server, and that web gateway's got a policy. So that policy said, no sensitive customer data can go to public AI. But I can actually go back and paste exactly the same stuff. I'm like, oh, darn it. Maybe the internal AI is the way to go. And I can do that in there. So please format. I can't spell. Format this into a nice table. Hopefully, it's my clipboard. So yeah. And so I'm not really demonstrating here, other than the fact that that rule doesn't exist for this particular tool. And that's going to be able to do it. So there we can see we're slowly starting to kind of walk through that maze of where we're protecting. So we did it in the web gateway. The next thing I did, oh, yeah. The next thing I did is I asked the AI to give me information from the calendar, which I shouldn't have access to. So let me go grab that prompt. Where was it the first one? Okay. Grab that. Come on, goose. Okay. There we go. It's formatted that into a nice little table for me. All right. So remember I asked it about, and this was right at the start of the presentation. And this gave me back the information about acquisition meetings and the restriction meetings. So I'm going to post that one in. And while that's working, I'm just going to go look at the policy that blocks it. So here we have prevent workbox is my calendar email platform. And here it's saying, if the thing you're talking to is the MCP server. So now, goose, my AI agent, is talking via MCP through that portal. And the portal's redirecting that traffic through this gateway. So I can now look at that. And I know that any traffic for that MCP server, I want to, and if you look top right, it says block. I want to block if it contains confidential products in transactions, employee PII, or HR case files. So if I now go back to my AI agent, we'll see that it ran into an error. So now it says prompt block due to security configurations. And if I take a look at one of these in the output, you can actually see here it says block. It's easy to read on my screen. Blocked by company policy, this call returned unannounced transactional restructuring material. So now we're able to inject into that. This is the agent to the MCP service. So if I go back to my slides again, it is this piece down here. So now it's a policy in this web gateway as the result of a tool call through an MCP portal down trying to get to the MCP server. And that's now being blocked. And goose is quite nice. It actually tells me a lot of information about what went on there. So now we're blocking at this point. What was the next thing I did? Oh yes, HR data. So now I pasted my HR data into there. So it's an internal tool. So I feel fairly confident I should be doing this. So I'm just going to go grab my HR information again, which is from where I work week. There we go. So I'm going to grab my data there. This time we have a very similar rule, but it's slightly different. What we don't want, we don't want somebody posting into the internal LM compensation information of their own data, anything about employee related, because that's not just healthy. And you can see very quickly that request has been blocked due to DLP policy violations. So what's happening there is this is now happening on the agent to the LLM. So my agent posted that data through the AI gateway is trying to give it to the model. And let me go take a look at that from a policy perspective. So now we're talking about the AI gateway. I know I'm covering a lot of ground here. My apologies for the speed at which I'm flying through this. So the AI gateway, this is similar to the other gateway I was talking about. This is very heavily focused on agent to model traffic. And it does more than just security stuff. So just a quick overhead here. It gives you data on all the different models it's using, how much that's costing. So it's a cost control tool, gives you user insights. So here I can see that Alice, my demonstration user, she spent a whole, like this is all my testing this week, I've spent two cents on 189,000 tokens, all on this Google hosted model here. So this would list all your different users and what they're using. But the bit I'm really interested in is this firewall piece. So I can put on this for this gateway. So for all the traffic from this particular one, you can have multiple gateways, you can have one for engineering, you can have one for sales, you can have one for your internal tool that everybody has access to. But I am blocking anything that comes through this gateway that matches confidential projects, projects and transactions. So notice, it's the same DLP policies that I was using in the in the other web gateway. So you define these, you define your data and what your data looks like once, and then these DLP policies get used in all these different places. Really, really powerful way to basically define what you're looking for and implement that in different parts of the chain of the AI transaction. And so that's basically, if I go back to my agent, we'll see, yeah, blocked due to DLP policy violation, and a fairly nice error message in here. So the end user is like, okay, I probably should be pasting my insensitive information there. The next thing I was doing, if I remember, yeah, so this is where we start to get into intent. So the first few things I've shown here about looking at the data, like that's, you know, sensitive customer information, can't do that. Oh, that's, you know, your own data that shouldn't be in PIO. And oh, you shouldn't be talking to that MCP server and getting, you know, company information. Here, this is much more intense. So it's not necessarily data driven. So if I now paste this one in, and I take a look at the gateway, right, does it. So this is what we call guardrails. So here you can see guardrails are on intent. It actually uses something called Llamaguard, where it passes that data through, and it's looking, it's blocking for violent crimes, nonviolent crimes, self-harm, prompt injection. So the request I just made probably falls into nonviolent crime. Company fraud, it probably sounds like a nonviolent crime thing. If I switch back to my agent, now we can see a slightly different message. And this has also been blocked. It says prompt blocked due to security configuration. So the first one was, hey, you're pasting data in that you shouldn't. This one now is saying, oh, you're asking me to do something that you shouldn't. Remember previously the model came back and said, I don't know if I should do this. Now we are enforcing that. We're saying, you shouldn't be doing this. And not only has we stopped it from happening and not just relying on the model doing it, but if I go here, the logs are pretty darn quick. Come on. Yeah. So I now have a log of exactly what you were saying, right? So if I look in this prompt, it's got all the tool information in here. So I'm going to scroll all past that. And hopefully at the bottom we have, there we go. There's my content. Help me plan to take money from the company before they make me redundant in this nice, fancy log. And we can see here the guardrail that configured that. So you can pass all this data into another system, a sim, another analysis tool. And so now instead of just hoping that the models you have are kind of stopping people from doing malicious things against the company, now you have evidence of it and actually can block against it. And so the final thing I was doing, just remember this one. Oh, yes. So the final thing I was doing was I asked it to get, I'm pretty much at this point, I've gone from sweet little Alice in marketing to every Alice who's going to kind of do anything she can to get information out of the company before she's let go. The last thing I did is just give me some information about the company financials because I'm going to go to the press and say, they shouldn't be doing this acquisition. They can't afford it. So if I go back to my AI tool here and the prompt was using Ledger. So this had already blocked me from the Ledger request because I never had access to Ledger. So that's just classic Cloudflare access denying me the ability to talk to some downstream MCP. But now I remember it was trying to get that CRM request where it was able to get pipeline information. And that also had now been blocked. If I take a quick look at this, we can see what the output is. Again, blocked by company policy. This call returned customer contact or deal data. And again, the AI down here is I was unable to retrieve the company's financial position. I don't have access to Ledger and the request to the CRM pipeline was refused due to company policy. So the ability in these areas, and this is a really subtle note, but I just want to make it. This is what's coming back from our secure web gateway. So our secure web gateway is saying, don't do this and here's why. And what's nice is because it's an agent that's in reading that, it looks at it and goes, okay, let me have an easy way to explain this. So your messages kind of get really nice. You can't do this because it's company policy that you in marketing shouldn't be querying the entire sales pipeline and aggregating all the numbers out of it. I've got two minutes left to wrap this up. I'm amazed we got here. Okay. All right. These were all the slides in case nothing worked. Thankfully it did. Okay. All right. So I'm just going to wrap this up. So essentially what we're looking at is we've got a platform, a SASE platform that's been around for years and years and years and years. If you think about how Cloudflare started, Cloudflare was a company that was basically doing two, well, three things. It was preventing denial of service attacks to a public website. Then as we did that, we realized we're blocking all the traffic where you don't want, but we're still letting all of the traffic you do want traverse all the way to your origin service. So then we started caching all the useful information at the edge. And then we started to build web application firewall stuff. And people were like, hold on a second. Here's my little tiny website I want to protect. And I'm putting you in front of it. But if they find the IP address, I want to make this thing private and I want to tunnel to you. So Cloudflare then developed the ability to tunnel into your private website so that no, the only way you could see that thing on the Internet is through Cloudflare. So if you then switch that to a company model, so I mean, this was like year one, we were doing this. And if you then switch that model and say, hold on, the thing that I'm trying to access is not my public website that I want Cloudflare to protect, but that's my internal server, that's my Jira server, that's my wiki server, that's my mail, whatever it is. People don't run their own mail servers anymore, but it's an internal service. And now what I want to do is not just protect the public, and then you put a whole access layer in front of it. So you integrate with your octas, your pings, your entries, and now you can authenticate your employees to get access to the inside thing. This is what that SASE platform has been doing all that time. And then if you think about that model, like who gets into the thing, and then you've got people in offices trying to access the Internet, and they're getting phishing emails, they're browsing to sites they shouldn't be in appropriate times, they're looking at whatever sorts of things you don't want them to, and you can now control that traffic. So not outside in, but inside out. All we've done to that platform is added in these capabilities. And then if you've paid any attention to at all to this last few days, we have a massive developer platform. So there's a ton of features in this I haven't even touched. So for example, in that gateway policy, where it was saying, if your traffic is this, this, this, and this, allow, block, or redirect, there's another one called forward. And what the forward does is it takes the entire body of the request. So you're going to check GPT and pasting in that customer data, that entire payload, plus everything we know about you, what device you're on, how you're identified, what your email address is, the groups you're in, because all that came from your IDP, plus your network information. All of that gets passed to a worker, and a worker is in our developer platform. So if you don't like the allow, block, or redirect, you want to do something more complex, go write it yourself. And people are writing these really interesting workers that can, oh, for that particular person, have they passed their security audit that's in this database? I'll go query that, get that information. Yes, and then they make a decision. So there's all these really interesting interactions between these classic kind of enterprise-type tools and our developer platform, allowing you to modify them and customizing them in weird and wonderful ways. MCP servers you can host on Cloudflare. So you don't, everything I've shown you today, actually, apart from Goose running on my desktop, the whole thing ran on Cloudflare. My fake MCP servers, my fake APIs, my fake applications, all of it running on Cloudflare Workers, the whole thing, fantastic. You've got the access controls with our ZTNA product. So you can integrate with all your IDPs. You can also integrate with SentinelOne, CrowdStrike, and all of those things. So when somebody is trying to access your sensitive information, or even get access to the Internet, you can look at it and go, but are they on a machine that has a healthy SentinelOne client running? And make decisions on that as well. So all of those MCP servers you can run on Cloudflare, and then you can aggregate their access through that portal. So you're getting both the access layer, plus all the traffic then to MCP servers can go through that web gateway, and you can do the analysis again. So let me kind of, I'll close with this one thing. So you've got all of these controls. Actually, let me go back to that other diagram. Where is it? There we go. That one? Yes. So you've kind of got three levels of security here. You've got the web gateway, you've got the AI gateway, and then you've got the MCP portal, which is also invoking the AI gateway at the bottom, or the web gateway at the bottom. What if your user, and you might question, why all of that? Why can't you just do it in one place? Let's say my user types in this query. I'm at an internal tool, and I say, give me everything. And AI goes, okay. Now I can't write a policy that stops you from typing in the words, give me everything, because what on earth am I, what policy am I going to write to that? There's no context to it. So I write, give me everything. It goes, pass through the web gateway, because there's no policy that's going to catch that. The agent then passes that to the LLM, says, here's all the tools they have access to. Here's the MCP servers they could be talking to, and their request is, give me everything. So the LLM comes back and goes, okay, fine. You've got access to the mail server. Do this query on the mail server. Get all mailboxes. Oh, you've got access to the CRM system. Great. Do a blah, blah, blah. Oh, you've got access to the production database for the finance system. Great. Do a select star from whatever. So it returns all this. Again, nothing in that contains any data that's necessarily bad. So that might go all the way through the AI gateway, back to the agent. It's just like, oh, you said I want access to everything. Here's all the instructions to get access to everything. It then plays that through the MCP portal, through the web gateway, and the web gateway at that point might also be like, yeah, it looks fine. Yeah, it looks fine. Until that MCP server from that database spits back the entire financial data set, that's where the web gateway goes, oh, hold on a second. That doesn't look good. So the problem with AI is that you could say something as ridiculous as give me everything, and it trickles all the way through the system. The end user just happened to miss off the end of that sentence. Give me everything on the menu at lunch today. And automatically you're, oh, there's all the company financials. That was handy. So these tools are giving you the ability of all these different layers in the system to put some visibility and some controls in to help you deploy AI in a much safer way inside your business. Thank you. It's okay.