Stop reacting to breaches and start preventing them with User Risk Scoring (opens in new tab)
Cloudflare is adding User Risk Scores to Cloudflare One so access decisions can reflect a user’s recent behavior, not just identity and device posture. The system continuously combines security signals, assigns a deterministic risk level, and applies adaptive access policies in real time. This is intended to replace slow, manual incident response with continuous, automated protection. ## Continuous User Risk Scoring - Risk scores identify behaviors associated with compromised accounts or insider threats, including: - Impossible travel - Failed login attempts - Malware detections - Risky browsing - Data loss prevention (DLP) violations - Outdated or insecure devices - Cloudflare Access and Gateway provide internal telemetry such as login activity, location, malware events, and sensitive-data triggers. - Integrations with CrowdStrike and SentinelOne add third-party device and security signals. - Administrators choose which behaviors to monitor and assign each a low, medium, or high risk level. - A user’s score is based on the highest-risk enabled behavior detected during the relevant period. - Investigators can manually reset a score after reviewing an incident while retaining its historical record. ## Adaptive Access Policies - User Risk Score is now available as a condition in Cloudflare Access policies. - Organizations can create global or application-specific controls, such as: - Blocking high-risk users from financial applications - Requiring medium-risk users to authenticate with a physical security key - Automated enforcement reduces the delay involved in revoking sessions or changing identity-provider groups manually. - Policies can limit damage while allowing lower-risk users to continue working. ## Dynamic Enforcement and Integrations - Access can be revoked during an active session when a user’s risk increases. - Access is automatically restored when the score falls after investigation and clearance. - Cloudflare plans to explore enforcing step-up MFA during active sessions when risk changes. - Through the Shared Signals Framework, Cloudflare can send risk information to Okta so users restricted on the network are also restricted at the SSO entry point. Cloudflare recommends using User Risk Scores to make zero trust access continuously adaptive rather than evaluating users only at login. Existing customers can configure the feature in the Cloudflare One dashboard, while larger organizations can integrate partner telemetry through a ZTNA pilot.