Application security · News & analysis
AI makes bot attacks cheaper. Measure what they cost your business.
Cloudflare’s Adaptive Intelligence announcement puts bot economics in focus. A practical way to evaluate abuse defenses without blocking real customers.
Cloudflare introduced Adaptive Intelligence on August 31, describing an approach to bot defense that responds to changing attacker behavior. The announcement argues that AI reduces the effort needed to configure and adapt automated attacks.
This is a vendor’s account of a new defensive offering, rather than an independent comparison of bot-protection products. For a software company evaluating the announcement, the useful question is how to measure whether a defense protects a business workflow without making that workflow painful for legitimate users.
Start with the transaction you want to protect
Our suggested starting point is a business action, such as creating an account, reserving stock, requesting a password reset or submitting a lead. A single traffic count can hide very different outcomes. Ten thousand blocked requests may be helpful, irrelevant or harmful depending on who sent them and what they were trying to do.
For an AI product, also consider the cost of an accepted request. A bot that triggers expensive model calls may cause harm without stealing an account or taking the service offline. Decide which operations deserve per-account limits, which require additional verification and which can safely remain public.
Give false positives an owner
A new challenge or block rule can improve an abuse dashboard while reducing successful customer signups. Evaluate both effects together. The support team should have a way to report legitimate users who cannot proceed, and the engineering team should be able to connect those reports to the relevant policy version.
Separate emergency mitigation from the steady-state configuration. An incident may justify temporarily stricter controls, but somebody should review them after the immediate pressure passes. Otherwise the temporary response can become a permanent source of customer friction.
- Track completed legitimate transactions alongside blocked traffic.
- Set explicit budgets for costly anonymous or newly created accounts.
- Keep a record of rule changes, their owners and their rollback conditions.
- Include accessibility and customer-support cases in the evaluation.
Buy an outcome you can verify
Before choosing a service, define a small evaluation with your own traffic patterns and an agreed success criterion. Ask which decisions the provider makes automatically, how you can inspect them and how exceptions are handled. Avoid treating the presence of an AI feature as evidence that those questions have been answered.
The operational result should be understandable without specialist vocabulary: less abusive activity reaches the application, real customers can still complete their work, and the team can explain what changed. That is a better purchasing test than the largest number on a blocked-request chart.
Put your security work in motion.
Book a meeting