Cloudflare's Adaptive Intelligence Flips the Economics of Bot Attacks

Cloudflare has launched Adaptive Intelligence, a new bot detection engine designed to undermine the economics of bot attacks. Instead of building a taller wall, it makes getting through so slow and costly that attacks stop being worth running.

The core insight: deterministic defenses hand attackers a stationary target. They iterate in days while models wait months for updates. Adaptive Intelligence flips this by being non-deterministic, continuously retraining, and deploying disposable rules that vanish before attackers can reverse-engineer them.

Three Components

• Improving itself: The engine retrains continuously on live traffic, folding in new bypass tools and bot frameworks as they appear, without waiting for scheduled releases.
• Disposable rule generation: Rules are created for specific attacks, deployed and retired at random intervals, injecting noise into the attacker's feedback loop. No rule needs to be perfect, just last long enough.
• Learning from traffic: Corrections from customers and own measurements become training signals, tuning protection to the current threat landscape.

How It Works

The engine runs a loop: observe, train, deploy, validate. It aggregates network signals like JA4 TLS fingerprints, request structures, challenge outcomes, session behavior, and client-side telemetry from Turnstile and Precursor. It evaluates traffic over multiple time windows to catch both sudden bursts and slow, distributed attacks.

Before a new model version goes live, it runs in shadow mode alongside the current one, scoring live traffic without affecting visitors. If it would score real people worse, it doesn't ship.

Cloudflare has run similar automated loops against DDoS for years; bots are a harder problem because signals are quieter and the story unfolds over time.