Cloudflare Joins Cyber Resilience Pledge, Outlining Security and Supply Chain Practices

Cloudflare has joined the founding group of signatories to the UK’s voluntary Cyber Resilience Pledge, a framework centered on security governance, leadership accountability and supply chain protections. The company says the framework reflects principles it has followed for more than a decade. Its account also sets out how those principles apply to network defenses, internal controls and supplier reviews.

The pledge arrives amid rising cyber activity. Cloudflare reports that its global network blocked an average of 234 billion cyber threats per day in the first quarter of 2026. It also says it recently mitigated a distributed denial-of-service attack that peaked at 31.4 Tbps. By the end of 2025, the UK had become the sixth-most targeted location worldwide for DDoS attacks, according to Cloudflare’s data. The company describes growing attacks on application-layer services in financial services, aviation and regional infrastructure.

Separate figures from the UK Cyber Security Breaches Survey indicate that 43% of surveyed British businesses and 28% of charities experienced a cyber incident in the past year. These figures point to a resilience challenge that extends beyond the largest companies: basic controls and sound oversight matter across organizations of different sizes.

Resilience starts with prevention and adaptation

Cloudflare frames cyber resilience as the ability to keep services available, responsive and trustworthy through attacks, outages, abuse and operational complexity. Recovery after an incident is only one part of that work. Organizations also need to track threat signals, withstand disruption and adapt their systems based on what they learn.

The company argues that security controls make resilience practical. Its approach places defenses close to the network edge, where they can filter threats before they reach core systems. Cloudflare says its network peers directly with more than 13,000 networks around the world. That reach lets it turn a threat pattern detected in one location into protections elsewhere within seconds. For example, a rule developed during an attack on a customer in Singapore could help protect a customer in Sheffield shortly afterward.

Cloudflare also points to frontier AI models as a changing factor in cyber defense. It says these models can lower the entry barrier for attackers and support more automated vulnerability scanning and more convincing phishing. In response, the company has published an architecture for defending against frontier cyber models, with components including machine learning-based attack scoring and Zero Trust access controls. Cloudflare says customers can use each layer today.

Security available across the network

One of Cloudflare’s stated design principles is that baseline protection should not depend on buying a higher-priced product tier. The company says it was the first to provide SSL certificates to all users. It also points to programs such as Project Galileo and the Athenian Project, which support vulnerable organizations, and to its deployment of post-quantum cryptography across its network.

Cloudflare’s free plan includes unmetered DDoS protection regardless of an attack’s size, duration or volume, along with a content delivery network and DNSSEC. Those capabilities can reduce the need for costly hardware and specialist teams, particularly for smaller organizations. That matters to the pledge’s aim of raising baseline resilience across the UK economy: broad participation depends in part on whether smaller businesses and local services can access useful protections.

Internal controls and public learning

Cloudflare says it uses the same security products and infrastructure for its own systems that it offers to customers. Employees access internal applications through Cloudflare Access and Gateway. Each request requires hard key-based multi-factor authentication, device posture checks and cryptographically verified identity tokens. The company describes this internal use as a way to test its security layers and carry lessons into product development.

Its approach also emphasizes sharing information after incidents. Cloudflare says it publishes technical postmortems when security incidents or zero-day vulnerabilities emerge, including indicators of compromise and architectural analysis. The company presents those write-ups as a resource for the wider security community, while treating each incident as a reason to strengthen its own systems.

After a significant outage the previous fall, Cloudflare began its Code Orange effort. Engineering teams worked on designing systems to “fail small,” creating tools for safer configuration changes and automating recommended practices. The goal, as described by the company, was to reduce the chance that the same failure could happen again.

Board oversight and supplier checks

Cloudflare says its Board of Directors treats cyber risk oversight as a core responsibility. The Chief Security Officer briefs the Board at least quarterly, including on direct threats. The Board’s Audit Committee also receives quarterly enterprise risk management briefings that include cyber risks and the company’s process for reviewing and reducing them. The company welcomes resources from the Department for Science, Innovation and Technology to support board oversight across UK organizations.

For suppliers, Cloudflare says it uses a risk-based review process and requires critical vendors to meet recognized security standards. Its primary benchmarks are ISO 27001 and SOC 2 Type II. The company says these frameworks cover the five technical areas that underpin Cyber Essentials: firewalls, secure configurations, user access controls, malware protection and patch management.

Cloudflare says it can use the Cyber Essentials Supplier Check Tool for UK-specific supplier validation. For suppliers elsewhere, where that certification may not be practical or standard, it accepts equivalent international certifications such as ISO 27001. The company says this approach is intended to verify supplier security while accounting for differences across its global supply chain.

Cloudflare’s participation gives the pledge a concrete example of how network defenses, board reviews and vendor checks can fit together. The broader test will be whether organizations make these practices routine: resilience depends on ongoing monitoring, safe failure and learning from incidents, not a one-time commitment.