Cloudflare has automated the triage of submissions to its bug bounty program for just $58 monthly using Anthropic's Claude Sonnet model, while a security-focused alternative would have cost roughly $200,000 per month for the identical task. The company's chief security officer Grant Bourzikas revealed these figures during a media event in Sydney last week, where he also disclosed that Cloudflare has abandoned nearly all third-party security tools in favor of internally developed applications, many built with AI assistance. The disclosures highlight both the dramatic cost differences between AI models and the company's broader shift toward building rather than buying security infrastructure.
Cloudflare previously handled all incoming bug reports manually, but Sonnet now filters submissions, checks for duplicates, and judges whether each merits human review. The company has created more than 200 autonomous agents to manage its security operations, replacing commercial security products with custom-built tools. Some of these applications were coded with AI help. Cloudflare's recent workforce reduction eliminated 1,100 positions, with Chief Strategy Officer Stephanie Cohen describing some of those roles as ones that "make no sense" given AI's automation capabilities and the changing nature of customer interactions. Cohen said she expects Cloudflare will return to its pre-layoff headcount over time.
Bourzikas cautioned against other organizations attempting to replicate Cloudflare's build-over-buy approach, emphasizing that the company's business model and distinctive security challenges create a different equation than most firms face. "We have expertise in building security software," he said, adding: "We are not believers in the SaaSpocalypse. We do not think every bank on the planet should start building all their own software systems." The CSO explained that AI users need to learn how to pair the appropriate model with each specific task, noting that choosing Sonnet over Anthropic's Mythos model demonstrates this principle. Bourzikas also suggested that even developers with five to ten years of experience may lack the skills Cloudflare now requires, while a recent graduate with strong prompt-writing abilities can prove more valuable for certain roles when he's using AI to build new software.
Cohen argued that AI hasn't yet established a viable business model, contrasting it with the advertising-based model that powers today's web. AI companies earn billions from subscriptions, she noted, but haven't properly addressed the fact they don't compensate most content creators whose material gets scraped for training large language models and powering search tools. Some AI-powered services like Google's search deliver fewer clicks to publishers, making monetization harder. Cloudflare is positioning itself as an intermediary to construct this business model, leveraging its existing position between users and content providers to let AI firms pay publishers for content access, possibly through micropayments, while Cloudflare charges for the service. Cohen defended the company against concerns that it could exploit this tollbooth position, pointing to Cloudflare's decision to provide SSL connections for all customers as an "expensive choice" reflecting its commitment to building a better internet. She also observed that Silicon Valley often mistakenly assumes people want endless optimization, when many prefer experiences like shopping in physical stores despite lower e-commerce prices. The cost gap between AI models suggests strategic procurement decisions will shape which organizations can afford automation at scale, while the shift from packaged software to forward-deployed engineers signals potential upheaval in how enterprise technology gets delivered and priced.