Cloudflare Email Security

AI-Powered Protection Against Phishing, BEC, and Multi-Channel Attacks
Technical Deep Dive
Cloudflare One · Zero Trust · SASE Platform
OVERVIEW

Agenda & Core Architectural Focus

1
Threat Landscape
Why email remains the #1 initial access vector and how modern Business Email Compromise (BEC) bypasses traditional Secure Email Gateways.
2
Deployment Models
Evaluating API-First, MX Record Gateway, and Hybrid integration models — 5-minute setup with zero added latency.
3
Proactive Crawling
Cloudflare's core differentiator: crawling newly-registered domains and SSL logs to find phishing campaigns up to 24 hours before transmission.
4
Detection Engines
Under the hood of multi-attribute engines: NLP, computer vision, and sender behavioral analysis for payloadless attacks.
THREAT INTELLIGENCE

Email: The Prime Enterprise Attack Vector

Threat actors systematically target the easiest entry point: user inboxes — with zero-payload coercion that evades signature tools.

90%+
Initial Breach Vector
of successful enterprise cyber attacks start with a highly targeted phishing email.
$2.7B+
Annual BEC Losses
lost globally to Business Email Compromise scams (FBI IC3 reports).
230B+
Global Threat Queries
daily global queries feed Cloudflare's real-time threat intelligence graph.
ARCHITECTURAL GAPS

Why Legacy Secure Email Gateways Fail

MX-FIRST POINT INSPECTION
The Legacy SEG
Inspection
Inspects email only at delivery, with no prior threat-campaign tracking.
MX-bypass
Siloed MX requirement is vulnerable to attackers targeting mailboxes directly.
Weakness
High SMTP-hop latency; struggles with zero-payload BEC (static signatures & hashes).
PROACTIVE MULTI-ATTRIBUTE
Cloudflare Email Security
Pre-emptive
Crawls the web to map attacker infrastructure before campaigns launch.
Deployment
API-first — no MX changes, no bypass surface, no added latency.
Detection
NLP + behavioral models catch payloadless impersonation and vendor fraud.
HYBRID TOPOLOGY

Flexible Deployment: MX + API-First

M365 & GOOGLE WORKSPACE
API-First Integration
Setup
OAuth / Journaling authorization in under 5 minutes — no MX record changes.
Inspection
Parallel, non-blocking asynchronous inspection with zero email delay.
Remediation
Instant retroactive inbox scans + native folder clawback inside mailboxes.
GATEWAY & HYBRID MODE
Inbound MX Gateway
Routing
Routes external email through Cloudflare's global edge before delivery.
Control
Inline enforcement for organizations requiring pre-delivery blocking.
Hybrid
Combine MX gateway with API clawback for defense in depth.
DEPLOYMENT ARCHITECTURE

Two Deployment Models — Architecture at a Glance

Identical detection engine, two integration topologies: out-of-band API vs. inline MX gateway.

Model A · API-First — Microsoft 365 & Google Workspace
Out-of-band · post-delivery
Mail is delivered normally; Cloudflare inspects in parallel via API and remediates inside the mailbox.
Model B · Inbound MX Gateway — Gateway & Hybrid mode
Inline · pre-delivery
MX record points to Cloudflare; every message is inspected at the global edge before delivery.
SOURCE
Sender / Internet
MAILBOX
Microsoft 365 / Google
DELIVERED
User Inbox
INSPECTION
Cloudflare Email Security
Why teams choose API-first
No MX change — no bypass surface
Parallel inspection — zero mail delay
Retroactive 14-day mailbox scan
Native folder clawback of live threats
API / OAuth · parallel
quarantine / clawback
SOURCE
Sender / Internet
EDGE · MX
Cloudflare Email Security
MAILBOX
Microsoft 365 / Google
DELIVERED
User Inbox
block / allow before delivery
API-First = out-of-band clawback · MX Gateway = inline pre-delivery block · Hybrid = run both together
CORE DIFFERENTIATOR

Proactive Threat Crawling: Stopping Phish Pre-Delivery

1
SSL Logs & Registrars
Monitors global domain registration and SSL Certificate Transparency logs for newly registered spoof domains.
›
2
Automated Web Crawlers
Autonomous crawlers render suspicious links in sandboxes, bypass CAPTCHAs, and scan for phishing frameworks.
›
3
Pre-empting Campaigns
Maps attacker landing pages as they are built — blocking campaigns up to 24h before the first email lands.
UNDER THE HOOD

Purpose-Built ML Models for Every Threat Vector

BEHAVIORAL
BEC & Impersonation
Analyzes sender patterns, conversation context, and writing style to detect executive impersonation — even with no links or attachments.
DETONATION
Link & URL Analysis
Real-time crawling of URLs, QR codes, and shortened links. Delayed-activation detection catches links weaponized after delivery.
SANDBOXING
Malware & Payload
Multi-stage static and dynamic analysis of attachments. Detects ransomware, trojans, and zero-day exploits.
COMPUTER VISION
Visual & Brand Spoofing
Computer vision compares rendered pages against known brand logos and login forms to catch credential-harvesting kits.
IDENTITY & COMPLIANCE

Hardening Inbound & Outbound Boundaries

AUTHENTICATION
DMARC, SPF & DKIM
Wizard
Automated DMARC wizard monitors outbound SPF/DKIM failures.
Reporting
Aggregates XML reports into a clean analytics dashboard.
Enforcement
Progressive policy guides: none → quarantine → reject.
DATA LOSS PREVENTION
Outbound DLP
Scanning
Comprehensive outbound content scanning for sensitive data.
Policy
Blocks exfiltration of PII, secrets, and regulated data.
Unified
Same policy engine as Cloudflare One DLP across all channels.
CLOUDFLARE ONE

Platform Play: Unified Zero Trust Security

RBI INTEGRATION
Email Link Isolation
Rewrite
Automatically rewrites suspect links inside incoming email.
Isolate
On click, links render in Cloudflare Remote Browser Isolation.
Block
Stops zero-day browser exploits, drive-by downloads, credential entry.
NETWORK EFFECT
Global Threat Sharing
Feedback
Every detection feeds back into the global threat database.
Coverage
~20% of web traffic gives unmatched attacker visibility.
Unified
One console for email, web, network, and Zero Trust access.
CAPABILITY COMPARISON

Cloudflare vs. Legacy Secure Email Gateways

Capability
Legacy SEGs
Cloudflare Email Security
Pre-Delivery Crawling
Reactive scan on delivery
Active crawling of new domains & certs
Integration Speed
Complex MX routing (days)
Instant API OAuth (< 5 minutes)
BEC / Payloadless
Weak (attachments & SPF/DKIM)
NLP sentiment + comms graph
Suspect Link Handling
Simple redirect or block
Real-time RBI isolation on click
Threat Intelligence
Vendor-limited feeds
230B+ daily queries, ~20% of web
DEPLOYMENT

Three Easy Steps to Inbox Protection

Run API-first in “Audit Mode” alongside your existing SEG — prove value with no inline SMTP routing changes.

1
API Connection
Authorize Microsoft 365 or Google Workspace tenant. Completed in under 5 minutes with zero traffic interruption.
›
2
14-Day Retro-Scan
Runs an instant historical threat assessment, identifying missed phishing runs and active BEC targets.
›
3
Turn on Blocking
Set policies to active remediation — quarantine, clawback, and enforcement once value is proven.
Inbox Protection Initiative

Stop Phishing.
Harden Your Inboxes.

Deploy in audit mode alongside your SEG in under 5 minutes. Request a free 30-day retroactive threat assessment.
sales@cloudflare.com
PPowerPoint (.pptx)Pixel-perfect, editable in PowerPoint & Keynote
Slides render as high-res images — nothing reflows. Animated slides show a single frame.