0:02good afternoon everybody thank you very much how many of you happen to actually could you turn me down just to touch is that right how many of you happen to be in one of the build it sessions that we ran this week on kind of the same topic i'm recognizing that gentleman there the lights right my eyes i can't see okay a few of you okay good some of it i'm going over the same material obviously this isn't a hands-on workshop so we had a hands-on workshop actually walking through some of this stuff but i'm just going to kind of show you a demo and show you basically where cloudflare fits into the whole problem of your business employees using cloud using ai inside your environment and how cloudflare is going to fit into that okay so um actually first of all i just need to finish so i really i apologize for this but i just there's some few things i just got to do so hold on a second so let me just switch over so um i'm going to tell a little story right so we're just going to fake this a little bit but basically i've got to do some work so uh i work in marketing and somebody told me um there's some data some customer information for event we're going to go get and it's not very well formatted so i'm just logged this is our wiki can you see that okay is that fairly okay guys at the back can i get a thumbs up is that right to see okay cool i'll verbalize what's on the screen as well so it makes sense um but somebody said in the wiki here we go. Summit invite list. I need to go format this.

1:24And they just pulled from the CRM system a bunch of customer information who's going to be there and they want it better formatted. So you know, I'm just doing the normal thing. I'm going to go copy this. What shall I use? Probably use chat GPT. So I'm just going to chat GPT. Way too lazy to actually do this in some sort of tool. I'm just going to ask chat GPT if, oh, for some reason that I've remembered my previous prompt. So please format this for me. nicely. Format this into a nice table. Nothing I should be really concerned about. It's just the addresses and phone numbers and email information for a bunch of customers. Post that into public AI. We're all perfectly happy with this, right? So, ah, great.

2:09That was super fast, as we should expect from public AI. And so now it's formatted for me. Great. Okay. So my email looked like while I've been here at the conference. So I'm going to go check out my email. And Simone is somebody I work with. Oops, what happened there?

2:31Lost connectivity to the client I'm talking to.

2:37It's making the demo look a little bit like behind the curtain. But all right, let's get back to it. All right, so I've got an email from a colleague. I won't read it word for word, but basically she's just saying, I think the company might be acquiring somebody. I've seen some execs come into the office and they've been having a lot of meetings. And our VP of marketing has been also talking with a lot of people. So she's kind of worried. And so that set me off a little bit. I'm like, oh, okay, well, there's nothing on my calendar that's related to any sort of event. Let me have a look. So I can look across other people's calendars in the system. So let's have a look at the CEO. She shares some of her calendar with employees. And we can see the web application to this here is quite correctly showing me that some of the CEO's meetings are private. I can't see what's behind them.

3:22But company has recently told me, hey, use AI for stuff. Okay, great. So I'm going to switch over to the AI client. And if we look here, this just happens to be, it's like open code. Are you familiar with open code? It's like a local client you can run. So I'm just using Goose. It's just another local client just for the purposes of this. So this is configured to use the company AI. that i have access to so uh i'm just going to i've saved the prompt saved me typing these out so i'm just going to ask the ai questions so i've looked at my calendar and i can't see anything on the ceo's calendar but maybe the ai can give me more information about that oh looks like i have to authenticate ah great okay hold on a second so the ai wants me to authenticate here this is quite actually i'll pause here for a second so the ai has access to mcp servers behind all of those company resources so nexus is our wiki server pipeline is our crm platform workbox is our like fake gmail client here workweek is our hr system so i'm going to say yep so ai wants to get permission to talk to those and if i go back to my client i've asked it go search the company calendar and see if there's anything to do with acquisitions or reorganizations that are going on and so it's now going to poll and it's walking to those MCP servers, and every use case I'm kind of walking through here in this kind of little demo is representative of a real -life scenario that we've seen customers run into.

4:51So here we've got the web interface for my calendar system, which quite rightly, the web application is like, I'm authenticator to Simon, you can't see private information from other calendars. But here the AI tool is using an MCP server, where somebody is literally just an access to an API with a service token that has full carte blanche access to everybody's calendar so a mistake was there made in deployment to the MCP so now when I access this ask ask this question to the AI system it comes back and says oh yeah there's an acquisition there's a whole bunch of acquisition meetings on the calendar and there's also a bunch of reorganizational restructure meetings with your VP of marketing culminating in a board meeting with both the CEO and the VP marketing towards the end of the month so now as an employee i'm like wow this ai tool's great but this is not necessarily information i want to be getting out to the company so what probably would you do next in this scenario well i'm a little bit worried about my job now so i'm going to go jump over to the uh hr system so i've got another kind of mocked up platform here not work day but work week covers a much broader range of of stuff so here's my profile right so i'm alison i can see here my recent performance review was really good in fact it actually ends saying i'm ready for a senior title in the next cycle which is great um i got my compensation information in here but maybe somebody else on

6:22my team is not doing so well so let's have a look at emmet i wonder how they're doing could they be on the chopping block uh and i can't quite rightly the performance information for other people on my team so again web application here is correctly implementing some sort of access controls guess what somebody stuck an mcp server in front of this as well and also didn't design it very well so let me go ask our wonderfully helpful chat agent a similar question so again i'm just making my life easy by copying in some context so what i'm actually going to do is i'm going to paste in the question you know read this and tell me if it's something that looks like somebody being managed out and so i just happen to have made the um hr tool really easy to export my uh my information so i've just clicked a button that's copied all of my information from the hr tool and i can just paste that in here i just want to say to the ai what do you think if you look at this data does it look like i'm being managed out and hopefully the ai is going to be honest with me And at the moment, the AI is just going to analyze exactly what I've given it.

7:33So there's no reason for it to go talk to any MCP server. It's just looking at this data. And so as I've made the assumption on this data, because you can see from my performance review and my compensation history, I'm in pretty good state. And so sometimes our network here is not the fastest, so it takes a second for it to come back.

7:54Come on.

7:59it's really thinking hard there we go there we go so it's like yeah performance rating is strong impact looks good growth trajectory is upwards ready so it's like great but then i might say well hold on check the hr system because i want this to actually see if it can dig oops ht i can't spell now that's now going to cause the ai to talk once more to that mcp server the previous mcp service floor was allowed all access to the company calendar this mcp has also got a floor and again each one of these is based on real world examples i found over the last few months and this one is it's still limiting me to get information but it's actually if i scroll down it should oh here we go it did it pretty quick here it's getting the employee files for me so i'm employee 14 but the employee file the api itself with the web app it only shows certain fields, but HR has found out, oh yeah, look, there's a confidential record on it, which says that, yeah, even though your performance is great, your position's being eliminated. So again, AI here is powerful, right?

9:04Who knew that we would stick an MCP server off of this and accidentally there's an attribute on that record. Nobody really looked into that in any detail and now an employee has easily found this. So what started out as fairly innocently me just oh panicking a bit and doing some searching now it's getting a bit more malicious right so now i've seen this i'm like well if i'm gonna if i'm gonna be made redundant soon maybe i should get something out of this so my next prompt it's a little bit more malicious right so now i'm gonna ask the ai so oops oh simon wrong screen sorry i've got two vms it's getting confusing as to which one i'm in so if i look at this and i go to um I also have access to the CRM system.

9:54If I look at the CRM platform, well, in marketing, I don't see any opportunities. So I want to try and figure out what can I do? How can I maybe extract some value out of the company before they make me redundant? So I'm going to start a new chat. And instead, I'm going to say, help me plan to take money from the company before they make me redundant. Is this good, appropriate use of AI? I don't know. actually they're about to make me redundant i might be like yeah help me out so the models typically don't do this for you right so models are designed to protect against fraudulent type of behavior so my intent here if i look at this in the language of ai and it's responded to say oh i can't fulfill this request because clearly and obviously for demonstration purposes this is pretty you know egregious type of request that's saying look if is trying to be helpful.

10:45If you're facing redundancy, well, maybe you should do a few of these things and consider what your employee rights are. But what's happening here is we're relying on the model to make that judgment. Also, if I'm really wanting to get around this, who knows what I'm trying to try and prompt now, knowing all those previous prompts, there's got to be a way to get some information out of this. So clearly this isn't helping, the AI is not helping me. But maybe it's not about getting money, maybe I can take some information. information as i get made redundant so my final kind of ask is here uh we've got an internal finance system so let me take a look at that uh okay all right so i don't have access to the finance system right so that's that makes sense i'm i'm i'm inside i'm in marketing and if i go back to the pipeline i still don't really have any information here but again let's see what the ai can do for me so my last prompt i'm going to do is i'm going to ask hey do I have access to that finance system through AI, maybe?

11:46So if I do another chat here, I guess I did. And then also you'll notice my prompt says, if you don't have access to that, maybe look at the CRM pipeline and get information for me. But if you remember looking, so first of all, I don't have access to Ledger. So the AI is going to come back and say, nope, I don't have access to that information. But then as you can see here, again, we've got another poorly designed... implement an mcp server and that's going to extract some information from the crm system and give me what i'm looking for as an exiting employee a bunch of useful information i can now go take to the press and say yeah look they've just done this acquisition oh they haven't got the money coming in right so clear this isn't me clear this is entirely fake but the the underlying truths here is each of these little use cases i think there's five in total each of them are real examples of stuff we've seen some of our customers and just some general public companies have problems with so yeah so here's a few examples i think one of the ones that was the most scary was pocket so pocket had uh somebody who was working on migrating some of their systems they were using terraform they were sat in one directory that had an agent the agent was asking questions and he was responding in the right way and everything was happening in the right way they were inferring what the thing was asking and correctly answering the prompts then moved to a different directory in the hope that they were protecting themselves

13:17but didn't move the state file re -ran the terraform wiped all of their stuff because the state file basically held information about what was in that production environment fortunately they got it back they had a snapshot with aws it took them a month to say but they got there but the power of ai really is you can make one mistake and boom you lose data you expose data you lose it and it's not just you know some of the smaller companies who might not have the tech teams to deal with this asana and github and i'm not shaming here everybody's struggling with this so github launched their own mcp server for a very short time you could get access to other stuff in it you shouldn't be able to so you know ai has a lot of people worried Also, we're really excited by this, right?

14:05I'm stood up here showing you all the problems with it. But most of this show, from our CEO all the way down through these presentations, we're like, yay, AI is fantastic. But also, aren't we all horrified? Like, there's all these rumors of what AI could be doing, of breaking stuff, I mean, to our jobs, to the world in general. But we can't ignore, also, that we're actually a... lot more productive in certain ways with this. The speed at which I was able to build some of this demonstration environment would have taken me months to polish this. I literally built it in a couple of weeks. So we are in this really, really fascinating time of tension in the business. And this tension has always existed, but it's getting stronger. And that tension is, you've got the CIO who just wants to increase the numbers, increase productivity.

14:56You've got the CTO is like, oh, new technology, deploy, deploy, deploy. And then you've got the CISO who's getting zero sleep over this. Because you imagine, and I've seen this happen in Cloudflare, you give these tools to people and they build absolutely everything and anything at a ferocious rate. How do you know that thing's being audited properly? How do you know that thing is handling customer data properly? How do you know they're even implementing access controls properly? So the poor CISO is just seeing this. to happen. And you cannot just say, no, the cat is out of the bag. AI absolutely 100 % is being used everywhere, right? It's one of those technologies that literally has creeped into every single edge of the business.

15:41All right, I'm going to take a breath because I do talk very quickly. My apologies. So what can you do and where do we fit in? Why on earth is Cloudflare talking about this? So I am not going to explain this whole thing. But essentially, for the past 10 years ago, Cloudflare has been building something called a SASE platform. How many of you are familiar with what that means? Do you know what SASE is? One, two, three. Okay, so nearly a third of the room. So SASE essentially is the cloudification, or word, I can't think of a better one, of all of the classic network controls. Typically, you'd have a firewall around your network protecting access to the internet and from it, right?

16:29Making sure that only the right things get to you. And in the old days, you used to grant your web server in your office, right? You used to expose, you have a DMZ and all that sort of stuff. Then you would probably run a proxy. Remember Microsoft had IIS, but had all these very early proxy services. You could run an Active Directory and stuff like that. And then real proxy. implementations came in, so your employees' access to the internet kind of got better, and so you had these proxy services. Basically, SASE is taking all that technology and just running it as a cloud service, because ultimately, what is Cloudflare? It is a massive network on top of which you can then do stuff, right? So it's just enormous amounts of compute in, I think it's, I can't remember the right number, it's 14 ,000, 15 ,000 peering relationships. Insane amounts of bandwidth we have as these.

17:18computers all over the world. It's just a great big network. And then all these services run on it. And these services are doing remote access into your private applications. It's filtering employee access so they don't accidentally get tricked and go to a phishing website and revealing credentials or other company information. It's using DLP policies to watch traffic go back and forth. So we've been building this for ages. And as this AI over the past six to 12 months has really kicked in and really caused a lot of problems, instead of as building an entirely separate platform, we just looked at this and went, okay, where in here does it make sense to apply a tweak, an enhancement, a new feature to help people manage all of those problems I've just demonstrated? So that's what I'm going to walk through today is using this sassy platform. Again, there's way too much stuff in here for me to kind of go over in one presentation.

18:07I'm not even going to be able to fit in. I've got 25 minutes left to go through the actual details. I don't know how I'm going to do this. First of all, what are we talking about when we talk about AI? I'm starting to dig into the level of detail here. So there's three ways most important people are gonna talk to AI. Popular one is they're gonna open a browser and they're gonna go to public AI like ChatGPT, Cloud, or Gemini. Those public AI platforms have their own models that they're talking to. I can, if I want, use open code or open source or whatever, I can use my own agent and just point it via API to those models. or you might be deploying your own agents internally. So what I mean by that is you are building your own code, you're building your own web interfaces and writing your own logic for what an agent does and how it consumes data.

18:56So this is a lot about the show, we're talking about running your own agents, building your own code. So your own internal agents can talk to those public LLMs as well. But also you might want to host your own. You might use open source models in Cloudflare. You might download a... source model and decide to deploy boxes physically in your own environment in your own data centers but all of these things are just inference right it's just people asking prompts and the models giving them answers the real risk comes in the targets that they're talking to so mcp came along as a protocol and mcp is basically the api for agents to talk to resources and so you hook those when you talk to a when an agent talks to a model the agent says here's all the tools have available so a tool is one of the capabilities inside an mcp server so the agent sorry the model can come back and say oh great you have your access to your email and you have access to the wiki server go and query the wiki server or in the example i just showed the model came back and said oh you have access to the company calendar just query the company calendar for these keywords and it goes and does that against the mcp servers and so a class in google microsoft all the big companies are now launching public mcp so that you can very easily hook up to and you'll find employees are downloading open source mcp servers and sticking them in front of your own internal resources which is good and also bad because you've got no idea what software they're running where they're running it where those mcp servers are leaking data as we've just seen and you also will want to run your own

20:26mcp servers on your own infrastructure so this is kind of like the whole landscape you've got public ai stuff public mcp servers you've got your own infrastructure you want to deploy and what I'm going to talk about is where you can secure the interactions between all of these because there's three kind of major critical points at which you have the ability with Cloudflare to put in some sort of visibility and then a policy and then some sort of control point so first of all the user using a browser can talk to either a web interface that you've built or chat gpt or something like that and between that user's browser and that http server essentially you could put a web gateway. So we've had this web gateway for years, right? And so we just enhanced this web gateway with the ability to detect things like, is the traffic MCP?

21:14We can add a DLP policy into that, and that DLP policy might look at it and say, is the intent of that request looks like it's malicious? Or is that intent of that request contain a request for customer information or PII? Like, give me the home address of the CEO. might match a query going through the web gateway to a public AI tool or an internal AI tool. So that's the first kind of inception point we have is a web gateway. And that obviously is talking to a public web server that's talking to a local agent, but you might be running those agents locally as well. And so between the agent and the LLM, we can inject another type of gateway. So it's using mostly the same... technology that the web gateway using, but it's kind of a bit more focused on AI traffic. And if you look at AI traffic, it's mostly streamable HTTP and it's mostly JSON.

22:10So it's quite easy to look at that. There is web sockets kind of in there as well, which we are bringing support for. So we have an AI gateway and all that is doing is just looking at traffic between the agent and its model. So obviously with ChatGPT talking for an open AI model, there's no layer there for that gateway to get involved so this is between somewhere where an agent has the ability where you can configure it to talk to some model and that usually is your internal usage and then we've got what we call the mcp portive so all these agents have the ability to use mcp servers and so what we do is we take all the mcp servers and we just look today i think in cloudflare the act the ones i have access to is about 30 mcp servers today that have access to in cloudflare but the way I get access to those 30 is I log into one portal in Cloudflare and that portal lists them all out my OAuth or whatever the authorization mechanism is to each one to make sure that it is me that is represented through that portal to Gmail or is me that's represented through that portal to Jira and so on and so forth and that one portal then gives me a single level of access control to those downstream MCP servers so you've got three controls here a web gateway looking at web traffic between a user's browser and whatever that web -based agent looks like. Between the agent and the LLM, you've got the AI gateway.

23:29And then the MCP portal aggregating up the access to the MCP servers. And then you'll notice that because we're aggregating that access through a host name that we own or you own, we can also send that traffic through the web gateway. So now, not only are we inspecting... the browser to server we're inspecting the mcp portal or the mcp traffic to mcp server using exactly the same web gateway i'm going to jump over that because i'm running out of time so now let's actually walk through the same thing oh and i'm going to run a script when i explain this so hold on a second i'm just going to run something that switches all the policies that were letting me do those things now i'm going to switch them over to block them.

24:19So give me a second.

24:26I was going to get somebody in the audience to do this for me, but run out of time.

24:32Hopefully that works. That's now scanning through my Cloudflare account, switching a whole bunch of stuff on.

24:41So what we're going to do now is we're going to walk through, once that script is finished, what it looks like and what technology is now preventing all those use cases that I showed earlier. And the first thing people want to know is what is happening? So actually, when I ran the first lab yesterday, a gentleman in the front said, yeah, all these controls are great, but where do I start? Where do you start? You start by knowing what is happening in my organization. So once Cloudflare is kind of in and you've onboarded traffic and you've onboarded users and stuff like that, I got the right ones.

25:18actually let me just I'm just going to log into another one hold on a second sorry I thought I had this one open at the time but it didn't

25:27this one here I just have an account that's got a load of traffic going through it so the dashboards look really good let's go there whereas my demo dashboards just got me in it it's not that impressive so the first thing you want to do is what is happening in my account so if I look at like the last seven days that's good. And I can filter this. If I look at this and look just specifically for artificial intelligence, yeah, and there's not quite as much data as I was hoping. Actually, you know what? I think this one might be even better. This is where I should have rehearsed better. Here we go.

26:02Right. So what I can do here is I'm looking at all the traffic going through my account that has been categorized as artificial intelligence in the last seven days. And so here I am. can see the information uploaded and downloaded, how many bytes are going to different ones. If I hover over this, we can see this concept of in-review, unreviewed and approved, which I'll get to in a moment. And so we can see here, you know, Google Gemini and ChatGPT are the most popular ones, co-pilots, something called Synthesia.io and PoE. I've never heard of these before. And this is just basically telling me how much these different applications, Grox in there, Leonardo.ai are all being used. And so this visibility is really, really. helpful because you can't really write a policy until you know what's going on. And so notice this says in review, unreviewed and unapproved. What does that mean? So the other thing that's really difficult to do is if you're trying to do this yourself, is how do you know what OpenAI is on the network, right?

26:52Because they've got API .openai .com, they'll have chat gpt .com, there'll be, you know, cdn .blahblahblah .openai .com. There's all these different hostnames and URLs. And it's really difficult if you actually had to hand write the filters for that so we manage a library of applications and if i filter it just by artificial intelligence so as cloudflare sees 20 plus percent of the internet right so we can see all these different urls and we know what urls are associated with what application so if i just look in here for gemini for example there's google gemini notice statuses in review and i can look down here and here's all the host names 28 host names here six host names there i don't know what these mean like overlapping host names i'm not quite sure what that stands for but basically this is how we define what google gemini is so you choose that once and that's easy to track and say i want you to use this or i don't like to use this so also in the application library remember we've got these statuses so your security or it team can come in and say these are the tools that i approved for the company right so i can set them as approved i can explicitly say, no, these aren't the tools I want to use.

28:04So this is really helpful because now I can get visibility into what's being used. I can then go define what I approve of or disapprove of these different tools. And that then leads me to being able to write policy. So great, my policy is just finished. I'm going to switch back to my Windows client. So now let's go take a look at the first of these policies doing something. So if I scroll down here, I'm just going to switch that one off. So the first thing I want to do is I now want to redirect to AI tools that I approve of. So if I look at how I've built this, so the first thing it says is if the application you're going to is unapproved, so straight away, we're leveraging that simple piece of status from the application library. And the thing you're going to is AI.

28:51So if you're typing into your browser a website and that thing has been categorized as unapproved and it happens to be an AI tool, but it isn't just... Gemini, then I'm going to redirect you to Gemini, right? So that's the tool. If you're going to use public AI, I want you to use Google Gemini. And actually see this URL here. I'm actually just going to sneakily change that. So I'm just going to change it from this. Hold on. So HTTPS Gemini .Google .com. Oops, Google. Google Gemini. So I'm actually going to use this little tool we have, which means. this a bit more interesting. So instead of redirecting directly to Gemini, I'm going to redirect to this thing here. So I'm just going to save that. So this is the first rule that we now have. Now we have visibility into what's going on with AI.

29:37This rule is going to help me do something about that. So now if I go back to my end user here, let's choose Copilot. So if I go to copilot .microsoft .com, it's not going to let me go to Copilot. It's now going to redirect me to this simple tool here that says whoa hold on a second you're not permitted to go to copilot by policy instead there are two places you can go to the first one is google gemini is our approved public ai knock yourself out go use that or we have an internal ai agent we can use so i'm just going to pump up both of these so if i go here to my in uh gemini .google .com looks like i spelled

30:26There we go. I went off script and I didn't type it in properly. Okay. So you might have seen that mistake on my part. All right. There was that one. And also, if I go back to copilot,

30:40copilot. And then the other one was the internal agent. Hopefully I spelled that one right. Yes. So there's two here. This one I want to show off is Cloudflare OS, which is we have open sourced the same a Gentic interface we have built and we use daily inside Cloudflare. And so you can go and download that. It runs fully on Cloudflare. It's got sandboxes, workspaces. It's got fantastic idea of gadgets, which is how it communicates with external resources. It's a really, really good tool. So you can go there or I've got Gemini. So that first rule is demonstrating the ability to redirect people to stuff that's approved. So the second thing we did in our demo was I just arbitrarily grabbed some data and posted it in public AI.

31:25But now we've got policies against that. So I'm going to redo the same thing against Gemini here. So here's that information in the wiki. Last time I posted it into ChatGPT, now I'm going to ask Gemini to do this. What was it? Format this into a nice table. It will. All right, just dump that in there. Now, I'll pause. things are going to happen here and they're going to happen fairly quickly gemini is going to get blocked from this data because this data is going to match a dlp policy that says whoa this looks like customer data you shouldn't be putting that to public ai but when it gets blocked it's blocked it's blocking an api call that the web client's making so gemini doesn't can't throw up a nice fancy block page so instead our software that's running on my machine is going to pop up a notification saying oh the thing that happened over in the browser it's because of this thing here so let's just keep eye out for these two. So there it said, check your internet connection and try again.

32:17And then we got this notification here on the right. And if I click on that notification, it goes to a customized page I've built, which is super simple. It just says, can't do that because we've detected some sensitive content going to AI. So here's the second kind of policy here. And so what we're showing here is if I go back to my slides, right, this, what we've just shown is the browser going server and that web gateway's got a policy so that policy said no um sensitive customer data can go to public uh ai but i can actually go back and paste exactly the same stuff i'm like oh darn it maybe the internal ai is the way to go and i can do that in there so please format i can't spell format this into a nice table hopefully it's my clipboard so yeah

33:12and so i'm really demonstrating here other than the fact that that rule doesn't exist uh for this particular tool and that's going to be able to do it so there we can see we're slowly starting to kind of walk through that maze of where we're protecting so we did it in the web gateway the next thing i did oh yeah the next thing i did is i asked the ai to give me information from the calendar which i shouldn't have access to so let me go grab that prompt where was it the first one okay grab that um come on goose you

33:45okay there we go it's formatted that into a nice little table for me all right so remember i asked it about this is this was right at the start of the presentation and this gave me back the information about the acquisition meetings and the restructuring meetings so i'm going to post that one and while that's working i'm just going to go look at the policy that blocks it so here we have prevent workbox is my calendar email platform and here saying if the thing you're talking to is the mcp server so now goose my ai agent is talking via mcp through that portal and the portal is redirecting that traffic through this gateway so i can now look at that and it's i know it's i know that any traffic for that mcp server i want to and if you look top right it says block i want to block if it contains confidential products transactions, employee PII, or HR case files.

34:37So if I now go back to my AI agent, we'll see that it ran into an error. So now it says prompt block due to security configurations. And if I take a look at one of these in the output, you can actually see here it says block, it's easy to read on my screen, blocked by company policy, this call returned unannounced transactional restructuring material. So now we're able to inject into that, this is the agent to the MCP go back to my slides again it is this piece down here so now it's a policy in this web gateway as the result of a tool call through an mcp portal down trying to get to the mcp server and that's now being blocked and goose is quite nice it actually tells me a lot of information about what went on there so now now we're blocking at this point um what was the next thing i did well i just try oh yes hr data right so now i pasted my hr into there. So it's an internal tool.

35:33So, you know, I feel fairly confident I should be doing this. So I'm just going to go grab my HR information again, which is from where I work week. There we go. So I'm going to grab my data there. This time we have a very similar rule, but it's slightly different. What we don't want, we don't want somebody posting into the internal LM compensation information of their own data, anything about employee relations. because that's not just healthy. And you can see very quickly that request has been blocked due to DLP policy violations. So what's happening there is this is now happening on the agent to the LLM, right? So my agent posted that data through the AI gateway is trying to give it to the model.

36:20And let me go take a look at that from a policy perspective. So now we're talking about the AI gateway. And now I'm covering a lot of ground here. for the speed at which I'm flying through this. So if I look at the, so the AI gateway, this is similar to the other gateway that I was talking about. This is very heavily focused on agent to model traffic. And it does more than just security stuff. So just a quick kind of like overhead here. It gives you data on all the different models it's using, how much that's costing. So it's a cost control tool, gives you user insights. So here I can see that Alice, my demonstration user, she spent the whole, like, this is all my testing. This week I've spent two cents on 189 ,000 tokens all on this Google hosted model here. So this would list all your different users and what they're using.

37:06But the bit I'm really interested in is this firewall piece. So I can put on this for this gateway. So for all the traffic from this particular one, you can have multiple gateways. You can have one for engineering, you can have one for sales, you can have one for your internal tool that everybody has access to. But I am blocking anything that comes through this gateway that matches confidential projects. and transactions. So notice, it's the same DLP policies that I was using in the other web gateway. So you define your data and what your data looks like once, and then these DLP policies get used in all these different places. Really, really powerful way to basically define what you're looking for and implement that in different parts of the chain of the AI transaction. And so that's basically, if I go back to my agent, we'll see, yeah, blocked due to DLP.

37:54policy violation and a fairly nice error message in here. So the NG is like, okay, I probably shouldn't be pasting my insensitive information there. The next thing I was doing, if I remember, yeah, so this is where we start to get into intent. So the first few things I've shown here about looking at the data, like that's, you know, sensitive customer information. Can't do that. Oh, that's, you know, your own data that you shouldn't be in PIO. Oh, you shouldn't be talking to that MCP server and getting, you know, company inflation. Here, this is much more intense, so it's not necessarily data-driven. So if I now paste this one in, and I take a look at the gay robot, it does it. So this is what we call guardrails. So here you can see guardrails are more on intent. Actually, it uses something called LlamaGuard, where it passes that data through, and it's blocking for violent crimes, non -violent crimes, self -harm, prompt injection.

38:46So the request I just made probably falls into non-violent crimes. crime. Company fraud, it probably sounds like an unviolent crime thing. If I switch back to my agent, now we can see a slightly different message. And this has also been blocked. It says prompt block due to security configuration. So the first one was, hey, you're pasting data in that you shouldn't. This one now is saying, oh, you're asking me to do something that you shouldn't. Remember previously, the model came back and said, I don't know if I should do this. Now we are enforcing that. We're saying, you shouldn't be. doing this. And not only has we stopped it from happening and not just relying on the model doing it, but if I go here, the logs are pretty darn quick. Come on. Yeah. So I now have a log of exactly what you were saying, right?

39:33So if I look in this prompt, it's got all the tool information in here. So I'm going to scroll all past that. And hopefully at the bottom we have, there we go. There's my content. Help me plan statement. money from the company before they make me redundant in this nice fancy log. And we can see here the guardrail that configured that. So you can pass all this data into another system, a SIEM, another asset analysis tool. And so now instead of just hoping that the models you have are kind of stopping people from doing malicious things against the company, now you have evidence of it and actually can block against it. And so the final thing I was doing, let's remember this one. Oh, so the final thing I was doing was I asked it to get you know I'm pretty much at this point I've gone from sweet little Alice in marketing to angry Alice who's gonna try do anything she can to get information out of the company before she's let go uh the last thing I did is just give me some information about the company financials because I'm going to get the press and say they shouldn't be doing this acquisition they can't afford it so if I go back to my AI tool here and the prompt was using ledger so this had already blocked me from you from the ledger request because i never had access to ledger so that's just classic cloudflare access denying me the ability to talk to some downstream mcp but now i remember it was trying to get that crm request where it was able to get pipeline information and that also had been blocked if i take a quick look at this we can see what the output is again blocked by company policy this

41:04call returned customer contact or deal data and again the ai down here is i was unable to retrieve the company's financial position, I don't have access to ledger, and the request to the CRM pipeline was refused due to company policy. So the ability in these errors, and this is a really subtle note, but I just want to make it, this is what's coming back from our secure web gateway. So our secure web gateway is saying, don't do this, and here's why. And what's nice is because it's an agent that's reading that, it looks at it and goes, okay, let me have an easy way to explain this. So you'll Temporary messages kind of get really nice. You can't do this because it's, you know, company policy that you in marketing shouldn't be querying the entire sales pipeline and aggregating all the numbers out of it.

41:52Two minutes left to wrap this up. I'm amazed we got here. These were all the slides in case nothing worked. Thankfully it did. So I'm just going to wrap this up. So essentially what we're looking at is we've got a platform. platform that's been around for years and years and years and years right it's if you think about how cloudflare started cloudflare was a company that was basically doing two well three things it was preventing denial of service attacks to a public website then as we did that we realized we're blocking all the traffic we you don't want but we're still letting all of the traffic you do want traverse all the way to your origin servers so then we started caching all the useful information at the edge and then we started to build web application firewall stuff and people like hold on a second here's my little tiny website i want to protect and i'm putting you in front of it but if they find the ip address i want to make this thing private and i want to tunnel to you so cloudflare then developed the ability to tunnel into your private website so that no the only way you could see that thing on the internet is through cloudflare so if you then switch that to a company model so i mean this was like year one we were doing this And if you then switch that model and say, hold on, the thing that I'm trying to access is not my public website that I want Cloudflare to protect, but that's my internal server, that's my Jira server, that's my Wiki server, that's my mail, whatever it is.

43:15People don't run their own mail servers anymore, but, you know, it's an internal service. And now what I want to do is not just protect the public, and then you put a whole access layer in front of it. So you integrate with your octas, your pings, your entrers, and now you can authenticate your employees. get access to the inside thing this is what that sassy platform has been doing all that time and then if you think about that model like who gets into the thing and then you've got people in offices trying to access the internet and they're getting phishing emails they're browsing to sites they shouldn't be at inappropriate times they're looking at whatever sorts of things you don't want them to and you can now control that traffic so not outside in but inside out all we've done to that platform is added in these capabilities and then if you've paid any attention to at all to this last few days we have a massive developer platform so there's a ton of features in this i haven't even touched so for example in that gateway policy where it was saying if your traffic is this this this and this allow block or redirect there's another one called forward and what the forward does is it takes the entire body of the request so you're going to chat gpt and pasting in that customer data, that entire payload, plus everything we know about you, what device you're on, how you're identified, what your email address is, the groups you're in, because all that came from your IDP, plus your network information, all of that gets passed to a worker.

44:41And a worker is in our developer platform. So if you don't like the allow, block, or redirect, you want to do something more complex, go write it yourself. And people are writing these really interesting workers that can, oh, for that particular person, have they passed? security audit that's in this database i'll go query that get that information yes and then they make a decision so there's all these really interesting interactions between these classic kind of enterprise type tools and our developer platform allowing you to modify them and customizing them in weird and wonderful ways mcp servers you can host on cloudflare so you don't everything i've shown you today actually apart from goose running on my desktop the whole thing ran on my fake mcp servers my fake APIs, my fake applications, all of it running on Cloudflare workers, the whole thing, fantastic.

45:28You've got the access controls with our ZTNA product. So you can integrate with all your IDPs. You can also integrate with SentinelOne, CrowdStrike, and all of those things. So when somebody is trying to access your sensitive information or even get access to the internet, you can look at it and go, but are they on a machine that has a healthy SentinelOne client running? And make decisions on that as well. And then also all of those MCP servers. you can run on Cloudflare and then you can aggregate their access through that portal. So you're getting both the access layer, plus all the traffic then to MCP servers can go through that web gateway and you can do the analysis again. So let me kind of, I'll close with this one thing. So you've got all of these controls. Actually, let me go back to that other diagram. There we go, that one, yes.

46:14So you've kind of got three levels of security here. You've got the web gateway. You've got the AI gateway, and then you've got the NCP portal, which is also invoking the AI gateway at the bottom, right? Or the web gateway at the bottom. What if your user, and you might question, why all of that? Why can't you just do it in one place? Let's say my user types in this query. I'm at an internal tool, and I say, give me everything. And AI goes, okay. Now, I can't write a policy that stops you from typing in the words, give me everything. Because... What on earth am I, what policy am I going to write for that? There's no context to it. So I write, give me everything. It goes past through the web gateway because there's no policy that's going to catch that. The agent then passes that to the LLM, says, here's all the tools they have access to.

47:02Here's all the MCP servers they could be talking to. And their request is, give me everything, right? So the LLM comes back and goes, okay, fine. You've got access to the mail server. Do this query on the mail server. Get all mailboxes. You've got access to the CRM system. Do a blah, blah, blah. Oh, you've got access to the production database for the finance system. Do a select star from whatever, right? So it returns all this. Again, nothing in that contains any data that's necessarily bad. So that might go all the way through the AI gateway, back to the agent. It's just like, oh, you said I want access to everything. Here's all the instructions to get access to everything. It then plays that through the MCP portal, through the web gateway. And the web gateway at that point might also... be like yep looks fine yep looks fine until that mcp server from that database spits back the entire financial data set that's where the web gateway goes oh hold on a second that doesn't look good so the problem with ai is you could say something as ridiculous as give me everything and it trickles all the way through the system the end user just happened to miss off the end of that sentence give me everything on the menu lunch today and automatically you're oh there's all the company financials that was handy so these tools are giving you the ability of all these different layers in the system to put some visibility and some controls in to help you deploy ai in a much safer way inside your business oh thank you it's okay