Cloudflare has joined a new voluntary framework launched by the UK government aimed at enhancing cybersecurity across organizations. The Cyber Resilience Pledge, as it is called, invites companies to commit to foundational cybersecurity governance, board-level accountability, and comprehensive security measures throughout their supply chains. Cloudflare is part of the initial group of signatories for this initiative.
The company views the pledge's core principles—democratizing security, leadership accountability, and radical transparency—as aligning with its long-standing operational philosophy. Cloudflare stated that it sees the pledge not as a new set of obligations but as an endorsement of the security principles it has championed for over a decade. The organization expressed satisfaction that the broader industry is moving in this direction.
This pledge comes at a time of heightened cyber risk. Cloudflare reported that its global network blocked an average of 234 billion cyber threats daily in the first quarter of 2026. The company recently mitigated a distributed denial-of-service (DDoS) attack that reached a peak of 31.4 terabits per second.
Data from Cloudflare indicated that the UK had become the sixth most targeted location globally for DDoS attacks by the end of 2025. Threat actors are increasingly focusing on application-layer services within sectors such as financial services, aviation, and regional government infrastructure. These findings are consistent with broader trends, as a UK Cyber Security Breaches Survey revealed that 43% of British businesses and 28% of charities experienced a cyber incident in the past year.
The evolving threat landscape, influenced by advancements in artificial intelligence, is lowering the barrier for attackers. AI models are enabling more automated vulnerability scanning and the creation of more convincing phishing campaigns. Cloudflare has been preparing for these shifts, developing defensive architectures for advanced AI models that mirror the need for security to evolve as rapidly as threats.
The Cyber Resilience Pledge is seen as essential because it emphasizes the critical role of collective defense. It encourages organizations to prioritize cyber resilience at the leadership level, implement controls to improve threat awareness, and ensure that supply chains meet a baseline level of security. Many security breaches continue to exploit known vulnerabilities, such as unpatched systems, weak access controls, or inadequate vendor oversight. The pledge aims to encourage more organizations to address these gaps through enhanced governance and monitoring.
Cloudflare's mission to build a better Internet is underpinned by the belief that cybersecurity and resilience are most effective when universally applied. The company argues that a more resilient Internet is inherently a better one. Cyber resilience is increasingly seen as a fundamental business requirement, with customers expecting continuous availability, responsiveness, and trustworthiness from services, even in challenging operational environments.
Cloudflare contributes to strengthening resilience through its security architecture, which shifts protection closer to the network edge. The company advocates for "security as a default," making baseline security protections accessible to all. This principle is reflected in offerings like free SSL certificates, unmetered DDoS protection, a global content delivery network, and DNSSEC, capabilities that historically required significant investment. Cloudflare's model aims to support smaller businesses, local authorities, and startups in participating in efforts to raise the cyber resilience floor across the UK economy.
The scale of Cloudflare's network allows it to detect attack patterns as they emerge by peering with over 13,000 networks globally. Threat intelligence gathered from one part of the network can be rapidly translated into protections for other areas. This visibility also enhances the detection, scoring, and response to attacks across Cloudflare's services, leading to scaled resilience for its customers. Furthermore, Cloudflare utilizes its own infrastructure and security products to protect its internal systems, acting as "customer zero" and using internal learnings to refine its security solutions.
Transparency and a commitment to continuous improvement are also key components of resilience. Cloudflare publishes detailed technical postmortems on its blog following security incidents or the discovery of zero-day vulnerabilities, sharing information to benefit the broader security community. The company treats every incident as an opportunity to enhance its network's resilience, as demonstrated by efforts to rebuild systems for greater resilience and implement new tools to enforce safer configuration changes and automate best practices.
In line with the pledge's requirements for board responsibility and governance, Cloudflare stated that its Board of Directors treats cyber risk oversight as a core responsibility. The Board receives regular cybersecurity briefings from the Chief Security Officer, and the Audit Committee receives quarterly updates on enterprise risk management, with a specific focus on cyber risks and mitigation processes. Cloudflare expressed gratitude for the UK government's resources, which can support governance efforts across the UK economy.
