Scaling Security Insights: how we achieved a 10x increase in global scanning capacity

**TL;DR:** Scaling Security Insights: how we achieved a 10x increase in global scanning capacity

---

Security Insights provides actionable security recommendations for every Cloudflare account. To find these insights, we perform regular scans for all accounts, zones, and DNS records, looking for potential security risks and misconfigurations. However, two key issues emerged. First, our scans were too infrequent. Scans were only being performed every week or two, and therefore newly introduced security risks could remain undetected for up to two weeks. Second, automatic scanning was opt-in for many free plan accounts – meaning lots of accounts weren’t being scanned at all.

The risks of infrequent or nonexistent scans are rising: as automated attacks accelerate, the window for detecting security misconfigurations is shrinking. Making sure that we’re finding these issues for all of our customers is crucial to our aim of building a better Internet for everyone. We calculated that to increase our scanning frequencies and enable automatic scanning for all accounts, we would need to increase our scanning throughput by around 10x on average – from 10 scans per second to 100 per second.

But our system was already struggling with its load: millions of events were filling up our backlog wait

Source: Cloudflare Blog

Security headlines need a calm read: who is affected, what is confirmed, and whether there is a realistic mitigation for normal users.

The immediate headline is only the entry point. The more useful question is who gains leverage, who faces new risk, and whether the change is durable or experimental.

Follow whether independent researchers or regulators validate the claims — that is often when the real scope becomes clear.

1) Separate the announcement from the shipping date. 2) Compare alternatives if pricing or terms shift. 3) Revisit the story when independent verification lands.

**Q: Is everything in this article confirmed?** A: The summary reflects publicly reported information at publication time. Analysis sections are clearly framed as context, not new reporting.

**Q: Will iByte update this page?** A: Yes. As primary sources publish more detail, this article can be refreshed without changing the URL.

Last updated: June 16, 2026.

Additional context: early-cycle stories often look bigger in headlines than in day-to-day impact. The useful move is to identify the smallest set of facts that would change your decision, then wait for those facts to land.

Additional context: early-cycle stories often look bigger in headlines than in day-to-day impact. The useful move is to identify the smallest set of facts that would change your decision, then wait for those facts to land.