Building a Security Overview Dashboard for Actionable Insights

Cloudflare redesigned Security Overview not as a simple visibility screen, but as an operational hub you can act on right away. The core is Security Action Items, which surfaces what users need to fix right now, and Detection Tools, which lets you see at a glance whether your security stack is actually active.

Security items are prioritized into Critical, Moderate, and Low, and can be filtered by Insight Type. Cloudflare also connected the Suspicious Activity cards that were previously scattered across Security Overview and Security Analytics, so a single click on a card takes you straight to the analytics screen with the relevant filters already applied.

Behind the scenes, an engine refreshes more than 10 million actionable insights per day. To make this work, Cloudflare uses a structure of small, specialized microservices covering each domain area, called checkers, which operate in two ways.

• Scheduled checks: An orchestrator periodically pushes tasks, and checkers perform deep inspection of configurations such as DNS.
• Event handlers: These react instantly when control plane events occur, such as WAF rule changes, catching anomalies in real time.

This structure doesn't stop at simply finding anomalies—it also attaches context. Cloudflare calls this Contextual Insights, and it focuses in particular on detecting dangling DNS records, showing both which resources are dangling and how significant the real-world impact actually is.

For example, a Dangling A/AAAA/CNAME record is first confirmed as a genuine risk through active validation. For A/AAAA records, a dedicated egress proxy attempts HTTP/HTTPS connections to check whether the server is dead, while CNAME records are recursively followed to their final destination and matched against provider-specific error patterns from providers like AWS, Azure, and Shopify to determine whether the resource is reclaimable.

Once validation is complete, context is added. Impact is calculated by aggregating DNS query counts over the past 7 days in ClickHouse; for A/AAAA records, the network owner (ASN) or infrastructure location is identified, and for CNAME records, the hosting provider is identified. TTL is also factored in, showing how long the vulnerable state can persist due to caching even after a fix.

Cloudflare also presented real data. It scans more than 100 million DNS records every week, and last week alone discovered more than 1 million dangling DNS records. Of these, most of the 31,000 dangling CNAME records pointed to Microsoft Azure and AWS Elastic Beanstalk, and Cloudflare notes that such resources can lead to subdomain takeover, requiring immediate action.

Finally, this feature currently starts at the domain level, but the next step is the account level. The plan is to expand it to aggregate security action items across multiple Cloudflare domains on a single screen, so enterprise security teams can prioritize and address the most critical risks first.