Skip to content
Cloudflare Docs

Risk score

Subscribe to RSS

2026-01-15


Support for CrowdStrike device scores in User Risk Scoring

Cloudflare One has expanded its [User Risk Scoring] (/cloudflare-one/insights/risk-score/) capabilities by introducing two new behaviors for organizations using the [CrowdStrike integration] (/cloudflare-one/integrations/service-providers/crowdstrike/).

Administrators can now automatically escalate the risk score of a user if their device matches specific CrowdStrike Zero Trust Assessment (ZTA) score ranges. This allows for more granular security policies that respond dynamically to the health of the endpoint.

New risk behaviors The following risk scoring behaviors are now available:

  • CrowdStrike low device score: Automatically increases a user's risk score when the connected device reports a "Low" score from CrowdStrike.
  • CrowdStrike medium device score: Automatically increases a user's risk score when the connected device reports a "Medium" score from CrowdStrike.

These scores are derived from [CrowdStrike device posture attributes] (/cloudflare-one/integrations/service-providers/crowdstrike/#device-posture-attributes), including OS signals and sensor configurations.

2024-06-17


Exchange user risk scores with Okta

Beyond the controls in Zero Trust, you can now exchange user risk scores with Okta to inform SSO-level policies.

First, configure Cloudflare One to send user risk scores to Okta.

  1. Set up the Okta SSO integration.
  2. In Cloudflare One ↗, go to Integrations > Identity providers.
  3. In Your identity providers, locate your Okta integration and select Edit.
  4. Turn on Send risk score to Okta.
  5. Select Save.
  6. Upon saving, Cloudflare One will display the well-known URL for your organization. Copy the value.

Next, configure Okta to receive your risk scores.

  1. On your Okta admin dashboard, go to Security > Device Integrations.
  2. Go to Receive shared signals, then select Create stream.
  3. Name your integration. In Set up integration with, choose Well-known URL.
  4. In Well-known URL, enter the well-known URL value provided by Cloudflare One.
  5. Select Create.

2024-06-14

SentinelOne signal ingestion

You can now configure a predefined risk behavior to evaluate user risk score using device posture attributes from the SentinelOne integration.