Email security is a constant arms race. Like WWII engineers reinforcing only the planes that returned, survivorship bias hides real gaps. But LLMs can help us find the invisible weaknesses.

Cloudflare's platform is a leading provider of internet security and performance solutions, offering insights into web security, content delivery, and DNS management. Through documentation, blog posts, and webinars, Cloudflare provides insights into protecting websites and applications from cyber threats and improving performance. Developers and IT professionals can learn about CDN (Content Delivery Network), DDoS mitigation, and firewall configurations to secure and accelerate web traffic.

Cloudflare

Cloudflare describes how integrating LLMs into their email security pipeline shifts detection from reactive to proactive. Traditional systems rely on user-reported misses to improve, creating a survivorship bias problem where real gaps remain invisible. By using LLMs to categorize millions of emails at scale, Cloudflare can identify emerging threat patterns like 'Sales Outreach' phishing before they generate widespread failures. LLM-generated tags feed a targeted ML training pipeline focused on sentiment and intent rather than static indicators. This approach produced a 20.4% reduction in daily Sales Outreach phishing misses from Q3 to Q4 2025, with a two-thirds drop continuing into Q1 2026. Cloudflare also offers a free Retro Scan tool for Microsoft 365 inboxes.

From reactive to proactive: closing the phishing gap with LLMs