Cloud connectivity provider Cloudflare Inc. today announced the launch of Application Confidence Scores for artificial intelligence applications, a new feature designed to help enterprises evaluate the security, compliance and reliability of third-party software-as-a-service and generative AI tools.

Offered as part of Cloudflare One’s AI Security Posture Management suite, the new scoring system gives information technology, security, legal and compliance teams a transparent way to assess the rapidly expanding universe of AI software without resorting to blanket bans.

Application Confidence Scores seeks to address the growing issue of shadow IT and shadow AI in enterprises, particularly where employees use unapproved generative AI tools to boost productivity and can expose sensitive data while doing so. Added to the mix is that exposed sensitive data could be retained by AI providers and later shared or even used to train models on user inputs.

Cloudflare argues that traditional approaches, such as blocking all AI applications, stifle innovation and push usage underground. Instead, it proposes an automated way to evaluate applications across objective, publicly documented criteria.

The new scoring framework is focused on transparency rather than subjective judgments or black-box assessments. Cloudflare crawls public documentation such as privacy policies, compliance certifications, security frameworks and model cards before processing the information with AI and human oversight.

The scoring system ranks assessed services from one to five based on whether they meet enterprise-grade safety, security and governance standards. Vendors can challenge or update their scores by submitting documentation.

The Application Confidence Score measures general SaaS maturity, covering factors like compliance certifications, data retention policies, third-party data sharing, security controls and financial stability. A complimentary Gen-AI Confidence Score focuses on AI-specific risks, including ISO 42001 certification, deployment security models, model cards and whether user prompts are used for training.

In some examples provided by Cloudflare, ChatGPT Enterprise was found to score higher than free and consumer versions, as the enterprise plans disable training on prompts by default and provide enhanced controls. Similarly, Anthropic PBC’s enterprise offerings achieved near-perfect confidence ratings, while consumer tiers scored lower due to limited safeguards.

Cloudflare plans to make the scores freely accessible through its dashboard’s Application Library, with future integration into Cloudflare Gateway and Access to enforce policies such as blocking traffic, applying data loss prevention, or isolating browser sessions based on confidence levels.

Photo: MichaelVi/Adobe Stock