Cloudflare Access now supports passkey sign-in for protected applications. Separate Cloudflare updates show activity for stored AI Gateway provider keys and add a DNS risk signal to Cloudflare One. Start with a passkey pilot, use key activity to guide credential reviews, and investigate DNS alerts before acting on them.
The research window expanded from 24 to 72 hours to include the three 6 November announcements. The source pages give calendar dates without exact publication times.
Pilot passkeys on a protected application
Users can enroll after verifying their identity with an existing login method. Administrators select which applications accept passkeys and can remove registered passkeys. Access policies still decide who can enter each application.
Pilot enrollment and recovery with a small group. Check that the same access rules apply when a user signs in with a passkey.
https://developers.cloudflare.com/changelog/post/2026-11-06-access-passkeys/
Review stored provider keys before rotating them
AI Gateway now shows masked previews, aliases, and last-used and last-updated dates for stored provider keys. Cloudflare highlights keys with recorded activity older than 90 days. Usage tracking starts in November 2026, so older activity may be missing.
Check which workloads depend on each key before rotating or deleting it. A blank activity history alone cannot establish that a key is unused.
https://developers.cloudflare.com/changelog/post/2026-11-06-provider-key-security/
Investigate fast flux detections
On Enterprise plans, Cloudflare One can add fast flux detections to a user's risk score when the behavior is enabled. Fast flux rapidly changes the IP addresses returned for a domain and can make malicious infrastructure harder to track.
Review the domain, DNS history and related endpoint activity before escalating. The detection contributes a risk signal and calls for corroboration.
https://developers.cloudflare.com/changelog/post/2026-11-06-fast-flux-detection-ueba/