Your engineering teams are about to spend 50% time on security

The security shift. The internet is experiencing a fundamental change in vulnerability frequency and severity. Dane Knecht, CTO of Cloudflare, reports that critical vulnerabilities now emerge weekly rather than annually. Log4j-level incidents used to be once-a-year all-hands events; they are now routine. This acceleration is driven by AI agents — used by everyone from nation states to high school students — that never sleep and can probe codebases at machine speed. Teams that once had months to react now have days.

The response required. Knecht believes over 50% of engineering time will shift to security work over the next 18 months. He is explicit that this is temporary, not permanent: once AI has surveyed most existing code and found the majority of bugs, that surge will recede. But for now, organizations must accept that feature velocity will take a back seat to finding and patching vulnerabilities. The shift is not optional.

The organizational lever. Rather than freezing all new development, Knecht advocates creating multiple red teams — going from one internal team to four or five within a year. The logic is counterintuitive: process improvements come from crisis volume, not from top-down mandates. When the fix backlog grows too large for normal processes, engineers will automate the patching pipeline themselves. Leaders should invest in discovery (finding the bugs) and trust teams to build scalable remediation.

The workflow redesign. Cloudflare's internal restructuring illustrates the deeper challenge. A cross-team email workflow involving BI, marketing, and marketing operations was replaced by a single AI-powered tool that lets a product manager define a cohort, draft copy, get approval, and send. The implication: roles that existed to move information between teams will disappear. Leaders must identify these multi-team handoffs and redesign them, not just accelerate existing steps.

The agentic economy challenge. The current internet is built for humans reading at human speed. Agents, which can visit thousands of pages in the same time, break the ad-driven economic model. Cloudflare is betting on micropayments via stablecoins and a "monetization gateway" that lets site owners charge the CPM-equivalent for agent reads. This is early and unproven. The tension between blocking agents (Amazon) and building payment rails for them remains unresolved.

The takeaway for leaders. The evidence is production experience at scale, not speculation. Cloudflare is living through this transition with 5,000 employees and hundreds of millions of sites. The key signal: the security problem is not a technical puzzle — it is an organizational redesign problem. Teams that treat this as a hiring challenge (more security engineers) will miss the point. The real work is simplifying attack surfaces, embedding security into AI-generated code, and rethinking which workflows still need human coordination.