Liz Morton Interviewed by Confidence Staveley

Intro

From the trading floors of the New York Stock Exchange to the front lines of the global internet, Liz Morton has spent 25 years solving what she calls the “visibility gap.” Now, as Field CISO at Cloudflare, she sits at the intersection of global traffic and the AI revolution.

Cloudflare sits in front of roughly 20% of the web. That’s a vantage point few security leaders have. In this conversation, Morton shares what that view reveals about how AI is transforming both attack and defense.

Stat Callout: 234 Billion threats blocked by Cloudflare every day

Cloudflare By The Numbers: — 20% of the global internet’s traffic — 190+ countries with points of presence — 330 Data Centers — Millions of customers (fewer than 300,000 paying)

The Scale of What Cloudflare Sees

We have a point of presence in 190+ countries. We have 330 different data centers, Morton explains. The way Cloudflare runs data is globally. So it’s not just by region or zone. It’s by the whole picture.

That global view enables correlation at scale: If something looks bad here and it looks bad here and it looks bad there, it’s probably bad. You get more data points, you get more fidelity to your conclusions.

How AI Is Changing the Threat Landscape

AI will allow anybody to do one-to-many, Morton says. You write one agent, you create one AI. It can do many, many things and it never sleeps and it can scale as long as you can scale infrastructure.

Pull Quote: Attackers don’t have to be accurate. They just have to be there doing something. They just have to be right once. — Liz Morton

The implications are stark: If it’s machines doing this, you have an unlimited capacity to conduct any kind of attack you want. If you can dream it, you can do it because AI will write the code for you to try. And if your code isn’t secure, it doesn’t matter if you’re on the attack side. Just keep running. It doesn’t have to be perfect. It doesn’t even have to be good.

What Keeps Morton Up at Night

AI-Powered Social Engineering at Scale. Morton’s biggest concern: Take an AI agent and get to a lot more people with a lot better content that is a lot more customized to that person’s response, a lot smarter, a lot wilier, a lot better at creating a deeper and deeper connection. The fraud campaigns she witnessed as Head of Cyber at the New York Stock Exchange were devastating.

Pull Quote: Deep fakes are not a unique story anymore. I could go on because this is a wicked problem. — Liz Morton

Critical Infrastructure Coordination. State actors are strategically pre-positioned in some very important places. Those threat actors definitely know about AI. Attack coordination, conditional trigger-based, event-based triggers become very easy to correlate. When you start messing with critical infrastructure, you start messing with human lives.

Hypervolumetric DDoS Attacks. Instead of having to walk down the street and try the door yourself, you walk down the entire world’s streets and somebody else helps you try all the doors all at once. For non-Cloudflare customers hit at an important business inflection point, the results can be catastrophic.

How Cloudflare Fights Back

We’re an AI-first company, Morton says. Everything starts around the network. A lot of point solutions in the AI space will make use of the CDN. In our case, we are the CDN. So all of our intelligence starts at the network.

Cloudflare’s AI Security Suite:

Firewall for AI: Works like a WAF but for AI. Interrogates every transaction going into or out of your model, checking for prompt injection, guardrail compliance, and model poisoning attempts.

Bot Management: In July 2025, Cloudflare’s “Content Independence Day” blocked AI scrapers from pulling training data by default. Content creators should be compensated for that work.

Human Verification: Cloudflare has figured out that there’s a level of randomness that human beings create all on their own. No more clicking squares with traffic lights.

PII Detection: Can detect PII in model responses and obfuscate, block, or refuse to return sensitive data. Belt and suspenders for AI development.

The Identity Crisis

Morton is candid about the challenge: There are days when I think I’ve got it and then there are days when I think I gotta go back to school.

Her view on what’s coming: I think two-factor authentication is ultimately not going to be enough. It’s going to have to come down to something you are as a factor. Is that something that means we’re going to have a chip in our neck? I hope not.

What AI Should Be Doing (But Isn’t Yet)

Morton’s answer surprised us: problem management. Not vulnerability management. Problem management.

The Problem Management Gap:

You have 250 vulnerabilities that just came out of your latest scan. 10 are crits. 20 are highs. The rest are mediums and lows. What’s difficult is to say: this host also has a configuration problem here, an application using a bad library there.

If you have five or six problems with one host, can we just have something say: you need to take a maintenance window and do these five things?

AI-powered problem management: creating heat maps of organizations, correlating vulnerabilities with configuration issues, making the impossible task easier.

The Philosophy: AI Makes Great People Amazing

One of the things that’s part of the philosophy at Cloudflare is that good AI makes good people better, great people amazing, Morton says. But it is a terrible replacement for humans.

Pull Quote: A human being’s core competency is not clicking a button or typing numbers into spreadsheets. A human being’s core competency is thought, creativity, dot connecting, new ideas, problem solving.

Pull Quote: Don’t be afraid to boldly take a step back. Take on some expense. Maybe one less project in order to give your team time to go train. Let that team innovate, experiment, let them try things and fail. You learn more through failure than you learn through success. — Liz Morton

Watch the full interview at aicybermagazine.com

About The Author

Liz Morton is the Field CISO at Cloudflare. With over 25 years of experience in IT and security, she previously secured critical infrastructure at the New York Stock Exchange and Intercontinental Exchange. She has spent her career solving the “visibility gap” and now sits at the intersection of global traffic and the AI revolution.