Bots are getting smart, especially during the AI era – Executing JavaScript, completing CAPTCHA challenges, clicking the “I’m Not a Robot” checkbox – therefore, it is even harder than ever to distinguish human users from them. So to counter that, Cloudflare has shipped the new Precursor verification system, designed to identify automated traffic by analyzing how users behave throughout an entire browsing session instead of relying on isolated security checks.
This new release functions by continuously monitoring interaction patterns across a user’s session. Instead of simply checking whether someone can pass a challenge, the system observes behavioral signals such as mouse movements, keyboard rhythms, focus changes, and page visibility to determine whether the visitor behaves like a real person or an automated script.
They do this through the injection of a lightweight JavaScript bundle into web pages served through Cloudflare’s network. The script quietly collects interaction data, compresses it, and periodically sends it to Cloudflare’s edge servers for analysis. There, multiple behavioral evaluators examine relationships between events – such as whether mouse activity matches page visibility or whether keyboard activity only occurs when text fields are actually focused – before contributing signals to the overall bot detection engine.
Taking a page out of their example, human user inputs naturally have slight corrections, overshooting targets, varying speeds, wrist-driven arcs, and small hand tremors when using the mouse. Bots are on the other side of the spectrum – smooth paths, perfectly timed clicks, or predictable movement patterns.
Unlike request-based detection, Precursor operates on a session level, allowing Cloudflare to build an evolving behavioral profile throughout a visitor’s journey. This also prevents bots from simply refreshing a page or restarting a challenge to erase suspicious behavior accumulated earlier in the session.
Cloudflare also emphasized that the system was designed with privacy in mind. Rather than recording what users type, for example, Precursor only analyzes characteristics like typing timing and rhythm. The collected behavioral data is evaluated in aggregate, isn’t tied to user identities or accounts, and isn’t exposed through customer dashboards.
Precusor will be launched as an optional feature within Enterprise Bot Management that complements Turnstile rather than replacing it.
Aside from Precursor, Cloudflare also announced session-based analytics within Security Analytics that helps organizations view complete visitor journeys instead of individual requests, making it easier to identify where sessions deviate from expected behavior, detect long-running automation, and better understand how legitimate users interact with their applications.
