Cloudflare's new engine, Precursor, doesn't ask who you are at the door - it watches you through the whole session: keystroke rhythm, cursor movement, when the window had focus. The human hand draws arcs, because it has a wrist. Automation goes straight.
- Precursor was announced on July 13, 2026: continuous behavioral verification through the whole session, instead of a check only at the door.
- A lightweight script is embedded in the response and collects signals - cursor, keystroke rhythm (not the keys themselves), focus, visibility.
- It's given to Enterprise Bot Management customers, free until general availability later in 2026.
Until now, defense sat at the gates - login, checkout, form. Between them it was blind. Once a bot got past the door once, the rest of the walk was its own. Precursor fills exactly that gap. It watches the whole path, not the two doors.
There are two sides and I'll say both. As someone who guards a site, I like it - the check at the door hasn't caught anyone serious in a long time. But the same mechanism watches the agents we build too. The network stopped measuring them by signature. It started measuring them by gait. That's a different game. And it's not won with a better user-agent string.
One detail is worth not skipping - they read keyboard rhythm, not the keys. The difference between the two is the whole difference between defense and eavesdropping, and it's good that they took the trouble. Except the idea is already published. The next one to copy it might not take the same trouble. And won't tell you in a blog post.