Update docs to include evaluation time for risk behaviours (#30225)

srishti2123 · pedrosousa · web-flow · commit d9dae4a5e0f9 · 2026-04-23T13:54:21.000+01:00
* Create 2026-4-08-high-risk-browsing.mdx

Add changelog for high risk browsing activity

* PCX review (includes file rename)

* Update risk-score.mdx

Updating clouflare docs with new risk behaviours

* Update risk-score.mdx

* Update risk-score.mdx

Updating risk score docs

---------

Co-authored-by: Pedro Sousa &lt;680496+pedrosousa@users.noreply.github.com&gt;
diff --git a/src/content/docs/cloudflare-one/team-and-resources/users/risk-score.mdx b/src/content/docs/cloudflare-one/team-and-resources/users/risk-score.mdx
@@ -61,17 +61,16 @@ While the Okta integration is turned on, Cloudflare One will send any user risk
 ## Predefined risk behaviors
 
 By default, all predefined behaviors are disabled. When a behavior is enabled, Cloudflare One will continuously evaluate all users within the organization for the behavior. You can [change the risk level](#change-risk-behavior-risk-levels) for predefined behaviors if the default assignment does not suit your environment.
-
-| Risk behaviors                         | Requirements                                                                                                | Description                                                                                                                                                                                                            |
-| -------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Impossible travel                      | [A configured Access application](/cloudflare-one/access-controls/applications/http-apps/)                                            | User has a successful login from two different locations that they could not have traveled between in that period of time. Matches will appear in your [Access authentication logs](/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/). |
-| High number of DLP policies triggered  | [A configured DLP profile](/cloudflare-one/data-loss-prevention/dlp-profiles/)                     | User has created a high number of DLP policy matches within a narrow frame of time. Matches will appear in your [Gateway activity logs](/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/).                                  |
-| SentinelOne threat detected on machine | [SentinelOne service provider integration](/cloudflare-one/integrations/service-providers/sentinelone/) | SentinelOne returns one or more configured [device posture attributes](/cloudflare-one/integrations/service-providers/sentinelone/#device-posture-attributes) for a user.                                          |
-| CrowdStrike Low ZTA security score| [CrowdStrike integration](/cloudflare-one/integrations/service-providers/crowdstrike/)| A user's device reports a score between 0-50 for any CrowdStrike Zero Trust Assessment attribute (OS Score, Overall Score, or Sensor Config score). Refer to [CrowdStrike device posture attributes](/cloudflare-one/integrations/service-providers/crowdstrike/#device-posture-attributes) for more information.|
-| CrowdStrike Medium ZTA security score| [CrowdStrike integration](/cloudflare-one/integrations/service-providers/crowdstrike/)| A user's device reports a score between 50-79 for any CrowdStrike Zero Trust Assessment attribute (OS Score, Overall Score, or Sensor Config score). Refer to [CrowdStrike device posture attributes](/cloudflare-one/integrations/service-providers/crowdstrike/#device-posture-attributes) for more information. |
-| Interaction with malicious file | [Gateway AV scanning](/cloudflare-one/traffic-policies/http-policies/antivirus-scanning/) or [File sandboxing](/cloudflare-one/traffic-policies/http-policies/file-sandboxing/) | User uploads or downloads a file flagged as malicious by Gateway's AV scanner or file sandboxing. Risk is elevated even if the file is blocked. |
-| Suspicious Security Domain Visited  | [Gateway DNS policies](/cloudflare-one/traffic-policies/dns-policies/)    | User visits a domain categorized as a security risk or security threat. Refer to [domain categories](/cloudflare-one/traffic-policies/domain-categories/) for the full list. Risk is elevated even if the traffic is blocked. |
-| High Risk Domain Visited | [Gateway DNS policies](/cloudflare-one/traffic-policies/dns-policies/)    | User visits a domain categorized as questionable content, violence, or CIPA. Refer to [domain categories](/cloudflare-one/traffic-policies/domain-categories/) for the full list. Risk is elevated even if the traffic is blocked. |
+| Risk behavior                         | Requirements                                                                                                | Description                                                                                                                                                                                                            | Evaluation timing |
+| -------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
+| Impossible travel                      | [A configured Access application](/cloudflare-one/access-controls/applications/http-apps/)                                            | User has a successful login from two different locations that they could not have traveled between in that period of time. Matches will appear in your [Access authentication logs](/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/). | Evaluated at each authentication and session-refresh event. |
+| High number of DLP policies triggered  | [A configured DLP profile](/cloudflare-one/data-loss-prevention/dlp-profiles/)                     | User has created a high number of DLP policy matches within a narrow frame of time. Matches will appear in your [Gateway activity logs](/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/).                                  | Evaluated per-request in milliseconds. |
+| SentinelOne threat detected on machine | [SentinelOne service provider integration](/cloudflare-one/integrations/service-providers/sentinelone/) | SentinelOne returns one or more configured [device posture attributes](/cloudflare-one/integrations/service-providers/sentinelone/#device-posture-attributes) for a user.                                          | Ingested via service-to-service API. Frequency is administrator-configurable during device posture setup to align with SentinelOne's API rate limits. |
+| CrowdStrike Low ZTA security score| [CrowdStrike integration](/cloudflare-one/integrations/service-providers/crowdstrike/)| A user's device reports a score between 0-50 for any CrowdStrike Zero Trust Assessment attribute (OS Score, Overall Score, or Sensor Config score). Refer to [CrowdStrike device posture attributes](/cloudflare-one/integrations/service-providers/crowdstrike/#device-posture-attributes) for more information.| Ingested via service-to-service API. Frequency is administrator-configurable during device posture setup to align with CrowdStrike's API rate limits. |
+| CrowdStrike Medium ZTA security score| [CrowdStrike integration](/cloudflare-one/integrations/service-providers/crowdstrike/)| A user's device reports a score between 50-79 for any CrowdStrike Zero Trust Assessment attribute (OS Score, Overall Score, or Sensor Config score). Refer to [CrowdStrike device posture attributes](/cloudflare-one/integrations/service-providers/crowdstrike/#device-posture-attributes) for more information. | Ingested via service-to-service API. Frequency is administrator-configurable during device posture setup to align with CrowdStrike's API rate limits. |
+| Interaction with Malicious File | [Gateway AV scanning](/cloudflare-one/traffic-policies/http-policies/antivirus-scanning/) or [File sandboxing](/cloudflare-one/traffic-policies/http-policies/file-sandboxing/) | User uploads or downloads a file flagged as malicious by Gateway's AV scanner or file sandboxing. Risk is elevated even if the file is blocked. | Evaluated per-request in milliseconds. |
+| Suspicious Security Domain Visited  | [Gateway DNS policies](/cloudflare-one/traffic-policies/dns-policies/)    | User visits a domain categorized as a security risk or security threat. Refer to [domain categories](/cloudflare-one/traffic-policies/domain-categories/) for the full list. Risk is elevated even if the traffic is blocked. | Evaluated per-request in milliseconds. |
+| High Risk Domain Visited | [Gateway DNS policies](/cloudflare-one/traffic-policies/dns-policies/)    | User visits a domain categorized as questionable content, violence, or CIPA. Refer to [domain categories](/cloudflare-one/traffic-policies/domain-categories/) for the full list. Risk is elevated even if the traffic is blocked. | Evaluated per-request in milliseconds. |
 ## Manage risk behaviors
 
 To toggle risk behaviors, go to **Risk score** > **Risk behaviors**.
