Most security incidents leave a trail. An EDR alert, a firewall log, an IdP audit record — something you can reconstruct. Edge infrastructure? Not so much.
Serverless functions, API gateways, Workers at the perimeter — they process real requests with real credentials. But when something goes wrong at the edge, there’s often nothing to rebuild the scene from. A function executes, makes some calls, returns a response, and vanishes. If logs exist, they’re shallow. The config that was in place six months ago looks the same on paper, even if it’s drifted.
AWS VP Gee Rittenhouse said it plainly at re:Invent 2025: “It’s hard to do agentic security if you’re not observing it.” Most organizations aren’t observing the edge at all.
Cloudflare alone runs code for over 41 million websites now. AWS Lambda, Azure Functions, Google Cloud Run — serverless compute expanded across every major provider. The industry built EDR when endpoints proliferated. It built IdP audit trails when identity became the attack surface. Edge and serverless got no equivalent security tooling moment.
The result is a gap in the shared responsibility model. Cloud providers secure the underlying infrastructure. But the configuration, credentials, and behavior of what runs on top? That’s on the customer. Most haven’t fully absorbed that boundary.
Then there’s configuration drift. A developer deploys a Worker for an integration. It ships with credentials and a CORS policy that made sense at the time, maybe a debug route left open. The integration ships, the developer moves on. Nobody decommissions it because nothing’s broken. Six months later it’s still running — same permissive settings, nobody watching, nobody remembering it exists.
Nick Gray, an entrepreneur and Cloudflare superfan, documented this as the “Shadow IT Fix” problem at a Cloudflare Workers meetup. Routes and Workers that developers spun up and forgot about. “Often the entry points for attacks.” He’s not a security professional — that’s what makes the observation worth noting.
The edge isn’t invisible because teams made mistakes. It’s invisible because the instrumentation was never built.
