Source review: October 17, 2026. This historical briefing distinguishes what the dated announcement said from later availability. The original page date is retained; it is not evidence that a service was live then.
A partnership to develop cyber defense
On February 17, 2026, Cloudflare and Mastercard announced an intention to develop cyber-defense tools for small businesses, critical infrastructure and governments. Their proposed combination joined Mastercard’s Recorded Future and RiskRecon attack-surface monitoring with Cloudflare Application Security. The release described discovering exposed assets, prioritizing risk and supporting remediation. It did not establish automatic deployment to every small merchant or a guaranteed reduction in payment fraud. Read Cloudflare’s original partnership release.
What an owner should ask the provider
An exposed website, a stolen administrator account and an unauthorized card transaction are different problems. A tool that discovers an unprotected domain can be useful without making an acquiring bank’s transaction decision or taking responsibility for an employee’s account. Ask the vendor to demonstrate the particular problem it covers before treating “payments security” as one service.
For a concrete evaluation, give the provider an authorized inventory of your store’s website, booking service and administrative accounts. Ask which assets it actually sees, who receives a finding and who is allowed to fix it. Have the person responsible for the website describe what happens if a suggested change interrupts checkout. This tests ownership and response, not just the number of alerts in a dashboard.
For action after suspected credential theft, use Eric’s merchant cybersecurity guide. For a New York operation choosing providers, the AMS New York reading path adds payment and operational context. Neither a regional guide nor this announcement establishes that a particular tool is deployed at your business.
More analysis: Eric Kuvykin.
