# Cloudflare scales Security Insights beyond 120 scans per second > Kafka flow separation, batched Postgres writes, and API changes raise scanning capacity more than tenfold without adding hardware. Canonical URL: https://www.devobs.io/news/news-cloudflare-security-insights-scanning-scale/ By: Lucas Vale Published: 2026-09-06T11:58:54.640Z Updated: 2026-09-06T11:58:54.640Z Event date: 2026-06-12 Section: Security Cloudflare reported on June 12 that it had increased Security Insights scanning throughput by more than tenfold, from about 10 scans per second to more than 120 at peak scheduling. The [engineering post](https://blog.cloudflare.com/scaling-security-scans/) says the work enabled default scanning for free accounts and more frequent checks across plan tiers without adding hardware. ## Several small queues were hiding behind one backlog Security Insights schedules scans of accounts, zones, and DNS records through Kafka messages handled by specialized checkers. Workloads varied dramatically, so slow messages could occupy consumers while fast ones waited. Cloudflare separated processing paths so large or slow jobs had dedicated capacity and ordinary checks could continue. The persistence API was another bottleneck. It executed a database round trip for each insight, reaching hundreds of thousands of operations in a large request. Cloudflare replaced that loop with a hybrid: `UNNEST` for batches below a threshold and `COPY` for larger sets. The resulting system supports scans every seven days for Free, every three days for Pro and Business, and daily for Enterprise accounts, according to the post. It also adds granular on-demand rescans. ## Throughput is an end-to-end property Adding Kafka partitions or pods would not have removed the per-item database work. The investigation shows why queue lag, consumer duration, API latency, and database statements need to be viewed as one flow. Teams operating similar scanners should record payload-size distributions and set separate service objectives for small and exceptional jobs. Batch thresholds need tests for lock time, temporary-table overhead, and retry behavior. If a bulk request partially fails, the caller must know whether replay is safe. Cloudflare’s result improves the freshness of configuration findings. It does not mean a periodic scan observes every transient state; teams still need change controls and event-driven detection for risks that cannot wait for the next scheduled pass. ## Source references -