Cloudflare: Leading Cybersecurity - [Business Breakdowns, EP.241]

26:48Does it extend beyond that in terms of phishing emails and scams? Curious to know who's doing what in the chain of constant precautions that I'm being told. Anytime you're doing something on the internet in a work context, that's this whole space. And Cloudflare has a solution to that. It's a very broad market. There's a lot of competitors in here. There's probably three buckets of activity that an employee will commonly take that you need to protect. One would be you're on your work laptop or your work network and you're visiting an outside public website. And you want to make sure that the traffic going in and out of your work environment to the public internet is safe and secure.

27:28The second type would be you're working just with your internal apps. You're checking Salesforce, you're checking ServiceNow, things like that. So you need to make sure that you're actually approved. And this is that zero trust, approved to view each app. And then maybe there's different policies on what you can view. And then the third bucket is, I guess, all the adjacent things with that. The email security is one, protecting against phishing attacks and things like that. I've definitely experienced where being on-prem, I can use certain apps even, but once I'm off-prem, I'm mobile or on my own device, there are certain restrictions on what I can access for good reason.

28:06I have some sense of how they've evolved pretty naturally from being that external third-party guard dog of sorts to also protecting from the inside. Would you point to anything else just in terms of the evolution or what they've rolled out that was key or monumental in terms of the development of the overall business and what they offered? This is a continual evolution that all companies are going through is your corporate environment used to just be your on-prem network, but now everything's cloud-based. You can work from home. You can work from anywhere. The corporate perimeter or security perimeter is effectively the whole internet.

28:45That's why they can fit nicely in there and provide those services. They realized that with their hardware system and their single global network, they could expand from web services to corporate security. The way they did that was building a lot of the software themselves. To be able to provide these services at a global scale, they often had to build a lot of their own software. They couldn't rely on AWS, for example. No one else could handle their scale and they wanted to have really strong security. What that meant is they have this proprietary software stack. That leads to their next product evolution where they realized that if you can build Cloudflare using these internal tools that we've built ourselves, then other developers will be able to build really powerful products with these tools as well.

29:35So they started offering these services to the developer market. So these include things like cloud storage, lightweight databases, video services, and their flagship product in this, what's called Act 3, is the Cloudflare workers. So that's a serverless function service. And they specialize in lightweight containers, lightweight functions that can be spun up and spun down really quickly to solve bite-sized tasks. And are these developers working within corporations where what Cloudflare is building off the shelf needs to be maybe expanded upon and they're incorporating it there? Or is it separate from the enterprise corporate type clients and it's developers that are building some unique product and then selling it themselves to a different audience?

30:24It's currently quite separate. You don't have to use these products together. You can just be a developer building a weekend hobby project and you want to use the Cloudflare serverless functions, that's a totally valid use case. They're working to bring the products together into a more unified experience, but they don't need to be. You can use these Cloudflare developer products on anything, really. The developers, I assume, are then paying Cloudflare some software cost to use that? That's right. So similar to other cloud models, I say from the hyperscalers, their developer products follow a usage-based prices model.

31:03So the more you use, the more you pay. But similar to the early products, they have a very generous free tier because they really want to attract that long tail of developers and then bring that into the enterprise, which is what they're doing at the moment. So there's over 3 million developers building, using these Cloudflare developer products. A lot of them would be building quite sophisticated functions just within their free tier. To give a sense of how generous this free tier is, I think with their workers' serverless functions, you can query that up to 100 ,000 times a day. Their storage is 10 gigabytes per month with zero egress fees, which is dramatically cheaper than a lot of the alternative developer products.

31:47Can you just give an example of what a developer might build with the tools, just to give a sense of what a tangible example might be? Cloudflare workers are best for quick functions that need to be done close to the user. Maybe one quick example would be that if you're loading a website, you might have a quick worker script that changes the local pricing or changes the local language based on where that web page is loaded. That's done at the edge. So it's faster than querying, say, a central database to generate the page from scratch. the way to conceptually think about these workers is anytime you can take like a task and put it into bite-sized functions it's good for that just because they spin up so quickly and then turn themselves off it is a slightly different way of thinking because you're deploying again to the single global network if you deploy a function to aws you might put that on the us east servers so it lives there so if you call that function you have to travel there whereas with cloudflare if say you're building an app in New Zealand, you deploy a function immediately in London, someone can query that website and that same function is served from that London server at the edge.

33:03Everything gets propagated around really quickly, which is just another benefit of this single global network that they've built. Yeah, I can speak to that example as someone who tends to find myself on UK or Japan websites. Just the currency switch is always beneficial. Saves me some time from doing the currency conversion. When you think about AI, this is a business that has clearly benefited and took advantage of what the cloud has provided in terms of opportunities, been very thoughtful about that, and evolved naturally into different pieces of an organization and offering more. So two different things riding away, but also being operationally thoughtful about how they're going to market.

33:43When you think about where they fit into the AI boom and potential to be whatever they might be in that world. How do you frame it? And then how does the management team talk about where Cloudflare fits into the AI ecosystem? I would say they fit kind of all around the AI industry. And there's probably four ways I'll describe this. First way is just the adjacent tailwinds, which you mentioned, as people want to use AI, then they're thinking more about the data strategy. And often you want your AI agents, for example, to read a lot of data, and you might want to do that quickly without paying a lot of egress fees.

34:22So there's tailwinds in general for Cloudflare's approach for doing that. So that's the first relationship to AI is just adjacent services. The next three are the different sides of AI that they serve. The first is just serving the AI companies themselves. The latest reporting was that 80 % of the top AI native companies, the top AI companies were Cloudflare customers. So that just shows that this next generation, this next era of businesses still look to Cloudflare first. So if they're providing other services for these AI companies, it positions them well to provide AI services as well. That's one, is just serving the customers themselves.

35:03The second direct AI involvement with Cloudflare is inference themselves. They've started to offer inference at the edge through their workers' AI product. It's a slight evolution from their previous strategy where they still have this single global network, but previously every component, like every piece of that hardware could provide every service, which is really powerful because it just meant the return and investment on each of those pieces of hardware could be split across all of their products. But now with AI inference, the hardware starts to matter. They had to install GPUs across their servers.

35:44They have servers across 330 different cities across the world. This was done really quickly. So Cloudflare is a very long-term strategic company. When they're actually designing their motherboards for all of their chips, they left an empty slot open because they didn't know what would it be for or what the use case would be, but they needed it just in case something came up. And it turns out AI inference, was that something? So they could go to all of their boxes and simply just plug in a GPU. And then AI inference is available across the world at all of these locations. This is serving these LLM models.

36:20You can quickly query an open source model for text generation, image generation, voice, or enterprise customers can deploy their own custom LLMs as well. And again, that gets propagated across their single global network. The AI inference from Cloudflare can be done really quickly at the edge. And as I mentioned before, Cloudflare workers are really quick at spinning up and spinning down. So unlike, say, a hyperscaler, You don't have to pre-book or pre-provision capacity. You only use for what you pay for. If an inference is small and you don't use it for a day, you're not going to pay anything.

36:59So it only charges you directly on the AI inference that you use. It feels like a key layer of infrastructure. So you could see them on all sides of the market. Thinking about how they transitioned, you mentioned they got to a point where their offering was on par and then eventually better than what incumbents and legacy providers were offering. Can you talk about what that looks like? Because I imagine they broke into the enterprise market over time, what that looked like, how they approach it, some of the nuance to what it looks like to have an enterprise contract. This is an ongoing evolution.

37:37They go to market changes. Three things I'll call out. One is just the general enterprise sales motion, the partner motion, which is really important to understand, and then their pool of funds bundling strategy. So the first go-to-market evolution was the enterprise sales. This is just a typical transformation from product-led sales, enterprise sales, and the product capabilities were there, but it's still a new go-to-market muscle. And across all companies, this is never an easy transition, particularly as you're moving into security as well. It's a new buyer for them instead of just an IT administrator that is looking over the website.

38:11You're now selling to the whole security office. It could be a multiple month process. So they had to build this new go-to-market muscle out. So in 2023, they actually saw their rep productivity start to drop and they had to let go a lot of their sales team. But in 2024, they brought in a new president of revenue, Mark Anderson. He's incredibly experienced. He's formerly president of sales for Palo Alto Networks, CEO of Alteryx. So he has this deep experience with enterprise sales. This transformation, they're hiring a lot more reps. They've switched from hiring majority mid-market reps to now hiring a majority of enterprise reps.

38:51And they're still keeping this product-led growth because it's so important to their story. But now they're really increasing their sales-led growth motion. There's still ongoing transformation, but quick quantitative proof that we're starting to see is that the growth of revenue from large customers, it started to inflect. It was around 30 % and now it's starting to inflect up to 40 % year over year. It's a really impressive transformation. How big of a chunk of the business is it today? If you look at customers over$100 ,000 in revenue, they're less than 1.5 % of the actual customer base, but they contribute to about 75 % of the revenue.

39:33It's very important to get this segment right. There's a long runway to that segment as well. They're at a bit over$2 billion of annualized revenue. With that, they have a bit less than 200 customers that are over$1 million. If you compare that to Zscaler, when they're at that same size, that$2 billion run rate, they had almost 500 customers with that$1 million revenue. So it highlights that runway that they have at that very large enterprise end And the go-to-market transformation is a big part of that. How much stickiness is there, both from a perspective of keeping customers, but also being able to win share from some of the competition?

40:17Are there long-term contracts that are in place? Is there a major friction associated with ripping out old infrastructure and implementing new? Seems like they've been able to gain market share, but how much goes into that and what are some of the unique dynamics there? It's definitely a sticky product because if you have all your kind of web and security set up, it would take a lot to migrate from that and a lot of convincing to do to migrate away from such a powerful network. So there is definitely a stickiness involved. And one way to look at that is the net revenue retention over the years.

40:49It's always been above 110%. In the last few years, it has dipped a little to 112 in the last few quarters. but with a lot of their other efforts which is the pool of funds recent initiative that's been starting to inflect and the latest quarter or q3 2025 that re-accelerated up to 119 percent so going from 112 percent up to 119 percent of expansion of existing customers is a significant re-acceleration and obviously their product's important but some of this go-to-market contracting is really important as well. I want to get to the partner strategy, but you mentioned the pool of funds and how that might link to that reacceleration.

41:36Can you describe that? We've spoken about like the three different products, the web security, the corporate security, and then the developer platform. We also spoke that it can be quite separate. What that meant is you could have three different buyers and you could have a company that were using each of the three different products groups, but not necessarily talking to each other. There's a bit too much friction for what should be a smoother process for working on a single platform. So that's where they introduced pool of funds. This is a bundling method. And it's also, as it sounds, it's a pool of funds that large customers can draw down from.

42:14What's really important with this is that you can draw it down from any product. So this really encourages experimentation and adoption of some of their newer products. These are multiple year commitments as well. This is their top enterprise customers. And they recently signed a$130 million five-year contract. So these are big contracts. But what it means is if you plan to say use 80 % of these pool of funds on say Act One, you still have a little capacity and flexibility to experiment and try out a few of these workers products. You'll see that they work at an enterprise scale and that just encourages the adoption there.

42:51It's still a fairly new initiative, a roll down 2024, but it's already up to low double digits of their total annual contract value. A quick metric to show that this is working is that this puts a lot of focus on RPO, the remaining performance obligations. That's been growing around 40 % year over year through 2025. So there's very high growth at this scale and this pool of funds are contributing to that. And I mentioned before that it's starting to accelerate the net revenue retention as well. Obviously, not all from pool of funds because it's still new, but it's a contributing factor as well.

43:27It's a really interesting strategy. You look at all these different businesses that have complementary products, but oftentimes we glance over that you have different divisions that are buying them, different customers, and what seems complementary gets bogged down in frictions associated with that. You don't get the synergistic effect that you should. I'm sure it exists elsewhere in terms of this type of approach, pooling funds, but that's quite notable. On the partner strategy, which I skipped over, but you referenced before, what does that buyer base look like? What does that strategy look like?

44:02And when did that come into play? So the channel partner strategy, it's really important for their act two, this is their internal security products, because the buyers often go through channel partners. These channel partners, they often have a preferred vendor list. So the relationships with these partners, and these could be consultants, system integrators. If you're not on their preferred vendor list, it makes the sale a lot harder. So would it be like WordPress might have Cloudflare? It's more like maybe a Cognizant, a CDW for security, like Tata, and all these consulting and professional services groups.

44:39So they'll help with the sale and then help with the implementation as well. These are whole companies on their own. So the relationships with them are really important. So Mark Anderson, the new CRO, brought in a new head of partnerships, Tom Evans. And he has a long history in these cybersecurity partnerships. Worldwide channel sales lead at Palo Alto Networks. So he has this big Rolodex to pull from. The results for that are quite impressive. The channel partner-led growth. And the last few quarters has been growing around 65 % year over year for the past two years. the percentage of incremental total revenue from partner channels has gone from about 20 % to over 40 % of incremental sales.

45:22So it's a really important driver of their growth. And there's a long runway too, just to really highlight how important this channel is for security. Cloudflare's current channel partner revenue as a percentage of total revenue is about 30%. And if you contrast that to Zscaler and Netscope, they're almost at 90 % of their revenue going through channel partners or channel referred partners. So there's a long runway to go. It's a relatively new motion. So I would say they're just getting started there. Those channels are always interesting. It's kind of like an external sales force in many ways that can do the work on behalf of you.

45:59Do they give any sense of whether the margin looks materially different through the partner channel versus the other buckets. Sometimes you get lower margins associated with that because there is, in theory, a middleman involved. But do they provide any disclosure on that? They don't give too much because it is different depending on the partners and that you might have different contracts. Typically, what these partners do, though, is the large scale resellers will basically take a cut. But some of the larger ones, most of their revenue is actually from the professional services and implementation on top.

46:32So they're not trying to skim a product fee. They're more interested in the professional services that go on after the sale. So that just helps with the negotiation and it can protect their margins. Quickly on margins, these Act 2 products, they're the highest incremental gross margin part of the business. It's a high willingness to pay buyer of security and you're using your existing network. So very strong margins in that part of the business as well. Maybe we can get into the financial business model and some of the spreadsheet details. I think you referenced, you're looking at over$2 billion in revenue on an annualized basis today.

47:11How is it split out between those buckets? You may have referenced it in passing, but just to give a clean snapshot of that. They don't split it out exactly, but you can estimate if you split it between the Act 1, the Act 2 and the Act 3 products, that$2 billion is majority of Act 1, like it's their bread and butter. And you could estimate maybe roughly two thirds of their revenue is from Act 1, maybe 30 % from Act 2 growing quickly. And then Act 3, it's still a bit smaller, but growing very quickly as well. In terms of the customer base, I'm assuming most customers, or at least a large percentage of the revenue are using multiple products.

47:52I think your point in terms of the large accounts being one and a half percent versus 75 % of revenue kind of gets to the power of large customers. But is that the case where the majority of customers are using or majority of revenue is coming from customers that are using multiple products? That's exactly the case. And they have over 55 revenue generating products, so a long product sheet. And customers with more than 10 products is the fastest growing revenue category. So that's exactly the case. Offering a freemium model seems to be ingrained in their DNA. How would they manage that over time in terms of continuing to offer a product that attracts users and potentially gets them into the funnel over time?

48:37What does that look like? We spoke a lot about the freemium model for like how they got started and they've really kept that in their DNA for act two and act three as well. The way they do it as well, it's quite strategically different to some of their competitors. On Act One, they don't really charge for volume. Their free users can actually get unmetered DDoS protection, free bandwidth for CDN. This is really generous. What they actually charge for is complexity if you want specialized rules and special bot management setups. But that means if you're a website that constantly gets attacked with high volume, they're not going to charge you extra.

49:15They're not going to punish you for that. That's one interesting part of the different strategy, at least for the Act One products. for Act 2, quite generous as well, up to 50 free users. But then Act 3, their freemium product as well, you can very realistically set up and build a sophisticated app without paying much at all. And that's actually what we have done at SquareFeg internally. We've built some quite sophisticated kind of AI products to ingest a lot of our research, create dashboards and have a full AI interface built on Cloudflare. And it generates an enormous amount of value. And our Cloudflare bills have been remarkably low.

49:55Interesting that an investment firm can do that and fit into that category. Is there a way to capture what's subscription-based versus that? You mentioned the complexity. Does that still fall under a subscription? I'm just trying to get an understanding of the contractual nature versus the usage-based nature, which I'll bucket complexity into that if it should be. They're not charging based on volume necessarily, but how do you split that up? It is slightly different per product group, but for Act One, it is a contract. It's a subscription tier. So you pick a plan, pro tier, business tier, or custom enterprise tier, and you're paying that flat monthly rate for that tier.

50:38And it includes a bunch of things. You would upgrade a tier when you need more enterprise features, whether it's those complexity rules, special splitting of traffic and things like that. Not on volume for Act 1 at least. Act 3, those developer products, that is more uses-based pricing. No egress fees, but the uses-based pricing for how much you use their services. Putting it all together on a margin, however you would look at this, what do margins look like for Cloudflare? They're a software business, so they non-GAT gross margins are about 75 % to 78%. This looks lower than maybe a top performing software business that you'd expect to see.

51:19But you have to keep in mind that they own and operate their own physical infrastructure. And the depreciation of this equipment is included in the reported cost of goods sold that naturally compresses their gross margin. If you did want to try to look at a cash based gross margin to compare apples to apples, About 6 % of their revenue is depreciation directly tied to equipment. So if you want, you could add that back in and compare gross margins on an 83%, 85 % range. As it falls to the bottom line, whether it's EBITDA margin, free cash flow margin, what does that look like? Are there any major cost buckets that eat into that?

52:03The main one to call out is the CapEx, which is naturally, again, a lot higher than a lot of software businesses. The CapEx has consistently been around 11 % to 14 % of revenue. That's going to bring your free cash flow margins down. And the free cash flow margins have been around 10 % in recent years. The long-term guidance, at least from management, is to expand those to over 25 % as operating leverage continues to expand. They'll get the majority of that off of the operational costs, labor, whatever it might be. Yeah. One big cost now is their sales and marketing costs. That's 35 % of revenue that has opportunity to come down and there's margin points available there as well.

52:47Capital allocation, with that in mind, it feels like a business that has reinvestment opportunities that would take up the majority of where that cash flow would go. Has that been kind of the policy and how do you think about how they allocate the capital that they do have and their history for capex spend and ROI in that capex? The capital allocation, it's a really important part of the business and they're very strategic about how they do it such that they get a really strong ROI on their capex. We spoke earlier about just using commodity hardware so that reduces the cost of the hardware. They often talk about investing behind the demand curve so they see where the traffic is and what the demand is before they build.

53:35They're not just building for no reason. What's really important to understand with their CapEx is that all of their servers can run all of their products and provide all of their services. So that means the CapEx and the ROI is split across all of their product lines across Act 1, 2, and 3. So the incremental ROI is more diversified and it's higher. So you're not building a separate network for each product. It's one network that can contribute to the return on each incremental CapEx spend. You've alluded a lot to legacy competition. Are there new competitors that are in the market? It does seem like a market that will only get more important over time.

54:21How do you frame the competition? And does anybody have large comparable market share similar to what Cloudflare has? In Act One, they've established themselves as a leader. Some of the legacy companies specialize in certain types of networks where there's media and things like that. So they're still important competitors, but Cloudflare has the biggest network that, as we mentioned, is very hard to catch up to. But in Act Two and Act Three, it's much more competitive there. I think Act Two is probably the most competitive because cybersecurity, there's always new players, there's always new trends.

54:58And importantly, Cloudflare isn't leading the innovation there like they did in Act 1, like they're a second mover. So Zscaler is probably the largest pure play, zero trust Act 2 competitor. And they also have a global network that they run and manage themselves. It's a decent time to bring up the outage, which I probably like really burying the lead in terms of recent activities and news. But just in terms of competition and what it could represent, can you walk through what exactly happened where I felt like, one, the entire internet was out on me to I learned just how many websites were connected to Cloudflare.

55:39So two important things came out of that, but maybe just an explanation of what happened. And then we can get into if there's any residual implications from it. The outage affected everyone. And it's one of the downsides of having a single global network is that it can all go down. And that's what happened. I think what's important to understand with that outage is that it wasn't an attack. It wasn't a security breach or anything like that. It was a process error. Basically, their bot management software that inspects all the traffic, it's a little machine learning model, so it has all these features.

56:14There was an upstream error that caused those features to double in size, and their servers just didn't have the memory for them. These features, they're updated constantly. Every five minutes, the model's getting updated with new threats. Every five minutes, a corrupted file is getting pushed out, and it broke a lot of their services. So everything went down. It's not dissimilar to, say, the CrowdStrike outage that happened in 2024, where it wasn't a security breach. It was a process error for something that was kind of very in the weeds. It caused all these outages. Everyone realized similarly how many businesses ran on CrowdStrike, but they've come back just as strong as ever because I think people realize, okay, it was a process error and they're clearly going to do something about it, which is exactly the case with Cloudflare.

57:01I think what the customers and community really appreciate with them is just how transparent they were. They wrote a very in-depth and transparent report day of the incident and having quite like an engineering forward customer base. I think that was just really appreciated. They've outlined process steps and updates they'll take to make sure something like that doesn't happen again. It's a little tough when it's the machine learning. You don't have a scapegoat if it's just the machine. I guess you do, but nobody in theory gets fired over that or maybe the person behind the machine learning who codes that all up, but noteworthy.

57:36And as it happened over history, I do think it's interesting with businesses, whether it's Moody's during the financial crisis, Equifax with security breaches, where if it doesn't kill them, it kind of proves the moat or strength of the business in many ways and to all different degrees. But have there been historical outages, maybe not as impactful as that one. And any signal to whether they have material impacts, whether short or long term on the business? There was one semi recently, it wasn't as big as the one that happened recently. But there was an outage. And this actually encouraged some internal transformation or accelerated some internal transformations.

58:18So I mentioned earlier that Cloudflare is built on Cloudflare, they build a lot of this proprietary software to run their systems for most of their systems, but not all of them. And this could include things like acquisitions or other things when they're scaling up new products, they might borrow something. And what happened in the previous outage was there was an issue with like a Google Cloud KV cache or like a small piece of the database, which flowed through some of their products and caused an outage. Again, wasn't a security breach as an error that happens. But what it did was they had an internal project to migrate off those third-party solutions and that just accelerated that so i guess it was not good but they kind of turned it into a strength to increase the robustness of their systems then i guess based on current growth numbers or more recent growth numbers hasn't been too impactful on the underlying business performance on competition it feels like Zscaler is one that shows up in multiple categories.

59:24So I put them there. In Act 3, you mentioned the hyperscalers, which I think are worthy competitors for anyone to deal with. But in terms of the competitive risks and threats, how high do you rate that on the risk spectrum? Is it something that concerns you sometimes in a growing market? If you have one of the leaders, you usually feel pretty good that even if things move slightly, it's not going to be too material. Just thinking about the competitive threats and how fragile their position is versus being very strong and only strengthening. My view is that it's a strengthening position. Say with Act 2, Zscaler has that incumbent advantage and that trust with very large enterprises.

1:00:11But it's a huge market and Cloudflare can, like their other products, start at the smaller end and work up to the enterprises. And they're starting to do that. What really benefits them is having that global network of all the products. They can use their Act 1 strength to prove their product, encourage adoption of their Act 2 products. One example of that would be, let's say you're using Zscaler for internal security. You send a request, it goes to Zscaler's machines, and then to a website. But that website is going to be likely using Cloudflare. So it ends up going to a Cloudflare server anyway, and then back.

1:00:48And so Cloudflare is in a really strong position. It's like, we're processing all of this traffic anyway. Why don't we process it on the way out as well as the way back in? And that will improve your latency. Another difference would be just on their peering networks. So it's very hard for another company to have all these partnerships with all these ISPs around the world. Zscaler took a different approach where they peered directly with the apps, which is great for dense cities, but in certain markets, it doesn't work as well. And maybe an example just to highlight some of these differences would be Canva.

1:01:25So thousands of employees around the world, Canva, the web design company, they employ a lot of contractors to help out with the design templates and things like that. And a lot of those contractors are based in Southeast Asia. Canva uses their Cloudflare Act 2 products to help with the access because Cloudflare uses what's called like an inline service. So you don't actually have to install an agent or anything onto the machine, which is really important when you're working with contractors. You can give these contractors access to all of the corporate apps that they need without having to have them install anything.

1:02:03because say a lot of these contractors are based in markets where other competitors won't have direct peering relationships. Cloudflare can say, look, we've been improving the speed of this area for years. These contractors can sign on, be secure and interact with your product with low latency. That's not going to slow anyone down. And that's a really strong value proposition that a lot of other companies can't speak to. Are there any other risks that really stand out to you just from a business perspective and the organization and some of the external factors sitting around it? Two risks to call out.

1:02:41One is that second move in the act two that we were just speaking about. They are playing a bit of a catch up, but there is a long runway to go and they're a solid contender there. So I think all the trajectory is very positive when you look at their product positioning, their channel partner growth and all that. But it's worth just calling out just because they are the second mover. The other risk to call out is just their AI inference strategy and AI in general, because it is new and it does slightly diverge a little from their previous strategy. So that always adds some risk there. Because I mentioned earlier that all of their other services can run on all hardware, whereas GPUs are specialized for inference.

1:03:24With the ROI of their other products, it was split across all of their services. But the ROI of the GPU component, that's just from the AI inference. So it's a more concentrated ROI risk. Also, there's a slight difference in how the AI inference product came about from their other products. A lot of their other products, they kind of emerged from what Cloudflare was doing internally. With the Act 3, they had to build these services themselves. They never planned on launching a developer product, but they saw the value on that and they released it. Similarly with Act 2, they saw that during the day, not many people are on websites, they're underutilized servers, so they could work with corporate security that was used during the day.

1:04:12And then during the night, there's all their website security. So they kind of saw these opportunities and built for them and lent into them. Whereas AI inference, I think they just saw the importance of the market and decided to go after it. It's still that single global network, but there is a bit of topspin of difference in strategy versus their other product launches. That's worth calling out. Thank you for calling that out. I do want to get your general framework for valuation. I find software businesses, heaven forbid, 75 % to 80 % gross margins relative to the 90 % that some of these software businesses post.

1:04:49But how does the market approach it? How do you think about valuation? And just anything that you would comment on that topic would be useful of the year? It's no secret that Cloudflare is a highly valued company. I think at the start of the year, they were 25 times the next 12 month revenue, which is one of the highest in the industry. From my perspective, I love Michelle and Matt as the operators of Cloudflare. But valuation, it's always a constant battle, even though it's such an impressive company. And importantly as well, it's a capital intensive business. So the free cashflow margins and earnings will start to matter more and more in, say, five years time.

1:05:28And they'll likely have lower free cash flow margins than what we've seen in best-in-class software. But I think what gives confidence the bull case for Cloudflare is that there's numerous growth levers that can support sustained high growth. And they've sustained it in that 29%, 30 % or higher range. and the markets that they operate in have a lot of runway and they're continually adding products and features that support that sustained high growth rate. So that's a distinguishing factor for them. But to get comfortable with the valuation, you have to model out two things. You have to model out the act two, how quickly they can catch up and perhaps surpass the incumbents in that space.

1:06:13And the trajectory is very solid there. But also you need to model out what the Act 3 scenarios could look like. Like how important will they be for AI inference? How big will the inference market be? We believe that it can be a very large business and you have to believe that. And just quickly on margin structure, sales and marketing, 35 % of revenue today, there is room for operating leverage. They've guided to 25 % free cash and margins plus. We think they can exceed that. So then you can model that out over the years and still make money on the stock. But it's important to call out that there's effectively no margin for execution error.

1:06:55It's priced for pretty flawless execution, which they've done, but you just have to build confidence that'll continue. Well, I was a very intellectually honest approach to it. a 25 times sales. I saw the SpaceX IPO headlines today, which implied I think 100 times sales. It's all relative in this market. Yeah, it makes it look cheap. Yeah. Yeah, exactly. And the growth number on revenue, they must be sandbagging because it wasn't that material from you to hear. Nonetheless, this has been fascinating. I really tried to scrape out as much on the technology. So thank you for keeping up with that. We like to talk about the lessons that you could take away, maybe bring it up a notch to think about frameworks and pattern recognition.

1:07:37What would you point to from Cloudflare that really stands out? There's a few lessons from Cloudflare that I think can be applied generally. I'll call out four quick ones. So number one, I think founder-led companies is very important for companies to have that founder-led vision. It can be very powerful for setting that long-term strategy and setting polled visions and sticking to the company mission. SquarePeg's origins are Whereas a VC fund and then the global tech fund listed strategy, we still look for that founder DNA. And Matthew Prince is a great example of that. The second general lesson would just be looking for product simplicity, particularly for complicated industries to the extent they can serve the whole long tail of the internet, despite having a very sophisticated technical infrastructure that sets them up really well.

1:08:27And it's a really positive signal. applying that elsewhere. I think that applies to Snowflake as well. They have a very powerful engine under the hood. It's very hard to replicate. But when you look at the product, it's a very simple query interface. It's very easy to use and adopt. And similar with Datadog, very easy to get started and set up. But it's powerful enough and flexible enough to work with the world's largest companies as well as the world's smallest companies. So that looking for that product simplicity, yet flexibility and power is really important. Number three would just be looking for multiple levers of growth.

1:09:00So great companies, they're multiple levers of growth and they find ways to solve more problems for more customers over time. Cloudflare, great example of that. They've expanded their product lines, expanded the customer archetypes within each market and have done so in markets that all have tailwinds, particularly for AI. Fourth lesson would be that CapEx in software can be okay, provided that it has that very high ROI that CapEx is used to build that defensibility for their business. Talked a lot about that earlier with that reinforcing cycle. It creates a moat that's very hard to replicate.

1:09:39And because they're stacking layers on top of that hardware, you can extract a lot of ROI from each individual purchase there. Those lessons, they fit very cleanly into what SquarePeg looks for. We have a framework around theme, team, model, and moat. In Cloudflare, they sit at the center of a critical theme in managing networks for speed, efficiency, and trust, particularly in the era of AI. The team, they're hungry, is founder-led, very focused, and they can attract and retain some of the best talent in the world. I think it's an underappreciated, high-quality business model. So they can stack multiple revenue lines on top of their core capability.

1:10:21and all of these levers have that long duration that we look for. And finally, Moat. Cloudflare, it's a business that gets better as it gets bigger. And that's really important. They use their scale to enhance their differentiation and create barriers to entry as well. CapEx can be okay is a good lesson. I think AI certainly has shifted the narrative in terms of the willingness to accept high CapEx companies out there in the market. Assuming that they're creating bearish entry. We can debate where that falls in line for companies and whether that's true or not. But this has been fascinating. Sam, I appreciate you sharing all of the knowledge, getting into the nitty gritty details here, giving me a better appreciation of all that's happening on the internet behind the scenes.

1:11:07So I appreciate you joining us. Thank you. This has been a lot of fun. To find more episodes of Breakdowns ranging from Costco to Visa to Moderna, or to sign up for our weekly summary, check out joincolossus.com. That's J-O-I-N-C-O-L-O-S-S-U-S dot com.