Business Breakdowns
· Matt Reustle
[00:00:00] S0: This is Matt Reustle, and today we are breaking down the cybersecurity giant, Cloudflare. Today, Cloudflare controls over 20% of the world’s web traffic. And to me, an equally notable metric is that Cloudflare absorbs 2.5 million cyber attacks per second. My guest for this episode is Sam Eden, investor at Square Peg’s Global Tech fund. And while I could understand on the surface what Cloudflare does, Sam really helped me get into the weeds on how the digital pipes actually work. So we go through the rise of Cloudflare and how they built a differentiated product and evolved that over time, versus incumbents and fellow upstarts in what is obviously an in-demand market. And through this story, Sam gets into the product offerings that led to Cloudflare’s leading market share, some of the new evolutions, and what that might mean for growth looking forward, and how to conceptualize that and break it down through the various buckets. So if you have any interest in better understanding the world of cybersecurity, you will enjoy this episode. Alright Sam, I am excited to have you here to break down Cloudflare. It is a tech company that I think is obviously understood by tech investors. Generalists maybe have a more high-level understanding. And I think the population at large probably has very little understanding of what's going on. We're going to do our best to get that understanding before we get into the overall business and what it looks like today. Just to start there, how would you describe, explain, paint a picture of what Cloudflare does as a business and as a technology for its customers?
· Sam Eden
[00:00:00] S1: Cloudflare has many different products, and we'll get to these throughout this conversation. But the most common one, and it's what they started with, is their application services and their website services. Cloudflare provides speed and security for your website. Their customers are companies with a website. This could be your weekend hobby project, or it could be some of the largest companies in the world, with some of the most trafficked websites in the world. So if you run a website, it has a public URL, so anyone can visit it. But that also means that anyone can attack it. So Cloudflare provides security to prevent these spam attacks. These are known as DDoS attacks that basically try to overload your servers. Hackers will try and intercept and manipulate internet traffic. Cloudflare will protect you from that, and it prevents bots from scraping a website. That probably sounded a little technical. So maybe an analogy for these internet services I like to think of is a postal service. Let's say you run a website, which in this analogy would be, say, a warehouse that ships out products. So you'll get in mail orders from all over the world. This would be your internet requests. In this analogy, Cloudflare would be a sorting factory that intercepts all of your mail. They'll block junk mail for you. They'll block organized spam mail attacks that might try to clog up your mailbox. They'll scan all incoming boxes to make sure there's nothing malicious coming in. So this is all their application security. They extend this further. So in this analogy, they'll also help you set up local warehouses to reduce international shipping. They'll create dedicated fast freeways for postal services. They can speed up the whole postal network. So they provide all these things to make your website fast and secure.
· Matt Reustle, Sam Eden
[00:00:00] S0: You're proving to me that I use the internet quite a bit, but don't fully appreciate all that's going on behind the scenes when I'm clicking around and ordering things and whatnot. One of their customers is Shopify. Can you just give a relatable example of what it would look like for Cloudflare helping out Shopify? The speed portion makes a lot of sense in terms of making sure that they can run on optimized speed. But from a security perspective, what might that look like in a scenario? [00:00:00] S1: For Shopify, they have millions of merchant storefronts. From the security point, let's say a massive botnet, they attack a specific store. Let's say it's during Black Friday. Without Cloudflare, that merchant's servers, they’re just going to get overloaded. The website would go down and they can't make any sales. But with Cloudflare, they're going to absorb that traffic at the edge. The website is protected and it can stay online. That's really important for these e-commerce companies because if your website's down, well, you're not making any revenue. [00:00:00] S0: It's a time-is-money type thing anytime there's an outage or things go down. Before we get into some of the history, can you just give me a sense of how big Cloudflare is today, just in terms of any numbers that would capture the size and impact that they have in the market?
· Matt Reustle, Sam Eden
[00:00:00] S0: It's a time-is-money type thing anytime there's an outage or things go down. Before we get into some of the history, can you just give me a sense of how big Cloudflare is today, just in terms of any numbers that would capture the size and impact that they have in the market? [00:00:00] S1: Cloudflare is huge. And when you think about the scale of the internet, it's sometimes hard to wrap your head around. But Cloudflare, you can think of as a single global private network that runs all this traffic. And over 20% of the world's web runs through Cloudflare's servers. So that's the scale that we're talking about. And in terms of cyberattacks, an average of over 2.5 million cyberattacks every single second is absorbed and blocked by the Cloudflare network. [00:00:00] S0: 2.5 million cyberattacks per second is somewhat frightening to me that that's happening. [00:00:00] S1: Totally. [00:00:00] S0: Let's get into the history here because I know it has evolved quite a bit over the years and you don't get to that 20% without evolution. What's the founding story? Obviously, it wasn't around before the internet. But tell me a bit about the founding story, founding team and some of those key moments in the history.
· Sam Eden
[00:00:00] S1: It's really important to understand the history of Cloudflare because if you can understand why they were successful in the start and how they got their initial foothold in the market, all of their new products build on top of that. So if you understand the history, then you can understand all of their new products. Cloudflare, they were founded in 2009 by Matthew Prince, Michelle Zatlyn, and Lee Holloway. They now have over $2 billion in revenue. One thing to always remember about the internet is that everything still runs on physical hardware. So there's cables that actually run across the oceans. They run through mountains and they physically connect server boxes that intercept and process all this internet traffic. Before Cloudflare was founded, let's use an example of someone based in New York. They want to visit a website in Australia. So to do that, you send a request all the way from New York to Australia. They process that and then send it all the way back through a cable across the Pacific Ocean back to the server. So that's slow. And it also costs your ISP, your internet service provider, some money because they have to pay some transfer fees to work with other ISPs across the world. So this is a bit of a lose-lose situation for the ISP. They have to pay transfer fees and it's a bad and slow customer experience. This is still before Cloudflare. Some of the early legacy companies, let's say Akamai – they provide what's called a CDN, Content Delivery Network. The Australian website can pay Akamai to store images or some of the other website assets in a server in New York. Anytime someone in New York visits the same Australian website, it's just pulling the data from New York across the city much faster. One thing that's important to understand because it sets up Cloudflare well, is that these legacy companies like Akamai – they split the network. Customers have to decide what to put on their CDN network and what to handle directly. To set this up, you need a sales engineer. It's a complex implementation. There's a lot of ongoing maintenance. And then if you buy a different service, then you have to administer that and set up a whole different network and decide what to get redirected where. Also, this website in Australia, for example, might want to only serve valid requests.
· Sam Eden, Matt Reustle
So they actually have to buy a physical firewall to intercept and check this traffic. All these services, they're what's called reverse proxies, which basically means they just intercept incoming traffic on behalf of the website. And that's part of the security piece that we talked about earlier. So that's the lay of the land before Cloudflare. This was all very difficult. It needed those sales engineers. This was only really accessible for larger enterprises and more sophisticated websites. And these legacy vendors didn't have a solution for the long tail of websites that Cloudflare started serving. If we want to just relate this back to the postal example, this legacy setup would be if that website in Australia – they would have to inform all of the different postal routing services all over the world. They'd have to tell them their different split rules. If the mail is directed to this department, use this address. If it's directed to this department, use this address. If it's a package, use this address. And that takes maintenance because if your rules change, you have to update that and it's a lot of work. That's a bit of a history of the pre-Cloudflare time. [00:00:00] S0: Feels very manually intensive and a bit of a traveling salesman problem in terms of optimizing for where things go.