Business Breakdowns
· Sam Eden, Matt Reustle
That means you don't have to pay those transfer fees. I'll serve the content directly." And that ISP situation has gone from a lose-lose, kind of cost and slow internet – to a win-win because they don't have to pay those transfer fees and the internet just sped up. So Cloudflare can negotiate this relationship and often doesn't have to pay bandwidth fees. [00:00:00] S0: Is the ISP the loser in that case?
· Sam Eden
[00:00:00] S1: I would say it's a win-win situation because without Cloudflare, they have to pay the cost of connecting to other networks. So it's a cost for the ISP. If you think about your own internet experience – if your internet's slow, you don't blame the fact that the server is on the other side of the world or anything like that. You blame your internet service provider. By partnering with Cloudflare, they cut out those costs – because they just serve it from Cloudflare. And they can speed up their internet so their customers are happier. They partner with all these ISPs across the world. And one way that I like to visualize Cloudflare is they have this single global network that spans across the world. It's a single web, and that connects to all these sub-networks, all the ISPs. And today their single global network connects to over 13,000 different networks directly. And these sub-networks could be ISPs, they could be cloud providers, they could be corporate networks, but they connect them all together in this one connectivity layer. Now we're ready to piece this all together. I think this is the most important part of the Cloudflare business. So if you put this history together, it creates a reinforcing loop. So I'll try and help you visualize it that at the top of the cycle, we talked about their low bandwidth and low hardware costs. And they're easy-to-use products that enables this product-led growth motion, so they can serve that long tail of customers. What that enables is more traffic goes through their servers. So they collect more signals, they collect more data, and then they get better and better at blocking malicious actors. They get better at optimizing the network for speed and just providing better website services. And better services – which is halfway around the cycle now – that leads to more paying customers and more enterprise customers, which again brings in more traffic. And then as they get more traffic, they can negotiate even more with these ISPs to reduce their bandwidth fees further, create more peering relationships that brings their costs down further. And then they can reinvest that revenue and cost saving back into their global network, create more products, continually building out. And the cycle continues – they attract more of that long tail, collect more data, build out their network.
· Sam Eden, Matt Reustle
This network gets better as it gets bigger. We often look for businesses that follow this characteristic. Because they've been doing this for over 15 years, it's an incredibly difficult system to replicate, and it's a really important part of their moat. So that's how they can continually offer these freemium services while processing over 20% of the world's traffic. And it's just a powerful reinforcing loop that gets stronger and stronger. [00:00:00] S0: In terms of controlling that volume that puts you in a better position from a negotiating perspective, you can bring down costs in a lot of ways. But for a business like this, which is trying to detect certain things and optimize certain things, you get better in terms of what you're offering, if done right. On the evolutions that occurred over that period, I'm really curious too, just in terms of when they hit a point of evolving into the commercial operations, what that looked like, how challenging that might have been. And then some of the products that have been layered on since then, because it definitely has evolved into a full suite of things that are very complimentary. But how did that pace out together?
· Sam Eden
[00:00:00] S1: The Cloudflare we just described looked very different to the Cloudflare of today in terms of their product suite. The main product evolutions have been going from that product-led growth to enterprise, and then using that single global network to add services. So they've added a lot of internal cybersecurity products, and then a whole developer platform on them. We can go through each of those. The first one is just that transition from serving this long tail only of freemium customers to serving the biggest websites in the world. And it follows that same loop. The more data they collected, the more they could build out the network. It reached a tipping point where now their capacity and their services were better than the legacy companies. Their capacity to absorb, say, cyberattacks or those DDoS attacks is just unmatched. And a recent example they gave in one of their earnings calls is they won over a large customer because their DDoS protection capacity was over four times the two legacy competitors combined. It was over 30 terabytes per second that they just easily absorbed because they'd continually built out this network. So they can serve the long tail and now these high willingness-to-pay enterprise customers. That's one product evolution within their original product set. They're able to evolve just from those web security products, to this whole new market of internal cybersecurity.
· Matt Reustle
[00:00:00] S0: I've seen a lot of references to this in terms of a kind of a growth engine, but how would you articulate what's going on there? I think it's clear once it's articulated, but describe that for the audience.
· Sam Eden
[00:00:00] S1: If you think about the services I've just explained, it's Cloudflare intercepting outside traffic for a website. What they realized is that, "We have all this hardware. Why don't we intercept and inspect traffic that goes from a company to the outside world?" It's basically the other way. This is a reverse proxy and a forward proxy, and they use the same hardware for that. So, if you think of a reverse proxy as protecting a website from the public internet, a forward proxy server – which is their whole security products – is protecting an employee from the outside internet. It protects you when you have outbound traffic. This is the basis of the whole product suite. It's often termed zero trust. That's a type of approach that you can provide these internal security products. Zero trust means there's zero trust between any app and any user. So if you contrast that to old services, maybe you log into your corporate network. You gain trust once and then you're within your private network. Zero trust just means just because you could access app number one, doesn't mean you can access app number two. You have zero trust between the apps. You have to get validated each time. To do that, that means you have to get inspected each time. All of your web requests have to get inspected each time. And that looks a lot like their original services because they're very, very good at inspecting every single packet. So they realized that they could apply their commodity hardware. They didn't have to change anything. They just added a software layer to provide this whole new market of internal corporate cybersecurity.