Business Breakdowns
· Sam Eden, Matt Reustle
This network gets better as it gets bigger. We often look for businesses that follow this characteristic. Because they've been doing this for over 15 years, it's an incredibly difficult system to replicate, and it's a really important part of their moat. So that's how they can continually offer these freemium services while processing over 20% of the world's traffic. And it's just a powerful reinforcing loop that gets stronger and stronger. [00:00:00] S0: In terms of controlling that volume that puts you in a better position from a negotiating perspective, you can bring down costs in a lot of ways. But for a business like this, which is trying to detect certain things and optimize certain things, you get better in terms of what you're offering, if done right. On the evolutions that occurred over that period, I'm really curious too, just in terms of when they hit a point of evolving into the commercial operations, what that looked like, how challenging that might have been. And then some of the products that have been layered on since then, because it definitely has evolved into a full suite of things that are very complimentary. But how did that pace out together?
· Sam Eden
[00:00:00] S1: The Cloudflare we just described looked very different to the Cloudflare of today in terms of their product suite. The main product evolutions have been going from that product-led growth to enterprise, and then using that single global network to add services. So they've added a lot of internal cybersecurity products, and then a whole developer platform on them. We can go through each of those. The first one is just that transition from serving this long tail only of freemium customers to serving the biggest websites in the world. And it follows that same loop. The more data they collected, the more they could build out the network. It reached a tipping point where now their capacity and their services were better than the legacy companies. Their capacity to absorb, say, cyberattacks or those DDoS attacks is just unmatched. And a recent example they gave in one of their earnings calls is they won over a large customer because their DDoS protection capacity was over four times the two legacy competitors combined. It was over 30 terabytes per second that they just easily absorbed because they'd continually built out this network. So they can serve the long tail and now these high willingness-to-pay enterprise customers. That's one product evolution within their original product set. They're able to evolve just from those web security products, to this whole new market of internal cybersecurity.
· Matt Reustle
[00:00:00] S0: I've seen a lot of references to this in terms of a kind of a growth engine, but how would you articulate what's going on there? I think it's clear once it's articulated, but describe that for the audience.
· Sam Eden
[00:00:00] S1: If you think about the services I've just explained, it's Cloudflare intercepting outside traffic for a website. What they realized is that, "We have all this hardware. Why don't we intercept and inspect traffic that goes from a company to the outside world?" It's basically the other way. This is a reverse proxy and a forward proxy, and they use the same hardware for that. So, if you think of a reverse proxy as protecting a website from the public internet, a forward proxy server – which is their whole security products – is protecting an employee from the outside internet. It protects you when you have outbound traffic. This is the basis of the whole product suite. It's often termed zero trust. That's a type of approach that you can provide these internal security products. Zero trust means there's zero trust between any app and any user. So if you contrast that to old services, maybe you log into your corporate network. You gain trust once and then you're within your private network. Zero trust just means just because you could access app number one, doesn't mean you can access app number two. You have zero trust between the apps. You have to get validated each time. To do that, that means you have to get inspected each time. All of your web requests have to get inspected each time. And that looks a lot like their original services because they're very, very good at inspecting every single packet. So they realized that they could apply their commodity hardware. They didn't have to change anything. They just added a software layer to provide this whole new market of internal corporate cybersecurity.
· Matt Reustle, Sam Eden
[00:00:00] S0: If I'm thinking about that as an internal employee, would that be if I'm logged in and I click on a link that goes to a website, it's giving me the alert that this looks unsafe. Does it extend beyond that in terms of phishing emails and scams? Curious to know who's doing what in the chain of constant precautions that I'm being told? [00:00:00] S1: Anytime you're doing something on the internet in a work context, that's this whole space. And Cloudflare has a solution to that. It's a very broad market, there's a lot of competitors in here. There's probably three buckets of activity that an employee will commonly take that you need to protect. One would be you're on your work laptop or your work network and you're visiting an outside public website. And you want to make sure that the traffic going in and out of your work environment to the public internet is safe and secure. The second type would be you're working just with your internal apps. You're checking Salesforce, you're checking ServiceNow, things like that. So you need to make sure that you're actually approved – and this is that zero trust – approved to view each app. And then maybe there's different policies on what you can view. And then the third bucket is, I guess, all the adjacent things with that. The email security is one, protecting against phishing attacks and things like that.
· Matt Reustle
[00:00:00] S0: I've definitely experienced where being on-prem, I can use certain apps even, but once I'm off-prem, I'm mobile or on my own device, there are certain restrictions on what I can access. For good reason. I have some sense of how they've evolved pretty naturally from being that external third-party guard dog of sorts to also protecting from the inside. Would you point to anything else just in terms of the evolution or what they've rolled out that was key or monumental in terms of the development of the overall business and what they offered?