Business Breakdowns
· Matt Reustle
[00:00:00] S0: I've seen a lot of references to this in terms of a kind of a growth engine, but how would you articulate what's going on there? I think it's clear once it's articulated, but describe that for the audience.
· Sam Eden
[00:00:00] S1: If you think about the services I've just explained, it's Cloudflare intercepting outside traffic for a website. What they realized is that, "We have all this hardware. Why don't we intercept and inspect traffic that goes from a company to the outside world?" It's basically the other way. This is a reverse proxy and a forward proxy, and they use the same hardware for that. So, if you think of a reverse proxy as protecting a website from the public internet, a forward proxy server – which is their whole security products – is protecting an employee from the outside internet. It protects you when you have outbound traffic. This is the basis of the whole product suite. It's often termed zero trust. That's a type of approach that you can provide these internal security products. Zero trust means there's zero trust between any app and any user. So if you contrast that to old services, maybe you log into your corporate network. You gain trust once and then you're within your private network. Zero trust just means just because you could access app number one, doesn't mean you can access app number two. You have zero trust between the apps. You have to get validated each time. To do that, that means you have to get inspected each time. All of your web requests have to get inspected each time. And that looks a lot like their original services because they're very, very good at inspecting every single packet. So they realized that they could apply their commodity hardware. They didn't have to change anything. They just added a software layer to provide this whole new market of internal corporate cybersecurity.
· Matt Reustle, Sam Eden
[00:00:00] S0: If I'm thinking about that as an internal employee, would that be if I'm logged in and I click on a link that goes to a website, it's giving me the alert that this looks unsafe. Does it extend beyond that in terms of phishing emails and scams? Curious to know who's doing what in the chain of constant precautions that I'm being told? [00:00:00] S1: Anytime you're doing something on the internet in a work context, that's this whole space. And Cloudflare has a solution to that. It's a very broad market, there's a lot of competitors in here. There's probably three buckets of activity that an employee will commonly take that you need to protect. One would be you're on your work laptop or your work network and you're visiting an outside public website. And you want to make sure that the traffic going in and out of your work environment to the public internet is safe and secure. The second type would be you're working just with your internal apps. You're checking Salesforce, you're checking ServiceNow, things like that. So you need to make sure that you're actually approved – and this is that zero trust – approved to view each app. And then maybe there's different policies on what you can view. And then the third bucket is, I guess, all the adjacent things with that. The email security is one, protecting against phishing attacks and things like that.
· Matt Reustle
[00:00:00] S0: I've definitely experienced where being on-prem, I can use certain apps even, but once I'm off-prem, I'm mobile or on my own device, there are certain restrictions on what I can access. For good reason. I have some sense of how they've evolved pretty naturally from being that external third-party guard dog of sorts to also protecting from the inside. Would you point to anything else just in terms of the evolution or what they've rolled out that was key or monumental in terms of the development of the overall business and what they offered?
· Sam Eden
[00:00:00] S1: This is a continual evolution that all companies are going through is – your corporate environment used to just be your on-prem network, but now everything's cloud-based. You can work from home. You can work from anywhere. The corporate perimeter or security perimeter is effectively the whole internet. That's why they can fit nicely in there and provide those services. They realized that with their hardware system and their single global network, they could expand from web services to corporate security. The way they did that was building a lot of the software themselves. To be able to provide these services at a global scale, they often had to build a lot of their own software. They couldn't rely on AWS, for example. No one else could handle their scale, and they wanted to have really strong security. What that meant is they have this proprietary software stack. That leads to their next product evolution, where they realized that if you can build Cloudflare using these internal tools that we've built ourselves, then other developers will be able to build really powerful products with these tools as well. So they started offering these services to the developer market. So these include things like cloud storage, lightweight databases, video services, and their flagship product in this – what's called Act 3 – is the Cloudflare Workers. So that's a serverless function service. And they specialize in lightweight containers, lightweight functions that can be spun up and spun down really quickly to solve bite-sized tasks.
· Matt Reustle, Sam Eden
[00:00:00] S0: And are these developers working within corporations where what Cloudflare is building off the shelf needs to be maybe expanded upon and they're incorporating it there? Or is it separate from the enterprise corporate type clients and it's developers that are building some unique product and then selling it themselves to a different audience? [00:00:00] S1: It's currently quite separate. You don't have to use these products together. You can just be a developer building a weekend hobby project and you want to use the Cloudflare serverless functions. That's a totally valid use case. They're working to bring the products together into a more unified experience, but they don't need to be. You can use these Cloudflare developer products on anything really. [00:00:00] S0: The developers, I assume, are then paying Cloudflare some software costs to use that?