Business Breakdowns
· Matt Reustle, Sam Eden
[00:00:00] S0: Putting it all together on a margin, however you would look at this, what do margins look like for Cloudflare? [00:00:00] S1: They're a software business, so their non-GAAP gross margins are about 75% to 78%. This looks lower than maybe a top-performing software business that you'd expect to see. But you have to keep in mind that they own and operate their own physical infrastructure, and the depreciation of this equipment is included in the reported cost of goods sold. That naturally compresses their gross margin. If you did want to try to look at a cash-based gross margin to compare apples to apples, about 6% of their revenue is depreciation directly tied to equipment. So if you want, you could add that back in and compare gross margins on an 83%, 85% range. [00:00:00] S0: As it falls to the bottom line, whether it's EBITDA margin, free cash flow margin, what does that look like? Are there any major cost buckets that eat into that? [00:00:00] S1: The main one to call out is their CapEx, which is naturally a lot higher than a lot of software businesses. The CapEx has consistently been around 11% to 14% of revenue. That's going to bring your free cash flow margins down. And the free cash flow margins have been around 10% in recent years. The long-term guidance, at least from management, is to expand those to over 25% as operating leverage continues to expand. [00:00:00] S0: They'll get the majority of that off of the operational costs, labor, whatever it might be.
· Matt Reustle, Sam Eden
[00:00:00] S0: They'll get the majority of that off of the operational costs, labor, whatever it might be. [00:00:00] S1: Yeah. One big cost now is their sales and marketing costs. That's 35% of revenue. That has opportunity to come down and there's margin points available there as well. [00:00:00] S0: Capital allocation, with that in mind, it feels like a business that has reinvestment opportunities that would take up the majority of where that cash flow would go. Has that been kind of the policy? And how do you think about how they allocate the capital that they do have and their history for CapEx spend and ROI on that CapEx? [00:00:00] S1: The capital allocation, it's a really important part of the business. And they're very strategic about how they do it, such that they get a really strong ROI on their CapEx. We spoke earlier about just using commodity hardware, so that reduces the cost of the hardware. They often talk about investing behind the demand curve. So they see where the traffic is and what the demand is before they build. They're not just building for no reason. What's really important to understand with their CapEx is that all of their servers can run all of their products and provide all of their services. So that means the CapEx and the ROI is split across all of their product lines across Acts 1, 2, and 3. So the incremental ROI is more diversified and it's higher. So you're not building a separate network for each product. It's one network that can contribute to the return on each incremental CapEx spend.
· Sam Eden, Matt Reustle
[00:00:00] S1: The capital allocation, it's a really important part of the business. And they're very strategic about how they do it, such that they get a really strong ROI on their CapEx. We spoke earlier about just using commodity hardware, so that reduces the cost of the hardware. They often talk about investing behind the demand curve. So they see where the traffic is and what the demand is before they build. They're not just building for no reason. What's really important to understand with their CapEx is that all of their servers can run all of their products and provide all of their services. So that means the CapEx and the ROI is split across all of their product lines across Acts 1, 2, and 3. So the incremental ROI is more diversified and it's higher. So you're not building a separate network for each product. It's one network that can contribute to the return on each incremental CapEx spend. [00:00:00] S0: You've alluded a lot to legacy competition. Are there new competitors that are in the market? It does seem like a market that will only get more important over time. How do you frame the competition and does anybody have large comparable market share similar to what Cloudflare has?
· Matt Reustle, Sam Eden
[00:00:00] S0: You've alluded a lot to legacy competition. Are there new competitors that are in the market? It does seem like a market that will only get more important over time. How do you frame the competition and does anybody have large comparable market share similar to what Cloudflare has? [00:00:00] S1: In Act 1, they've established themselves as a leader. Some of the legacy companies specialize in certain types of networks, whether it’s media or things like that. So there’s still important competitors, but Cloudflare has the biggest network that, as we mentioned, is very hard to catch up to. But in Act 2 and Act 3, it's much more competitive there. I think Act 2 is probably the most competitive because cybersecurity – there's always new players, there's always new trends. And importantly, Cloudflare isn't leading the innovation there like they did in Act 1. They're a second mover. So Zscaler is probably the largest pure-play zero trust Act 2 competitor, and they also have a global network that they run and manage themselves.
· Sam Eden, Matt Reustle
[00:00:00] S1: In Act 1, they've established themselves as a leader. Some of the legacy companies specialize in certain types of networks, whether it’s media or things like that. So there’s still important competitors, but Cloudflare has the biggest network that, as we mentioned, is very hard to catch up to. But in Act 2 and Act 3, it's much more competitive there. I think Act 2 is probably the most competitive because cybersecurity – there's always new players, there's always new trends. And importantly, Cloudflare isn't leading the innovation there like they did in Act 1. They're a second mover. So Zscaler is probably the largest pure-play zero trust Act 2 competitor, and they also have a global network that they run and manage themselves. [00:00:00] S0: It's a decent time to bring up the outage, which I probably like really burying the lede in terms of recent activities and news. But just in terms of competition and what it could represent, can you walk through what exactly happened where I felt like – one, the entire internet was out on me. Two, I learned just how many websites were connected to Cloudflare. So two important things came out of that. But maybe just an explanation of what happened. And then we can get into if there's any residual implications from it.
· Sam Eden
[00:00:00] S1: The outage affected everyone. And I guess one of the downsides of having a single global network is that it can all go down. And that's what happened. I think what's important to understand with that outage is that it wasn't an attack. It wasn't a security breach or anything like that. It was a process error. Basically, their bot management software that inspects all of the traffic – it's a little machine learning model, so it has all these features. There was an upstream error that caused those features to double in size. And their servers just didn't have the memory for them. These features, they're updated constantly – every five minutes, the model's getting updated with new threats. Every five minutes, a corrupted file was getting pushed out, and it broke a lot of their services. So everything went down. It's not dissimilar to, say, the CrowdStrike outage that happened in 2024, where it wasn't a security breach. It was a process error for something that was kind of very in the weeds. It caused all these outages. Everyone realized similarly how many businesses ran on CrowdStrike. But they've come back just as strong as ever because I think people realize, okay, it was a process error, and they're clearly going to do something about it, which is exactly the case with Cloudflare. I think what the customers and community really appreciate with them is just how transparent they were. They wrote a very in-depth and transparent report, day of the incident. And having quite an engineering-forward customer base, I think that was just really appreciated. They've outlined process steps and updates they'll take to make sure something like that doesn't happen again.