Business Breakdowns
· Matt Reustle, Sam Eden
[00:00:00] S0: You've alluded a lot to legacy competition. Are there new competitors that are in the market? It does seem like a market that will only get more important over time. How do you frame the competition and does anybody have large comparable market share similar to what Cloudflare has? [00:00:00] S1: In Act 1, they've established themselves as a leader. Some of the legacy companies specialize in certain types of networks, whether it’s media or things like that. So there’s still important competitors, but Cloudflare has the biggest network that, as we mentioned, is very hard to catch up to. But in Act 2 and Act 3, it's much more competitive there. I think Act 2 is probably the most competitive because cybersecurity – there's always new players, there's always new trends. And importantly, Cloudflare isn't leading the innovation there like they did in Act 1. They're a second mover. So Zscaler is probably the largest pure-play zero trust Act 2 competitor, and they also have a global network that they run and manage themselves.
· Sam Eden, Matt Reustle
[00:00:00] S1: In Act 1, they've established themselves as a leader. Some of the legacy companies specialize in certain types of networks, whether it’s media or things like that. So there’s still important competitors, but Cloudflare has the biggest network that, as we mentioned, is very hard to catch up to. But in Act 2 and Act 3, it's much more competitive there. I think Act 2 is probably the most competitive because cybersecurity – there's always new players, there's always new trends. And importantly, Cloudflare isn't leading the innovation there like they did in Act 1. They're a second mover. So Zscaler is probably the largest pure-play zero trust Act 2 competitor, and they also have a global network that they run and manage themselves. [00:00:00] S0: It's a decent time to bring up the outage, which I probably like really burying the lede in terms of recent activities and news. But just in terms of competition and what it could represent, can you walk through what exactly happened where I felt like – one, the entire internet was out on me. Two, I learned just how many websites were connected to Cloudflare. So two important things came out of that. But maybe just an explanation of what happened. And then we can get into if there's any residual implications from it.
· Sam Eden
[00:00:00] S1: The outage affected everyone. And I guess one of the downsides of having a single global network is that it can all go down. And that's what happened. I think what's important to understand with that outage is that it wasn't an attack. It wasn't a security breach or anything like that. It was a process error. Basically, their bot management software that inspects all of the traffic – it's a little machine learning model, so it has all these features. There was an upstream error that caused those features to double in size. And their servers just didn't have the memory for them. These features, they're updated constantly – every five minutes, the model's getting updated with new threats. Every five minutes, a corrupted file was getting pushed out, and it broke a lot of their services. So everything went down. It's not dissimilar to, say, the CrowdStrike outage that happened in 2024, where it wasn't a security breach. It was a process error for something that was kind of very in the weeds. It caused all these outages. Everyone realized similarly how many businesses ran on CrowdStrike. But they've come back just as strong as ever because I think people realize, okay, it was a process error, and they're clearly going to do something about it, which is exactly the case with Cloudflare. I think what the customers and community really appreciate with them is just how transparent they were. They wrote a very in-depth and transparent report, day of the incident. And having quite an engineering-forward customer base, I think that was just really appreciated. They've outlined process steps and updates they'll take to make sure something like that doesn't happen again.
· Matt Reustle
[00:00:00] S0: It's a little tough when it's the machine learning. You don't have a scapegoat if it's just the machine. I guess you do. But nobody, in theory, gets fired over that. Or maybe the person behind the machine learning who codes that all up. But noteworthy. And as it happened over history, I do think it's interesting with businesses, whether it's Moody's during the financial crisis, Equifax with security breaches – where if it doesn't kill them, it kind of proves the moat or strength of the business in many ways and to all different degrees. But have there been historical outages, maybe not as impactful as that one? And any signal to whether they have material impacts, whether short or long term on the business?
· Sam Eden
[00:00:00] S1: There was one semi-recently. It wasn't as big as the one that happened recently. But there was an outage. And this actually encouraged some internal transformation or accelerated some internal transformations. So I mentioned earlier that Cloudflare is built on Cloudflare. They build a lot of this proprietary software to run their systems – for most of their systems, but not all of them. And this could include things like acquisitions or other things. When they're scaling up new products, they might borrow something. And what happened in the previous outage was there was an issue with a Google Cloud KV cache, like a small piece of the database, which flowed through some of their products and caused an outage. Again, it wasn't a security breach, it was just an error that happens. But what it did was they had an internal project to migrate off those third-party solutions. And that just accelerated that. So I guess it was not good, but they kind of turned it into a strength to increase the robustness of their systems.
· Matt Reustle
[00:00:00] S0: And I guess based on current growth numbers or more recent growth numbers, it hasn’t been too impactful on the underlying business performance. On competition, it feels like Zscaler is one that shows up in multiple categories, so I put them there. In Act 3, you mentioned the hyperscalers, which I think are worthy competitors for anyone to deal with. But in terms of the competitive risks and threats, how high do you rate that on the risk spectrum? Is it something that concerns you sometimes in a growing market? If you have one of the leaders, you usually feel pretty good that even if things move slightly, it's not going to be too material. Just thinking about the competitive threats and how fragile their position is versus being very strong and only strengthening.