Cloudflare: Leading Cybersecurity - [Business Breakdowns, EP.241]

· Sam Eden, Matt Reustle

So they actually have to buy a physical firewall to intercept and check this traffic. All these services, they're what's called reverse proxies, which basically means they just intercept incoming traffic on behalf of the website. And that's part of the security piece that we talked about earlier. So that's the lay of the land before Cloudflare. This was all very difficult. It needed those sales engineers. This was only really accessible for larger enterprises and more sophisticated websites. And these legacy vendors didn't have a solution for the long tail of websites that Cloudflare started serving. If we want to just relate this back to the postal example, this legacy setup would be if that website in Australia – they would have to inform all of the different postal routing services all over the world. They'd have to tell them their different split rules. If the mail is directed to this department, use this address. If it's directed to this department, use this address. If it's a package, use this address. And that takes maintenance because if your rules change, you have to update that and it's a lot of work. That's a bit of a history of the pre-Cloudflare time. [00:00:00] S0: Feels very manually intensive and a bit of a traveling salesman problem in terms of optimizing for where things go.

· Sam Eden

[00:00:00] S1: So now we can get to Cloudflare. Matthew Prince, the co-founder and CEO of Cloudflare, a very interesting background. Tinkered with computers as a child, studied literature and became a lawyer, and you can see that with his storytelling abilities now. Here's an interesting background. He was set to take over his family business, which actually included running a Hooters. He didn't want that, so he went to HBS. But before and during that, he was working on a project called Project Honey Pot, and that eventually became Cloudflare. So he was working on Project Honey Pot with the technical co-founder, Lee Holloway, who was responsible for a lot of the early code and a lot of the early innovations. Unfortunately, Lee was diagnosed with frontotemporal dementia so he's no longer with the business, but his technical influence remains strong throughout Cloudflare today. Project Honey Pot, it's kind of as it sounds, it was a way to let hackers and spammers scrape email addresses from your website. But these email addresses were just trackers. You could see if someone tried to spam that email address, they would get put on effectively a big list of bad addresses. It was creating a big, bad list. It was effectively a do-not-call list for spammers. Hundreds of thousands of people were installing Honey Pot to help build out this list. And they're helping build out this list because they wanted to be protected from this list. So the more users, the better the service because the list got bigger. At HBS, this is where Matthew met Michelle Zatlyn. She's now the COO. She heard about this idea and wanted to be a part of it. They're a great pair. Matthew brings a real visionary, and Michelle brings a lot of the operational rigor. Now we can get into the technical side of Cloudflare and I'll keep a high level – but they have this Honey Pot list, a list of bad actors, but it's a tricky problem to solve because it's effectively a lookup table, right? You see an incoming address, you compare that to the list and see whether you want to accept the request or not. So one way would be to put it on all of your customers' servers and they can do the lookup, but that would slow the entire internet down because every single request now has to compare it. So what Cloudflare did, and this was the real innovation, was that they just intercepted everything.

· Sam Eden, Matt Reustle

You didn't need multiple reverse proxies to do different things. You just have one reverse proxy, that's Cloudflare, and that does many things. [00:00:00] S0: Were they getting paid to do that? [00:00:00] S1: No. And this is a story throughout Cloudflare. A lot of their products, they'll turn on and they have a very generous free program, but this helps build out their business moat, improve their products and create a business that's highly defensible. [00:00:00] S0: Network effect beneficiary, and getting the free service out there can lead to that.

· Matt Reustle, Sam Eden

[00:00:00] S0: Network effect beneficiary, and getting the free service out there can lead to that. [00:00:00] S1: Totally. That Project Honey Pot was the exact start of this. So all these customers could just redirect all of their traffic to Cloudflare and they would do the lookup. Now this is really hard to do. So Lee Holloway was able to build a technical solution on this. If we relate this back to our postal example, instead of splitting the network and all that, all you have to do now is just say, "My new mailing address is Cloudflare." No matter what the recipient is, no matter what the package type, Cloudflare will intercept it and decide what to do with it. What this allowed is because it's intercepting everything, if you want to add another service, whether it's a CDN or a DDoS protection, it doesn't matter. You can just really easily turn that on and off. You don't need that sales engineer that we mentioned before. Cloudflare is already in front of your traffic. You don't have to redirect anything. So that makes it simple. So this was the main breakthrough for Cloudflare. They could now serve that long tail of websites. And they were the first real product-led growth company for internet services. Anyone could sign up really quickly. They could serve all those weekend hobby projects, all the small websites, and start providing web protection services for them.

· Sam Eden, Matt Reustle

[00:00:00] S1: Totally. That Project Honey Pot was the exact start of this. So all these customers could just redirect all of their traffic to Cloudflare and they would do the lookup. Now this is really hard to do. So Lee Holloway was able to build a technical solution on this. If we relate this back to our postal example, instead of splitting the network and all that, all you have to do now is just say, "My new mailing address is Cloudflare." No matter what the recipient is, no matter what the package type, Cloudflare will intercept it and decide what to do with it. What this allowed is because it's intercepting everything, if you want to add another service, whether it's a CDN or a DDoS protection, it doesn't matter. You can just really easily turn that on and off. You don't need that sales engineer that we mentioned before. Cloudflare is already in front of your traffic. You don't have to redirect anything. So that makes it simple. So this was the main breakthrough for Cloudflare. They could now serve that long tail of websites. And they were the first real product-led growth company for internet services. Anyone could sign up really quickly. They could serve all those weekend hobby projects, all the small websites, and start providing web protection services for them. [00:00:00] S0: In terms of getting those users, were they just in front of the community of open source developers? Or was there anything that got the attention to where they got that initial user base going? Was there anything that stands out?

· Matt Reustle, Sam Eden

[00:00:00] S0: In terms of getting those users, were they just in front of the community of open source developers? Or was there anything that got the attention to where they got that initial user base going? Was there anything that stands out? [00:00:00] S1: A lot of their early customers – they served a lot of non-profits because they had a lot of traffic but couldn't pay much. So that was really big. And they actually served a lot of the hacker community because a lot of hackers get hacked as well. So hackers would sign up to Cloudflare to protect themselves. Those are some of the big starting customers that really proved that this service could work. Because if they could protect hackers, then they could protect a more basic website as well. [00:00:00] S0: That's very interesting. It also introduces they had to then be better than the hackers because in theory, the hackers would see what they're doing. The hacking community is one that is fascinating to me.