Cloudflare: Building the Internet's Operating System

I. Where Does Spam Come From?

On September 13, 2019, a company named after a weather phenomenon rang the opening bell at the New York Stock Exchange. Cloudflare had priced its initial public offering at fifteen dollars a share, above the range its bankers had already raised once, and it traded under a ticker so on the nose it sounded like a joke: NET.¹ Seven years later, on October 14, 2026, those same shares closed at about $350, within a few percent of their all-time high, and the company carried a market value of roughly $123 billion.²

Here is the strange part. In all of its reported history, Cloudflare has never produced a full year of GAAP profit. Over the ten years from 2016 through 2025 it lost about $1.2 billion on the bottom line.³ Yet the market today values the business at about forty-seven and a half times its trailing revenue, a price usually reserved for software monopolies printing cash, not for a network company that still has to buy servers, rent data-center cages and pay for bandwidth.² Somewhere between the bell in 2019 and the price in 2026, investors decided that Cloudflare is not what it looks like from the outside.

To understand why, the story has to go back further than the IPO, to a Chicago apartment and a question that sounds almost quaint today: where does spam come from? In 2004 a young lawyer named Matthew Prince and a programmer named Lee Holloway built a small open-source project to find out.⁴ They called it Project Honey Pot. The idea was a trap. Website owners installed a snippet of code that planted unique, invisible email addresses on their pages. When automated scrapers harvested those addresses and spam later arrived at them, the project could trace which machine had done the harvesting. Thousands of webmasters joined. Without quite meaning to, two hobbyists had built a global sensor network for bad behavior on the internet.

That accident is the seed of everything that follows. Cloudflare's whole business rests on one idea that Honey Pot proved first: if enough of the web's traffic passes through your hands, you see threats before anyone else does, and that vision is worth more than any single customer could pay you. The question this story keeps asking is whether that vision has finally been turned into an economic machine worthy of the price.

Four mysteries steer the episode. The first is identity. Is Cloudflare a runtime platform for the coming wave of AI agents, with genuine software pricing power, or a capital-hungry delivery network wearing a hyperscaler's multiple? The second is profit. The company reports healthy and growing free cash flow, but much of it exists because employees are paid in stock rather than cash, so is the cash real economics or a translation of dilution into a nicer-looking number? The third is the gamble of May 2026, when management cut about a fifth of its workforce, roughly a thousand people, to remake Cloudflare as what it called an "agentic AI-first" company.⁵ Does that unlock margins, or does it break the sales machine that brought in the big enterprise contracts? The fourth is power. The two founders control a majority of the vote through super-voting shares, and in June 2026 public shareholders voted heavily against their pay and against a new class of non-voting stock, and lost.⁶

The scale of what sits under these questions is easy to underestimate. Over the twelve months to June 2026, Cloudflare booked about $2.5 billion of revenue, growing faster than it had in two years.² It ended 2025 with more than 332,000 paying customers, up from about 238,000 a year earlier.³ Its network spans more than 330 cities, and by the tally of the web-survey firm W3Techs, Cloudflare sits in front of about one in five of all websites, and the overwhelming majority of those that use any reverse-proxy service at all.⁷

One more housekeeping fact matters because it simplifies everything. Cloudflare, Inc. is an independent Delaware corporation, incorporated in July 2009, with no parent company, no controlling conglomerate and no private-equity sponsor sitting above it.¹ Every dollar of revenue, every share of dilution and every risk on the balance sheet belongs to the public company and its shareholders. There is no group structure to untangle. What there is instead is a pair of founders who own a minority of the economics and a majority of the votes, which will matter a great deal before this story is done.

So how did an anti-spam science project turn into a company that the market prices like it owns a piece of the internet itself? It began with a phone call from people who understood the value of the honey pot better than its creators did.

Subscribe on LinkedIn

↑ Back to Top

II. Project Honey Pot and the California Summer

Prince has told the story many times. Years into running Project Honey Pot as a side project, he heard from people at the Department of Homeland Security who wanted to understand the data. Their interest carried an implicit message that stopped him: the logs of where attackers lived, how they moved and what they targeted were far more valuable than a two-person hobby had ever assumed.⁸ If government security officials wanted to know where the bad traffic came from, website owners would want something better. They would want it stopped.

Matthew Prince was not the obvious founder of a deep-infrastructure company. He had studied English and computer science as an undergraduate, earned a law degree at the University of Chicago, taught cyber law and co-founded an earlier anti-spam venture.⁸ His gift was framing: taking a technical idea and finding the sentence that makes a customer, a regulator or a journalist understand why it matters. Lee Holloway was the opposite. Quiet, intensely focused, a programmer who could hold an entire system in his head, he was the one who actually wrote the Honey Pot code and kept it running.⁴ Prince talked; Holloway built.

The third founder arrived by way of Harvard Business School. Prince had enrolled in the MBA program, and there he met Michelle Zatlyn, a Canadian with a chemistry background who had already worked at startups and had a talent for asking the obvious question nobody else in the room would ask.⁴ Prince described the Honey Pot data; Zatlyn asked why they did not simply build a service that protected websites from the threats the data revealed. The two entered the school's business plan competition with the idea in 2009 and came away with prize money and, more importantly, a reason to stop treating it as a hobby.⁸

The early reaction from experts was skeptical, and for a good technical reason. Cloudflare's proposal required a website to point its traffic at Cloudflare first. Every visitor's request would travel to a Cloudflare server, which would inspect it, block it if malicious and pass it on to the real site if not. That arrangement is called a reverse proxy, and to a network engineer in 2009 it sounded like adding a toll booth to a highway. More hops meant more delay, and more delay meant slower pages, which in the economics of the web means lost visitors and lost sales.

Holloway's answer turned the objection inside out. If the Cloudflare server was going to sit in the path anyway, it could also keep copies of the parts of a website that rarely change, the images, the style sheets, the scripts. A visitor in Frankfurt would get those copies from a nearby Cloudflare machine instead of waiting for them to cross the Atlantic from a server in Virginia. The proxy that was supposed to slow the site down would make it faster. Security would ride along for free.

That is the foundational insight of the company, and it deserves to be stated plainly. Cloudflare did not try to sell security as a cost. Security products are a grudge purchase; nobody wakes up excited to buy a firewall. Speed is something every site owner wants. By bundling protection into acceleration, Cloudflare made the decision to route traffic through it a performance decision, and in doing so it got itself into the path of the traffic. Everything the company sells today depends on being in that path.

The founders incorporated in Delaware in July 2009 and moved to California.¹ They recruited infrastructure engineers from large web companies and raised early venture money, with Venrock and Pelion Venture Partners among the first institutional backers.¹ Then, on September 27, 2010, they took the stage at TechCrunch Disrupt and launched publicly with a pitch that sounded almost irresponsible: any website could sign up, change two lines in its domain-name settings and get Cloudflare's protection and speed, starting at no cost at all.⁸

Free is a strange way to start a company that will eventually need billions of dollars of servers. It was not charity, and it was not merely marketing. It was the Honey Pot idea at a far larger scale, and it would make Cloudflare both indispensable and, on occasion, deeply uncomfortable.

↑ Back to Top

III. Defending 4chan and the Accidental Content Arbiter

In its first years, Cloudflare learned what it means to stand in front of the internet's most hated websites. The early customers were not Fortune 500 banks. They were bloggers, small online shops, gaming forums and, inevitably, the rowdier corners of the web, including the image board 4chan, whose community attracted both furious attackers and furious defenders. In 2012 a hacking group compromised Prince's own accounts and used the access to tamper with a customer's settings, and Cloudflare responded by publishing a detailed, step-by-step account of exactly how it had been breached.⁸ That habit, writing long, technical, unvarnished explanations of its own failures, would become one of the company's signatures.

To see why the free tier worked, it helps to look at who Cloudflare was competing with. In 2010 the content delivery business belonged to Akamai and a handful of rivals such as Limelight. Their model was built for big media companies and large enterprises: negotiated contracts, minimum bandwidth commitments, sales engineers and professional services. A small startup or a hobby blog was simply not worth a salesperson's time. Cloudflare served that ignored market with software instead of people. Sign-up was self-serve, the paid plans were a flat monthly fee, and the free plan cost nothing. The incumbents had no reason to chase customers worth nothing to them, which is exactly why Cloudflare could collect millions of them.

The architecture made the economics possible. Rather than building specialized hardware appliances for each job, Cloudflare ran its software on ordinary commodity servers placed in third-party data centers, and it used a routing technique called anycast. In plain terms, anycast means the same internet address is announced from every Cloudflare location at once, so a visitor's request naturally flows to the nearest site, and an attack aimed at one address gets spread across the whole network rather than concentrated on one machine. Every server runs every service. There is no separate box for caching, another for firewalls and a third for attack scrubbing. That design, a direct descendant of Holloway's early code, means capacity built for one product is capacity for all of them.

The free users did something else, too, and it is the closest thing Cloudflare has to a secret. Every free website was a sensor. When a new attack pattern hit an obscure blog somewhere, the network saw it, learned it and could push a defense to every other customer within moments. The Fortune 500 bank paying for an enterprise contract was, in effect, being protected by what the network had learned from millions of people paying nothing. The free tier was the training data; the paid tier was the business. A decade before machine learning became a boardroom word, this was a data flywheel in its purest form.

Behind the growth, a private tragedy was unfolding. Lee Holloway, the engineer whose code sat at the center of the network, began to change. Colleagues noticed he was disengaged, erratic, uncharacteristically unkind. For a while it looked like burnout or a personality shift. It was neither. Holloway left the company in 2015, and he was later diagnosed with frontotemporal dementia, a disease that attacks the parts of the brain governing personality and judgment, often in people far younger than typical dementia patients.⁴ The man who designed the system that would eventually carry a fifth of the web could no longer follow what his company had become. Cloudflare's story is often told as a triumph of growth; at its center is also a genuine loss.

The other cost of standing in front of everyone was moral. Cloudflare's position for years was that it was infrastructure, like a phone company, and should not decide which lawful websites deserved protection. That principle collided with reality in August 2017, when the neo-Nazi site The Daily Stormer claimed Cloudflare secretly supported its ideology. Prince terminated the site, and in the same post explained why the decision troubled him: a company with Cloudflare's reach deciding what stays online was, in his words, a dangerous precedent, and he had made the call because he woke up in a bad mood, which is exactly the problem.⁹ Two years later, after the shooting in El Paso, Cloudflare dropped 8chan, describing the forum as lawless in a way that had contributed to multiple tragedies.¹⁰ In 2022 it did the same with Kiwi Farms.³

It is worth asking the hard commercial question here, because the moral drama can obscure it. Did becoming the internet's reluctant referee cost the business anything? The record says no. No single customer has accounted for even a tenth of Cloudflare's revenue in any recent year, and none accounts for a tenth of its receivables.³ Terminating a handful of notorious sites had no visible financial effect. That tells an investor two things at once. The customer base is so fragmented that no individual account, however loud, holds leverage over the company. And Cloudflare's real exposure from content decisions is not revenue but politics: regulators and governments who have learned that the internet's plumbing has a small number of chokepoints, and that Cloudflare is one of them.

By the mid-2010s, then, Cloudflare had a giant free user base, a clever network and a growing reputation. What it did not yet have was the institutional muscle to sell to large companies, or the battle scars of a true crisis. In February 2017 it got both lessons at once.

↑ Back to Top

IV. The Cloudbleed Breach and Project Holloway

On a Friday in February 2017, Tavis Ormandy, a researcher on Google's Project Zero security team, noticed something deeply wrong in data his team was examining. Fragments of web pages cached by search engines contained material that did not belong there: pieces of other people's private requests, including cookies, authentication tokens and passwords. He traced the leakage back to Cloudflare and reached out to its security team.¹¹

Cloudflare's engineers found the cause within hours. Some of its servers rewrote web pages on the fly, for example to obscure email addresses from scrapers, a feature descended directly from Honey Pot. The code that parsed the HTML for this job had been generated by an older tool, and a subtle programming error meant that under certain malformed conditions the parser read past the end of the memory it was supposed to use. Whatever happened to be sitting in the adjacent memory, often data from completely unrelated customers, was spilled into the response.¹¹ Imagine a postal sorting machine that occasionally slips a page from someone else's letter into your envelope. Most recipients never notice. Search engines that store copies of everything do.

The bug became known as Cloudbleed, and it was the kind of incident that can end a security company. Cloudflare disabled the affected features globally within minutes of understanding the problem, then spent days working with Google, Microsoft, Yahoo and others to purge leaked data from their caches.¹¹ It also did what it had done during the 2012 hack: it published a long, technical post-mortem explaining exactly what had gone wrong, how long the bug had been live and what it was doing about it.¹¹ The incident caused real reputational damage, and some critics argued Cloudflare minimized the scale. But the company kept its customers, and its transparency became part of its brand with the engineers who choose infrastructure vendors.

Cloudbleed coincided with a strategic turn. A free-and-self-serve company cannot reach the scale its network needed on twenty-dollar subscriptions alone. Michelle Zatlyn, who ran much of the go-to-market side of the business, led a deliberate move upmarket, building a direct sales organization aimed at chief information security officers at large companies.¹ The pricing changed shape with it. Small sites still bought simple plans, with the Pro tier at $20 a month and Business at $200, but large customers now signed custom contracts, typically spanning one to three years, invoiced annually in advance.¹

The results showed up in the prospectus. By mid-2019 Cloudflare had 408 customers paying more than $100,000 a year, up about 70 percent from a year earlier, and those large accounts were growing faster than the business as a whole.¹ Revenue had climbed from about $84 million in 2016 to $192 million in 2018, and it reached $287 million in 2019, a growth rate of roughly 50 percent.³ The losses grew too: operating losses reached about $108 million in 2019.³ This was the classic shape of a land-grab company, buying growth with losses on the theory that the network would someday pay for itself.

Inside the company the IPO had a code name, and it was a tribute. The listing was called Project Holloway, after the co-founder who could no longer take part in what he had helped build.⁴ On September 13, 2019, Cloudflare sold 35 million shares at $15, raising about $489 million after costs, and the stock closed its first day up about 20 percent.¹

Here is a point worth holding onto. At its IPO, Cloudflare described itself as on a path to sustainable profitability, and that path has been the company's recurring promise ever since. Its financials showed the gap was large: an operating loss equal to more than a third of revenue in 2019.³ Seven years and a nearly eightfold increase in revenue later, the operating margin is still negative, though far less so, about minus 10 percent in 2025.³ The direction of travel has been right. The destination still has not been reached. That pattern of steady improvement without arrival is why the market's patience is the real asset the company spends.

What the IPO money bought was time to build the thing that would justify today's valuation. It turned out not to be a better content delivery network at all. It was a computer, spread across the planet.

↑ Back to Top

V. The Network Moat: Serverless at the Edge and Zero Trust

In September 2017, Cloudflare announced a product called Workers, and opened it broadly that year and into 2018. On the surface it was a developer feature: a way to write small programs in JavaScript, and later in other languages compiled to WebAssembly, that run on Cloudflare's servers instead of on the customer's own.⁸ Underneath, it was the moment Cloudflare stopped being only a shield and started becoming a place where software lives.

The technical trick deserves a moment, because it is the heart of the bull case. Amazon's competing service, Lambda, runs customer code in small virtual machines or containers that have to be started up when a request arrives. That startup, called a cold start, can take long enough for a human to notice. Cloudflare instead borrowed the isolation technology from Google's Chrome browser, called V8 isolates. A browser runs code from dozens of untrusted websites at once without letting them interfere with each other; Cloudflare uses the same machinery to run thousands of customers' programs on one server, each walled off, with startup times measured in milliseconds.⁸ The analogy is a hotel versus a block of houses. Lambda builds a small house for each guest. Workers gives each guest a locked room in a building that is already standing.

Because every Cloudflare server runs every service, Workers was not a separate data center. It was spare capacity on machines that were already deployed in hundreds of cities to block attacks and cache content. That is the Cloudflare model at its most elegant, and it is why the company argues that the incremental cost of each new product approaches zero once the network exists.

That claim is worth testing properly, so it is worth running the full strategic audit here, once, using Hamilton Helmer's Seven Powers and Michael Porter's Five Forces.

Start with scale economies. A network in more than 330 cities that connects directly with more than 12,000 other networks avoids paying middlemen to carry its traffic, and spreads the fixed cost of each location across every product it sells.³ A new rival would have to build that footprint before it could match Cloudflare's costs, and it would have to do so while losing money. Next comes process power: a decade of software built around running everything on one kind of commodity server, in Rust and Linux and V8, is hard to copy because it is a way of working, not a single invention. Switching costs are real but uneven. Moving a website's caching from one provider to another takes an afternoon; moving a company's domain-name system, its firewall rules, its employee access controls and its application logic written for Workers takes months, and that is precisely the depth Cloudflare tries to reach with each enterprise customer.

The most interesting power is counter-positioning. Amazon Web Services makes a great deal of money charging customers to move data out of its cloud, so-called egress fees. In 2021 and 2022, Cloudflare launched R2, a storage service with no egress fees at all.⁸ Amazon could match it only by giving up one of its most profitable revenue lines, which is exactly the kind of move incumbents resist. Finally, there are network effects in the narrow, data sense described with the free tier: each new customer adds threat signal that protects all the others.

Porter's lens gives a similar picture with more shading. The threat of new entrants is low, because a global anycast network takes years of peering negotiations and billions of dollars to replicate. Buyer power is low to moderate: no customer is large enough to dictate terms, but large enterprises can and do run multiple vendors. Supplier power is moderate. Cloudflare depends on colocation operators and internet carriers, and it carried about $255 million of non-cancelable purchase commitments at the end of 2025, mostly for bandwidth and data-center space, costs it cannot turn off if growth slows.³ The threat of substitutes is low for its core security and domain-name services, but higher in computing, where the big clouds offer databases, AI tools and storage right next to the code. Rivalry is intense but fragmented: Akamai still owns much of the legacy enterprise and media business, Fastly competes on high-performance delivery, and Zscaler leads in securing corporate employees' internet access. None of them has Cloudflare's combination of developer reach and breadth.

Now for the strongest test of the moat, because a moat argument means nothing until it is pushed. Is delivery itself, moving bytes from one place to another, a defensible business? The history of the industry says no. Akamai's content delivery revenue has been shrinking for years as bandwidth prices collapsed and big customers built their own networks.¹² Fastly, a direct technical peer, trades at about six to seven times sales.² If Cloudflare were simply a faster pipe, that is roughly where it would trade too. The record therefore narrows the moat claim to something smaller and more specific: Cloudflare's advantage is not the network as such, but the products it can sell on top of the network at near-zero incremental cost. Bandwidth is the commodity. Security, access control and compute are the margin.

That narrower claim has decent evidence. Cloudflare's gross margins have historically stayed in the mid-to-high 70s, unusually high for a company that owns physical infrastructure, which is what one would expect if most of the value comes from software layered on shared hardware.³ Its zero trust product line, which replaces corporate VPNs by checking each employee's access request at the edge, has given it a credible wedge into the security budgets that used to belong to appliance vendors. But the claim also carries a caveat. Cloudflare's own capital spending has been rising faster than revenue, as the story will show, and that is not what a business with near-zero marginal costs should look like. The moat is real; the question is whether it is as cheap to defend as the valuation implies.

To answer that, the story has to follow the money, and the money at Cloudflare follows a path that is easy to misread.

↑ Back to Top

VI. The Dilution Engine: Converting Losses into Free Cash

In February 2026, Cloudflare filed its annual report for 2025. On one line, it reported an operating loss of about $207 million and a net loss of about $102 million. A few pages later, it reported that operations had generated about $603 million of cash, a record.³ Two numbers describing the same year, separated by more than $700 million. Which one tells the truth?

Both do, and the gap between them is the single most important thing to understand about Cloudflare's finances. Over the decade from 2016 through 2025, the company's cumulative net loss was about $1.2 billion, while its cumulative cash from operations was about $1.3 billion, a swing of roughly $2.5 billion.³ The explanation fits in three pieces, and it is worth walking through 2025 step by step.

Start with the loss of $102 million. Add back about $452 million of stock-based compensation: the value of shares given to employees instead of cash, which counts as an expense in the income statement but never leaves the bank account. Add back about $190 million of depreciation, the accounting charge for servers bought in earlier years. Then add about $224 million of growth in deferred revenue, which is cash customers paid upfront for service Cloudflare has not yet delivered.³ Subtract the commissions it capitalized and the growth in receivables, and the result lands at $603 million.³

Now look at the biggest of those pieces. Stock compensation alone equaled about three-quarters of the year's operating cash flow.³ In other words, most of the cash Cloudflare reports generating exists because it paid its people in shares rather than dollars. That is not fraud; it is how almost every high-growth software company reports. But it means the cost of running the business did not disappear. It was moved from the company's bank account to its shareholders' ownership stakes, which shrink a little each year as new shares are issued. After capital spending, free cash flow was about $261 million in 2025.³ Subtract the stock compensation, and economic earnings were deeply negative.

The prepayments deserve a fairer hearing, because they are genuinely good. Enterprise customers pay annually in advance, so Cloudflare collects cash before it does the work. The company effectively runs on customer money; working capital, measured against revenue, ran deeply negative in 2025.³ That is the hallmark of a business customers need badly enough to prepay. It is also a reminder that a prepayment is a promise, not a profit: if growth slowed, the float that flatters today's cash flow would stop expanding.

What about the quality of what customers owe? Here the record is clean. Receivables equaled about 68 days of revenue in 2025, an improvement from 73 days in the two prior years, and actual write-offs were about $16 million on more than $2 billion of revenue, well under 1 percent.³ Channel partners now bring in about a quarter of revenue, up from about a sixth in 2023, which can sometimes stretch payment terms; so far, it has not.³ Cloudflare's customers pay.

There is one more cushion hiding in plain sight. After raising $2 billion of convertible debt in June 2025, Cloudflare ended the year holding about $4.1 billion of cash and high-grade securities, mostly US Treasuries and investment-grade corporate bonds.³ That pile earned about $123 million of interest in 2025, which offset more than half of the operating loss and is a large part of why the net loss looked so much smaller than the operating loss.³ When rates fall, that cushion thins.

Management often describes Cloudflare as self-funding, and it is fair to test that against the record. Capital spending on servers, equipment and capitalized software rose from about $135 million in 2023 to about $343 million in 2025, and then to about $245 million in just the first half of 2026, nearly a fifth of revenue.³² Much of the recent increase reflects GPUs and AI inference hardware. Meanwhile, the biggest cash events of the last two years came not from operations but from the bond market. The history narrows the self-funding claim: Cloudflare's operations do cover its running costs and most of its capital spending in cash terms, but only because employees take a large share of their pay in stock, and its balance-sheet strength was built on convertible debt. The test that would settle it is a year of positive GAAP operating income, which counts stock pay as the real cost it is.

Which brings the story to the year Cloudflare decided its biggest cost, people, was the thing to cut.

↑ Back to Top

VII. The 1,000-Person AI Restructuring and the Replicate Bet

On May 7, 2026, Matthew Prince sent a memo to the entire company. Cloudflare would eliminate roughly a fifth of its workforce, about a thousand people, effective immediately, and reorganize itself around what he called an "agentic AI-first" operating model.⁵ The phrase meant that software agents, programs that can carry out multi-step tasks on their own, would take over work that people had been doing, from handling routine support tickets to triaging threats and qualifying sales leads. Cloudflare would be both the seller of the tools for this transition and its first large test case.

The context explains the timing, even if it does not settle the wisdom. Cloudflare's headcount had grown from about 3,700 at the end of 2023 to more than 5,100 by the end of 2025, a rise of about 40 percent in two years.³ Revenue had grown faster, but not by enough to close the operating loss. Each new salesperson and administrator was being added faster than the margin improved. Management's argument, made in the memo and on the following earnings call, was that the company's own AI tools could break that link: grow revenue without growing headcount at the same rate.⁵¹³

The first financial consequence was a mess. In the second quarter of 2026, Cloudflare recorded about $151 million of restructuring charges, mostly severance and accelerated stock awards, and its operating loss for the quarter jumped to about $206 million, nearly 30 percent of revenue, its worst quarterly figure in years.² Strip out the one-time charge and the underlying loss looks broadly similar to earlier quarters. That is the generous reading. The skeptical reading is that the cut has so far produced a large bill and no proven savings; the savings arrive, if they arrive, in the quarters ahead.

What made the cut harder to dismiss as panic was the top line. Revenue growth had bottomed at about 27 percent in late 2024 and early 2025, and then turned up: about 30 percent for full-year 2025, 33 percent in the first quarter of 2026 and about 36 percent in the second, when revenue reached $696 million.²³ Companies in distress do not usually accelerate. Management credits the acceleration to large enterprise deals and AI-related workloads on its developer platform.¹³ Cloudflare does not break out AI revenue separately, so that attribution rests on management's word rather than on disclosed segment figures.

The AI bet has two concrete pieces. The first is hardware. Since launching Workers AI in September 2023, Cloudflare has been placing GPUs in its edge locations so that customers can run AI models close to their users rather than in a distant cloud region.¹⁴ The second is an acquisition. On December 1, 2025, Cloudflare bought Replicate, a platform popular with developers for running open-source AI models through a simple programming interface.³ Replicate brought a community of developers who already think in terms of calling models as services, exactly the audience Cloudflare wants on Workers. Cloudflare has not disclosed a figure that would let outsiders benchmark what it paid against the revenue Replicate brought, so whether the price was disciplined cannot be judged from the outside; what can be said is that it was a bet on developer mindshare rather than on acquired revenue.

Here the historical test bites hardest. Large enterprise contracts, the deals that took Cloudflare from 408 big customers at its IPO to the RPO backlog of about $2.7 billion today, are sold by people.¹² Solution architects design complex zero trust migrations; account managers hold the hands of nervous security chiefs. Cloudflare's own history is a story of building that human sales muscle deliberately after the self-serve era hit its ceiling. Cutting a fifth of the company risks reversing exactly that. There is a counterweight: management says the cuts were weighted toward roles it considered automatable, and revenue accelerated in the quarter the cuts happened.¹³ But one quarter cannot prove that enterprise sales execution survived, because big deals signed in the second quarter were mostly in the pipeline before May.

So the record leaves the claim intact but unproven. The restructuring is plausible as margin strategy and dangerous as sales strategy, and the evidence that would separate those outcomes, retention rates and large-customer growth in the second half of 2026, has not yet been published. What is already visible is how little say outside shareholders had over any of it.

↑ Back to Top

VIII. The King's Shield: Class C Shares, $60 Million Pay, and the Shareholder Revolt

On June 30, 2026, Cloudflare held its annual meeting of stockholders online. There was no drama on screen; there rarely is at a virtual meeting. The drama was in the tallies. When the inspectors finished counting, a large block of public shareholders had voted against the company on pay, against one of its directors and against a proposal to change its capital structure. Every one of management's proposals passed anyway.⁶

The reason is a share structure built in before the IPO. Class A shares, the ones the public owns, carry one vote each. Class B shares, held almost entirely by insiders, carry ten.¹⁵ As of April 2026, Matthew Prince controlled about 39 percent of the total vote and Michelle Zatlyn about 13 percent, together just over 52 percent, while owning a far smaller share of the economic value of the company.¹⁵ Any proposal they support passes. Any director they back is elected.

The pay that provoked the revolt came in 2025. Prince's reported compensation jumped to about $60.6 million and Zatlyn's to about $60.0 million, up from about $2 million and $1.4 million the year before, driven almost entirely by restricted stock and performance share grants valued at about $58 million each.¹⁵ The ratio of the chief executive's pay to the median employee's was 387 to one, against a median employee earning about $156,000.¹⁵ The board would argue that founders who had taken little equity in recent years were being re-incentivized for the AI era. A shareholder would answer that the grants landed in a year of GAAP losses, a year before the company cut a thousand jobs.

The votes made the disagreement concrete. On the advisory say-on-pay vote, about 139.6 million shares voted against and 445.9 million in favor.⁶ Because the founders' super-voting shares sit in the "for" column, that headline result understates the dissent among ordinary holders; stripped of insider votes, the public opposition was very large. Harvard Business School professor Karim Lakhani, a director on the audit committee, saw about 119 million votes withheld.⁶ And roughly 200 million Class A shares voted against the charter amendments that created a new non-voting Class C common stock and a Series FF preferred stock.⁶ The purpose of the non-voting shares is straightforward: they let the company issue equity for employee pay or acquisitions without diluting the founders' voting control. Stockholders also approved doubling the authorized Class A shares from 2.25 billion to 4.5 billion.⁶

The same founders have been genuinely skillful with the balance sheet, and that deserves equal weight. Since the IPO, Cloudflare has raised almost all its outside capital through convertible notes, bonds that pay little or no interest and can convert into stock if the share price rises above a set level. In August 2021, it sold about $1.29 billion of notes paying zero percent interest, due August 2026, convertible at about $191 a share.³ In June 2025, it sold $2 billion more at zero percent, due 2030, convertible at about $248, and spent about $283 million on capped calls, hedges that limit dilution if the stock rises.³ Borrowing billions at no interest is about as good a deal as capital markets offer, and Cloudflare got it by selling investors volatility.

The test came in 2026, when the first big batch of notes came due. In May, with the stock far above the conversion price, Cloudflare told noteholders it would pay the $1.29 billion principal in cash and settle the excess conversion value in shares.² The cash came from the $4.1 billion treasury, so there was no refinancing scramble. But the shareholder still paid: every dollar of conversion value above the principal arrives as new Class A stock. Convertible debt is cheap in interest and expensive in dilution when the stock does well, and the stock has done very well.

One more item belongs here for completeness. Since August 2024, Cloudflare has leased an aircraft from an entity affiliated with Prince for business and security travel, and paid it about $1.3 million in 2025; the board says independent consultants judged the rates below comparable charter costs.¹⁵ It is small. What it shows is that Cloudflare's governance problem is not cash leaking to insiders. It is control: two people who can set their own pay, pick their own board and change the rules on how future shares vote, against the stated wishes of a large share of the public owners. The market, by paying nearly fifty times sales, has so far decided that is a price worth accepting. Whether that bet is wise depends on the business case, and it is time to weigh that directly.

↑ Back to Top

IX. Bull vs. Bear Case

On October 14, 2026, Cloudflare's stock sat near $350, its enterprise value about $122 billion. At that price, the market pays about 47 times trailing revenue, more than 3,000 times trailing EBITDA, and accepts a free cash flow yield of about 0.3 percent.² For comparison, Akamai trades at roughly five times sales, Fastly at six or seven, and Zscaler at about ten. Only CrowdStrike, the most richly valued name in cybersecurity, trades in the same neighborhood.² The market is not pricing a content delivery network. It is pricing a platform that it expects to become far larger and far more profitable.

The bull case starts with location. If AI agents become a large share of internet traffic, they will need to run somewhere, and running them close to users, data and the websites they act on avoids the delay of a round trip to a distant cloud region. Cloudflare already sits in the path of a fifth of websites and in hundreds of cities.⁷ With Workers, GPUs at the edge and Replicate's developers, it can argue that it is the natural runtime for that agent traffic, collecting a toll on machine activity as well as human. The bull also points to consolidation: companies stitching together separate vendors for content delivery, firewalls and employee access could move onto a single Cloudflare control panel, and the revenue acceleration through 2026 is consistent with that happening. The restructuring, in the bull's version, is the margin unlock the company has always promised: if revenue can grow above 30 percent while headcount shrinks, the operating margin could cross into positive territory faster than the history suggests. And neutrality matters: Cloudflare works with every cloud, so it wins regardless of which hyperscaler takes the most workloads.

The bear case starts with arithmetic. At 47 times sales, even sustained 30 percent growth for several more years leaves the stock priced for profits that do not yet exist. The company's own history shows how violent the alternative can be: the stock fell about 83 percent from its 2021 peak during the 2022 tech sell-off, with a business that kept growing the whole time.² Physics is the second bear point. Capital spending reached nearly a fifth of revenue in the first half of 2026, for GPUs, servers and data-center space, and those costs compound as AI inference grows.² A software multiple assumes software economics; a business buying more hardware each year has to prove it still has them. The third point is execution: if the May cut damages the enterprise sales motion, the bear will see it first in slower large-customer growth and weaker retention. The fourth is retaliation. Amazon, Microsoft and Google can lower egress fees, bundle edge security into their clouds or price AI inference aggressively, and each of them has a balance sheet many times larger than Cloudflare's.

A skeptical activist would sharpen all this into one question. Cloudflare has spent sixteen years promising that scale would bring profits, has lost about $1.2 billion along the way, and in one year paid its two founders about $120 million in stock.³¹⁵ At what point does a public shareholder get to demand GAAP net income? The honest answer is that, given the voting structure, the shareholder cannot demand anything; the only lever is the share price itself.

Weighing the two sides, the evidence supports a narrower version of the bull thesis than the price implies. The moat in security and developer reach is real and has survived both a catastrophic bug and a decade of hyperscaler competition. The AI runtime claim is plausible but unproven, because the company does not disclose AI revenue. The profitability claim remains a promise. Three numbers will decide which side is right, and they are the ones worth watching above all others. The first is revenue growth, which stood at about 36 percent in the second quarter of 2026 and has risen for four straight quarters.² The second is dollar-based net retention, the growth in spending from existing customers, which tells investors whether the enterprise base is expanding after the cut. The third is GAAP operating margin, which was about minus 10 percent for 2025 and worsened sharply in the restructuring quarter.²³ Growth up, retention holding, margin turning positive: that is what the price is asking for.

↑ Back to Top

X. Playbook: Business and Investing Lessons

Picture the decision Cloudflare faced in 2009, on a whiteboard in a small office. Charge every website a few dollars a month for protection, the way every security vendor did, or give basic protection away to everyone and hope to make money later. The answer they chose shaped every lesson that follows.

The first lesson is that free users can be the product's immune system. Cloudflare's free tier was never charity; each free website was a sensor feeding attack data into a network that protected the paying ones. The lesson for founders is that a byproduct you give away can become a moat if it makes the paid product better with every user. Free users are not a cost center; they are the sensor network.

The second is to build where the incumbent cannot follow. Amazon's egress fees were a profit center, and R2 turned them into a liability Amazon could not easily abandon. Find your rival's most profitable habit and make it look like a trap.

The third is architectural. Lee Holloway's decision to run every service on every server meant Cloudflare never paid the coordination tax of stitching together separate appliances, and it is why Workers and AI inference could be added onto machines that already existed. Build one machine that does everything, and every new product is almost free to ship.

The fourth is that honesty can be a security feature. From the 2012 hack through Cloudbleed, Cloudflare explained its failures in technical detail, and the engineers who choose infrastructure vendors came to trust it more, not less. In security, the post-mortem is the brand.

The fifth is for investors, and it cuts both ways. Cloudflare used zero-interest convertible bonds to fund its network on the bond market's appetite for its volatility, a genuine financial weapon. But every convertible eventually turns into either cash or shares, and when the stock soars, the bill comes in equity. A zero-coupon bond is never free; it is just paid for by somebody else.

↑ Back to Top

XI. Epilogue

Tonight, Cloudflare stands at the most interesting point in its history. Its revenue is growing faster than at any time in two years. It has contracted backlog of about $2.7 billion, up from about $2.5 billion at the end of 2025.² It has about a thousand fewer employees than it did in the spring, a new set of non-voting shares ready to issue and founders who have just been paid more than ever. Its servers in hundreds of cities are increasingly running AI workloads alongside the security and delivery services that built the company.

Over the next year, a handful of moments will decide which version of Cloudflare the market is actually buying. The first comes with the third- and fourth-quarter 2026 results: if net retention and growth in large customers hold up, the restructuring will look like a margin decision; if they fade, it will look like a sales mistake made at the worst possible time. The second is the annual report for 2026, due early next year: if Cloudflare starts disclosing AI or developer-platform revenue separately, investors will finally be able to test the AI runtime story against real numbers, and if it does not, the thesis will keep resting on management's word. The third is the march toward GAAP operating profit: a full year in the black, counting stock compensation as the cost it is, would answer the question the company has deferred since its IPO. And the fourth is governance: the non-voting Class C stock gives the founders a way to issue shares without diluting their control, and any lawsuit or institutional campaign challenging that structure would be a sign that the public's patience has limits.

The tension that remains is the same one that has followed Cloudflare since the bell rang in 2019. It has built something genuinely essential. Whether it can turn essential into profitable, on terms that treat its outside owners as partners rather than passengers, is the question the next few quarters will start to answer.

↑ Back to Top

XII. Outro

Go back to that Chicago apartment in 2004. Two programmers, a few lines of code and a trap baited with fake email addresses, trying to figure out where the spam came from. They wanted to see the bad actors on the internet. Twenty-two years later, the company their idea became sits between a fifth of the world's websites and everyone who visits them, scrubbing attacks, caching pages and now running AI models before a human eye can blink.

Lee Holloway's code still runs inside that machine, and his name was on the project that took it public. Cloudflare set out to help build a better internet. What it actually built was a toll road that almost nobody can route around, and the only question left is how much of the toll will ever reach the people who own it.