Demand for many of Cloudflare’s (NET) - Get Cloudflare Inc. Class A Report security services has jumped over the last several months...and so has the number of security attacks it’s seeing on its platform.
Cloudflare operates a global server network across more than 200 cities and 100 countries. It uses this infrastructure to provide a wide variety of web content delivery, security and networking services to clients. The company also runs a cloud infrastructure platform known as Workers that specializes in serverless computing -- a cloud computing approach in which the provisioning and managing of server virtual machines is handled by the cloud provider -- and which recently got a major update.
Cloudflare’s revenue rose 48% annually in Q2 to $99.7 million, with paid customers rising by about 7,000 to more than 96,000. Its stock is up 136% year-to-date, leaving the company valued at around 30 times its 2020 revenue guidance of $404 million to $408 million.
I recently had a pretty informative talk with Cloudflare co-founder and CEO Matthew Prince about near-term trends, Cloudflare’s R&D efforts and what the company sees as its competitive strengths. Here’s what Prince had to say on these subjects and others, slightly edited for clarity.
How much traffic has grown for Cloudflare’s platform since March.
“I think that overall, it went up at least 50% and in certain industries, even more…[We saw] most of that in the March/April timeframe that corresponded almost directly on a region-by-region basis [to when] regions locked down and instituted shelter-in-place rules.
“I think that for the second half of the second quarter and through July, the actual traffic flows for the normal traffic across the Internet have largely leveled out and plateaued. We're not seeing the same explosive growth across Internet services, because I think that...you saw that shift [earlier] and now, if anything, people are spending less time sitting home watching streaming [content] and other things.”
What has surprised Cloudflare in terms of the traffic spikes it has seen this year.
"I think the thing that has been the biggest surprise for us [is] the rise in cyber attacks that have gone up, where we saw more than more than a 30% increase [among] customers that had been on our platform in Q1 [in terms of] what they've [seen for] cyber attacks in Q2. And then across our entire platform, including growth customers that had a 67% increase in cyber attacks from from Q1 to Q2. That is a very substantial amount.
“I think it's [due to] a couple of things. One is...the relatively innocuous bored kids phenomena, which is we [would] traditionally see an uptick in cyber attacks when school was out every year. And I think a lot of the volume of those attacks is just bored kids who are home during COVID and...try their hand at relatively amateur cyber hacking.
“That's not particularly worrisome. I think the more worrisome trend is that we have in the last few months -- and it really picked up across Q2 -- is a rise in much more sophisticated, what appear to be nation state-sponsored attacks. And they have targeted a number of things which are pretty critical pieces of infrastructure. So we've seen a number of attacks against various government and independent healthcare resources, especially sites that are trying to provide resources to deal with the COVID pandemic. Which is pretty gross, [in terms of] one nation attacking another. And then we are starting to see a rise in cyber attacks attacking both U.S. political campaigns, as well as elections infrastructure...And we have a feeling that it will continue to rise as we get closer to the election.”
Whether Cloudflare has seen (as some software firms have reported seeing) customers facing business pressures limit how much they spend with the company in order to conserve cash.
“You know, I think so far we haven't. We were concerned about an uptick in either requests for concessions for our services, or [of companies failing]. And so in Q1, we did a pretty thorough analysis of our customer base and simulations of various situations, and found that less than 8% of our revenue was exposed to COVID-sensitive industries. Over Q2, that exposure decreased to only about 7%.
“But what we were pleasantly surprised by was that those customers continued to pay for Cloudflare’s services. And the reason that the exposure decreased was just the rest of our business grew even faster. I think that what we're hearing from customers is that they are really sorting their vendors into two buckets: The sort of nice to have, and the must have. And because Cloudflare provides [a] pure, reliable, fast connection to the Internet, we have largely been sorted into that must-have bucket.
“And so we are not only seeing new customer growth, but we are also seeing record expansion among our existing customers. And so far, we don't see a lot of people who are opting out of their cybersecurity and Internet connectivity. Because right now, COVID has made that more important than ever before.”
How the current environment has helped drive adoption of the Cloudflare for Teams security solution.
“In January, we launched what's called Cloudflare for Teams. And Cloudflare for Teams replaces VPN firewall technology which has traditionally been delivered as a physical appliance. But we deliver it instead through a cloud service that can scale to whatever demand, whatever need you have. And, you know, if you, if you think about the traditional way of securing enterprise, it was a castle-and-moat strategy where you...put all your employees in the castle, you put all your secrets in the castle, and then you built a moat around the castle that was your firewall. And then you have a limited set of draw bridges to cross that moat by people who are authorized. Those were your VPNs that were out there and again, those were [typically] physical appliances.
“In March, as the world shifted to remote work, what we saw was that those physical appliances were getting overwhelmed. And as a result, businesses came to Cloudflare and said we need help. We need a cloud service that can scale to replace this physical hardware that we use. We are seeing so much demand from small businesses who were really struggling at the time.
“So an example was, I remember being on a call with a 100-person travel agency based in the Pacific Northwest right as the pandemic was first taking hold in Seattle, and they were getting frantic calls from customers who were trying to rebook or change their travel policies. They sent all their employees home, and they had requirements, they still had to use their VPN for both regulatory and compliance reasons. And the physical box...was designed to maybe have 10 people using it simultaneously, not all 100.
“And so we were able to onboard them on to the CloudFlare for Teams product….According to the owners of the business, we helped save their business and then also helped make sure that they can service all of their customers...That and many stories like it were so powerful that we made a decision that we would extend our CloudFlare for Teams products to small businesses at no cost through September. Shortly after we did that, we started getting calls from government and business organizations around the world that said, ‘This is not just a problem for small businesses, it’s a problem for large businesses as well, and their ability to continue to get work done.’
“It's critical for them to have a function like this, and so at that point, we [decided] for the good of businesses everywhere that we would extend the cloud over teams products at no cost, through at least September 1. We've had thousands of businesses sign up for it, some of the stories in the last six months that I'm the most proud of are [about] how [we helped] those businesses continue to get work done. And I think that what this overall has done, is really accelerated the transition away from the old castle-and-moat, hardware-based, Internet Security approach, to a much more modern, scalable, cloud-based approach.
“And now we're talking to those customers about being full-time customers. Not only are they thankful for us having been there at their time of need, but it's really allowed them to accelerate their digital transformation plans. And, and we're excited to have many of them that stick around as long term customers.”
“Who we still compete with the most are the physical hardware vendors...companies like Cisco (CSCO) - Get Cisco Systems Inc. Report, Palo Alto Networks (PANW) - Get Palo Alto Networks Inc. Report...Check Point (CHKP) - Get Check Point Software Technologies Ltd. Report, F5 (FFIV) - Get F5 Inc. Report, Riverbed, the list goes on and on. And so I think cloud vendors still to this day compete less with one another, than they do with...legacy providers that are out there.
“I think when we do compete with other cloud vendors, I think the strength of Cloudflare is that we provide a broad set of services that really solve the network and IT security problems that our customers want to solve. And having one broad platform where you can get everything from DDoS mitigation, to firewalls, to VPN replacement is an advantage. And if you look out at a lot of the other cloud providers, for example that are focused on zero-trust -- which again we do very well -- you'll see that many of them actually are Cloudflare customers for our DDoS mitigation or our [web application firewall] product.
“And I think that shows the power of having just one platform that is able to perform all of those services very effectively. And so CloudFlare delivers a very unified approach, we can deliver a complete solution to our customers. And those complete solutions are very difficult for any competitor to match.”
The competitive strengths of the Cloudflare Workers serverless platform.
“We’ve been running the Workers platform now for nearly three years. And just last quarter. We had over 20,000 developers write their first Worker, and there are hundreds of thousands of developers that are using a platform now. And every day I get surprised by the new types of use cases that we're seeing across the platform.
“When we first launched the platform, we really thought that the killer feature was speed, and Cloudflare Workers, we believe is, still to this day, the fastest of any of the serverless platforms that are out there. And for a certain set of applications, things like credit-card processing or human-computer interaction, speed is a killer feature. And we're seeing people able to build applications that are faster and [have better] performance than...on any other platform.
“But I think we've realized over the last three years that while speed is nice to have for every application, it's only a must-have for a relatively small and niche set of applications. And so with the new Workers Unbound service, which is an extension of the Workers platform, what we really focused on were some other things.
“We focused on consistency, which was why we worked to get cold start times to be something you only read about in the history books. To make that go to zero, and that's really revolutionary across platforms. We focused on cost and total cost of ownership and the fact that you can run the same code base on a Cloudflare Worker for as much as 75% less than you would pay for a service like AWS Lambda is really meaningfully compelling.
“We first focused on ease of use. Making sure that we support all the languages that developers already know, not forcing them to learn some proprietary language to build on that on the platform.”
How compliance needs are driving the adoption of Workers and other edge computing platforms.
I think the killer use case for Cloudflare Workers and other platforms that are similar to it is actually something that's not particularly sexy, but matters a lot to General Counsels and CSOs and CIOs, and that's compliance. And I think that as the world becomes more complicated, if you're building an application that is a global application, that your requirements around setting different different policies and different rules in different jurisdictions is going to become increasingly difficult, and in fact impossible on traditional centralized platforms.
“And so the example of TikTok right now is a good one, where Europe is requiring data from TikTok to be stored in Europe and United States is requiring it to be stored in the United States and China is requiring it to be stored in China, Brazil is requiring it to be stored in Brazil and India banned TikTok entirely in part because they didn't comply with the laws to store the data of their users inside of India.
“And I think that as that much more of the norm, that complexity on the regulatory environment is actually going to force people to look for a platforms that are present in all those places around the world, and that can help make sure that the data of a particular user in a particular country stays in that country and is processed in that country. And the fact that today, Cloudflare Workers run in 200 cities across more than 100 countries around the world is a really powerful feature, and some of our most sophisticated [clients], especially financial services and other global clients, are looking at Workers as a way to ensure that they can comply with that increasingly complicated regulatory environment all around the world.”
Cloudflare’s R&D priorities for Workers, and its efforts to grow Workers’ developer ecosystem.
“I think a real challenge that is still not fully satisfied [by] a platform like Workers is how you handle data. Workers has a great key value store, which [is] a relatively simple data store. But I think that that final piece that is needed in order to be able to port any type of application to get the speed, consistency, costs and compliance benefits that the Workers platform has is a way to have it through distributed database functions, which is more sophisticated than the simple key value store. And so that's an area that we're investing in heavily, that's an area that we're working on. I think when that is in place, that's when...you'll see more and more applications that are built using Workers because of the other benefits.
“And again, I think that that plays into the key of ease of use, which is there. I think that your second point about the overall ecosystem, you know one of the real powerful things about Cloudflare, is that so much of the web already sits behind our platform. And so one of the things that we're thinking a lot about is, ‘How can we use the fact that there are already nearly 30 million websites and APIs and applications that sit behind our platform, how can we use that as a way to allow developers to more effectively reach our customers and sell more to them?’
“And so you could imagine in the future, that we could have a developer platform that allows developers using Workers who very easily sell to other Cloudflare customers, the code and the function that they have that they have built. And because we have such a diverse set of customers already, that's a pretty rich environment.”
“The thing that struck me the other day, as a bit of a surprise, was that when Apple launched the Apple App Store, there were only a third as many iPhones, that had been sold as there are today, Cloudflare Internet applications that are sitting behind Cloudflare Apple launched the App Store with about 10 million iPhones in the market. Whereas today we have over 30 million Internet applications that stand behind our network. So we think that that actually provides a very unique access to a broad set of customers, and that that is an additional incentive…[for] developing applications across our platform. That it gives you access to a very broad set of customers and ways to design and tool functions for that.
“So as we're thinking about this going forward. I think we are very much focused on how we make that ecosystem for developers that build on Workers richer and richer over time.
How much Cloudflare competes against CDN owners such as Akamai, Fastly and Limelight, or against the CDN services provided by the cloud giants.
“We've never really thought of ourselves as a CDN, and most of the CDN business that that a Fastly (FSLY) - Get Fastly Inc. Class A Report or a Limelight (LLNW) - Get Limelight Networks Inc. Report or an EdgeCast bids on, which is, which is merely bit delivery, we don't think of as very interesting. So we don't see those providers almost ever in deal.
”I think that Akamai (AKAM) - Get Akamai Technologies Inc. Report has morphed slowly into being more of a security-focused company, and when there are security deals they will show up time-to-time. But I think that we’ve been very successful at winning business in that space. I think that the big public cloud providers, largely we partner with, and we have strong relationships with Microsoft and Google and the others. I think Amazon has been a more difficult company to partner with, but even there, their sales team [is] often going to market including our solutions alongside them. And so I think there are definitely times where we find ourselves in competitive situations with them, but there are a lot of times also that we go hand-in-hand to solve customers’ problems.
“Again, I think the primary companies that we, and most of the big cloud providers, and also the other security companies, are primarily encountering as competition are still on-prem hardware [vendors]. There's a lot of Cisco hardware out there that is going to get replaced over the next 10 years...We think that we're very well positioned to do that. And that COVID has only accelerated that trend.”
Cloudflare’s use of machine learning to enable and improve its services.
“I think we hesitate to say machine learning or artificial intelligence. They're overused terms, but those have been at the core of Cloudflare since our very earliest days. We use all of the traffic data through our network in order to separate good guys from bad guys, as well as to help optimize routes across the internet. So for example, our route management product is 100% a machine learning-based product that is learning from every single request that goes through our network. And...the enormous volume of traffic through our network is part of what has made that such an effective product.
“Our Argo smart routing technology is constantly running what is effectively the world's most complicated traveling salesperson problem to figure out [the most effective] path across the Internet. And we...adjust in real-time and are able to optimize again using smart algorithms that are taking in real-time data on things like latency, jitter, packet loss, costs, and other factors and optimizing for that.
“So I think that if you look across our team, you know, we have some of the best machine learning and artificial intelligence scientists and engineers. And they are constantly using our data in order to make our products better and better over time. And it's part of why every new customer that signs up for Cloudflare makes Cloudflare a better service for everyone who is currently using it.”
Cloudflare’s views on providing serverless clients with access to programmable AI accelerators, and its interest in deploying ARM-based server CPUs.
“We're always optimizing how we can...improve our products. We are experimenting with TPUs and GPUs. So far we haven't seen that [there are] significant additional benefits that we can get from that. A lot of times, generating the [AI] model is a different process than actually testing against the model. And so far, that's not something that we have deployed, but it's something that we're constantly testing.”
“We also are very big fans of ARM-based solutions. We were well down the path of migrating to ARM-based servers that were going to be powered by Qualcomm chipsets before Qualcomm unfortunately shut down their server chipset [efforts]...but in that process, we ported all of our applications over to ARM so that we can ship.
“And our thesis is that whatever chip wins the consumer market eventually wins the server market. And so while we haven't found the right solution yet for that, we're actively testing different ARM-based solutions. And some of those may end up having some vector-based processing to do machine learning and other applications.
“One thing we are seeing is that increasingly our customers are using Workers to run AI and ML loads closer to the edge. And I think that's going to be an exciting area, and if at some point that a GPU or TPU at the edge can help those workloads function better, and we can demonstrate that, then that might be something that we add as an additional feature that our customers can tap into. But so far, that hasn't been something that we've seen [as providing] substantial additional benefits.”
Which international markets Cloudflare is seeing particularly strong growth in, and where it expects international revenue (51% of Q2 revenue) to be as a percentage of revenue long-term.
“I think the fact that we are a global company for as young a company we are is already pretty surprising...North America represents 50% of revenue, and Europe and Asia each represent another 25%...If that were the case in 10 years. I think that that would be something that we would think is quite healthy and the right mix.
“Where we have seen a lot of growth recently has been in regions that have traditionally been a little bit more traditional, or a little bit lower, to adopt cloud services. So continental Europe is somewhere where for quite some time, it was thought of as a region that didn't adopt cloud services as quickly as other regions around the world. That I think changed dramatically since March. COVID forced European companies to reevaluate their strategy and, and they went from sort of leaning away from cloud services to leaning into them much more. And so we saw particular strength across large markets in Europe like Germany, Switzerland, France, Spain, Italy and others through the quarter.
“And I think that that has been really a sea change for that market. Where I think you're seeing a lot more adoption of cloud services like Cloudflare, and I think that’s exciting...I think that the COVID change took a lot of the companies that were traditionally slow to adopt cloud services and made them faster. Small businesses [were] also slow to adopt cloud services, [there was] a lot of speculation that they would actually pull back from things like cloud spending. We're seeing that the small businesses that are surviving and even thriving right now are the ones that are investing in the cloud, and so we've actually been quite pleasantly surprised at how quickly that cohort has been growing.
“And then others like industrial and manufacturing [firms] which again, have traditionally been slow to adopt the cloud. I think COVID pushed a lot of them to reevaluate their plans, accelerate their digital transformation, and turn to services like Cloudflare in order to continue to grow. And so we saw...a lot of strength in that segment, over the course of the last quarter.”