Business Breakdowns
· Sam Eden
[00:00:00] S1: The Cloudflare we just described looked very different to the Cloudflare of today in terms of their product suite. The main product evolutions have been going from that product-led growth to enterprise, and then using that single global network to add services. So they've added a lot of internal cybersecurity products, and then a whole developer platform on them. We can go through each of those. The first one is just that transition from serving this long tail only of freemium customers to serving the biggest websites in the world. And it follows that same loop. The more data they collected, the more they could build out the network. It reached a tipping point where now their capacity and their services were better than the legacy companies. Their capacity to absorb, say, cyberattacks or those DDoS attacks is just unmatched. And a recent example they gave in one of their earnings calls is they won over a large customer because their DDoS protection capacity was over four times the two legacy competitors combined. It was over 30 terabytes per second that they just easily absorbed because they'd continually built out this network. So they can serve the long tail and now these high willingness-to-pay enterprise customers. That's one product evolution within their original product set. They're able to evolve just from those web security products, to this whole new market of internal cybersecurity.
· Matt Reustle
[00:00:00] S0: I've seen a lot of references to this in terms of a kind of a growth engine, but how would you articulate what's going on there? I think it's clear once it's articulated, but describe that for the audience.
· Sam Eden
[00:00:00] S1: If you think about the services I've just explained, it's Cloudflare intercepting outside traffic for a website. What they realized is that, "We have all this hardware. Why don't we intercept and inspect traffic that goes from a company to the outside world?" It's basically the other way. This is a reverse proxy and a forward proxy, and they use the same hardware for that. So, if you think of a reverse proxy as protecting a website from the public internet, a forward proxy server – which is their whole security products – is protecting an employee from the outside internet. It protects you when you have outbound traffic. This is the basis of the whole product suite. It's often termed zero trust. That's a type of approach that you can provide these internal security products. Zero trust means there's zero trust between any app and any user. So if you contrast that to old services, maybe you log into your corporate network. You gain trust once and then you're within your private network. Zero trust just means just because you could access app number one, doesn't mean you can access app number two. You have zero trust between the apps. You have to get validated each time. To do that, that means you have to get inspected each time. All of your web requests have to get inspected each time. And that looks a lot like their original services because they're very, very good at inspecting every single packet. So they realized that they could apply their commodity hardware. They didn't have to change anything. They just added a software layer to provide this whole new market of internal corporate cybersecurity.
· Matt Reustle, Sam Eden
[00:00:00] S0: If I'm thinking about that as an internal employee, would that be if I'm logged in and I click on a link that goes to a website, it's giving me the alert that this looks unsafe. Does it extend beyond that in terms of phishing emails and scams? Curious to know who's doing what in the chain of constant precautions that I'm being told? [00:00:00] S1: Anytime you're doing something on the internet in a work context, that's this whole space. And Cloudflare has a solution to that. It's a very broad market, there's a lot of competitors in here. There's probably three buckets of activity that an employee will commonly take that you need to protect. One would be you're on your work laptop or your work network and you're visiting an outside public website. And you want to make sure that the traffic going in and out of your work environment to the public internet is safe and secure. The second type would be you're working just with your internal apps. You're checking Salesforce, you're checking ServiceNow, things like that. So you need to make sure that you're actually approved – and this is that zero trust – approved to view each app. And then maybe there's different policies on what you can view. And then the third bucket is, I guess, all the adjacent things with that. The email security is one, protecting against phishing attacks and things like that.
· Matt Reustle
[00:00:00] S0: I've definitely experienced where being on-prem, I can use certain apps even, but once I'm off-prem, I'm mobile or on my own device, there are certain restrictions on what I can access. For good reason. I have some sense of how they've evolved pretty naturally from being that external third-party guard dog of sorts to also protecting from the inside. Would you point to anything else just in terms of the evolution or what they've rolled out that was key or monumental in terms of the development of the overall business and what they offered?
· Sam Eden
[00:00:00] S1: This is a continual evolution that all companies are going through is – your corporate environment used to just be your on-prem network, but now everything's cloud-based. You can work from home. You can work from anywhere. The corporate perimeter or security perimeter is effectively the whole internet. That's why they can fit nicely in there and provide those services. They realized that with their hardware system and their single global network, they could expand from web services to corporate security. The way they did that was building a lot of the software themselves. To be able to provide these services at a global scale, they often had to build a lot of their own software. They couldn't rely on AWS, for example. No one else could handle their scale, and they wanted to have really strong security. What that meant is they have this proprietary software stack. That leads to their next product evolution, where they realized that if you can build Cloudflare using these internal tools that we've built ourselves, then other developers will be able to build really powerful products with these tools as well. So they started offering these services to the developer market. So these include things like cloud storage, lightweight databases, video services, and their flagship product in this – what's called Act 3 – is the Cloudflare Workers. So that's a serverless function service. And they specialize in lightweight containers, lightweight functions that can be spun up and spun down really quickly to solve bite-sized tasks.