Prospectus Summary
PROSPECTUS SUMMARY This summary highlights selected information that is presented in greater detail elsewhere in this prospectus. This summary does not contain all of the information you should consider before investing in our Class A common stock. You should read this entire prospectus carefully, including the sections titled “Risk Factors” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and our consolidated financial statements and the related notes thereto included elsewhere in this prospectus, before making an investment decision. Unless the context otherwise requires, the terms “Cloudflare,” “the Company,” “we,” “us,” and “our” in this prospectus refer to Cloudflare, Inc. and its consolidated subsidiaries, and references to our “common stock” include our Class A common stock and Class B common stock.Cloudflare, Inc.
Overview
Cloudflare’s mission is to help build a better Internet.
Today, the Internet is the lifeblood of business and the primary vehicle of commerce and communication for people around the world. While it was brilliantly architected to deliver fault tolerance and robust connectivity, it was not designed to deliver the security, millisecond performance, and reliability required for businesses today.
For decades, a number of vendors have looked to address the core limitations and vulnerabilities of the Internet for businesses that operate online. These vendors built a range of standalone hardware boxes to address the emerging requirements for security, performance, and reliability. These boxes could be deployed in on-premise data centers to deliver functions such as virtual private network (VPN), firewall, routing, traffic optimization, load balancing, and other network services. While they created massive complexity, cost, technical debt, and a tangled web of dependencies for the organizations that deployed them, the approach generally worked and these on-premise “band-aid boxes” were able to alleviate some of the Internet’s fundamental security, performance, and reliability problems.
And then the cloud happened.
In recent years, the technology industry has undergone a massive transition from on-premise hardware and software that customers buy, to services in the cloud that they rent. This transition has swept through the application, compute, and storage layers of enterprise computing architectures.
Organizations now exist in a complex, heterogeneous infrastructure environment which exacerbates the fundamental problems of the Internet more than ever, and the on-premise band-aid boxes that they once relied upon to solve these problems were never designed to work in such an environment. An on-premise box will not solve the problems organizations now face. Nor can a business ship a band-aid box to a cloud vendor. Even if they wanted to, there is literally no place to install such a box in the cloud.
The result is that a major architectural shift at the network layer is now underway. Cloudflare is leading this transition.
We have built a global cloud platform that delivers a broad range of network services to businesses of all sizes and in all geographies—making them more secure, enhancing the performance of their business-critical applications, and eliminating the cost and complexity of managing individual network hardware. Our platform serves as a scalable, easy-to-use, unified control plane to deliver security, performance, and reliability across on-premise, hybrid, cloud, and software-as-a-service (SaaS) applications. Today, approximately 10% of the Fortune 1,000 are paying Cloudflare customers. Additionally, across the broader Internet, approximately 10% of the top million, 17% of the top 100,000, and 18% of the top 10,000 websites use at least one product on our platform on a paid or free basis.(1) We started by building an efficient, scalable network. This network forms the foundation of our platform on which we can rapidly develop and deploy our products for our customers. Together, the development of our network and products create the interconnected flywheels that drive our business and have allowed us to achieve our market position.
We have experienced significant growth, with our revenue increasing from $84.8 million in 2016 to $134.9 million in 2017 and to $192.7 million in 2018, increases of 59% and 43%, respectively. As we continue to invest in our business, we have incurred net losses of $17.3 million, $10.7 million, and $87.2 million for 2016, 2017, and 2018, respectively. For the six months ended June 30, 2018 and 2019, our revenue increased from $87.1 million to $129.2 million, an increase of 48%, and we incurred net losses of $32.5 million and $36.8 million, respectively.
Our Industry
The Internet was not built for what it has become.
Originally conceived as a decentralized, wired network to interconnect academic institutions, the Internet has evolved into a global platform for business and communications, hosting a wide variety of often mission-critical applications. While the Internet was brilliantly architected to deliver fault tolerance and robust connectivity, it was not designed to deliver the security, millisecond performance, and reliability required now that it has become the lifeblood for business and the primary vehicle of commerce and communication for humanity.
Despite the Internet’s limitations, businesses relying on it must meet customer expectations for always-on access to their services, low latency, total reliability, and high levels of security and privacy. Furthermore, businesses are accountable for the delivery of these requirements end-to-end, to every customer and employee’s desktop or mobile device, forcing them to address security, performance, and reliability globally and well beyond what they once thought of as the perimeter of their own infrastructure.
Band-Aid Boxes
To meet evolving expectations and navigate the limitations of the Internet, businesses have traditionally relied on a broad array of hardware devices deployed in on-premise data centers to deliver
functions such as VPN, firewall, routing, traffic optimization, load balancing, and other network services. These band-aid boxes were meant to patch the Internet and address its core limitations. While the band-aid boxes added some security, performance, and reliability benefits, they contributed to massive complexity, cost, technical debt, and a tangled web of dependencies.
In spite of the drawbacks, the band-aid boxes were sufficient to ensure the safety, functionality, and resilience required by businesses that could afford them in the on-premise paradigm.
But these band-aid boxes were never designed to work in the cloud.
Shift to the Cloud
In recent years, the technology industry has been undergoing a transition from on-premise hardware and software that customers buy, to services in the cloud that they rent. Application vendors led this transition as companies like Salesforce, Workday, and NetSuite provided cloud-based, multi-tenant solutions that disrupted legacy, on-premise software from companies like SAP, Oracle, and Microsoft. Compute and storage followed, with public cloud vendors such as Amazon Web Services, Microsoft Azure, Google Cloud Platform, and Alibaba Cloud disrupting server and storage vendors like HP, Dell, Lenovo, and Sun Microsystems.
The Network Layer Transitions to the Cloud
The rise of cloud computing architectures alongside the massive increase in mobile devices vastly complicates the already difficult task of securing and optimizing applications. Organizations exist in a complex, heterogeneous infrastructure environment of public cloud, on-premise, and hybrid deployments. The threat landscape, functional requirements, and scale of business applications are evolving faster than ever before, and the volume and sophistication of network attacks can strain the defensive capabilities of even the most advanced enterprises.
The hardware-based, inflexible, on-premise band-aid boxes that organizations once relied upon to meet these challenges were never designed to work in an environment like this. And even if the band-aid boxes could scale to meet the challenges of the modern enterprise, a business cannot simply ship a band-aid box to a cloud vendor. There is literally no place to install such a box in the cloud.
This is forcing a major architectural shift in how enterprises address security, performance, and reliability at the network layer. The functionality provided by companies such as Cisco Systems, Juniper Networks, F5 Networks, Check Point Software, Palo Alto Networks, FireEye, Riverbed Technology, and others is being elevated, abstracted, and unified into the cloud.
Cloudflare is leading this transition.
Our Platform
We have built a global cloud platform that delivers a broad range of network services to businesses of all sizes around the world—making them more secure, enhancing the performance of their business-critical applications, and eliminating the cost and complexity of managing and integrating individual network hardware. We provide businesses a scalable, easy-to-use, unified control plane to deliver security, performance, and reliability across their on-premise, hybrid, cloud, and SaaS applications.
Previously, enterprises would often string together a diverse set of on-premise band-aid boxes from different vendors to solve their network challenges. As these solutions move to the cloud, the network latency, support complexity, and cost of overhead makes stringing together multiple point-cloud solutions that only address a specific network need untenable. Customers are therefore looking to consolidate behind a single platform. We offer this unified control plane. Customers who join our platform using one product can adopt our other seamlessly integrated products with a single click. We serve comprehensive customer needs across security, performance, and reliability. Our platform and business model are designed to make rolling out our new products fast and efficient. We believe that platforms with the broadest catalogue of products will ultimately beat point-cloud solutions.
To achieve what we have, we started by building an efficient, scalable network. This network forms the foundation of our platform on which we can develop and deploy our products for our customers. Together the development of our network and products create the interconnected flywheels that drive our business and have allowed us to achieve our market position.
Network Flywheel
We have created a network architecture that is flexible, scalable, and gets more and more efficient as it expands. We designed and built our network to be able to grow capacity quickly and inexpensively; to allow for every server, in every city, to run every Cloudflare service; and to allow us to shift customers and traffic across our network efficiently. We refer to this architecture as “serverless” because it means we can deploy standard, commodity hardware, and our product developers and customers do not need to worry about the underlying servers. Our software automatically manages the deployment and execution of our product developers’ code and our customers’ code across our network. Because we manage the execution and prioritization of code running across our network, it means that we are both able to optimize the performance of our highest paying customers and also effectively leverage idle capacity across our network. We have chosen to utilize this idle capacity to create a free tier of service—which has generated substantial global scale for us. In turn, this scale makes us attractive partners for Internet Service Providers (ISPs) globally, which reduces our co-location and bandwidth costs. As our network grows, these dynamics become even more powerful.
Today, our network spans 193 cities in over 90 countries and interconnects with over 8,000 networks globally, including major ISPs, cloud services, and enterprises. We estimate that we operate within 100 milliseconds of 98% of the Internet-connected population in the developed world, and 93% of the Internet-connected population globally (for context, the blink of an eye is 300-400 milliseconds).(2) And, we have built this powerful network while achieving U.S. GAAP gross margin of 77% in the year ended December 31, 2018 and the six months ended June 30, 2019, demonstrating the cost and capital efficiency of our model.
Product Flywheel
We began with the idea of serving the broadest possible market. To do this, we made our products easy to use and affordable and were able to provide our entry level plan for free in part because of the cost advantage of our network. We leverage the resulting customer scale and diversity to continuously make our products better. Our machine learning systems improve our products with every customer’s request, optimizing our security, performance, and reliability globally. The over 20 million Internet properties (e.g., domains, websites, application programming interfaces, and mobile applications) that use our platform comprise a global sensor network, which functions like an immune system for the Internet—routing around congestion, optimizing for traffic conditions, and using data on cyber attacks
against any one of our customers to better protect them all. We leverage these insights to block cyber threats every day, which in the three months ended June 30, 2019 averaged approximately 44 billion per day.
Feedback from our diverse, global customer base helps us expand into new, adjacent product areas. Since our customers’ traffic is already passing through our network, our serverless architecture means we can add products on our platform to solve new network challenges without significantly increasing our incremental costs. This allows us to provide new products at competitive prices and further expand the overall market.
Market Opportunity
We believe our platform disrupts several large and well-established IT markets. The key markets that are addressed by our platform include VPN, internal and external firewalls, web security (including web application firewalls and content filtering), distributed denial of service (DDoS) prevention, intrusion detection and prevention, application delivery controls, content delivery networks, domain name systems, advanced threat prevention (ATP), and wide area network (WAN) technology. From our analysis based on IDC data, $31.6 billion was spent on those products in 2018, which is expected to grow to $47.1 billion in 2022, representing a compound annual growth rate of 10.5%. We also are actively developing new products to address adjacent markets including compute, storage, 5G, and Internet of Things (IoT) that are not included in the estimate of our addressable market.
Why We Win
We have six distinct advantages that uniquely position us to win:
Growth Strategy
Key elements of our growth strategy include:
Risk Factors Summary
Our business is subject to numerous risks and uncertainties, including those highlighted in the section titled “Risk Factors” immediately following this prospectus summary. These risks include, but are not limited to, the following:
Channels for Disclosure of Information
Investors, the media, and others should note that, following the completion of this offering, we intend to announce material information to the public through filings with the Securities and Exchange Commission (the SEC), the investor relations page on our website, press releases, public conference calls, webcasts, our company news site at https://www.cloudflare.com/press, and our corporate blog at https://blog.cloudflare.com.
The information disclosed by the foregoing channels could be deemed to be material information. As such, we encourage investors, the media, and others to follow the channels listed above and to review the information disclosed through such channels.
Any updates to the list of disclosure channels through which we will announce information will be posted on the investor relations page on our website.
Corporate Information
We were incorporated in the state of Delaware in July 2009. Our principal executive offices are located at 101 Townsend Street, San Francisco, California 94107, and our telephone number is (888) 993-5273. Our website address is www.cloudflare.com and our corporate blog’s address is https://blog.cloudflare.com. Information contained on, or that can be accessed through, our website or blog does not constitute part of this prospectus and inclusions of our website and blog addresses in this prospectus are inactive textual references only.
“Cloudflare,” our logo, and our other registered or common law trademarks, service marks, and trade names appearing in this prospectus are the property of Cloudflare, Inc. Other trademarks and trade names referred to in this prospectus are the property of their respective owners.
Implications of Being an Emerging Growth Company
We are an “emerging growth company” as defined in the Jumpstart Our Business Startups Act of 2012 (the JOBS Act). An emerging growth company may take advantage of specified reduced reporting requirements that are otherwise applicable generally to public companies. These reduced reporting requirements include:
We may take advantage of these provisions until we are no longer an emerging growth company. We would cease to be an “emerging growth company” upon the earliest to occur of: (i) the last day of the fiscal year in which we have greater than $1.07 billion in annual revenue; (ii) the date we qualify as a “large accelerated filer,” with at least $700 million of equity securities held by non-affiliates; (iii) the date on which we have, in any three-year period, issued greater than $1.0 billion in non-convertible debt securities; and (iv) the last day of the fiscal year ending after the fifth anniversary of this offering. We may choose to take advantage of some but not all of these reduced reporting burdens. We have taken advantage of certain reduced reporting burdens in this prospectus. Accordingly, the information contained herein may be different than the information you receive from other public companies in which you hold stock.
The JOBS Act permits an emerging growth company like us to take advantage of an extended transition period to comply with new or revised accounting standards applicable to public companies. We have elected to use this extended transition period until we are no longer an emerging growth company or until we affirmatively and irrevocably opt out of the extended transition period. As a result, our financial statements may not be comparable to companies that comply with new or revised accounting pronouncements as of public company effective dates.
See the section titled “Risk Factors—Risks Related to Ownership of Our Class A Common Stock—We are an “emerging growth company” and we cannot be certain if the reduced disclosure requirements applicable to emerging growth companies will make our Class A common stock less attractive to investors.”