Cloudflare, Inc. Research Report
Cloudflare, Inc. Research Report
Cloudflare (NET) Deep Dive
In September 2019, Cloudflare, Inc. (Ticker: NET) made its public debut and successfully raised more than $525 million through an initial public offering (IPO) with a $5.2 billion company valuation. Since then, Cloudflare's market capitalization has tripled to $16.6 billion. Matthew Price, the CEO of Cloudflare, pitched the company at the 2010 TechCrunch Disrupt conference. He explained that internet giants have two major concerns: making sure their website is fast and secure. Watching back this pitch makes for fascinating viewing thirteen years later.
What has propelled Cloudflare's market capitalization to triple since its IPO in 2019, and how has the company positioned itself to address the critical challenges of internet speed and security?
Contents
Executive Summary
Overview
Customer Base
Financial Analysis
Competitive Landscape
Management and Ownership
Risks
Opportunities
Valuation
Investment Outlook
1. Executive Summary
Cloudflare's success can be attributed to their ability to offer a range of cloud-based services that help organisations tackle the challenges of managing complex infrastructure in today's ever-changing technology landscape. They've created a highly efficient, scalable, and serverless network that spans the globe, connecting with major ISPs, cloud services, and enterprises, which helps them save on co-location and bandwidth costs and makes them an attractive partner for ISPs worldwide.
Cloudflare has a large and diversified customer base, consisting of both free and paying customers. The free tier service helps to test new products and gain feedback before promoting to paid tiers, and it attracts small businesses that can potentially grow into paying customers. Cloudflare's annual recurring revenue has seen significant growth in both the number of customers with high ARR and the total ARR value suggesting that the company's product strategy of expanding its offerings and upselling more services to customers is proving successful. Despite all of this, Cloudflare's revenue heavily relies on a small number of large customers, with 60% of their revenue coming from just 2,156 large customers. Growth in new paying customers has slowed to 13% in Q1 2023.
Cloudflare's product shortcomings noted by Gartner, such as limitations in deployment options, inconsistent post-sale support, deficiencies in reporting and incident response capabilities, and a cluttered management interface, could potentially lead to a loss of customers who require these features for their specific use case. The company's gross retention rate falling below 90% further highlights this risk.
Cloudflare's ownership and operation of over 285 data centres and its highly distributed development platform provide a significant opportunity for network leverage, enabling the company to offer faster, more reliable, and more secure services to its customers. Hyperscalers and new entrants may find it challenging to duplicate this approach due to the significant capital expenditure costs and the need to re-architect their systems.
Cloudflare believes that it has a large addressable market that will reach $204 billion by 2026, with potential for growth in developer services, AI solutions, data localization, multi cloud ecosystems, and Zero Trust security products. The company aims to reach an annual revenue run rate of $5 billion within five years based on its existing portfolio of products and services. Cloudflare’s expanding set of products is an excellent opportunity for the company to consolidate security vendors, reduce costs, gain more control over traffic flow, and implement Zero Trust.
2. Overview
Cloudflare is a global cloud services provider with the mission to “help build a better internet”. As the technology industry has shifted from on-premises hardware and software to cloud services, organisations face challenges in managing their complex infrastructure. These challenges are exacerbated by the fundamental problems of the Internet, and on-premises hardware boxes are no longer effective solutions. As a result, a major architectural shift at the network layer is underway, and customers are consolidating behind a single global cloud services provider.
Cloudflare offers a broad range of services to businesses of all sizes and geographies, delivering security, performance, and reliability across on-premises, hybrid, cloud, and software-as-a-service applications. Their network is designed to be efficient, scalable, and serverless, allowing them to rapidly develop and deploy their products for customers. Cloudflare's software manages the deployment and execution of their product developers' and customers' code across their network, improving the performance of their highest paying customers and leveraging idle capacity across their network. Their network spans over 285 cities in over 100 countries worldwide, interconnecting with major Internet Service Providers (ISPs), cloud services, and enterprises, making them an attractive partner for ISPs globally and reducing their co-location and bandwidth costs.
Cloudflare offers a suite of deeply integrated products to provide security, performance, and reliability for an organisation's external-facing infrastructure such as websites, applications, and Application Programming Interface (API)’s. Customers can start with just one product and easily expand over time by adding most products with a single click. Cloudflare's integrated suite of products includes:
Website and Application Services provides a range of products that help businesses protect and optimise their websites, applications, and APIs, while also offering analytics tools to monitor and analyse traffic data in real-time.
Cloudflare One provides a comprehensive, cloud-based network-as-a-service solution that is secure, fast, reliable and future-proof for corporate networks. It leverages the public internet and offers network services, including connectivity, security, and performance, and Zero Trust services that protect, inspect and privilege data. It brings together how employees connect, on-ramps for branch offices, secure connectivity for applications, and controlled access to SaaS applications in a single pane of glass.
Developer-based Solutions allows developers to create scalable applications using a serverless platform without worrying about infrastructure or operations. This results in more efficient and high-performance applications that can scale globally instantly, while freeing up developers' time.
Consumer Offerings improve Internet performance and security for individuals, while also enhancing the effectiveness of its business offerings. The consumer products also serve as a marketing channel to raise brand awareness.
In layman's terms, Cloudflare provides a range of internet services to help protect websites and improve their performance. They offer services like website security, content delivery network (CDN), and domain name management. By using Cloudflare, websites can be faster, more secure, and more reliable, making it a better experience for visitors. Cloudflare's services are used by millions of websites around the world, from small blogs to large corporations.
Cloudflare has a hybrid pricing model that combines consumption-based and subscription-based pricing. The consumption-based pricing applies to certain services where customers are charged based on the volume of usage. The subscription-based pricing applies to services where customers pay a fixed monthly or annual fee for access to the service. Additionally, some services may have a combination of both pricing models.
Cloudflare's hybrid pricing model offers flexibility and control to customers by providing options between subscription-based or consumption-based pricing. It also enables customers to easily scale their usage up or down without being locked into a fixed pricing plan. The model aligns Cloudflare's incentives with those of its customers and encourages increased usage by decreasing the cost per unit of service as volume increases.
3. Customer Base
Cloudflare has a global community of millions of free and paying customers who manage millions of Internet properties on their network. Paying customers are diversified across organisations of all sizes in major industry verticals. Their large customer count has been steadily increasing, and no single customer accounted for more than 10% of their revenue in the past three years.
Some key metrics related to Cloudflare's customer base as of 31 March 2023:
Total Customers: Cloudflare has over 168,000 paying customers but provides a free service tier to millions of users, which helps to test new products and gain feedback before promoting to paid tiers. While utilisation from the free tier is relatively low and capped, the benefit is significant as these users provide valuable signals to identify threats and malicious behaviour, which feeds into security effectiveness. The free tier also attracts small businesses that can potentially grow into paid customers.
Annual Recurring Revenue (ARR): Cloudflare's ARR has seen significant growth in both the number of customers with high ARR and the total ARR value. The increase in the number of customers with ARR of $100,000 or more indicates a trend of strong growth in the high-value customer segment. It also means that the company's revenue growth is still heavily reliant on the addition of large customers, which may indicate a need to diversify the customer base in the future to ensure sustained growth.
Cohorts: Cloudflare is experiencing significant growth in the number of large customers spending $500k or more and $1M or more. This growth in large customers is actually outpacing the company's revenue growth and the growth of its $100k customers. This suggests that the company's product strategy of expanding its offerings and upselling more services to customers is proving successful. It also highlights the importance of focusing on customer retention and upselling, rather than just customer acquisition, to drive sustained growth.
Customer Retention Rate: Historically, Cloudflare has had a high customer retention rate, with a dollar-based net retention rate (DBNRR) of above 120%. For context, a DBNRR above 100% indicates that the company is generating more revenue from its existing customers than it lost from churn and contraction.
The DBNRR has slipped to 117% at Q1 2023, steadily declining from 127% twelve months prior. On the Q4 2022 earnings call, management explained that the declining DBNRR is not due to elevated churn but is attributable to slower expansion with pay-as-you-go customers and those spending less than $100k. Management reiterated their expectation that DBNRR will trend upwards over time towards their long-term target of 130% plus. During the Q1 2023 earnings call, management again explained that the declining DBNRR is not due to elevated churn but due to slower expansion from existing customers.
Management’s explanation appears reasonable initially. However, I noticed that the comment “Gross retention above 90%” that was included in the Q4 2022 slide deck was removed from the Q1 2023 version above. The rest of the slide is identical. My assumption is that this comment has been removed because the gross retention has dropped below 90%.
4. Financial Analysis
Cloudflare’s growth and expansion of its customer base has resulted in a strong growth rate of around 50% annually for the past two years, with revenue reaching almost $1 billion in 2022.
However, this growth has slowed to 37% for the first quarter of 2023 with management citing:
a material lengthening of sales cycles, a significant decline in close rates, even as win rates held strong, and an extreme back-end weighting to the quarter
Cloudflare has some of the shortest sales cycles in the industry (<1 quarter) meaning that short sales cycle businesses usually see the impact upfront which resulted in the sales cycle increasing by 27%.
Cloudflare's gross margin has remained consistent for the past five years, ranging between 75% and 77%. This consistency indicates that Cloudflare has a good handle on its cost structure and has been able to maintain healthy margins even as it has grown. Cloudflare's cost of revenue primarily consists of expenses related to operating in co-location facilities, network and bandwidth costs, depreciation of equipment, and amortisation of internal-use software and acquired technologies.
On a GAAP basis, Cloudflare is not yet profitable. The company recorded a Q1 2023 trailing twelve months (TTM) operating loss of $200 million resulting in an operating margin of -19%.
Cloudflare achieved an important milestone in 2022 by achieving Non-GAAP profitability. As part of the Q4 2022 earnings, management laid out a clear path to achieving higher operating margins in the future, which will improve its financial performance and make it more competitive with its peers.
Q1 2023 saw further improvements to the non-GAAP operating margin with management once again reaffirming the long-term model.
Cloudflare's improvement in operating margin has been driven by a reduction in the percentage of revenue allocated to sales and marketing (S&M), research and development (R&D), and general and administrative (G&A) expenses. The company has already reached its long-term target for R&D spend and is getting close to reaching the target for G&A.
The increasing share of revenue generated by large customers is contributing to this improvement, as these customers are increasing their spend at a faster rate than overall revenue growth. This is driven by the adoption of more Cloudflare products, which can be upsold with less sales effort than landing a new customer. As a result, the expansion with large customers should support higher sales efficiency, allowing for less investment in sales and marketing while maintaining the same growth rate.
On the Q1 2023 earnings call Matthew Prince remarked:
We've identified more than 100 people on our sales team who have consistently missed expectations. Simply put, a significant percentage of our sales force has been repeatedly underperforming based on measurable performance targets and critical KPIs. That's obviously a problem. But it's one in this environment with a particularly available and actionable solution. We are now in the process of quickly rotating out those members of our team who have been underperforming and bringing in new talent with salespeople who have a proven track record of success, grit, and a strong cultural fit
While this honesty might appear refreshing, it raises an important question. If the products truly have high demand, then why throw staff under the bus for not selling products that should be easy to sell?
The messaging around this was something that I was watching out for at the Cloudflare Investor Day 2023 which was held on 4 May 2023. The leadership team emphasized that:
We are not limited by TAM, opportunity or capacity, we are performance constrained
This message was consistently conveyed throughout the event, and the company has put forth a detailed 2023 Action Plan to improve performance, which is a positive development. We will soon discover whether the sales team or the Cloudflare products were responsible for the revenue slowdown.
Financial Position
Total Liabilities as percent of Total Assets has disimproved from 66% in 2021 to 76% at Q1 2023 primarily as a result of the change in accounting treatment of Convertible Senior Notes (Prior to January 1, 2022, the Company accounted for its Convertible Senior Notes due 2025 and 2026 as separate liability and equity components; however, the adoption of ASU 2020-06 led to the Notes being accounted for as a single liability measured at its amortised cost).
Significant level of debt (convertible senior notes) amounting to $1.4 billion making up 54% of total assets.
Goodwill balance making up almost 6% of total assets arising from a series of acquisitions including Area 1 Security for a reported $162 million in 2022 (Source: Tech Crunch).
Cash Flow Analysis
Cloudflare's operating cash flow increased significantly in 2022 (+91% to $124 million), but a significant portion of this increase can be attributed to the sharp rise in stock-based compensation (SBC) expenses. The fact that SBC has increased by over 120% in 2022 to $203 million, which is over twice as fast as revenue growth, suggests that the company has been quite generous in awarding stock-based compensation to its employees.
This is concerning because of the amount of shareholder dilution that it is causing. At the end of 2022 there were 328.6 million shares outstanding compared to 321.7 million at the end of 2021. This represents shareholder dilution of 2.1% in 2022. Since the end of 2019, an extra 28 million shares outstanding are in circulation representing total dilution of over 9% in 3 years.
Koyfin is the tool that I use to screen and analyse stocks. In my opinion, it is the most comprehensive financial data and visualisation tool that makes the research process so much easier for investors. If you would like to try it for yourself, you can click here to sign up and receive a 10% discount.
Cloudflare recorded Q1 2023 TTM free cash flow of $44 million which improved from -$43m in 2021. Despite posting positive operating cash flow, Cloudflare has only recently started to produce positive free cash flow due to the investments in capital expenditure (CapEx) which have continued to ramp up at a CAGR of 40% over the past six years.
Cloudflare's business model depends on robust global network infrastructure. Regular investment in network CapEx is critical to maintaining optimal performance and reliability of its services. It is reasonable to expect that network CapEx will gradually decrease over time, as the initial investments required to establish a global network infrastructure are completed. The focus will then shift to adding capacity to support increased usage. As part of the Q4 2022 earnings, management revealed that the company is allocating 11% to 13% for network CapEx in 2023, which is below the range set for 2022. Leadership have attributed this reduction to the flexibility, elasticity, and scalability achieved by the network.
Cloudflare is working to maintain and increase positive free cash flow margin going forward into 2023 and subsequent years. The introduction of new pricing and billing terms for pay-as-you-go customers, shifting from monthly to annual payments upfront is one initiative that should boost FCF. Customers who choose to remain on monthly payments will experience a 25% increase in cost. Although this segment represents less than 20% of Cloudflare's revenue, the lump sum payment upfront is expected to have a material impact on cash flow. Cloudflare is also negotiating for more front-loaded payment terms for the rest of its business under contract. By collecting cash at the beginning of a billing cycle, Cloudflare can increase its operating cash flow margins.
5. Competitive Landscape
Cloudflare is a Leader in the Magic Quadrant for Web Applications and API Protection (WAAP) compiled by Gartner. The report evaluates vendors based on their ability to provide security solutions for cloud-native web and API applications. The report highlights the importance of cloud-based security solutions and identifies the key features and functionalities that customers should consider when selecting a provider.
Whilst Cloudflare is a leader in its field, it competes with several companies that offer similar solutions. Some of the main competitors include:
Akamai: Akamai is a global cloud and security provider and a Leader in the Magic Quadrant. Its primary offerings include a CDN and application security services. It has expanded its security portfolio with acquisitions and updates, including the merging of WAP with Kona Site Defender to create App & API Protector. Multiple add-ons and features are available, including Account Protector, updated ASE, and Terraform deployments.
Imperva: Imperva is a Leader in this Magic Quadrant and is a privately held application and data security vendor known for its advanced cloud WAAP features. Its Cloud WAF offering is part of the "Imperva Anywhere" portfolio, which includes other security services such as a WAAP gateway, database security, DNS security, and RASP. Notable improvements in the past year include better CDN and caching features, support for external HSMs, and enhanced bot protection with a new tarpit action.
Radware: Radware is a Visionary in this Magic Quadrant, focused on applying machine learning techniques and rules to cloud WAAP security. They also offer innovative WAAP options for DevOps. Radware is primarily known for Distributed Denial-of-Service (DDoS) protection and provides WAAP through various form factors, including appliances and as a cloud service. Recently, Radware added API threat protection features to its cloud WAAP, including automated detection of API changes and a feature to minimise false positives.
Fastly: FastlyCDN and DDoS provider, is a Challenger in this Magic Quadrant. Fastly's cloud-based WAAP, Next-Gen WAF, is deployed as a runtime agent and WAAP service. It relies on its proprietary SmartParse engine, which uses a mix of vendor, templated, and custom rules. Recently, Fastly has introduced edge rate limiting, Response Security Service, and support for GraphQL inspection and HTTP/3.
F5: F5 is a Niche Player in this Magic Quadrant. It provides a portfolio of application delivery and security products, including Distributed Cloud WAAP, Silverline Web Application Firewall, Silverline DDoS Protection, and Silverline Shape Defense. It also offers an appliance-based WAF (BIG-IP Advanced WAF) and a lightweight module for NGINX called App Protect. F5's February 2022 launch of Distributed Cloud WAAP is a significant step in its strategic shift to a cloud-native platform. F5 has also acquired Threat Stack to improve its cloud security and compliance capabilities.
* All figures in US$ billions
Research from The Forrester Wave positions Cloudflare as a Leader for Web Application Firewalls and a Strong Performer for Bot Management. The competitive landscape remains similar with Akamai and Imperva both featuring strongly.
Rule of 40
Cloudflare significantly outperforms its competitors according to the Rule of 40, despite being a relatively smaller player.
Despite Akamai's dominant position with $3.6 billion in revenue, which is almost four times larger than Cloudflare, it only grew its revenue by 4% compared to Cloudflare's impressive growth rate of 44% TTM. Akamai’s healthy FCF margin of 23% suggests that Cloudflare may achieve a FCF margin of over 20% within the next few years.
6. Management and Ownership
Cloudflare was founded in 2009 by Matthew Prince, Michelle Zatlyn, and Lee Holloway. The founding story of Cloudflare began in 2004 when Matthew Prince and Michelle Zatlyn met while studying at Harvard Business School. After graduation, Prince worked at a law firm while Zatlyn worked at Google. In 2009, the two decided to start their own company and moved to California's Silicon Valley to work on their startup.
The idea for Cloudflare came to Prince while he was serving as a clerk for a judge in the U.S. Court of Appeals. He noticed that many websites, especially those of small and medium-sized businesses, were vulnerable to DDoS attacks and other cyber threats. Prince believed that he could help these companies by creating a system that would protect them from these attacks. Prince then reached out to Lee Holloway, a former colleague who had expertise in web performance and security. Together, they developed the initial concept for Cloudflare, a platform that would provide website security and performance optimization services.
As referenced in the intro, Cloudflare officially launched in 2010 and quickly gained popularity among website owners. The company's CDN and DDoS mitigation services helped websites load faster and stay online during peak traffic periods, while its security services protected them from cyber attacks.
Cloudflare is led by its co-founders, Matthew Prince (CEO), Michelle Zatlyn (COO), and Lee Holloway (CTO). Regrettably, in 2015 Lee Holloway had to depart from the company due to frontotemporal dementia. Matthew Price is the largest individual shareholder in Cloudflare, with a 10.2% stake (Source: Fintel). This represents significant skin in the game and should mean that Prince's interests are closely aligned with those of other shareholders. The company's largest institutional shareholder is Morgan Stanley, which owns a 10.7% stake. Other major institutional shareholders include Vanguard and Baillie Gifford.
Matthew Price achieves an 88% approval rating on Glassdoor with the company overall scoring 4.0 out of 5 by its own employees. Of note, some of the negative reviews relate to a change in culture and employee burnout.
Cloudflare's management is incentivized through long-term incentives and performance-based compensation, with no annual cash bonus program and no base salary increases in 2022. At the end of 2021, Co-founders Matthew Prince and Michelle Zatlyn were granted a 10-year performance-based option to purchase 3,960,000 shares of Cloudflare's Class A common stock, subject to certain stock price milestones being achieved and them remaining in primary leadership positions.
However, the Co-Founder Performance Awards were later forfeited by the co-founders after the Board of Directors withdrew the proposal to approve the awards from the agenda of the 2022 Annual Meeting, following feedback from stockholders, internal discussions, and advice from legal and other advisors. In April 2023, Cloudflare approved a special, one-time retention grant of 307,482 restricted stock units (RSUs) for each co-founder, which will vest quarterly over four years and are subject to double-trigger acceleration of vesting provisions. The new equity awards were structured as time-based equity awards sized for an annual grant, rather than the larger size and longer-term structure of the Co-Founder Performance Awards, to incentivize the co-founders to continue as key leaders in the short-to-mid-term and to drive business growth.
Thomas Seifert (CFO) and Douglas Kramer (General Counsel and Secretary) were granted long-term incentive compensation opportunities in February 2021 and 2022 in the form of restricted stock unit (RSU) awards and performance-based stock options that vest over four years based on the same stock price targets as the Performance Awards. However, due to market conditions and decline in the company's stock price, the original Performance Options were deemed to no longer incentivize the executives. Consequently, the Board of Directors approved amendments to the Performance Options in April 2023, which reduced the exercise price per share and modified the structure to contain nine separate tranches with updated Stock Price Targets. Tranche 1 Stock Price Target was more than halved from $156 to $72.
7. Risks
1. Customer Concentration
Cloudflare's risk of customer concentration is significant, given that more than 60% of its revenue is coming from large customers. The company generated $290 million in revenue in Q1 2023, and $174 million of that revenue came from 2,156 large customers. The average monthly revenue per large customer is $27,000, which suggests that the company's business model is heavily reliant on a relatively small number of customers.
On the other hand, the remaining $116 million in revenue came from a much larger customer base of 166,003 customers, with an average monthly revenue of just $233 per customer. This indicates that the company has a wide range of customers, from very small to very large, but that the revenue contribution from smaller customers is significantly lower.
The company's performance is dependent on upgrading paying customers to higher-tier subscriptions and expanding the number of products sold. The growth in new paying customers has slowed right down over the past two years meaning that Cloudflare is even more dependent on its existing large customers for revenue growth.
The company's gross retention rate falling below 90% further highlights the risk that large contracted customers could terminate their agreements, which could negatively impact the company's operations. Additionally, the company's customer retention rate is difficult to predict and may be impacted by a variety of factors such as customer satisfaction, economic conditions, and competition.
The company's subscription-based business model relies on customers renewing their subscriptions after the initial contract term. The mix of pay-as-you-go and contracted customers is important, as pay-as-you-go customers are an important source of revenue, but they are also more likely to terminate their subscriptions. Contracted customers have longer-term agreements, but they can still terminate their subscriptions under certain circumstances.
2. Product Risk
While Cloudflare is a leader in many of its areas, it is not without its product shortcomings which include limitations in deployment options, inconsistent post-sale support, and deficiencies in reporting and incident response capabilities as detailed by Gartner.
The fact that Cloudflare's offering lacks the option to run as an agent, a Kubernetes sidecar, or a containerized WAAP could deter organisations deploying API architecture and looking for a way to monitor east-west traffic. This limitation in deployment options could potentially lead to a loss of customers who require these features for their specific use case.
The inconsistent post-sale support provided by Cloudflare could lead to dissatisfaction among larger enterprise customers who expect more consistent and better support. This could result in a loss of customers who require reliable and consistent support to ensure the smooth operation of their business.
The deficiencies in reporting and incident response capabilities could lead to dissatisfaction among customers who require in-depth reporting and incident response capabilities to effectively manage their security. This could potentially lead to a loss of customers who require these features for their specific use case.
The cluttered and confusing management interface could also lead to dissatisfaction among customers who require a user-friendly and intuitive interface to easily perform custom security configuration. While Cloudflare has recently updated its WAAP UI based on customer feedback, it remains to be seen whether this will be sufficient to address customer concerns.
In comparison, Akamai offers a broad range of web application and web application security features, which appeals to large organisations looking to make a comprehensive set of features available in front of all their web applications. Akamai also offers leading threat intelligence capabilities with its client reputation feature and often releases new controls before the rest of the market. This gives Akamai a competitive advantage and could attract customers who value advanced features and capabilities. Akamai's consistently strong customer support creates trust and drives adoption, which is a notable achievement for a large platform provider.
Similarly, Imperva offers multiple ML approaches for bot mitigation and event aggregation, which shows promise for simplifying the management and incident response process. Imperva's Account Takeover Protection module includes several interesting features, such as detection of credential stuffing, and is designed to determine malicious intent from successful logins or impossible logins. Imperva's "Imperva Anywhere" strategy resonates with security teams willing to centrally manage WAAP enforcement points in different form factors and to consider adjacent application security approaches, such as RASP and database security. Imperva's advanced features and innovative strategies could also pose a risk to Cloudflare's market position and customer base.
8. Opportunities
1. Network Leverage
Cloudflare has a significant opportunity for network leverage due to its ownership and operation of over 285 data centres across the globe, as well as the establishment of 12,000 network interconnects with regional ISPs, cloud service providers, and large enterprises. These interconnects were established through the provision of free services to individual users and small businesses, resulting in many connections being by invitation. This network leverage provides Cloudflare with a competitive advantage, as it enables the company to offer faster, more reliable, and more secure services to its customers.
Moreover, all services run on every host in every data centre, making every service deployment fully global and distributed as a first principle. The serverless runtime allows for critical isolation, enabling all Cloudflare products to be supported on one common backplane without creating a mess of code conflicts. This architecture provides enormous benefits, such as the ability to push new capabilities to the whole network at once, instead of planning for an additional layer upon which to host the service. This greatly increases the rollout speed and allows hardware resources to be shared across all services, resulting in significant cost savings.
Cloudflare's highly distributed development platform also provides a significant opportunity for network leverage. By maintaining a development platform, Cloudflare incurs overhead, but it also enables composability, where new offerings can be bootstrapped with the building blocks from prior releases. This approach accelerates product development and allows Cloudflare to provide customizable and personalised products to customers.
The architectural tenets embraced by Cloudflare differ from the conventional approach taken by most software infrastructure providers. As such, it is challenging for hyperscalers or new entrants to duplicate this approach. For new entrants, it would require building a network of 285+ data centres similar to Cloudflare's scale, resulting in significant capital expenditure costs. For hyperscalers, it would require a significant re-architecting of their systems and likely conflict with existing revenue streams.
Cloudflare's ownership of their infrastructure allows them to offer cost and performance advantages over competitors. Their free tier of services provides new product efficacy benefits and allows them to safely battle test new capabilities. This usage tier also feeds security efficacy and provides a way to identify threats and malicious behaviour. Cloudflare's powerful and generous offerings for application protection have made them the entry point for 22% of the world's busiest websites. This relationship provides an opportunity for Cloudflare to cross-sell and upsell IT teams on additional services and provides an advantage to their Zero Trust offering.
2. Innovation and Expansion
Cloudflare’s rapid pace of innovation and expansion has resulted in its addressable market increasing from $32 billion in 2018 to $204 billion in 2026. Leadership believes the company can reach an annual revenue run rate of $5 billion within five years based on its existing products and services. Cloudflare's revenue run rate exceeds $1 billion implying that it has penetrated less than 1% of a $146 billion market in 2023 for its existing portfolio of products. The company sees further potential in various areas, including AI, databases, Internet of Things (IoT), 5G, and network services.
What makes this target achievable is that it is not dependent on taking significant market share from cloud hyperscalers. Instead, the company is looking to compete in developer services, such as object storage, where it can offer lower latency and cheaper pricing leveraging its global network.
Cloudflare's R2 storage product is an excellent opportunity for the company to expand its AI solutions by providing a neutral location for storing and accessing data across multiple cloud providers. As more companies move towards multi cloud environments, R2's consumption-based model can drive revenue growth as AI datasets continue to expand. Cloudflare's largest R2 customers are AI companies that are experiencing extraordinary growth as they put more data into their models.
A leading generative AI company signed a one-year $1 million deal. The company had been a user of our free tier since 2017. And this deal originally started out as a relatively small gateway DNS opportunity to replace Cisco umbrella. However, when their browser-based application debuted in late November, demand for the company's AI-generated content absolutely exploded with unprecedented rates of adoption
The company in question is OpenAi, the developers of ChatGPT.
Cloudflare's differentiated data localization suite can become more critical to customers as localization and data residency requirements become law in various geographies. Furthermore, Cloudflare's R2 and other workers' products can become the glue at the centre of a multi cloud ecosystem, which is a significant opportunity for the company.
Cloudflare's Zero Trust security products are gaining traction in the market, as evidenced by several large deals with Fortune 500 companies and a European financial services company. Additionally, Cloudflare is gaining traction in the U.S. government market, aided by their recent FedRamp moderate authorization in December. They landed a major $7.2M five-year deal to operate DNS for the .gov registry, which is significant for Cloudflare as it connects their network to every federal agency, offering an entry point for other service upsells.
A recent survey conducted by Morgan Stanley indicated Cloudflare is making significant progress in this market compared to its Secure Access Service Edge (SASE) competitors. The results showed that Cloudflare has gained a larger market share than its SASE peers.
This traction in the market was further acknowledged by Gartner in the 2023 Magic Quadrant for Security Service Edge (SSE) report, becoming the only new vendor to receive recognition.
Cloudflare's expanding set of products is an excellent opportunity for the company to consolidate security vendors, reduce costs, gain more control over traffic flow, and implement Zero Trust.
9. Valuation
Discounted Cash Flow
This absolute valuation method has a number of limitations related to appraising the value of Cloudflare due to the company’s architectural decisions, infrastructure ownership and business life cycle stage.
Discounted Cash Flow (DCF) analysis assumes steady cash flows, but Cloudflare's infrastructure ownership model may result in higher upfront CapEx costs and lower free cash flow early on, limiting potential for early cash flow margin expansion, which is a critical factor in DCF analysis. Additionally, Cloudflare's infrastructure ownership model does not fit traditional valuation models that assume a fixed cost structure, and its CapEx investments may be more variable, making forecasting more challenging.
Forecasting revenue and margins for companies that rapidly innovate and introduce new products and services is difficult particularly when the focus is not on maximising profitability. Cloudflare is an example of this, as the company has diversified its product portfolio and expanded its market segments over the past five years, growing almost five times larger than its original target market.
With all of the caveats out of the way, let’s take a look at the valuation and assumptions.
Using a discount rate of 10% and a conservative terminal value of 12, I have estimated the cash flows for the next five years. Considering the inherent difficulty in accurately projecting future cash flows for this business, I believe that a cautious approach is necessary.
I have used management’s updated guidance as the baseline for 2023 as I believe this is achievable. Looking further ahead, management expects to reach $5 billion of revenue within five years achieving a CAGR of 38%. My estimate of $4.4 billion is 12% short of the $5 billion target due to the lowered guidance for 2023 as I struggle to see how this can be achieved with a high degree of certainty, unless revenue growth accelerates significantly.
Given the increased focus on cash flow and profitability from the leadership team, I project that Cloudflare can achieve management’s long term guidance for operating margin above 20% within five years which could translate to an OCF margin of 30%. As a yardstick, Akamai posted an OCF margin of 35% in 2022.
Network CapEx is expected to trend down overtime which could result in overall CapEx as a percentage of revenue as low as 13% within five years. Akamai which also makes significant investments in building out data centres and network connectivity spent 13% of revenue on CapEx in 2022. This would result in a FCF margin of 19% by the end of 2027. During the Investor Day 2023, leadership expressed confidence in achieving a long-term free cash flow margin exceeding 25%.
Earlier analysis identified significant shareholder dilution over the past number of years. In 2022, the dilution rate was 2.1% (2021 4.7%, 2020 2.4%) but management has committed to a 3% cap on SBC dilution going forward. I have assumed an average dilution rate of 2% over the next five years.
Based on these assumptions the fair value of Cloudflare is close to $28 per share suggesting a potential downside of 44% based on the share price 11 May 2023. Of course, this needs to be taken with a grain of salt due to the limitations discussed earlier. Nonetheless, it is important to note how the margin profile of the company could evolve over time.
Enterprise Value to EBITDA Ratio (EV/EBITDA)
Cloudflare trades at a forward EV/EBITA of 76. While the ratio has improved significantly, it can appear a bit misleading as Cloudflare is not optimised for profitability.
Nonetheless, Cloudflare trades at a significant premium to all of its competitors. While one would expect Cloudflare to command a premium given its faster growth rate and potential growth opportunities, the fact that it is five times more expensive than the nearest competitor indicates how rich the valuation really is.
10. Investment Outlook
Cloudflare has managed to achieve an incredible growth trajectory since it entered the public markets in 2019. The company's unique platform enables it to provide a range of services that help its customers improve the security, performance, and reliability of their internet-based applications and websites.
One key factor to consider when assessing the competitive durability of Cloudflare is the "snap test” - if the company were to disappear, would anyone notice? In this case, the answer is yes due to the critical role that Cloudflare plays in the overall internet. The company's network outage in 2021 highlighted just how important its services are to keeping the internet running smoothly and securely.
However, investing in Cloudflare is not just about the present state of the business but also the return that can be achieved from this point. Even allowing for the limitations in the DCF valuation pertinent to Cloudflare, it is richly valued on a relative basis, which means that investors need to ask themselves how much they are willing to pay for future growth. This is especially important given the inherent execution risk that comes with investing in a company like Cloudflare, where future returns are likely to be driven by products and services that have not yet been developed.
Although enterprises continue to rightsize their IT operations, Cloudflare's products are backed by strong long-term growth prospects. The company has a history of attracting major enterprise clients by rapidly innovating and delivering crucial internet-based services. If Cloudflare can successfully execute its updated go-to-market strategy and achieve a string of positive earnings beat and raises the negative sentiment that surrounds the stock would dissipate and the stock could rally. Any miss on growth expectations will cause short-term pain to investors as seen by the price reaction following the Q1 2023 earnings report.
Disclosure: At the time of writing, the author holds a long position in Cloudflare, Inc.
Hit subscribe below if you have not already done so in order to receive the latest content straight to your inbox each week.
If you enjoy today’s edition, then feel free to share as it, it really helps.
Happy investing
Wolf of Harcourt Street
Contact me
Twitter: @wolfofharcourt
Email: wolfofharcourtstreet@gmail.com
Good work Wolf!