Cloudflare, Inc. (NET) Earnings Call Transcript & Summary

Welcome to Morgan Stanley's U.S. software research effort. And I'm very pleased to have with us at -- on day 2 of the TMT conference, Thomas Seifert, CFO of Cloudflare; along with Jayson Noland, Head of IR over at Cloudflare. So Thomas, thank you very much for joining us.

Pleasure, and thanks for having us.

Excellent. Before we kick off, just a brief disclosure from our side of the equation, for important research disclosures, please look to the Morgan Stanley website at www.morganstanley.com/researchdisclosures. And for anyone who's listening in on the webcast, you can ask questions with that link on the webcast. They're going to show up on my street here. I'll try to fit them into the conversation. So with that out of the way, again, thank you for joining us, Thomas. Always a pleasure to catch up with you and talk some Cloudflare.

And I got to admit, Cloudflare is a name that has been a very impressive story. But I feel like we've had this conversation probably 5 times where I'm trying to wrap my head around the scope of what Cloudflare is, and I'm always coming up short. I'm like, "Oh, this is an SMB play in terms of what performance and DDoS. No, it's much more than that." Or this is a DDoS. I'm like, "No, it's much more than that." This is a free-to-pay model. No, it's much more than that. How do you wrap your head around sort of the mission statement, the scope of what Cloudflare is trying to do out there?

Yes. It's a broad story, and it's a very disruptive play and sometimes not easy to get across. So we -- it helps to go back to the mission statement we have. It's very lofty. And we say we want to help build a better internet but we literally mean it the way we say it. And that means anything that wants to connect, we want to make more secure, more reliable, fast and efficiently in how it connects. And if you'll start there and work your way backwards and say, and we've built a network now that is large and complex, and it moves a lot of traffic. And of this network, we can offer any kind of service that people used to buy in form of hardware and boxes that they put in data centers. And we turned that into a service that we deliver from the network we have built. It becomes a much more comprehendible story, in my opinion.

Got it. Got it. So it's all based around that fundamental principle of your core customer is someone who wants a more performant Internet, a more secure Internet and Internet that provides that level of security and performance to users and data no matter where they reside.

I think that is a good way to put it. And you can turn around and say, we want to make the Internet good enough to be the corporate or your personnel network and make it so secure, so fast, so reliable and so affordable that this becomes the true alternative.

Got it. And then a lot of these sort of entry points that I think perhaps sometimes investors pigeon hole Cloudflare too tightly into, those are just on-ramps onto this broader value proposition. So when you think about DDoS, a lot of people say, listen, there -- that's just one of the on-ramps to get customers attached onto the network to understand the sort of the broader capabilities of what you guys can provide.

That is very fair. Our traditional play, and we have excelled around this over the last years, is a land and expand story. And how customers land on our platform literally depends where they come from, what vertical they come from, what customer size they might have. And from there, we expand. So a classical entry case would be a financial institution landing on our platform for a security product, and then we expand into other products we offer.

Got it. So I want to talk a little bit about 2020 as a set up into 2021. From my perspective, from a product side of the equation, as a Cloudflare for Teams, the broader Cloudflare One solution was probably the biggest kind of headline or the splashiest product initiative that you guys had out there in terms of enhancing the market opportunity and perhaps even sort of enhancing the growth because it really hit at an opportune time of when that type of solution is really needed in the marketplace. Would you agree with that assessment that that was probably sort of the biggest product initiative that you had going in calendar '20? And how should we think about sort of what's the top of the list in terms of calendar '21?

Yes. If Michelle was here, one of our co-founders, we would say, "Yes, that's what we did in 2020, and we just got started." And in a way, that's a true description. You remember, when we were at the IPO, we described our TAM that we attack as they're -- protecting the network infrastructure, and we sized it at about $38 billion at that time, growing 4% year-over-year. And now since we've gone public, we added 2 large TAMs around that. One is what we call Cloudflare for Teams, moving from protecting the infrastructure to protecting the individuals and teams that want to connect, whether it's on a corporate level or on a personal level. It started with our Cloudflare Access product, and Gateway followed. There will be browser isolation product that is in beta now that will see general availability at the end of this quarter, and there will be a data loss prevention product later this year. So that's a significant increase in the size of the TAM that we attack and that we can disrupt. And in a way, there was also some luck involved because we launched it right in front of the pandemic last year. We made it a free product, a free offering for all of our customers until the end of the year and then some still are, especially customers who are in verticals that are heavily impacted and affected by the pandemic. And then we launched Cloudflare Magic Transit, where we really go into offering us as an alternative to corporate network going after the SD-WAN and the MPLS WAN. And that was the third, really, large TAM that we added in the short time since we've gone public. So if you take that as an indication for how we want to move forward, adding TAM that we are going to disrupt is very much on the road map. There's a very disruptive product, as you know, that we have, our Workers product, that is our version of the edge compute -- solving for the edge compute problem. That is still not part of that TAM calculation. So there's a lot of opportunity in front of us. And I think the second thing that really people started to notice, and you said it yourself is the success we had moving up the customer stack to larger and larger enterprises. And I think even here, we are only in the early innings of our journey.

Got it. Got it. I want to dig into those products one by one, if we can. So Cloudflare One sort of the -- Cloudflare for Teams and sort of the broader Cloudflare One product, like you said, that right solution at the right time really helped a lot of people out during a crisis where they had to rapidly deploy a much more distributed work environment very quickly. There's free trials, and those 3 trials are now converting into paid customers. On a go-forward basis, does calendar year '20 in any sense present a tough compare for Cloudflare for Teams and Cloudflare One? Or is it just such early days in this opportunity that there's so much kind of wood to chop in terms of getting that penetrated to the customer base that the growth trajectory could sustain well against that ramp?

Well, in -- remember what I just said, for most of last year, we offered Cloudflare for Teams for free. So there's not a lot of Teams revenue in the 2020 numbers. We started to convert the free customers to paying customers towards the end of the year. And most of it is converted. As I said, there are some that we -- where we extended their free offering because they are in heavily impacted industries. But even the converted customers, we think, offer a significant opportunity in terms of expansion moving forward. So it's maxed out in terms of free to paying conversion. It's certainly not at the limit in terms of expanding the customers that we converted.

Got it. Got it. That makes sense. And then when investors are thinking about the competitive environment for Teams, is it the traditional network security guys that you're going after more often, the Zscalers and you're competing with Palo Alto with their Prisma Access? Or is it more so the -- sort of the legacy VPN architectures that prove to be inflexible and kind of outdated? Or is it greenfield? Just a lot of people out there just didn't have a good access solution.

I think the biggest revenue contribution still comes from disrupting the traditional players. Their traditional VPN providers, their Ciscos and Citrixs of this world. We run into Zscaler more and more often, but that is day-to-day is replacing the traditional players. COVID, I think, last year also brought us a lot of large lands where we are starting on a greenfield. Where companies or customers literally went from 0 or close to 0 to thousands of seats in 1 deployment. And we've seen a couple of very large customer wins that came from that direction.

Got it. Got it. Switching gears a little bit to Magic Transit. One, I think this is probably a part of the solution portfolio that investors are at least familiar with, at least I get the least amount of questions with. So can you talk a little bit about what Magic Transit is? And two, I think 1 of the things that really surprised us, this is 2 quarters ago when you guys announced an 8-figure deal, right? And I think that kind of changed investors' mindset on what's possible within Cloudflare. Can you talk to, like, why is it that Magic Transit could enable deals of this type of scope within the end customer?

Yes. Magic Transit -- we just talked about land and expand. And most of the products we launched and built in the past were traditional land products. Magic Transit, and I'll talk about it in a second, but it was truly the first product that was more a land than an expand product. And it's a -- in its most basic way, it's a comprehensive cloud-based network-as-a-service solution that is designed to be secure, fast, reliable, but it replaces, really, this patchwork of appliances and wide area network technologies that companies have, especially large companies with a very complex and heterogeneous network footprint. And you replace that with a single network that provides all their cloud-based security, the performance and most importantly, provides control through 1 user interface. So it brings together how people on-ramp branch offices, how they secure applications and then in the Cloudflare One space, also how you access SaaS applications, all in a single platform. So if you keep in mind that this would benefit in the first step, especially mid- to large-sized enterprises, you go after a significant spend. And solving this patchwork of appliances has become even more critical in a world that was influenced by COVID last year where your infrastructure becomes even more heterogeneous. And now you have many more employees that are not in the office anymore, are working remotely, are locking in -- and might even be mobile now and locking in from different places and different locations over time. So it's a land product, not so much an expand product, and it's going after large global footprints with -- for customers that have a very heterogeneous network setup. Those customers tend to spend a lot of money managing, in a lot of cases, even outsourcing their wide area network infrastructure. And because of that, it's a significant opportunity.

Got it. And one of the interesting sort of aspects of the story and some of the other emerging kind of security stories is now you guys have -- like, security has always been the stage where you deploy security either because there's a regulatory need, because you have to, because you're going to get hacked and the losses are going to be too great on the other side, but there was something of an attacks aspect of it. The security was attacked so it's something you have to do to keep your infrastructure secure. Now with stuffs like Magic Transit, it sounds to me like you can make a much firmer ROI equation on the security spend. You can go into the end customer and say, "Hey listen, what you're doing right now, not only is it insecure, it's not as performant as it could be, it's more expensive than it should be. That you could do this for a lower price if you consolidate it all into 1 modern platform. Is there truth to that?

Yes, it is. I mean MPLS connections are expensive connections for companies to run their WAN infrastructure. Us offering a very disruptive technology also from a pricing perspective allows for superior returns. ROIs are usually significantly less than 1 year. And that changes the conversation really, really fast at the time where not only budget dollars have to be shifted, but also budgets in general are under pressure. It doesn't mean that the security aspect goes away. We just landed a very large -- one of the largest oil and gas companies on such an approach. And it started as an ROI discussion, but the company came under a significant ransomware attack, and it was impossible to secure the environment with a distributed heterogeneous network where you had to talk to multiple ISPs and operators in order to get the infrastructure under control. And what would have been a very long sales cycle normally, proof-of-concept negotiations turned out to be an onboarding of a very heterogeneous infrastructure away from regional ISPs onto the Cloudflare network literally within a weekend.

Got it. Got it. I want to switch gears a little bit and talk about Workers. It's sort of the third category and probably the one that we get the most investor questions on. And as it is, there's a little bit of a disconnect in my head in terms of this is probably the part of the equation that investors are most excited about. I'll just give you an example. We have a question from one of the investors on the line here. "We're hearing Cloudflare taking share from EC2 and could be more than 20% of that AWS spend. How to think about Workers' edge contribution to revenues in the next 2 to 3 years?" Huge. Sort of, like, 20% of EC2 is -- that's big, right? But then when we talk to Matt, it seems like it's actually the part of the equation that he's least willing to put in a box, right, to put -- describe a particular TAM to. And it seems like it's still -- kind of the potential is still developing there. How do we flip those 2 sides of the equation?

Yes. One of the reasons why we don't want to be put into a box too early is, first of all, the numbers are getting ridiculously high really, really fast. And you get uncomfortable talking about TAM numbers that are north of hundreds of millions of dollars. You are a little bit afraid that you lose credibility when you tell stories like that. If that turns out to be the case, good for us and others in that space, but the math around how you calculate the TAM and what -- how much of the workloads and what use cases is still -- there's a lot of fussiness that makes us hesitant. The second reason, I think, which is even more important is we don't want to have this box be tied and dictate us and limited us in what we do. I think we learned so much about Workers over the last 2, 2.5 years in terms of what it is good for, what the use cases are, how the use cases have changed. There's this very famous blog from Matthew on our web page that says, "We thought it was about speed, but we think it's going to be about compliance in the near term." And to be very honest, the most exciting use cases we see are not only about speed bringing artificial intelligence to the edge of the network offloading electronics and bill of materials into our network, but the most exciting use case is today around this field of compliance. How do you get compliant with the increasing pressure around data privacy and data sovereignty, what's happening in Europe, in Brazil, in India, in China, in Australia, in New Zealand. And we think that is a unique opportunity for us. And if that is the case, you want to maximize penetration and adoption of our platform. We want to be the premier edge compute platform. And we don't want to limit that by putting too much emphasis on pricing and revenue targets, whether it's internally or externally. So the KPIs we measure are how many new developers are we signing up every quarter? How many Worker scripts are they writing? What is the difficult -- the degree of difficulty those Worker scripts have? What's the diversity in terms of use cases? How many workers do we attach to contracts we signed with customers? And how can we maximize that? So it's really about penetration, adoption and attaching and learning. If you think compliance is one of the big use cases. It's not only about edge computing, it's about how you store certain data. And just a last remark on this, we launched -- we have a feature in beta. It's called Durable Object. This goes into GA at the end of the quarter. That it literally allows you to pack data and say, "Oh, Keith is living in Munich, and his credit card information can only reside in the data center of Cloudflare in Munich, Berlin, Frankfurt, Hamburg and Berlin. It cannot leave the jurisdiction of a country, of a region and/or municipality." And all of a sudden, it's not only about the compute part, it also becomes a topic of how you store that information and where you store it. So long answer, but those are probably the 2 main reasons why we shy away from committing to a TAM too early.

Got it. So it sounds like there's almost an analogy between sort of, like, the core business of the first part is building it, right, and sort of building the community, building that network, getting the 3.5 million users on there. And then the monetization avenues come later, and you could quickly sort of expand upon that community. Right now, it's about getting all the developers on the network, getting sort of that development capability, understanding what they're using it. And then on a go-forward basis, you could add more monetization avenues on a go-forward basis once you have that community.

Very much. And you have to keep in mind that all of our products are built on Workers. So a customer that buys a load balancing service from us and attaches Workers immediately can use Workers to make that the most customized load balancing solution in the market. And that is true for every product that you buy or every service you buy from Cloudflare moving forward. You can use Workers to make that the most customized version of that service that is in the market. And that is, from a near-term opportunity, a good revenue opportunity, too.

Got it. Got it. So -- and that's a good segue into sort of the next part of the conversation that I wanted to go, which was the kind of the enterprise go-to-market motion that you guys had there. Over the best of this year, you guys have started disclosing the percentage of your revenues that are coming from customers over $100,000. And I got to admit, when you guys first put out that number, it was upside surprise, I think, to myself and to a lot of investors of how big it was. Right now, 49% of revenues come from customers over $100,000. And that really broke sort of the assumption that a lot of investors had that Cloudflare is an SM-focused company. You guys have a lot of your revenues tied up with large contracts. Do those contracts start large? Are they $100,000 lands? Or is this the sort of an ultimate of a land and expand strategy that could get customers up to that type of price point?

I would say today, it's 50-50, and I can give you a couple of examples of land and expand, land small, expand big and land big. But we see more and more significant lands out of the gate. In the third quarter, we talked about our largest customer that where we breached the $10 million per year threshold. That was a customer that started at $70,000 a year only 4 years ago, and it expanded into the size. We talked about a large financial institution in Asia that we just signed on as a customer in the fourth quarter. That was immediately almost a $10 million TCV, a 3 years contract. So we are about half and half today, 50-50, in terms of landing big and expanding big, but there are more and more large land deals that happen, and those are mainly driven by -- the customer in Asia that I just talked about buys pretty much almost everything that is on the menu.

Got it. And in terms of like the go to market, I think investors, and including myself, we got really enamored with Atlassian, right, a great company and a lot to be enamored with. And their self-service model, like, the product is going to draw the customer in, you don't need a sales force. And people saw your large free base and they saw the self-service motion. They're like, "Oh, Cloudflare is about that self-service motion." But it's broader than that. You got -- it's much more of a tiered motion of where there's the self-service, there the outbound sales, there's the enterprise sales. How are you thinking about sort of that striation, if you will? And where do you choose to invest? Like, how do you decide which parts of that equation you're going to invest more or less? Or is it just, "Hey listen, there's a big opportunity, do we invest across the board?"

No, we are more prudent than that. But I think what you said is really important. It's a tiered approach. They really -- the one benefit of having such a diverse customer and global footprint is that the data coming out of the freemium and the pay-as-you-go business is a good guide to where we should invest for field salespeople, for feet on the ground. And we never invest into capacity, sales capacity, hope that that capacity is finding quota and revenue. We wait until we have enough data in a location, in a country to say, okay, we have enough data to say there's interest -- there's interest for those products. It comes from the following verticals. And then we put feet on the ground. We did that in Germany. We did that in France. In Germany, we started with, I think, $1.5 million of revenue. And then we put people on the ground and we quadrupled or quintupled it within 12 months. So we are never ahead of the investment from a go-to-market perspective. I think that really, really helps. There is also a couple of really important KPIs that we measure to make sure that overall, the go-to-market is balanced. What is the ramp up time? What is the quota-retiring productivity? Does it stay high? Does it differ from vertical to vertical? And if you look at the journey we had where now 49% of the revenue is coming from very large customers, despite that, our customer acquisition costs have almost stayed flat to slightly down despite the journey upmarket at $1.40 at this point. So I think that gives you an idea of how we think about balancing go-to-market and how we invest moving forward.

Got it. I think one of the great things that sort of -- from my own perspective, one of the really interesting aspects of the Cloudflare story has been you guys seem to have a really great knack of finding kind of positive feedback cycles and positive reinforcement cycles. You're talking about sort of the free users providing really good indications of kind of where to go next with the solution portfolio, also a lot of data on what's going on with the network. I'm going to try to tie together a couple of questions from the investors here that I think also speak to that but on the opposite side of equation, the cost side of the equation. So one investor is asking the question of, can you discuss the value-add Cloudflare gives to the ISPs and how that benefits your co-location pricing? So that feedback loop that you're able to establish with the ISPs that gets you that preferential pricing on co-location. And then if we could tie that into another question from an investor, which is just really talking about your cost advantage. The fact that you do have such a high gross margin, such a short payback period while carrying such a large amounts of traffic, I think is all tied up in One, if I'm not mistaken.

Yes. Let's start there, and that might be a quicker answer and then I jump on the co-location topic. I think the reason why our CapEx efficiency is so high. And the CapEx, especially as a percentage of revenue, over time, even has come down. We guided for 10% to 12% for this year. We said midterm, it might be as slow as high single-digit is really driven by the uniqueness of the architecture, off-the-shelf hardware and then this unified software stack that allows us to run every product, every service in every city, which means every time we had a server, regardless of where in the world, there's more efficiency in the system, the network surface becomes bigger. And with that, the degrees of freedom how we manage cost, demand, supply becomes bigger. And I think this is one of the biggest competitive moats we have that makes us so unique. And it's one of the core contributions why the margin is so high. On the co-location side, I think we are now today in north of 210 cities on these countries, and in many cities in more than 1 location. And we always say, you can buy yourself given enough money in maybe 50 large cities and interconnects. But from there, it's really, really hard. You need to get invited. And why do we get invited? Why do we have 3 data centers in Pakistan or -- because you're going to the locations like that and the biggest websites might be Google and then followed by Facebook. But the next 50, the next 100 are almost guaranteed Cloudflare customers. So the data we aggregate is really significant. And the benefit for the local ISP then is significant cost saving colocating us because they don't have to backhaul all their traffic from wherever the next Internet connection is, might be Frankfurt. So having us colocated saves them significant cost. And in many places of the world where bandwidth is sold to customers not a flat fee arrangements, but where you pay for data you consume, speeding up the experience allows them to make more revenue. And that is what we do, you co-locate us for all the benefits we provide, we provide you an increase in performance and reliability. So it's cost saving, and it's an opportunity to increase top line revenue for the local ISPs. And that is only possible because we aggregate a large amount of diverse demand even in the most remote places of the planet.

Got it. I've got a minute left. I want to end on a kind of an operating margin target question, if you will. You guys hosted your Investor Day 2 weeks ago, I believe. If I recall, it was on a Friday afternoon, that's very nice of you guys to tie up our Friday afternoon that way.

Thank you. You've got a lot of grief. So we'll promise to do better next time.

At the Analyst Day, you guys reiterated a long-term operating margin target of 20%. And gross margins are there, and that's not the question. The question is really the balance between growth and margins, right? Because when you study the subscription models, growth and profitability are antithetical to each other, the faster you're growing the harder it is to get to that profitability. And how do you guys think about that equation of balancing sort of a huge opportunity in expanding solution portfolio, a big base of customers that pay you and don't pay you or can expand more fully versus -- I know you like to have a good margin profile, like, that inherent sort of profitability within the company. What's the philosophy coming from Cloudflare on that?

Yes. Good question. So the strength certainly is in the gross margin. We always said we want to get to breakeven reasonably fast. And the current performance and growth allows us to get there now significantly faster. We -- at the IPO, we said it would happen at the end of next year. Now we think it's going to happen at the very beginning of the year. So quite a bit earlier. But from there, we will be very measured moving forward. As long as we see our investment return by superior returns, we will continue to invest. But we want to get to this breakeven point on making money, not burning cash anymore, reasonably fast. And from there, as long as we see superior growth and our investment deliver superior returns, we are going to continue to invest.

Got it. So would a better way to think about that long-term target rather than thinking about the X-axis as being time, perhaps the X-axis is growth, right? At certain levels of growth, you should have certain levels of profitability?

Very much. I think, Matthew would say, he's very impressed with the Amazon business model. That is what they followed, get to breakeven reasonably fast. But as long as you can continue to grow, you keep the foot on the accelerator. I think we will follow a very similar path.

Outstanding. Thomas, unfortunately, that takes us to the end of our allotted time frame. But as always, a really great conversation. I appreciate you taking the time to walk us...

Thank you. Always a pleasure being with you. Thank you.

And looking forward to watching what transpires over the next years. You guys keep it exciting.

Same here.

Outstanding. Thank you, guys.

Thank you.