Cloudflare, Inc. (NET) Earnings Call Transcript & Summary

Thanks, everybody, for joining. I'm Brad Zelnick with the Deutsche Bank software team. We're here for the 2022 Deutsche Bank Tech Conference in Sunny, Las Vegas, Nevada. For this session, I am delighted to be joined by the good folks from Cloudflare in specific an old friend, the CFO, Thomas Seifert. Thomas, Thank you so much.

Well, thanks for hosting us.

For sure. It's always good to see you. Format of this session is going to be a fireside chat. I've got a number of questions that I'm going to go through. And if time permits towards the end, maybe we'll take a few from the room as well. But -- maybe just to kick it off, Thomas, I feel like despite being in the public market for a few years now, some investors still struggle with what Cloudflare is. Are you a networking company? Are you a platform for developers? Are you a CDN? Do you provide security? And I kind of feel like you're all of these things, and yet none of them all at the same time, and I mean that in a nice way. But how should investors get comfortable that the $135 billion TAM that you see is very real and perhaps more available to Cloudflare than the many legacy players that comprise the bulk of that TAM that we calculate today.

Well, we are not an easy story. We knew that. We've been -- I think we've become better at telling the story. But that we don't truly have a peer doesn't make it easier. We have a lot of competitors that are offering a sliver of what we do. And as the story here evolves, we will get to that in a minute turning those products of other companies into features of what we are offering is a part of why the story is so disruptive. So when I joined, now a bit more than 5 years ago, and talk about the other day, the longest I have been in the shop for a while and it's way beyond the lifetime. Every lifetime for public company [ see over this ] point, we were protecting infrastructure. In the run up of getting ready for the IPO, we thought about this, how do you describe what we do. And we came up with this bumper sticker at that time that said, Cisco as a service. Cisco doesn't like that, but we thought it was really catchy because every time you go to Cisco like company and buy a router, a firewall, a load balancer we offer this as a service of the network that we operate. And I'm not sure whether that's part of your questions later on, we should talk about why -- what makes that so special. The true competitive mode of this business model truly is the network architecture and the software that runs on top of that hardware that allows us to offer these services. And of all the things you mentioned, where we pushed back the hardest, always is that we said we were never were a CDN? Right. So when you talk to Matthew, our CEO and founder, he would say, when we get started, everybody said, "Oh, you're just a modern version of a CDN and he said, "No, no, no, this -- we happen to have a CDN because in order to deliver security, services and products at the edge of our network, you have to be really, really fast. If you start to add a bump in the wire, and latency to what you deliver, it's not going to work. So this obsession with speed allowed us to be -- to have the fastest CDN, right? Because this is what we need in order to deliver our services. But if you were to go through our product portfolio, you wouldn't find customers that look like traditional CDN customers where you just deliver a byte of data from point A to point B without really any value add. And if you look at the hardware stack, we'll probably get to that in a minute. It reflects that. We have more CPU cores and GPU cores at the edge of our network because this is what you need in order to encrypt to decrypt, to do package inspections than other companies you found there. And from there, the business model started to evolve, every new service and every new product we add to this offering comes at pretty much hardly any additional marginal cost. So the evolving from protecting infrastructure to protecting people. We started with this 2 years ago, the Zero Trust product suite, e-mail, browser, isolation, the gateway, CloudWafer access, the VPN replacement is literally just taking advantage of this rather unique network architecture. And then we -- in order to be able to agile and offer this rate of innovation we had to be creative, what -- how we develop our products ourselves one of the unique things these workers that is pretty much the language on which Cloudflare products are built and opening that up note to our customers and developers to build products on our network, I think was this last third leg now. And these are all staggering TAMs. They are very real. We think of them in wave 1, 2, 3 products in terms of when they will start to add revenue. But the most exciting, I think, if that is what you want to know is probably workers down the road.

Sort of ask -- you answered my next question. And then I want to ask you about the network architecture, its uniqueness and why it's so critical -- and I also want to [ dive ] into workers specifically. Maybe it's not going to be the answer. But the next question is, when we think about the 4 main end markets that you're in, if I think of apps, Dev, Network and Zero Trust security, which is the one that when we look back 5 years from now, do you think we can be most surprised at either the size of the overall market opportunity Cloudflare's share within it or both and why?

So I would say my answer has evolved, right? When I joined Cloudflare, a Head of the IPO Workers was still an idea. When we started to get into trouble by -- we saw our innovation rate slowing down. And if there's another thing that is unique about us over the years, it's this incredible pace of innovation. We literally did hundreds of features and products every quarter. And we slowed down because we didn't have the right tools to deploy tests, right, development products. And then this idea of Workers came up literally an opportunity to write code in this third place at the edge of our network, not on a device, not on a server, but as close as possible to where it makes sense to get executed. And that was an idea in 2017. And then we -- 2 years later, we got close to the IPO and we started to size and the numbers became just so big, how many workloads are at the edge today, how many workloads could move that we said we're not going to size the market because we lose credibility because the numbers are getting so big. So we kept it off. And even to this point, we try to avoid an answer. You're just picking up how many customers, but I think looking back 5 years from now, I think that will be the most impressive part or start to become the most impressive part of our top line. Doesn't mean the other products are not exciting. Significant momentum, especially on the Zero Trust side. This is a revenue opportunity now is short, but just forward and then looking back, I think this would be...

I'm going to put a calendar...

You should.

Planner for 5 years from now, and I'm going to check back with you. Let's maybe turn back to the network. Matthew, refers to your network as a global supercomputer. And what's unique about it, I think, is that at an atomic level, all of the building blocks are exactly the same, which creates many advantages. Can you talk about why this is important, both strategically and financially?

Yes. When I go back, we were all in Austin over the weekend and to a private event, that we met a management team there, and I've reflected how I joined. I think in my first or second interview with Matthew at that point, I started to get a glimpse of how unique this architecture of the network and the software stack. And I thought and I had an idea of how much it would mean to us as a competitive mode in terms of efficiency and cost, but I completely underestimated that. So what you have to think is we use off-the-shelf hardware that puts our equipment together, and we can get it assembled at some ODM in the eastern parts of this world. And on this hardware stack that is by now completely agnostic to the software that runs on it or vice versa. So whether we use Intel Cores or AMD cores or ARM Cores is completely irrelevant to the software that runs on top of it. And on this hardware stack, once it's fully integrated [indiscernible] software stack that allows us to run every product we have and every service we have on every server in every city and every country. And that means that the complete surface of this network becomes this -- we called it 1 supercomputer. What I like best about is this that the storage and compute capacity across that network is completely fungible in terms of how we manage demand and supply from a bandwidth perspective, how we manage capacity, how we manage costs, can you give you a couple of examples in a minute. But it also means every time we add a server regardless of where in this world, we increase the surface of this network. And with that you [ decrease of free ] to manage that. So we have thousands or ten thousands of paying customers, we have millions of free customers. So if you are a free customer, you don't have -- and you live in New York and you host your home page in New York. You don't -- that homage that need to be served from New York. So if Deutsche Bank or JPMorgan or whoever uses us in New York, spikes and demand, we can offload customers according to priority further away from where the spike occurs. We can use product and compute capacity for products in parts of where our network might be underutilized and it's always a part of the world that is asleep. Our network is underutilized. We can offload and shift compute-heavy task into that part of the network. And that also means that because you have this gigantic visibility now of how much traffic move, you get constantly innovation input into, well, how could we develop a future product that takes advantage of that specific situation. And Zero Trust to a certain extent, is a result of that. Because how -- it's almost like at your home, you pay for a certain capacity from your provider, but you download significantly more content than you upload. You have a couple of key strokes. Our network works in a very similar way. We pay for our infrastructure, not by the amount of traffic that moves through, but the size of the pipes that generate that traffic -- that transports that traffic. So as long as the back and forth in that pipeline is not getting bigger than the size of the diameter of that pipe, we don't have any additional cost. So now think about what I said, our first Wave 1 products where all about protecting infrastructure. So it was all pushing traffic out. And then you have all the planes that are sitting, so to speak, in all the cities, and they are empty. So what can we -- how can we load them when they come back and Zero Trust products are just transporting traffic in the other direction. So all the products we have there and Magic Transit, that push traffic in the other direction are literally for free from a cost perspective that's when we talk about margin accretiveness, even at low prices, these products are extremely margin accretive. It gives you an idea of how we think about this network. And now you use that to deploy code at the edge of the network where you now bring compute and storage capacity together really at the point of consumption. And I think this is unique. It's hard to compete with from a scale perspective. And I think it's the true competitive mode. That's why the innovation rate is where it is. That's why the margin is where it is. And that's why the pace of innovation that allows us to go after really chunky markets is what it is. Long-winded answer.

It very helpful. And I like that backhaul analogy of being able to get the return trip for free, so to speak. I haven't heard you articulate it that way, maybe I wasn't listening to carefully enough in the past. And I want to get back to more details of the architecture and Workers and talk more about your R2 offering that's, I think, coming GA and D1 and some other interesting things. But before I do, just component supply chains, in general, have been the topic of conversation for obvious reasons. Is there any way that we should think about constraints there as a tailwind for the business or maybe even as a headwind. And is there ever a point at which we should be concerned that you yourselves run up against capacity constraints. Can you just share maybe -- you talked about how you see the resources fungible, but is there anything about the elasticity of the network planning process that we should know or consider as we think about the business?

We -- I think we have a really good team in place that manages the network. And we started really early even when in the first quarter of 2020 when COVID started to start buy ahead equipment. So how we buy and how we source I think, has become a rather sophisticated process. I think our biggest protection against that is literally that there is nothing special in the hardware stack and that we have now become -- been able to achieve a point where literally, the software stack is agnostic to the hardware that runs on it. So whether we buy from Intel 1 day or AMD, the other, whether we use ARM cores is really -- it has certain price benefits that might have power advantages between different suppliers. But for the network itself for the product, it really doesn't matter. So we have been able, to a certain degree, at least, to decouple ourselves from any hardware dependencies. And this is huge because this gives us so many more degrees of freedom, how we source, when we source, where we source, how we negotiate, how we can take advantage of the uniqueness. And now we are already at a point where we have scale. So we are not this little guy anymore that buys. We have acquired enough in size. So we are still thoughtful about that. So the hardware part, I think we have been really managing well. We've become super sophisticated how we manage network capacity. So it's a completely fungible supercomputer, if you want to say, still completely fungible between storage and compute capacity between locations and how you shift it. This shifting is a highly automated process. There are so many algorithms in there that interpret traffic that automatically balance out where we are that we can run the network rather tight from a capacity perspective without getting into trouble, we have still significant headroom to where the network is today from a capacity perspective and how we utilize it. But the intelligence that is sitting now and resting in the management of the network capacity has become rather sophisticated and even for CFO, I can literally look at a specific server in a specific location in a specific country and look for a specific product, what our contribution margin is for a specific customers. So -- and that is incredible if you then turn around and what does this mean for our pricing, for our capacity planning for our procurement processes.

Thank you. Back to Workers. I can remember hearing about Workers when it was a little more than an idea. Today, I think you disclosed you've got 15% of customers that are using Workers at least to some extent, including amazing reference customers, Discord, Panasonic, Atlassian and Shopify. But tell us what have you learned in terms of where the opportunity is versus where it might be a little bit more difficult in competing with serverless offerings that run in central clouds.

There's a really interesting block post if you want to spend time. Matthew wrote this block post maybe 3 years ago about Workers and where it came from, where the idea was for and what we thought it would be and what it turns into at least in the near term. And we all thought -- so Workers really is a product that allows you to write code at the edge of our network. And before that idea of pushing code to the edge of the network, you could either write code on a device, your laptop, my mobile phone, where latency was really important or you could write code for server applications where speed was important. And now Workers allows you to find the third place to compute at the speed as if it were executed a code, it was executed in a server, but with the latency of almost being on the device because we are literally, we are now less than 50 milliseconds away from 99% of the things that want to connect to the Internet. So that is really powerful. And if you think about that, we thought the prime applications in the beginning would all be about speed, speed of execution. And we saw really interesting use cases in the beginning. You have lots of some Internet devices out there. So you could push AI or facial recognition software to dumb security cameras or you could take expensive devices thus driving cars or drones and offload non-latency-critical functions into our network close. So we thought that would be the big use case. But it changed over time. I think now in the new in the -- where we see most of the excitement is there's such a huge push to governize and regulate data and where it resides and how it can move. There's GDPR in Europe, there are attempts in China and Brazil, India, Japan, Australia. So today, we think, we developed a product under a headline that we call data localization suite that literally allows you to wrap something around a byte of data that says, "Oh, Brad is a citizen of Switzerland. He has a bank account with Deutsche Bank in Zurich and this credit card information is only allowed to move between specific cities between specific countries can only reside in data centers of Class 4 or 5 security level. So in the near and midterm, speed is still exciting from a use case perspective, but we see a lot of momentum in customers trying to cope with data serenity, data privacy and data governance topic and use us workers in combination with this highly decentralized network, where you come to Cloudflare, you don't have to choose a region, right? You can choose a specific location. You can say don't only in Frankfurt, only in Berlin, only in Zurich or only within your 20, whatever cities in the European Union. So I think Workers in the near term has evolved more in that direction, and it gets attached to -- the attachment in Europe to a large customers is probably even higher than it on average just because of that.

Helpful. And that actually leads me into my next set of questions for you, which I candidly struggle a little bit to really understand R2. And everything you talked about in terms of data location, data residency, data governance, makes a ton of sense. And if I struggle with this, I imagine others might as well or it could just be the -- so I don't always get everything. But later this year, you're slated to make R2 generally available, which is your block storage alternative to Amazon S3. And you've also announced your first SQL database a few months ago. I don't want to get too techy on you, but when I think about the advantage of edge architecture, I think about the power of distributing content application logic and network capabilities, but not necessarily massive volumes of data. And am I misunderstanding the use cases for things like R2 and D1, are they to be deployed in less distributed fashion across your network? And how should we think about the economics of these products, if I'm taking massive databases and replicating them in many different locations around the world.

The most interesting use cases are not about massive. It's literally what can you do if you have not only compute but storage capability at the edge of our network. And all of a sudden, all of those things, the application itself, the compute and storage that happens in the same location. I mean think about how disruptive that is going to be some of our competitors where the application might run in our part in a specific location. And then you use this your solution from a competitor where you have to build in another loop or who just in order to leave that application and come back. So there's some uniqueness around that. But I think the request from customers and especially developers to have this opportunity of storage at the edge of our network is what drove that. In the R2 case, where you talk about larger volumes, it's also most exciting use cases are, how do you avoid egress fees if you have to move significant amount of traffic between locations and there are some competitors would charge you a lot of money in order to do that, they should not be named, so we see a lot of use cases enabling that. And then when it comes to SQL database and D1, there are being able to localize this offering a huge amount of disruptive capability. So look at the structure of the network and we were able to offer this and drive it now to -- you said yourself R2 is going to be T8 now without literally investing into additional storage space at the edge of our network. So whatever we have done so far and what we need to do in order to get started happens within the existing capacity, but that gives you an idea of how powerful this instrument is if you can use all the storage capacity that we have already today on a global scale across whatever the 270 cities. And in many cities, we are in multiple locations in a completely fungible way. And then we found ways to partner with Oracle to deal how we deal with spikes in this model. So we offload certain traffic to partners. So we don't have to invest everything ourselves. So we are now at a point where we think we can do this, offer this unique capability without harming the CapEx efficiency of the model itself. And if you want to look at the reflection of how efficient is the model, you can look at our gross margin -- but we've been investing now between this year 12% to 14% of revenue into net working CapEx, which is really a low run rate compared to anybody else that space. And it has been coming down. It has not gone up. So we're in the high teens, only a couple of even 3 years ago when we were IPO. So we've been able to use the scale of the network to get a huge amount of leverage. And we think we can keep that performance even in a world where we start to have more storage capacity at an network.

Given the power of the platform. The way it is undetected and all the different things that you can do, it's understandable how it is that you're able to offer so much customer asks you to do something because you can -- you're a natural fit for you're going to obviously move in the direction of satisfying the customer. But what would you say to the perceived risk of spreading yourselves too thin in terms of the products and markets you're going after and especially it's not like you're going after some small competitors, right? In some cases, very strong, well-capitalized companies.

Well, a part of it a secret sauce, a part of it is thoughtfulness. So over -- the opportunity that is in front of us is literally overwhelming. And sometimes you Jayson and I have really elaborate process how we get to -- ready for an earnings call, right? And one part of that is talking to engineering and sales to pick the best examples that we can use in an earnings call. And then we sit together and we try to form the story and you say, what we did all this in the quarter. How are people from the outside able to stay on top of things if we have a hard time staying on top of things ourselves. There are organizational elements who help us to stay concentrated. I think the one thing that is really unique about us is how we develop products. We literally have 2 development organizations. The main one where probably 80% of our spend is and resources are taking existing products and featuring them out. That is -- we call this our journey up into the right on a Gartner Quadrant, right? Because we launched products early. We reiterate fast, but how we learn, how we improve, what is the customer feedback, what features are missing that is an organization in itself, so to speak, right? And that is their job. And then we have a second team, our advanced development team -- and it's a separate organization. And this is where all the -- what we call wave now, Wave 3, Wave 4, Wave 5 products are developed, where there's a significant more amount of leeway. We might have 2 teams in parallel because we don't know what approach is going to be successful. This is where Workers was developed. This is where our Zero Trust products were developed. And once they GA, they move over to the other organization where they get featured out. So this means there is still -- there is a substantial part of our product resources is focused on making their products and services we have better in terms of features, in terms of quality, in terms of use, and then there's the innovation part to it. Because the platform is so efficient, some of the most disruptive products we developed were not a lot of effort either, right? So the effort of launching a new service and trying it out in this world of a decentralized network, based on a product like Workers is rather unique. And then we've become quite sophisticated, I would say, at this point, how we think about how we allocate capital in resources over the course of the year, and we make cost corrections. We very openly talked at the last earnings call that it has become quite foggy out there and we take our foot off the accelerator on certain projects. One, we -- this is a project that we call Cloudflare for offices, where we say we take our hardware that is sitting -- residing today in cities, in many cities in multiple locations, but we push it into a large office building, but we take -- we push the edge further out. We slowed this down because real estate and that business has become. So we make cost corrections. We slow down hiring. So we are thoughtful from a strategic perspective how we allocate capital. We found ways to balance this risk of getting too excited about too many things with organizational structure, and I think we just learned fast and adapt fast.

Well, we're almost out of time, but maybe we can squeeze in 1 or 2 more. Thomas, can you talk about the momentum you're seeing with Zero Trust Services. In particular, how do you differentiate yourselves here versus the likes of a Zscaler. Where do you typically win? And where might it be perhaps a little bit more difficult to get traction?

Yes. I mean, first of all, I have to say they invented this space, they have a great product. And while we -- it's always easy to say here's the comment -- we have so much opportunity to disrupt a much bigger space than just winning against each other. There's all this on-premise hardware that needs to be disrupted and that is a lot of business, and we're doing really well, and I would assume they are doing really well, too. I think where we see a lot of traction, win rates as we talked about a large energy and oil company in Europe, where we won in a competitive situation, not only against this company, but also other competitors heterogeneous, complex global network setups. The topic that we just talked a minute ago that the performance of our product in the suite where these competitive offerings just become features of a larger offering on our side are turning in our advantage, the ease of use of the product that for many large customers applications already run in a Cloudflare environment in a specific situation. So why would you leave that for Zero Trust products and then the location of our [ pubs ] itself. We are not just in the bigger cities where lots of knowledge workers used to work, right? We're all remote now, and we travel. And so having a significantly larger footprint that offers that latency and performance literally anywhere on this planet is starting to have impact. And then -- it's just now your -- this feature is part of a significant control think that shows you significantly more than just Zero Trust traffic bundled into a larger offering from. So the win rates are strong, are looking good. There's momentum. But I always say -- the big opportunity in the large dollars are in disrupting the on-premise, the VPN set out there as they been...

Well, listen, maybe one real quick one from the room if we may, please.

There are so many. There's Discord and they use Workers in order to manage their chat function in large games, right, where all of a sudden performance and latency in the game and how you chat with your fellow gamers is important, while you need to keep traffic loophole you have large financial institutions, where I'll give you a good example. Layer 7 DDoS defense, this is a highly sophisticated product, right? Because you have to -- it's one of the most sophisticated attacks. In order to defend, you literally have to open a package and look inside, if the person that is trying to log in is who he or she says he is for large financial institutions in Europe, where you are able -- where are you allowed to open that package, right? So you have an DDoS attack that is happening. But at the same time, that origins, let's just make this up in Southeast Asia. But at the same time, you might have a customer being on vacation in Bangkok trying to lock into his account. So when you open up traffic -- that package in Bangkok, you'll see that " Oh Thomas Seifert with the bank account for this bank is trying to log in" you violate GDPR rule. So you have to find a way to let move that package to a place where you can open it up and inspect encrypted again move it on in the confines of GDPR regulations. That could be -- we talked about automotive customers trying to offload functionality that is in the car that is expensive from a bill of material perspective, but it's not latency critical that could be executed in our network close to that thing. But in safe cost, I gave you the other example of moving capability to dumb devices, right, not only from a capability perspective, you have an incredible amount of IoT devices that are running on operating systems that are from the 70s and 80s that are hard to update. So putting a security umbrella in front of IoT devices. And so on.

Well, thank you, Thomas. That was great. There's so many more things you can talk about, but unfortunately, we're out of time.

There will be time for other conference.

And we will look forward for that. So to you and Jayson, really appreciate your participation this year. This was fantastic. Thank you again.

Thank you. Thanks for having us.