Cloudflare, Inc. (NET) Earnings Call Transcript & Summary

Okay. Good afternoon, everyone. I am Mark Murphy, Head of Software Research for JPMorgan. And it's great to be here with CJ Desai, who is President of Product and Engineering for Cloudflare. I want to mention that Phil Winslow has accompanied him here as well. So CJ, first off, thank you for returning to the TMC conference. You promised me you would always come back to this event. I didn't know that, that would apply if you were wearing a different uniform, right? So good to see.

It's a pleasure to be here and fantastic to be here with you always, Mark.

So let's go into that. You joined Cloudflare back in October. I'm sure your reputation, I know your reputation could have carried you into a huge wide range of positions. What was it that attracted you to Cloudflare? If you could just speak to what are you seeing in the multiyear kind of vision and opportunity for this business?

Absolutely. So when I made the decision to join Cloudflare actually, relatively speaking, was an easier decision. I had options to join as CEO of both public equity and private equity companies, including late-stage start-ups, but turned them down to join Cloudflare. And just to put it simply, I would say the potential of the innovations that Cloudflare continues to deliver, and in addition, the opportunity that is there, whether it's digital-native companies, whether it's AI-native companies or whether it's large enterprises that can benefit from Cloudflare technologies, was so enormous that I said, "Hey, this will give me a good opportunity to all the lessons I've learned in the past in scaling companies, high-growth companies and the mistakes I have made, I can put them in use not to make those mistakes and help accelerate the growth at Cloudflare.

So it was obviously pretty compelling. We -- from our perspective, the history of this business, Cloudflare, is very, very rapid innovation. One of our contacts said, he summed it up and said Cloudflare is a disruptor in every sense of the word. How do you envision trying to make your imprint -- a product imprint on a company that has been innovating quite so rapidly? Is there some different direction that you want to try to steer it in? Would you go even harder toward developers? Do you think some of the -- do some of the products you want to fine-tune them a little more before you put them out there in the wild? Is there something else that you're imagining here?

Absolutely. So first of all, it is 100% true that -- even I knew this before I joined and been here 7 months, it is an extremely innovative company and the innovation pace is incredible. And even when customers sometimes would say, "Hey, CJ, we are missing this particular functionality or we need this specific thing for your feature," the team turns it around very fast and ships it. So the innovation spirit and the innovation DNA is world-class and probably the best that I have seen in my career. That's number one. In terms of where can we make a difference even more to just accelerate the pace of growth is what I would say, which is personally my experience as well, is around making sure that while the technology is great, it has also the enterprise readiness for the largest companies and governments in the world so that they can benefit and take true advantage of the platform. So that will be the one area. And then the second area is, Mark, you have known me for a long time, is there were a lot of places where through my history with many of the largest corporations in the world, where I'm opening the doors for Cloudflare, trying to really understand why they are only using product A, B and C from Cloudflare, what is preventing them from using product D, E and F or if they are not using Cloudflare, then can they use Cloudflare and what gets in the way, which gives us more requirements on the product and technology side. And then the last thing I would say is that, say, they are using 2 products from Cloudflare, are they truly getting the value from that so we can expand further in that client. So this is where I'm spending close to 30% of my time with customers, whether they are AI-native companies, digital-native or enterprises to really understand how we can deliver a custom fit solution for that customer.

So I'm hearing enterprise readiness of the products, and I'm hearing pushing kind of a broader absorption rate of the whole portfolio.

And making it relevant to the C-suite. Like what would it take for us to make it relevant to the C-suite to truly use our platform?

Okay. So -- and you seem to achieve some of that already in Q1. I think we look back on at, CJ, we came into this earnings season with a view that investors had actually become too pessimistic. But when we look at the Cloudflare results, they did -- they really did stand out. So you had -- it's a third straight quarter of CRPO growth of at least 29%. I think technically, that accelerated too. Help us understand -- so why did the company perform quite that well when you did have a backdrop of trade tensions that were building. Clearly, there was a hit to business confidence and consumer confidence.

So first of all, Mark, I would say to deliver those type of CRPO, not RPO, CRPO numbers is definitely a testament to great work by our go-to-market teams as well as product and engineering team because closer to 30% CRPO growth is definitely impressive for any metric while we guided to a $2 billion ARR run rate quarter in Q2. So that's number one. Number two, even the revenue growth besides the CRPO growth, which tends to be a trailing indicator, was 27% in Q1. That's also way ahead of what we guided when the quarter started, given the backdrop of what was going on when we announced that here is how much will come for Q1 in first week of February. The third thing I would say, the team continues to stay focused and Cloudflare, whether you look at our Act 1 business, Act 2 or whether you look at our Act 3, which is around workers and so on, this is not something nice to have once somebody decides it's a must-have, right? If you have a lot of external users and you want to protect your key assets from external hackers and others, this is a must-have. So I think this is not something a nice to have and must have. And despite the macro backdrop, more than macro backdrop, I would say, uncertainty and chaos that happened in Q1, the team executed really well.

And you closed the largest deal in the company's history. You closed this deal worth over $100 million. That definitely is quite a milestone. It definitely got our attention. And what is interesting is, so you had just mentioned the Act 3. It seemed like that deal revolved pretty heavily around workers. And I think we assume that means developers are actually going in and they're building something on the platform rather than kind of using the prebuilt products, right, that you've always had to filter traffic or whatever. Can you explain the significance of that? And then how did something like that come together? I wasn't sure if we really knew much about the use case or what it is that, that customer is building.

Absolutely. So first, I'll start is this is a reputable large tech company that was already a Cloudflare customer that knows Cloudflare and trusts Cloudflare, which is super important. So that's number one. Number two, this particular customer could have easily gone to a hyperscaler of significance and say, we will build this app in that hyperscaler and pay them whatever they needed to pay them based on their aspiration as well as scale. They came to us. They did a rapid prototype because now we have full stack capability to build a real-time app that can perform really fast. So they actually saw that in 4 weeks. So the cycle was 4 weeks long, where they saw, okay, Cloudflare has compute, it has storage, it has many serverless capabilities. Of course, it has the database and so on. So now I have full stack real-time application I can build on Workers. And oh, by the way, it will perform really fast with the global coverage we have and it is going to be cheaper than going to hyperscaler. So we absolutely, in this specific example, whether you call them beat hyperscaler or they chose us over a hyperscaler, however you want to phrase it, but that was their other option. They could have gone to a hyperscaler or they could have gone to Cloudflare, and they went to Cloudflare and did this multiyear meaningful transaction to be able to do that within 4 weeks. So we want to obviously repeat this cycle for this kind of characteristic when somebody is building a net new real-time application on our Workers stack. And this was not even Workers AI. It was just a classic application that you can build on any compute stack.

Okay. Impressive. I didn't know it came together that quickly either. So let's spend a moment. You said it wasn't Workers AI. Let's talk about AI companies for a moment that you have as customers. It includes OpenAI, it includes Anthropic, it includes Hugging Face. And you had given us the stat at the I think it was last year's Analyst Day that it was 78% of the top 50 GenAI web products by monthly visits use Cloudflare. And so my understanding of it, CJ, is that they wouldn't be using Cloudflare for training, right? Because to do the training, you would have a big monolithic data center that's not what Cloudflare is. But they seem like they're pretty interested in the inferencing piece of Cloudflare. Could you explain what is causing a major AI company or so many of them, I should say? And why are they choosing you again? You just talked about the one that it was against the hyperscaler. Why are they using Cloudflare? Why not AWS, Azure, Google?

Yes. So totally fair. So you're absolutely right that if you are doing model development, then Cloudflare is not an option that you would consider, right, when you are developing a model. Now some of the top AI companies, some of that you mentioned, when I speak to them, they will say it simply, Mark, that, listen, CJ, I'm running -- I'm a large AI company. I have hundreds of millions of monthly active users. Of course, my compute and storage right now is in one of the hyperscalers, but you are the extension of my network and you are my secure front door. I mean that is -- those are exact words that the CTO of one of these large AI companies used that we use Cloudflare as an extension of our network, and we use Cloudflare to protect us as a digital front door. So that's just them using us from our Act 1 product where we see a lot of traffic because what they are solving for is that when you go to their API and ask a question and you get an answer -- it generates an answer, they want that to be as fast as possible and network should not hold the answer back, meaning it gets delivered faster, the request gets routed faster and so on. So that's one piece, okay? Why these AI companies are already using us as an extension of network and for security. Now the second piece that you went to, which is the inference. For inference, if you want to deliver inference at a very fast pace in front of the eyeballs with very low latency where network matters a lot more, that's when you can run inference on Cloudflare's network. So you have smaller models that a lot of companies are coming up with as in the model providers, foundational model providers, you can run those models on Cloudflare's network so that you're closer to the eyeball, it runs fast, usually the out.

I'm sorry, did you say smaller models?

Smaller models.

Okay. So then what are the types of workloads? So what should we be picturing if you can make that tangible to us? Is it -- are they consumer-facing apps? Is it ChatGPT would seem to be one we can all relate to. Or are you saying that you would have an enterprise, right, building AI and then wanting to run the inferencing at the edge?

I would say it's an and, not an or. So it's both. So first of all, consumer-facing apps, so whether it's digital-native company, Mark or AI-native companies that are building agents that need to perform really, really fast and you want to run inference really fast, of course, that works. Enterprises, as you probably heard throughout this conference, enterprises are not doing inference at scale yet. They're not doing inference at scale yet. Yes, they are still fine-tuning their models. Many of the enterprises are still fine-tuning their models and rolling out slowly the inference. When the inference scale hits, we want to be there for them to provide the inference faster, cheaper and super performing.

Okay. It sounds like you think that, that is going to be in a process of hitting. We -- related to that, I do think we experience problems with lagging performance. And I think across a lot of these consumer-facing AI products, it's kind of common for me. You wait. Why is this taking a few seconds, 10, 20 seconds, depending on what you're trying to do. What is the bottleneck in that kind of a process? Because it might have some -- I don't know -- we don't know where that sits. And can you speak to -- if a company comes to you and says, we want you to be that secure front door, as you said, how materially can you change the latency?

Yes. So I would say always, when you think about that critical path, when you make a request, say, my son is doing history homework and -- real example, and he is trying to go to ChatGPT to get a quick answer rather than reading the entire chapter on it. When he does that, the compute in itself will take some time, right, based on how large the model is, what kind of servers, GPU chips they are running on, it will just take some time.

It's thinking.

Yes, it's thinking because it's generating an answer. So you have that specific bottleneck, we are not addressing that, right? That's the LLM providers working with the infra providers and they figure out how long it takes and how much they can fine-tune that. Where we add value is the request still goes through the Internet, right, and makes that call to say, who won the war of 1812 or whatever, something. In that example, we want to optimize the network path that is going over public Internet, so the requests get routed most efficiently to the LLM. LLM provides the answer. Now you want to come back also very fast and all that done securely where it's not a denial of service attack, somebody just trying to hack the model or somebody just trying to take advantage of it. That's what we are really, really good at, right? Because that's what leverages our global network. So that's why these AI-native companies say, "Hey, there is certain compute time that it's going to take before the LLM provides an answer," but then can we optimize all the remaining path, which is typically the network, the request coming in and the answer is going back over public Internet when my son is doing homework in Boston, he's actually here.

Okay. Good to hear. The -- I hope we know who won the war of 1812. So that helps us understand kind of there's bottlenecks that you can help with. There's bottlenecks that you can't help with. But we hear these AI model companies saying that they care about the security of those systems, and they'll talk about preventing the system from abuse, right? Can you make that tangible for the audience out here? What is an example of the security risk that they're worried about in the AI apps and in the abuse? And then how does Cloudflare prevent that?

So if there is any customer, right, you look at any enterprise customer, any AI-native companies that is trying to scale, you have many that are trying to scale. What is their worst nightmare? Their worst nightmare is similar to it happened on the classic HTTP traffic, web traffic, denial of service, where you have somebody just a bad actor trying to do bad things where the response just doesn't come in. So a classic denial of -- distributed denial of service type of attack, of course, they want to avoid that if you're an AI company. Number two, okay, now somebody has built an agent on top of your LLM. Can you make sure that legit traffic is going to that agent and it is not trying to abuse the actual LLM by either feeding it a bad data or try to extract personal data, right? Think about a chatbot for a large bank and it's trying to do customer service, somehow you provide information and it tells you, oh, Mr. Murphy, the wire transfer was not this amount, that amount, something of that sort, that would not be good if it's a personal data that's getting leaked by some specific LLM that is trying to serve customer service for a bank or a health care company or could be a government site, things like that. So there are legitimate concerns on data exfiltration, garbage data going into LLM, denial of service attacks and so on.

Okay. So that's very clear.

And we have a role to play.

And you have a role to play. And you play it well. Thinking back again to your time when you were on stage here a year ago representing ServiceNow, you were very instrumental in the work on Pro Plus and -- now Assist, not only the products, but I think also the pricing models because I remember talking to you, you were very scientific about it. And thanks to that work you've done, those products are heading towards $1 billion in the next couple of years. What's the right AI pricing and monetization strategy for Cloudflare?

So I would say Cloudflare, AI is definitely, from my perspective, for many years to come, is a killer transition that Cloudflare is going to benefit from, from an infrastructure perspective. So as you create AI agents, of course, you can create that on our platform, Workers platform. As you try to run inference, you can do that on our platform at scale. If you're trying to protect your AI agent, you can do that on Cloudflare. So you will have a series of products or enhancements that will come from us on AI that will just help you with your AI strategy. But at the same time, when you want to run AI efficiently and cheaper, we can help you with that as well. So here, the strategy is a little different that we want to be the best-in-class infrastructure, both from networking and security perspective for your AI workloads. And for that, we'll have either additional products or we have additional features or we will have GPUs available in many cities around the world, so you can run AI inference at scale.

Okay. Understood. So switching gears for just a moment. I wanted to go into this concept of what is happening in Google with AI overviews. Matthew Prince, who I think is just a brilliant amazing guy. He had shared his views of how AI is kind of undermining that -- he called it the traditional business model of the web because you have these zero-click searches, right? So the traffic is not going back to the website or the publisher in that case. And I think he said it was 3/4 of the traffic. I don't know. There's a huge amount of that traffic. It's just not flowing anymore. So first of all, can you help us with economically, how big of a problem is that? And then just secondly, what is Cloudflare doing to try and help it?

Yes. I mean -- so first of all, 100% agree with Matthew that this is a big problem, okay? Then you have to say, okay, who is the problem for, right? Who is the problem for? Then you can say the problem is how Matthew has described it correctly, for content creators, right? A lot of media companies that publish content JPMorgan research report from Mark Murphy. That's a proprietary content. And believe it or not, if I do search on some of the AI companies, your name and reports are there. Should they be there for free? I don't think so. So you can have content of different kind that is now sucked up in various LLMs. And it is not fair whether you are a media company that does journalism or whether you are investment research firm or whether you are a real estate company that is doing pricing on a house or you're an airlines that is saying from Boston to San Francisco between JetBlue, United and American, 3 choices I looked at tonight, which one is a better one. So there is a lot of proprietary information that should not be sucked up because that's your -- you exist for that content or you exist for that pricing. So now in this AI-driven Internet versus a search-driven Internet, what is the role Cloudflare can play? And the way we can play this role is if you don't have an agreement as an AI company with a media company X, the AI company should not crawl you and suck up all that content, which is proprietary to you. And of course, you make ad revenues and other revenues or eyeballs.

It's hard to disagree with that. Yes.

Yes. So the role we want to play is that can we act as somebody who can block the traffic for the AI company so that they don't scrape your content. So we give that right to the content creators, and we have made a few announcements in that area, what we can do. And oh, by the way, if you do have a relationship with that AI company, yes, let the traffic pass through and make sure that we give you all the insights on that traffic. So that's how I see the world. But yes, absolutely, this is instead of the blue links that we are all used to with Google since 1998, since 1998, that's been 27 years that people are used to the blue links. And now it's just the answer at the top, which could come up with -- which could have sorts of like 17 articles and nobody is going to click on those articles to go back to the media.

Yes, it's an incredible change, and we applaud you for trying to do something about it. I want to switch gears and ask you about the actual network itself. The numbers we have is the Cloudflare's network is sitting in 335 cities globally. And so you can hit 95% of Internet users within 50 milliseconds.

Or less.

Or less. How are you thinking about the network architecture and the build-out of it? So in other words, what's the right pace of that build-out? What is the right hardware to be using?

So first of all, as we have publicly stated, including at the Investor Day, our aspirations are the next milestone is $5 billion plus in subscription revenues. That's our next milestone. And we want to be prepared as more enterprises come on board, more AI-native companies come on board or digital natives come on board, we want to be prepared for all of those companies using Cloudflare's network security or the Workers platform, which means we will continue to invest. So for example, this year, even within India, we are expanding in 16 cities. We are adding global compute. We are expanding in 3 new countries. That expansion will continue. But at the same time, we are disciplined about it, right? We want to leverage this infrastructure really well. And we have given the long-range guidance range that our gross margins will be in the upper 70s, and we want to serve that. So we are being very methodical where we can have better software optimization, so we can leverage the hardware better. We will always do that. So we don't keep on adding more servers or more network switches or whatever the case might be and the same thing with GPUs.

The gross margins are amazingly good for the type of network that you've got. One aspect that surprised us a little in Q1 was the -- you had a CapEx spike. And I think -- our understanding was that more hardware kind of became available then. Can you explain what happened? What created that opportunity?

Yes. I would not worry about quarterly numbers. We have given the guidance for the year and guidance for the long range, how we think about it. And our goal is always -- sometimes we will purchase more depending on the quarter and so on, but we will still hit the upper 70s gross margin. It just goes through the quarterly fluctuation.

Okay. So not a lot to read into that. How about the GPU fleet? You had said the last update was 190 of those 335 cities had AI inferencing supported by GPUs. What do you think about -- maybe you can help us to understand that. Which GPUs make the most sense for what Cloudflare is trying to do? And how pervasively do you want to roll that out? Is it going into every city?

Not right now because here is what I would say. Speaking to all these companies, no matter whether it's AI native or the enterprises, the inference at scale is still not happening, Mark. So we are seeing that the inference volumes are growing, but no way they are leveraging all the capacity that we already have. And we are also constantly doing software optimization. models are becoming smaller. And you remember the DeepSeek announcement in February, I mean, you are seeing that people are trying to leverage the GPU even more the way this newer class of models are getting created. So first, I'll start there, that really good innovation happening. Second is we have shared that we have partnership with NVIDIA, and we have used NVIDIA's GEAR. But right now, 190 is more than enough for how we are seeing the inference at scale being played out.

Okay. Great to hear that and the underlying dynamics. In the last couple of minutes that we've got, CJ, I don't want to skip over what's happening in Zero Trust because it's been impressive, too. You're competing generally against an older first generation of Zero Trust providers. There -- so I think you're going in, there is an incumbent in there. And generally, Cloudflare is going in and having some success replacing them. What are the leverage points you're kind of using here to get them? It's not easy to rip and replace an existing product. So how do you convince them that it's right to be doing that?

Okay. So first of all, as I have come to understand the space and after speaking to many, many customers around the world, it is still an underpenetrated space. Zero Trust is not that easy to roll out because you need buying from your networking team, you need buying from your security team, you need buying from the overall IT infrastructure team, which networking team could be part of or could be a separate team. Enterprise architect, you understand. So first of all, even the first-generation vendors have not fully penetrated this space as much. Most have penetration less than 50% in Fortune 500 when I look at the entire landscape, okay? Number two is Cloudflare built this amazing network for external users. We are leveraging the same network for now internal users and employee. And I see that as just the other side of the same coin, and that mark is an advantage for us. Our global network and our performance is a disruptor, number one. Number two, reverse proxy, forward proxy, however you want to look at it, egress, ingress, what fundamentally it tells you is that what we did for external users from a security perspective, we can do the same thing for internal users as an employees and contractors. And so where we are winning deals is we are winning deals in companies that already trust Cloudflare on land and expand. You saw that it was just about, I want to say, 4 or 5 quarters ago, we started doing $1 million transactions, and we just announced last week that we did another 7-year, $14 million-plus transaction. So we are now getting the $1 million deals. But the key differentiator is our network. No other Zero Trust provider has the breadth of our network. Number two, the performance, less than 50 millisecond latency does -- for executives who are traveling, it matters a lot to them, including employees who travel. And number three, price. Because we are using the same network, our margin profile is much higher when we sell Zero Trust products. But number two, we don't need to charge very high because we've already built the network versus others cannot match them.

Okay. Compelling message to end on. Incredible to see the success you're having, the $100 million deals, the 7-year deals, really exciting seeing you on this path to $5 billion. Keep up the great work, and we'll see you back here in a year.

Yes. Sounds great. Thank you always. All right. Bye.