Cloudflare, Inc. (NET) — Coverage File

Data as of: Q2 2026 (quarter ended June 30, 2026; 10-Q filed Aug 6, 2026); latest source 8-K Aug 13, 2026 (2031 convertible notes) File last updated: October 10, 2026 (initial build)

---

0. 30-second reopen

• Business: A global network in front of more than a fifth of the web, selling security, performance, Zero Trust and the Workers developer platform; revenue grew 36% in Q2 2026 to $696.1M, 73% of it from customers paying over $100K a year.
• Core debate: Does the surge in AI-agent traffic become revenue faster than it becomes cost, and can growth plus operating leverage outrun ~20%-of-revenue stock compensation and a price of ~45x revenue?
• Base thesis: Agents have to cross Cloudflare's network, enterprises are expanding on it (DBNR back to 120%), and it is winning AI workloads without hyperscaler-style capex, so a 30%-growth business can keep widening operating margins.
• Main bear case: Agent traffic inflates cost first (gross margin down 3.2 points in a year, largely from undefined third-party technology costs) while growth is guided down to 31%, stock compensation exceeds free cash flow, and the founders have just added non-voting stock to their toolkit.
• What to watch: DBNR, large-customer growth, non-GAAP gross margin and third-party technology costs, network capex against the 14–15% guide, SBC as a share of revenue, and any Class C issuance.
• Valuation: ~$128.5B market cap at the Oct 9, 2026 close (web): ~45x 2026 revenue guidance and ~405x trailing free cash flow. The price assumes many years of ~30% growth and a large fall in SBC intensity.

---

1. Business snapshot

Cloudflare runs one network in more than 330 cities and 125 countries and sells everything on it as a single platform, reported as one segment [FY2025 10-K]. Management describes four "Acts": application services (security and performance for websites and APIs), Zero Trust/SASE for corporate networks, the Workers developer platform (compute, storage, AI inference, agents), and Act 4, new business models for the internet such as AI Crawl Control, pay-per-crawl and the Monetization Gateway [Q4 FY25 call; Q2 FY26 call]. Revenue by Act or product is not disclosed.

Contracted (Enterprise) customers sign one-to-three-year, mostly non-cancelable contracts; pay-as-you-go customers pay monthly by card; usage above commitments is billed as used [Q2 2026 10-Q]. A growing share of large deals are "pool of funds" commitments that can be drawn across the whole platform: about 20% of Q4 2025 ACV and mid-teens for 2025 [Q4 FY25 call]. A free tier for developers and small sites feeds the paid base.

Q2 2026 revenue was $696.1M (+36% y/y). The US was 51% (+41%), EMEA 27% (+30%) and APAC 14% (+32%) [Q2 FY26 call]. Partners carried 31% of revenue [Q2 FY26 call]. Customers paying more than $100K a year numbered 4,698 (+27%) and generated 73% of revenue; no customer exceeded 10% of revenue in 2023–2025 [Q2 2026 10-Q; FY2025 10-K].

2. Core debate

The first question is whether agent traffic is revenue or cost. Non-human traffic passed 50% of Cloudflare's network in Q2, and the CEO projects it could reach 1,000 times human traffic within five years [Q2 FY26 call]. Some of it is blocked at no extra charge, some is served for paying customers, and the products that would charge agents directly are announced but not yet reported. Meanwhile cost of revenue rose 53% against revenue up 36%, with third-party technology services the largest driver [Q2 2026 10-Q].

The second question is whether growth and operating leverage can outrun dilution at this price. Revenue growth has run 29–36% since 2024, and the May 2026 workforce cut (~20%) is meant to let profit scale faster than revenue. But stock compensation is ~20% of revenue and larger than free cash flow, the Q3 guide implies 31% growth, and the stock trades at ~45x this year's revenue (§8).

3. Base thesis

More than 20% of the web already sits behind Cloudflare [Q4 FY25 call], so AI agents reaching those sites cross its network whoever builds them, and more than 80% of major AI companies are customers [Q2 FY26 call]. Enterprises are consolidating security and networking onto its platform, and the developer platform is becoming a default deployment target for AI-built code. Because Cloudflare sells work done rather than server time, higher utilisation is its own profit, so it can grow AI workloads behind demand without a hyperscaler-scale capex cycle. On this view a 30%-growth, ~73% gross margin business keeps widening operating margins and reaches GAAP profit well before 2028.

Assumptions this rests on:

1. Agent and AI traffic turns into larger contracts from existing customers: DBNR holds at 115–120% or better and large customers keep growing in the mid-20s % [Q2 2026 10-Q].
2. The gross margin decline is mix and cost allocation (paid traffic moving network cost from sales & marketing into cost of revenue; a lower-margin developer platform), and margin stabilises near 73% while operating margin rises [Q1 FY26 call; Q2 FY26 call].
3. AI growth stays capital-light: network capex near 14–15% of revenue, and no commodity GPU leasing on Cloudflare's balance sheet [Q2 FY26 call].
4. The AI-first restructuring holds growth near 30% while SBC falls as a share of revenue and GAAP profit arrives by end-2028 at the latest [Q2 FY26 call].

4. Main bear case

The fast-grower risk here is paying for a duration of growth that does not arrive, while the business dilutes holders along the way. Trailing SBC was ~$508M against trailing free cash flow of ~$315M (author's arithmetic: FY2025 + H1 2026 − H1 2025) [FY2025 10-K; Q2 2026 release], and diluted shares rose 2.3% in the year to Q2 [Q2 2026 release]. Agent traffic, the core of the story, shows up first as cost. Non-GAAP gross margin fell to 73.1% from 76.3% a year earlier, and the measures that would show whether that matters are changing: management now emphasises an undisclosed "unit economic margin" over the 75–77% gross margin target it cited in February, and the 10-Q dropped paying customers as a key metric [Q4 FY25 call; Q1 FY26 call; Q2 2026 10-Q].

How it breaks: growth slides into the mid-20s as DBNR falls back toward 115%; gross margin keeps falling as agent traffic and third-party technology costs scale faster than monetisation; network capex has to rise above 15% of revenue to carry inference; another network-wide outage (there were two in late 2025) slows large-customer wins. Through all of it, the founders' voting control and the new non-voting Class C stock allow acquisitions and spending to continue without outside holders being able to stop them.

5. Business quality

The asset is the network and its position. More than a fifth of the web behind one provider gives Cloudflare traffic visibility, threat data and a distribution channel that point vendors and new entrants lack, and its neutrality is a selling point with AI companies and publishers wary of hyperscalers that build their own models [Q4 FY25 call]. Expansion economics are strong: DBNR recovered from 111% at Q4 2024 to 120% [FY2025 10-K; Q2 2026 10-Q], customers paying over $1M rose 55% in 2025 to 269 [Q4 FY25 call], and management reported its highest-ever renewal rate in Q1 2026, pool-of-funds renewals included [Q1 FY26 call]. Retention by cohort and gross churn are not disclosed.

The weaknesses are on the profit side. Cloudflare has never made a GAAP operating profit: FY2025's operating loss was $(207.2)M, and $131.2M of interest income narrowed the net loss [FY2025 10-K]. Gross margin has slid from 77.3% in FY2024 to 71.8% (GAAP) in Q2 2026 (author's arithmetic) [FY2025 10-K; Q2 2026 release]. Reliability is a single point of trust: software deployments caused "widespread service unavailability" on the network in November and December 2025 [FY2025 10-K].

6. Key value drivers

• Large-customer expansion: 4,698 customers above $100K (+27%), 73% of revenue; DBNR 120% [Q2 2026 10-Q; Q2 FY26 call]. Record net additions in every tier from $100K to over $5M.
• Developer platform (Workers): 7.4M developers, ~2M added in Q2 alone, and "the fastest-growing" Act [Q2 FY26 call]. It carries lower gross margin but a lower cost to book [Q1 FY26 call]. Its revenue is not disclosed.
• Zero Trust/SASE: management says it has gained share "pretty significantly in the last six months" by selling an agent-first security model [Q2 FY26 call]; not quantified.
• Contract structure: pool of funds and usage tiers make revenue lumpier ("higher standard deviation") but stickier [Q2 FY26 call; Q4 FY25 call].
• Channel: partners at 31% of revenue; the CEO expects over 50% in time [Q2 FY26 call].
• Cost lines that swing margin: allocation of network cost as free traffic turns paid; third-party technology services (+$30.1M y/y in Q2); depreciation from server deployments (+$10.1M) [Q2 2026 10-Q]; network capex guided at 14–15% of 2026 revenue against 7% in Q2 [Q2 FY26 call].
• Act 4 optionality: Monetization Gateway, Wallets and pay-per-crawl, plus an OpenAI research pilot [Q2 FY26 call]. None has reported revenue.

7. Financial profile

FY2023–FY2025 revenue was $1,296.7M, $1,669.6M and $2,167.9M (+29% and +30%). GAAP operating losses were $(185.5)M, $(154.8)M and $(207.2)M; non-GAAP operating income was $230.1M (14%) in FY2024 and $303.9M (14%) in FY2025. Free cash flow rose from $119.5M to $166.9M to $260.6M (12% of FY2025 revenue), while SBC rose from $274.0M to $338.5M to $451.5M [FY2025 10-K]. FY2025 capex including capitalised software was $342.6M, 15.8% of revenue.

H1 2026: revenue $1,335.8M (+35%), non-GAAP operating income $169.2M (12.7%), GAAP operating loss $(267.7)M including $150.7M of restructuring, operating cash flow $275.9M and free cash flow $140.5M [Q2 2026 release]. Restructuring is guided at up to $165M for 2026, about $130M of it cash; $99M was paid in Q2 [Q2 FY26 call; Q2 2026 10-Q]. Excluding restructuring, the Q2 GAAP operating loss was about $(55.0)M (author's arithmetic). Guidance for FY2026 is revenue of $2,864–2,870M (+32%) and non-GAAP operating income of $443–445M, up from $2,785–2,795M and $378–382M in February [Q2 FY26 call; Q4 FY25 call].

Balance sheet at June 30, 2026: cash and available-for-sale securities $4,162.8M; convertible notes carried at $3,270.3M, of which the 0$1,293.8M issued, due Aug 15, 2026) were current and the 0% 2030 notes ($2.0B, conversion price $247.67, capped calls to $469.73) were long-term; a $400M revolving credit facility signed May 2024 [Q2 2026 10-Q; FY2025 10-K]. Cloudflare elected to repay the 2026 notes' principal in cash and settle any excess in shares; the excess was ~$364.7M at the June 30 price [Q2 2026 10-Q]. In August it issued $2.175B of 0% notes due 2031 (conversion price $496.94, ~$2.14B net proceeds before capped calls; $325M option) [8-K Aug 13, 2026]. The 8-K describes the 2026 notes as $1.125B, which conflicts with the 10-Q; the settlement itself is not yet in sources.

8. Valuation

There is no GAAP earnings base to value, so the price rests on revenue duration and on SBC intensity falling. At the October 9 close the market value is ~45x FY2026 revenue guidance, ~51x trailing revenue, ~290x guided 2026 non-GAAP operating income and ~405x trailing free cash flow. Non-GAAP operating income adds back ~$560M a year of SBC and payroll tax at the current run-rate, so on an owner's-earnings basis the multiple is higher still. For context, the August convertible was priced off $310.59 [8-K Aug 13, 2026], and the stock has since risen ~16%.

Market data callout — as of market close October 9, 2026 (source: stockanalysis.com web market data, outside sources/; not company filings). Share price $360.93; 52-week range $158.83–$370.35; shares outstanding 356.08M; market capitalisation ~$128.5B. Derived using filings: cash and securities of $4,162.8M less convertible principal of $3,293.8M at June 30, 2026 gives net cash of ~$0.9B, so EV ≈ $127.6B → ~44.5x FY2026 revenue guidance midpoint ($2,867M), ~51x TTM revenue ($2,512M), ~405x TTM FCF ($315M). The net-cash figure predates the August 2031 notes and the 2026 notes' settlement. Market data is not a company source and is used nowhere else in this file.

9. Management & capital allocation

Matthew Prince (CEO since 2009) and Michelle Zatlyn (President) co-founded the company and co-chair the board; Thomas Seifert is CFO [FY2025 10-K/A]. Through 10-vote Class B shares the co-founders held ~50.5% of the vote at December 31, 2025, and insiders and 5% holders ~71.0% [FY2025 10-K]. In February 2025 each co-founder received 259,672 RSUs vesting over five years and 175,111 PSUs that vest only on 90-day average share prices from $156 to $579 within seven years; the $156 and $203 tranches were met in 2025 [FY2025 10-K/A]. The current price is above the $263 and $343 goals, but whether the 90-day test has been met is not in sources. About 24% of votes cast opposed say-on-pay at the June 2026 meeting (author's arithmetic) [8-K Jun 30, 2026].

The June 2026 meeting also created non-voting Class C stock and a Class C split, doubled authorised Class A shares to 4.5B and preferred to 450M, and required independent-director approval only for Class C-funded acquisitions above $100M [8-K Jun 30, 2026]. Class B votes (335.6M) carried it; if all were cast in favour, about 80% of Class A votes cast were against (author's arithmetic; inference). The proxy setting out the rationale is not in sources.

Capital allocation has been disciplined in scale but leans on equity. There is no buyback programme in the filings. Funding has come from 0% convertibles with capped calls (2026, 2030, 2031). Acquisitions are small technology and team deals: Kivera ($28.0M, 2024), Replicate ($57.4M cash, December 2025) and VoidZero ($164.2M, half in stock, plus $106.4M of retention awards, June 2026) [Q2 2026 10-Q]. The May 2026 restructuring cut ~20% of staff (headcount ~5,500 to 4,700) to move to an "agentic AI-first operating model" [Q2 2026 10-Q; Q1 FY26 call; Q2 FY26 call]. Management has declined to lease GPUs as commodity compute [Q2 FY26 call].

Claims to verify over time: GAAP profitability by end-2028 "at the latest", with the company "pacing ahead"; unit economics expanding through H2 2026 with gross margin stable; GPU utilisation approaching 70–80% CPU levels against single digits at hyperscalers; non-GAAP net loss ex-restructuring "around $18 million" in Q2; partner revenue above 50% in time; 2026 free cash flow expectations unchanged ex-restructuring [Q1 FY26 call; Q2 FY26 call]. None is auditable from the filings yet.

10. Risks ranked by damage

1. Growth fades into a price that needs it, while SBC dilutes Damage rank: High · Permanence: High · Fixability: Low Mechanism: a ~45x revenue multiple discounts many years of ~30% growth; if growth slows, the multiple compresses permanently, and SBC at ~20% of revenue means per-share value lags the business. Evidence today: Q3 guide +31% against +36% in Q2; SBC with payroll tax $140.6M (20.2% of revenue) in Q2; diluted shares +2.3% y/y; the 2030 notes convert at $247.67, below the current price [Q2 2026 release; Q2 FY26 call; Q2 2026 10-Q]. What would confirm it: DBNR back below ~115% and growth in the mid-20s with SBC still near 20% of revenue. Impact: permanent loss of capital even if the business keeps growing.

2. Agent traffic grows faster as cost than as revenue Damage rank: High · Permanence: Medium · Fixability: Medium Mechanism: blocked or served agent traffic consumes network, compute and third-party services before any agent-payment product earns revenue. Evidence today: cost of revenue +53% vs revenue +36% in Q2; third-party technology services +$30.1M of the +$67.9M increase, a cost line the filings do not define; non-GAAP gross margin 73.1% vs 76.3% [Q2 2026 10-Q; Q2 2026 release]. What would confirm it: gross margin below ~72% for two quarters, network capex above 15% of revenue for the year, or third-party technology costs outgrowing revenue. Impact: each gross-margin point is ~$29M of 2026 operating profit against $444M guided (author's arithmetic); undermines §3 assumptions 2 and 3.

3. Reliability with a leaner team Damage rank: Medium · Permanence: Medium · Fixability: Medium Mechanism: a single global network concentrates failure; a bad deployment hits every customer at once, and large contracts are bought on trust. Evidence today: network-wide outages from software deployments in November and December 2025; a ~20% workforce cut in May 2026 with growing reliance on AI tools the company says may not perform as expected [FY2025 10-K; Q2 2026 10-Q]. What would confirm it: another network-wide incident, slower large-customer additions or a dip in DBNR after it. Impact: customers add a second vendor and push back at renewal, hitting §3 assumption 1.

4. Founder control and non-voting currency Damage rank: Medium · Permanence: High · Fixability: Low Mechanism: majority voting control plus non-voting Class C and cheap convertible capital let management pursue acquisitions and spending without outside checks. Evidence today: co-founders ~50.5% of votes; Class C approved over apparent Class A opposition; $2.175B raised in August partly for "potential acquisitions" [FY2025 10-K; 8-K Jun 30, 2026; 8-K Aug 13, 2026]. What would confirm it: Class C issued for an acquisition, or a large deal funded by stock or convertibles. Impact: dilution without loss of control; outside holders cannot correct misallocation.

5. Hyperscaler bundling and competition Damage rank: Medium · Permanence: Medium · Fixability: Medium Mechanism: hyperscalers bundle security, CDN and developer services into existing cloud spend, and are building their own content marketplaces. Evidence today: management cites customers under "competitive pressure to consolidate spend with their incumbent hyperscaler" and notes Microsoft and Amazon have announced content marketplaces [Q2 FY26 call; Q4 FY25 call]; win/loss data is not disclosed. What would confirm it: slower new-logo growth among large customers, or pricing concessions visible in gross margin. Impact: slows §3 assumption 1 and caps Act 4.

6. Content and regulatory liability Damage rank: Low · Permanence: Low · Fixability: Medium Mechanism: Cloudflare serves sites whose content may break local laws, and EU states are adding obligations on intermediaries. Evidence today: an Italian regulator fined Cloudflare ~€14.2M in December 2025 [FY2025 10-K; Q2 2026 10-Q]. What would confirm it: larger fines, blocking orders or service restrictions in a major market. Impact: cost and friction rather than a threat to the model, unless it spreads to large markets.

11. Metrics to monitor

12. Thesis tripwires

13. Open questions

• What is in "third-party technology services"? Purchased AI model capacity, cloud services or something else? The filings do not say, and it is now the largest cost-of-revenue driver.
• How much revenue do Workers and the developer platform generate, and at what gross margin? Not disclosed.
• How is the "unit economic margin" defined, and what did the June 2026 Investor Day set as targets? The materials are not in sources (see §9 on claims to verify).
• What is the Class C stock for, and on what terms would it be issued? The 2026 proxy is not in sources.
• Were the 2026 notes $1,293.8M or $1.125B at maturity, how many shares were issued to settle the excess, and was the $325M 2031 option exercised?
• How much of the 74% growth in paying customers is small developer accounts, and why was the metric dropped from the 10-Q while still cited on the call?

14. Update log

15. Source map