Chit Chat Stocks - Cloudflare Part 2 (NET) with Joe Furmanski

Episode Date: June 9, 2022

Cloudflare offers an integrated cloud-based security solution. The company aims to make the internet safer and better for the world. Listen as Brett and Ryan ask Joe questions about the company, its business model, and valuation. Enjoy the show! This episode is sponsored by Quartr, the new way of doing company research. Access conference calls, presentations, transcripts, and more for FREE on your mobile device. Download Quartr on the App Store here: https://apps.apple.com/us/app/quartr-investor-relations/id1552412128  Download Quartr on the Google Play Store here: https://play.google.com/store/apps/details?id=se.quartr.android Subscribe to 7investing with the code "Money" and get $100 off: https://7investing.com/subscribe/aff/4/ Want updates on future shows and projects? Follow us on Twitter: https://twitter.com/chitchatmoney Interested to see more of Joe's work? Find him on Twitter here: https://twitter.com/joe_furmanski?s=20&t=lHPEZ0clbuIsP3eVZwDmtA Contact us: [e-mail]  Timestamps Cloudflare | (3:35) What is DDoS? | (13:06) Competition | (23:53) Disclosure: Chit Chat Money hosts and guests are not financial advisors, and nothing they say on this show is formal advice or a recommendation. Brett Schafer and Ryan Henderson are general partners and portfolio managers at Arch Capital. Arch Capital and its partners may hold securities discussed on this show. Learn more about your ad choices. Visit megaphone.fm/adchoices Learn more about your ad choices. Visit megaphone.fm/adchoices

Welcome to Chit Chat Money. This is our Thursday deep dive episode where we have on a guest to discuss a single stock. And today we are talking about Cloudflare for the second time with Joe Formansky. The first one I would say was more brass tacks, kind of the basics of the business. And this goes really more into depth about each of their, he calls them acts, but different products slash platforms. Yeah. And the company calls them acts too. If you're more interested, I know when you're listening, if you're not an expert on Cloudflare, you're going to have more questions. The company has a great IR site, investor relations site, and they have a lot of good stuff with their product suite. They're pretty open about it.

So there's plenty to dig into if there's something that piques your interest. But yeah, this, I learned a lot about Cloudflare. And I think, what would you say, like 50% of the way there from understanding? I'm like an IT expert now. Yeah. Before we're at 0%, after, learn a ton about how they work, why their value is there, and why they're building all these different S-curves of growth that just seem like a really, really sound strategy. Yeah. I know. Joe does a wonderful job explaining the business and why it's hard to know why something like this is so special for an outsider who's not in the industry. He does a really good job of painting, I guess, that special sauce.

But before we get to the interview, we have a word from our sponsor, our partners. It's quarter. It has been earnings season lately. And I have to say, I think I'm an earnings season daily active user. I don't know if I'd call myself a full-time DAU, but earnings season, it's an easier way to digest conference calls if you're in a bit of a time crunch trying to research or you like to listen to it audibly instead of reading it. this is the investor relations app for your phone. You can, you can even read their conference calls on there. You can read it on there. And I'll tell you what, there's been less free sites with the conference call transcripts lately. Quarter's been my outlet for that. That is true. I agree a hundred percent with that quarter is the best place. It's an easy, it's an easy product for us to promote because we actually use it every day. It's a hundred percent free. There's also some IR presentations on there for pretty much any company. And if they don't have the company, just recommend it or send it in and they will

probably have it up pretty quickly. And yeah, just go ahead and check them out. It's quarter Q-U-A-R-T-R. So no E at the end. And then you can also follow them on Twitter. Great Twitter account. It's quarter underscore app. I'll say it one more time. Q-U-A-R-T-R. No E. Go ahead, check them out. Without further ado, let's get to the interview. Welcome to Chit Chat Money. On this show, hosts Ryan Henderson and Brett Schaefer interview industry experts and riff on the world of investing. As a quick reminder, Chit Chat Money is a CCM Media Group podcast. Ryan and Brett are also general partners at Arch Capital, and Arch Capital may have positions in the securities discussed in this podcast.

Anything discussed on Chit Chat Money by Ryan or Brett or any other podcast guests is not formal advice or recommendation. Now, please enjoy this episode. Welcome in. Today, we are joined for now a second time by Joe Fremanski. He is an investor at NZS Capital. If you listened to the previous Cloudflare episode that I think aired, I want to say three or four weeks ago, this is a part two, a bit of a follow-up and maybe more in-depth conversation. But before we get to some of those more in-depth questions, I wanted you to kind of summarize what we talked about in the first episode and maybe just touch on what Cloudflare is generally. Yeah. And thanks for having me back. So when we spoke last time, one of the things that

was kind of discussed was what does Cloudflare do? And we mentioned one of the better ways of looking at a company like this is to first discuss what they've built and what they're capable of doing. And I think that really helps frame the company in a broader aspect. So Cloudflare has built this really globally interconnected network of edge computing using commoditized hardware, connecting it with commoditized networking, fat pipes, if you will, and using software as an overlay to really tie all that together in an intelligent, programmable way. And they just recently had their investor day and CEO Matt Prince really used a term that actually is pretty applicable here, which is, you know, they've created what is kind of a quote unquote

supercomputer in the sense that, you know, what John Gage from Sun Microsystems back in the day would have framed as the network is the computer. Well, they've created the network and the computer. This is one large interconnected network that uses software overlying this network and edge servers to really create something that can actually be capable of doing a lot. Additionally, this developed network has, as I mentioned, a lot of programmability, a lot of visibility and efficiency. And so it can really deliver security to everything that travels across that network. every, you know, whether it be your website or web applications or whether it be your actual network traffic that you're doing, it can also go further and actually become a platform for your edge cloud computing and need. And so if we frame it, what they've built this way as a

globally interconnected supercomputer, then we can start to imagine what it is capable of. You know, you can now make your websites and web applications faster, more reliable, more secure. It can serve as a network security and access piece, zero trust landscape, which we'll go into a little bit more detail on. It can also replace your own network functions like MLPS and become that cloud platform for the edge of your network. And, you know, that just seems like that's just kind of what they're currently capable of. What they can do in the future, you know, there definitely seems to be more out there for that. All right. That's a good summary. We're going to have to help.

uh i think we're gonna have you go through basically all the four acts they outlined they just did this at their investor presentation uh but we're definitely gonna have some maybe follow-ups and clarifying questions first maybe what is an mlps i think we're gonna have a few of those today i think a lot of people don't actually know what that is yeah so we'll get to the mlps when we get to kind of their third and fourth act um but that's part of you know connecting uh it's a it's a way of connecting branch branch offices or things together in a more dedicated way. And it's really been around for a long time. It's very expensive, hard to provision. It is what it is. It's kind of been the, if you will, the de facto

way of connecting your hub and spoke, if you will. But as time goes on, what we're finding is there's new and better ways of doing this utilizing software. And that's where a company like Cloudflare can definitely come in and help. But yeah, why don't we go ahead and kind of go through the the four acts and can start off with you know uh and just for those listening they they really phrased their product and services in these four acts to not only kind of kind of segment them into different pieces but also kind of discuss about them in where they are in their life cycle uh the CEO Matt Prince talked about stacking s-curves and so each of these acts is an s-curve if you think about it you know and you know for those who have read

jeffrey west you know the life cycle of organisms or organizations or products you know they all follow kind of a a a scale if you will and these s curves you know where we're at on each s curve is a little bit different so in act one we're kind of in the meatiest part of that s curve we're in a part where they've got a lot more penetration this is you know really contributing a lot to the current revenue and the current business model and uh they are continuing to innovate upon this act but there's there's you know they're the the bigger growth drivers are going to be in those next escorts or those next acts that we're going to come up to so uh then the first act is their application services this is you know where they you know all really kind of began for cloudflare

doing tdos modification their content delivery network services and like and these are software solutions that are there to improve the speed security and operability of your website or web-based applications by being the proxy or the middleman between the user and the application since this is a global network has educations all over the place uh you know 275 cities and county which is is really massive you can apply logic closer to the end user or closer to the application of both so you can actually use this network to be that middleman to serve up these web-based applications in the most efficient way you can also provide security you can utilize services like their ddos or their web application firewalls and intrusion detection

and prevention in order to make these web applications work uh significantly better um like i said while there remains growth ahead obviously for cloudflare in act one in this application services segment uh and and they're continuing to to innovate on this and add additional features and services uh they have a higher penetration here um it's difficult to actually say this is the exact penetration they have into this tam because there's a number of smaller tams within it that make it very difficult to to to calculate however you know as they are much more penetrated here and this is going to continue to drive growth but not necessarily the outsized kind of growth that many investors in cloudflare have become accustomed to and so

uh you know we'll continue to see them innovate and and grow within this um they're it's a really good business for them gives them significant amount of visibility into the network which you know allows them to stack additional s curves that visibility gives them you know insight into what is the malicious activity occurring across the globe and how can we tie that into act two or zero trust services to better secure the users and the like down the road who are the main competitors in this in the application services space is just the big cloud providers okay yeah so the the there's a number of competitors that are in uh this space a number of them are hardware based some of them are software based you've got companies like uh

Fortinet that is out there, Symantec, Imperva, as you mentioned, Cisco is involved, Palo Alto. A number of these companies have application services. We also have some more new age companies. One that comes to mind is Fastly is also heavily invested in application services. So there's a number of different companies out there. What it comes to being unique about Cloudflare is that they operate a couple of different things. One, the way they approach the market, they have a free tier for websites so that they can continue to get that scale and that visibility that as companies get a chance to try it out, they move on. Not every company will offer that.

This is software-based, not hardware-based. You're not necessarily looking to put in new hardware equipment into your on-prem or off-prem data center. uh additionally as we've kind of talked with these various different acts it's not just a we just do this one thing and only do this and so you know if you want to do the next thing you have to to work with another vendor and somehow get these vendors to tie in together they actually are more of a platform of services and so that's kind of what kind of separates them a little bit on the application services okay and is that what you mean by software based i know you hit on this before but like a software-based network and is that the key here where they say they have all

the hardware it's a commodity and then basically they're just using software to divide um i'm using the wrong terminology here dividing all their compute across everything is that the key here compared to someone else i mean the software defined networking uh overlay over this entire thing is really the special sauce that really kind of ties this entire company together because Because that allows them to provision the bandwidth on the flow, allows them to tie in programmability, allows them to do so much more than just preset routing tables or just utilizing, as we mentioned earlier, MLPS. It really allows you to do so much more to take this commoditized hardware and commoditized actual networking that is connecting all this. That software overlay is really what separates Cloudflare from the pack. That's really the special sauce that is the company.

Cox Panoramic Wi-Fi includes advanced security to help protect all your connected devices. You'll get real time alerts like this one. So you don't have to worry about malware or when your kid downloads a song from a shady link. And now all your computer can play is red color, red color, where are you? All blocked. Thanks to advanced security included with Cox panoramic Wi-Fi. Advanced security must be enabled in the panoramic Wi-Fi app. Restrictions apply.

Okay. And I think before we move on to the next step, I want to maybe do one example just to get anyone that's not in IT. just kind of a little bit more context of what a Cloudflare, the value Cloudflare is providing with these application services. So you mentioned, in my head, I pronounce it as DDoS, but it's DDoS. That seems like one of the big things. Can you explain kind of what that is? And is that in the security part or the performance part?

And why is it so valuable for, say, a big enterprise to have? Yeah, so let's just make a fictitious company and their website. um you know we'll just um call it chitchat.com um and you know chitchat.com you are uh you conduct a lot of your customer facing business for instance uh a ddos attack or a distributed denial of service is what it stands for um is basically you all of a sudden get pinged a bunch of times so every time a customer goes to your website you know you're running code And you have servers that are supporting that. And you only have so much bandwidth to handle it. So you might provision enough bandwidth for when this podcast drops, you have so much bandwidth. And then the next day, it goes down. Well, imagine if all of a sudden someone said, I want to take down their website.

What I'm going to do is use bots, and I'm going to actually ping it so many times. I'm going to hit it so many times that the website just can't handle it. The servers just crash because they cannot handle it. Well, what Cloudflare does on DDoS, and this is just how most DDoS work, is they can actually see that traffic coming in. they can identify to a certain extent how much of that is is legitimate or not and try to filter some of that but they also can route traffic away to other servers and say hey this you know you're just this is happening at this point we can spread this out and try not to take down your single server and and keep everything up and running that's just kind of the the high level there's

a lot more intricacies when you get into it but that's this kind of high level of what a ddos attack is and this company sits between you your applicant website for instance and the users and so he can actually manage that okay so it just helps with quality performance and they talk about being the first global super computer that kind of caught me off guard because i guess i may this might i i've always wondered if it's going to be a dumb question with cloudflare but why isn't aws or azure considered this when they seem to have way more scale or is it just a little bit of a different uh business model it's a little bit of a different business model so if you look at it you're right when we talk about overall density and size aws is huge however if you look

at it with regards to breadth and from that i mean aws and once again i can't remember the last number but i want to say it was somewhere between 100 150 different cities for instance and in those cities they may have a whole bunch of different uh aws uh locations they have multiple reliability zones and like uh and those are all connected to each other uh with with cloudflare they're in 275 cities so they're much more spread out in that uh instance and versus aws which is kind of more of a closed system where you know it's inside aws and transferring uh within aws when you come out of AWS, that's where things then go, if you will, across public channels. Obviously, they have AWS Lando, they have other options you can do. You can actually install a client onto

your... You can either host with Cloudflare like you host with AWS, but you can also, if you're one of their customers in Zero Trust, you can have a thin client loaded onto your your laptop and that actually provisions straight to a a a cloud flare edge location what is the client sorry just uh no problem so it's it's it's uh software that's on on in your on your laptop or on your phone for instance um you know where it basically says hey instead of this you know we're going to actually route the traffic from here to to us and and the term thin client actually more refers to you know how how onerous is it on your your laptop for instance uh yeah a thin client is is does its best not to to be too onerous obviously the term is it there is no uh measurement

to it so you know that's one of the things if actually as you guys alluded to when we were talking before you know they were talking quite a bit about zscaler and they would you know Cloudflare would argue that Zscaler puts a very heavy workload or a heavier client onto your desktop that makes things run a little bit slower. And then there's a lot more things behind the background. So when we think about the global supercomputer that they're doing, what they're trying to do is interconnect these. This is software-defined network and kind of being an overlay over the overall Internet, not just what's going into their cloud, but over the broader Internet. So, you know, it is kind of semantics. I would argue that, you know, AWS is in itself a supercomputer. And, you know, within that, they probably have supercomputers within the supercomputer. But, you know, I did think it was a very interesting way of kind of phrasing, hey, let's not talk about it as this is amalgamation of points of presence and network and hardware and whatnot. And think of it really as the network is the computer. And this is just one super network, therefore a supercomputer. All right. Well, if anything, it's good marketing.

Fantastic. Fantastic marketing. Let's talk about the second X. I think we covered the application services pretty well. This is the Zero Trust Services. Can you talk about why this is so meaningful for them? Yeah. So I think the first thing we should probably just touch on real briefly is what is Zero Trust and what is its role within cybersecurity? So for a long time, we've been kind of operating under what has been more known as a castle and moat kind of model where you have all your users and applications and servers within the four walls of your office. You are now doing business outside of those four walls of the office through the internet. And so you want to put up, if you will, gatekeepers at the entry point and therefore stop any bad actors from coming in. If you stop the bad actors from coming in, once that traffic is in, it can go wherever it wants.

As the world has kind of evolved into more of a work-from-anywhere, cloud-based kind of society, that model has really become difficult. That perimeter, if you will, around that castle has been extended and stretched so much that you just can't really have a gatekeeper at each and every entry and ingress point. Additionally, what we've found is bad actors aren't always on the outside of the company. sometimes they're on the inside of the company and whether it's by design or or just by accident you've got traffic leaving the company that needs to be inspected as well and so zero trust is kind of uh you know which google uh and beyond corp and have written this really great way of paper a number of years ago was you need to really treat everything as a bad actor zero trust don't trust anything because anything can be uh and you know over a long enough period

of time will be uh malicious or will will be acting uh inappropriately so uh with zero trust you basically you can break that down into largely three different pieces the first piece is identity so in the zero trust environment you have to assign every application every user every every work function everything needs to have really its own identity and and identity isn't you know joe uh employee at nzs capital it's joe investor at nzs capital located in the united states mobile worker i mean it's it's a pretty long definition but every single part of that actually has a specific meaning as to what is what is it that that joe is this particular user It could be an application or anything like that. What is it they're allowed to do? What is it allowed to access? What is it they're allowed to see? And what is the much broader scope of things that he is not allowed to do? And that is a very important thing.

uh beyond that you have uh things like endpoint security and something called um your network security or sassy we kind of mentioned this last time but um these two pieces tie very closely into it which is you need to have visibility on both the endpoints whether that be a a laptop or endpoints can now even mean um your iot devices and even your applications as well as the traffic that's traveling in between from point A to point B. You need to have visibility into all of that because it's one thing to say, hey, Joe, blah, blah, blah, blah, blah, he's here.

But it's another thing to say, hey, why is Joe accessing this from North Korea? Joe doesn't live in North Korea. Joe can't go to North Korea. Something's not right. Something has somehow gotten Joe's identity. Stop that. And that's where a company like Cloudflare comes in

is they're on that SASE side or that network security side where they're inspecting that traffic. They're seeing how everything is moving and the like. And so they have services like zero trust network access. So they have the ability to inspect all that traffic, see where all that traffic is coming and going. They can allow access through the network to a number of different areas. They have been expanding this area. So they've recently acquired and built out their cloud access security broker. They've also tied in additional areas or additional threat vectors. They just acquired area one, which is their email side of things, which they're kind of tying into their zero trust services. And this is a very big

TAM for them, if you will. It's a very fast growing area where we're seeing a lot of companies really adopt the zero trust and a company like Cloudflare is a vital part of that alongside with the identity guys like Okta and CyberArk and SailPoint as well as the endpoint guys like CrowdStrike and SentinelOne. In the metaverse, doctors will practice surgeries hundreds of times before operating on real patients. The metaverse may be virtual, but the impact will be real. Learn more at meta.com slash metaverse impact. Okay. So those kind of, yeah. All right. That's how they fit in. I guess it's okay. That makes sense. And they call out, and now I guess we want to hit competition for this. They call it C-scaler

a lot in their investor presentation. I guess maybe what are the other competitors as well? And why is Cloudflare solution better? Does it come back to that software enabled supercomputer, if I'm describing it correctly? Well, I mean, so there are a number of competitors you've got um really the two biggest competitors that i would highlight uh one being more of a quote-unquote legacy company that is really uh really adopting zero trust and transitioning away from kind of that legacy firewall model which is palo alto networks um they're they're expanding uh heavily in this they've been um making acquisitions and developing their own zero trust uh side of things they also are kind of a quote-unquote one-stop shop they

because they do have their own endpoint offering as well. And then you have a company like Zscaler, who is a newer company that actually has built their zero trust cybersecurity model, very similar to that of Cloudflare, to be honest. The differences between the companies, they can get kind of nuanced. When you look at a company like Palo Alto

and let's just put their firewall business aside and the role that would potentially play with also selling zero trust, they're built on top of AWS. is my understanding and with that there's certain limitations that they don't necessarily or things they don't have they don't have the same visibility in you know of traffic within aws as as maybe a cloudflare zscaler has um you know in their their uh co-location or their peering points um additionally uh with with palo alto networks there uh those locations aren't as dispersed

As we talked, you know, AWS is a behemoth, but they're not necessarily the edgiest of edge, if you will. They're not as close to some of the customers. So there is that, you know, potential difference between them and Zscaler and Cloudflare. With regards to Zscaler, once again, something we talked about is kind of, you know, what they do. They just do, they just do cybersecurity. They don't do, you know, as we'll get into Acts 3 and 4, the network and the, you know, cloud platform side of things. That focus has allowed them to be – they're a market leader in this space and have been doing very, very well. But Cloudflare will say, hey, what we did was we took – we're doing the same thing, but we're trying to make it much easier to provision, much easier to do.

As someone that's helped set up one of these, it can be a real bear just to get one of these SaaS networks, whether it's Zscaler or the like, set up and up and running and working effectively. It takes a lot of time, takes a lot of poking and prodding and maintenance. Cloudflare said, hey, we're going to try to make this as easy as possible to drive that adoption, drive that self-service adoption and make the users like it. And there's a number of things, you know, Cloudflare, since they have a lot of big emphasis on making things run more efficiently, the belief, and I don't necessarily have the numbers to back this up, so take this with a grain of salt, but what they will say is they can actually, when you're running their zero trust services, they're actually making your overall experience better because they're speeding things up because of the way their network is set up. Whereas the argument, at least Matt Prince would say, Zscaler is slowing it down as you do it now. You know, first off, how much, if any, is still up for debate.

But, you know, that's kind of the differences between, you know, the leading legacy guy, Palo Alto, and the leading new age guy, if you will, Zscaler. Okay. And I think last question on Zero Trust, unless Ryan has one more. Do you think, and this might be a tougher question for you to answer. So maybe does Cloudflare think that all software applications, all websites, anything connected to the Internet will need to adopt zero trust eventually? And how big is that opportunity? I think the answer is yes. I mean, I'm a little biased here, and I do believe that zero trust is really all it's cracked up to be. So take the with a grain of salt.

But with zero trust, you're taking it not only for the users, if you will. what we're finding is a significant amount of traffic is done by apis or basically computers talking to computers not not necessarily users really do anything or applications more specifically talking to applications and that that communication can also lead to one big blind spot for a lot of companies and so if you don't actually have some kind of zero trust network visibility even on your applications uh you know just let's just take an example if you're uh and if your website is taking a an order from a payment system there's an api that's tying those two in if you're not you know if you don't have any visibility over that communication

and something is starting to to be malicious or or something bad is happening there you're you're in the dark until it's too late and so uh describing this zero trust to iot so you know your printer if you will you know there's a story that you know a fish tank was a uh a way a hacker got into a computer because it was connected with wi-fi to the servers you know if you don't have all this stuff set up in a zero trust framework you and you don't have the visibility into that network then yeah you're gonna have a problem so i do see this being a you know everything kind of being adopted into zero trust we're seeing a lot of government uh involvement here you're seeing the sec and even the white house is is really pushing uh to say hey we want our vendors we want

our partners to be looking at zero trust so it seems to definitely be the way of the future i think we're starting to reach escape velocity there the only other thing i'd ask on this front is you mentioned the area one acquisition is that significant and maybe could you explain what that is yes area one is email um email security and there i would you know liken them to that of a minecaster proof point um i have not had the opportunity to actually uh to use area one so i can't necessarily compare and contrast that versus that of minecast but what we still do see is that email is one of the most popular and prevalent threat vectors and security phishing scams are happening i think just recently um seth green lost uh some of those board apes uh because

of the of the phishing scam and and so that's a huge it's huge it happens so often yeah yeah yeah exactly and the my understanding is that uh you know cloudflare had been using and a couple couple of different ones. They started using Area 1, found it to be really, really, really good, really easy to use. And it just was one of those things that said, hey, this is so great. We need to share this with the rest of our customers, with the rest of the world that isn't using this. We're going to acquire these guys, send them up within the organization and move forward. So email is very, very big. It continues to be a big area. There's always the discussion is a lot of email is hosted either by uh microsoft or google you know what's their role within this uh but one

thing we've noticed is that you know a really high quality cyber security isn't easy to do it's not a flip of the switch and additionally you know if you start doing that if google says hey we're going to be we're going to protect against everything then they're opening themselves up to to having to deliver on things that is very difficult to deliver i guess one last question And how are they, how is Cloudflare selling, how are they selling all these products? Is it all sort of one bundle, I guess, of all these different services or do you can like buy different ones? How does that work?

Yeah. So, I mean, they have these four hacks actually tie in very well. If you go to their website, you can actually see under their pricing how they actually kind of have these all set up. And so application services, for instance, is quote unquote a bundle and there's different tiers from a free tier to a $20 a month kind of tier to an enterprise tier, which is more custom built annually. Then you have the zero trust, and then you have network services and developer platform, which we'll get into those. And so there are different tiers of bundles within

these different acts, if you will, with additional add-ons you can get. A lot of their business model is self-serve or direct. And so either you go to their website or they have a sales team that's calling out to you. One thing that Matt highlighted during the investor day was one of the areas

that they're lacking and it is very apparent is they don't have a very extensive partner ecosystem or working with those managed service providers. They're helping medium and large size companies

actually integrate some of this stuff. And this isn't the easiest thing to, one, to even explain, none, let's actually put implement. And so there's a number of companies out there that want to adopt zero trust, for instance, that are sitting there saying, I don't know how to do it. I don't have the chops. I can't, you know, it's really hard to hire IT people. They're in high demand, very scarce asset. And so that's one area that they lack because they don't really utilize the channel partner network nearly as much as say a Zscaler or a Palo Alto does.

Gotcha. That makes sense. All right, let's move to Act 3. This is kind of the one there, I believe at the start of the S-curve, and that is called workers. It's a pretty broad definition, so maybe describe what this is. Yeah, no, you're right.

So, you know, if Act 1, we're in the kind of the top third of the S-curve, and in Act 2, we're in the middle to one third point. This one, yeah, we're definitely in the early stages on the low end of that S-curve. And so, Workers is their serverless cloud platform. Workers was actually announced initially as their edge compute part of the business

back in 2017, I believe, was in beta and now that's out. And currently, it's not in beta. You can actually go up and you can either try to deploy, write applications and deploy code at the edge of the network for free. They actually have also a paid tier.

They've also realized that this is going to need to be a bigger platform than just writing code at the edge, which requires a number of different things, including storage, including database, including a number of different pieces. And so they've actually been bolstering or broadening this platform. They announced R2, which is their object storage. It's an S3 compatible service to storage large amounts of unstructured data with no egress fees. And that last word, egress fees, is really the big part, because every time you take data out of S3, you actually have to pay. Oh, can we describe, define S3? Because I know it's really important to this overall industry. Yeah, so S3 is Amazon's data storage. And with that, once again, if you have this large amount of data that you have stored with Amazon, you know if you're having to pull that out as amazon for you know one reason or another every

time you take it out there's there's a egress fee there's a feed to do that um some applications are constantly pulling data in and out and so those egress fees can become much more expensive than just the actual cost of of actually having your data with with amazon and so r2 is you know the most simplistic way of talking about it is it's kind of a cache where it's a it's a local storage, whereas that data comes out of S3, some parts of that data is stored at the edge before it goes back in so that if you have to access that again, you can access it quickly without actually having to go back and pull it out of S3. And therefore, you're not having to pull all those egress fees. And so for applications that require that constant heavy touch of that

data, this is a huge money saver for them. And so that was kind of a, when they announced that, was kind of the the big foray or the big you know uh shot across the bow saying hey we're getting into the we're going to become not just this edge compute we're going to be an edge cloud platform that was kind of the the telltale sign that they're moving in that direction uh obviously there's there's still more that they have to do they just announced d1 which is at their sql database um they've promised a d2 which you gotta love that they're gonna have r2 and d2 so there's You know, for the Star Wars nerds like me, you know, get a chuckle out of that. But there's a number of different pieces. Some of it's going to be developed. Some of it's going to be a partner.

You know, there's definitely database companies out there that are absolutely fantastic. They can tie into that. You know, maybe Cloudflare isn't going to improve upon what they've done. They'll definitely look at partnering in this to create basically a really an edge platform, an edge cloud platform, much similar to that of an AWS, if you will, or a GCP or an Azure, but just more located towards the edge. And with that, they can try to fulfill their dream of being the fourth major cloud provider. Okay. And they talk about getting to 1 million people adopting it. That's kind of a milestone for them. how close are they and what is the significance of that is that just kind of having similar to oh gosh i'm trying to think of a company one of those um open source companies but i don't think i don't think i think this is a little different but is that just the significance of people

working on products for you or adding stuff on top of this serverless cloud platform is that what it is and i guess just why the 1 million as the goal so i mean 1 million is is you know a big, large round number that, you know, sounds very good and, you know, really will deliver on, you know, a lot of what they promised, but, you know, they actually spent a lot of time talking about, you know, how, you know, they've learned, looked at these platforms, they've looked at Azure and AWS and all that and spent a lot of time trying to learn, you know,

what is it going to take for something like this to really reach escape velocity and and with that what they're what they're saying is you know it's these these networks really need to feed on each other and you need that first killer app to to kind of get going to to showcase the need and then you need employees that really built on top of workers that made that first killer app to go start their own companies and then you you get this this fly wheel of it becomes this platform effect where you're just building more and more and so when talk about one million developers or they talk about you know most platforms take seven to ten years to develop uh to get to that scale where they're actually they're they're they're integral

part of the overall developer network that's what they're they're looking at is really getting to a point where enough has been developed on this that this is becoming an integral function of or an integral platform that a lot of developers are on top of and so you know we're in year They're maybe two of 10, and they're really wanting to get more developers on there, broaden the services to make it more of a complete solution so that you can start developing and get scale and get that breakaway effect. That is, once the platform gets big and everyone starts using it, it becomes just a self-fulfilling proxy.

And so they're still in early, early days, but that's kind of the thought behind the 1 million developers is, you know, you hit 1 million developers, you've reached escape velocity on this platform. I think you may have kind of just answered it, but what is the value of the free tier here? Is it that you're able to reach escape velocity faster? Yeah, I mean, so the free tier, and they operate a free tier in almost every one of their acts, if you will.

It serves a number of different functions, and it is a really smart move by Cloudflare. You know, in the application side, it gives them visibility into more and more just network traffic. With workers, it's a way of, you know, they have now a large group of people that can be beta testers, that they can work on iterations of workers,

iterations of different things. They also have people that are doing this maybe as, you know, hey, I only have so much of an IT budget at this corporation. I'm going to sign up for this free tier. I'm going to give this a try and see how our application would work on a Cloudflare's platform.

And I don't have to run that by, you know, my it budget now you know i can i can just give it i can test it i can use it as kind of a learning experience and then once they they end up uh using it and liking it they can either use it within their own organization and broaden that out or they can be they can take it elsewhere they can be the evangel even i don't want to say evangelical yes they yeah that's such a hard word to say we Yeah, I think everyone gets where you've been. Yeah, so they can go out there and they can say, hey, look at this. This is great.

I've used it. It's a fantastic product. So that free tier, to your point, that's how it serves. And it'll definitely help grow that ecosystem. Okay, one product, I think I was perusing their product screen. Something that kind of shot out to me was this thing that I didn't really know what it meant. It said extending Cloudflare for SaaS to end customers. customers and it sounded like that was an expansion of their strategy i don't know if that's

something that uh maybe i was just looking at the product suite like how what do they maybe mean by that is it like bringing say their security stuff to joe's giving us a confused face so it sounds like no no no i no i i think you're i think you're maybe potentially talking about the cloud the cloud access security broker or basically basically that kind of goes back to that act too of basically saying hey what we're going to be able to do is you're using sas software that's that's an application that's out there and we're going to be the the connective tissue and we're going to actually utilize your trust we're going to actually identify hey those sas services out there we're going to be able to connect it directly into those and and help with that zero trust

network access and that it serves the cloud access security broker in there i believe that's what it i i didn't i didn't quite catch that one particular uh statement i'm sorry sorry they have so many they have so many different parts that you think is important for the workers act that we don't touch on i mean i i think that the the important thing is you know when when the company talks and they they highlighted their their areas for potential incremental growth outside of their current tamp i think it highlights that this is an early early stage um product we've talked about It's in the very nascent stages of the S-curve. They're really trying to build scale.

And so, you know, the other thing is, you know, you need that killer app, really, that says, hey, being at the edge is, you know, truly something else. And they're starting to get some traction there. They're starting to get some stuff. But it still really, really does. Okay. Let's move on to Act 4 then, and that is network services or TBD. I know that they – I don't think they explicitly named it, but correct me if I'm wrong. We don't have any notes for this one because it is so early stage, but maybe speculate on or kind of what they've said on what this could be and why it could be so meaningful.

Yeah. So, you know, like you're right, that's still in development. And they kind of implied that this could be more of that network as a service kind of situation. So if, you know, if Cloudflare can replace your networking hardware and actually become much more of your communications platform, something that can actually, you know, really be directing all the traffic and running that. And there you think of things like to replace MLPS and utilize things like SD-WAN capabilities and could Cloudflare really replace some of these companies and go down that path? um there's also they're talking about in their in the early stages of doing cloudflare offices which is actually quote-unquote co-locating cloudflare point of present into your multi-tenant office building so you're actually connected right into the cloudflare network right from the get-go and so you know is that going back to on-prem then kind of is that what that means

kind of yeah and so basically you know in cloudflare offices you know is a situation that if your office is connected directly into that you're no longer maybe communicating with a with an ISP, Cloudflare is doing that for you. You're just now a Cloudflare customer instead of a Comcast customer. Now, obviously, Cloudflare may be a customer of Comcast in your stead in that circumstance, but Cloudflare offices and kind of extending that point of pressure or that edge really directly into your office building and it allows them to really take that networking services a step further. And that's a potential really interesting, very large market that they can go after uh down the road still a lot of development there that's you know they kind of

hinted toward that but however i'm not going to go out and say hey this is act four because maybe that's just part of really just their you know all of the three previous acts that we just discussed and there's another act four that we we can't even imagine at this point and what okay what are some of the companies that they would be just potentially disrupting if you're correct on where this is going and is this more and this is is this competing and maybe probably not disrupting but more competition with aws and microsoft and google or is that a totally different thing you know i think it would be more in competition with your companies like hmt and some of your telecom uh providers and the fact that they're saying hey we're going to uh we're going to connect into

the office of the basement uh you know maybe they're in more competition with a company like Cogent. And so, you know, it's, it's difficult to say exactly where, because for all we know, they actually may partner with those companies because at the end of the day, those companies still have the very valuable fiber coming into your office. So it could be not necessarily a direct competition. Maybe it's more of a, a partnership going forward with some of those players all right and is there anything i guess that you're you follow the company closely and you see we're on this i don't know they're saying this is act four is there anything maybe reading through the tea leaves you think could be coming down that could be important for this act

five well maybe not within the act four there's going to be yeah you know it you know i i'm sure if you were to ask uh matt or michelle over at cloudflare they would say that there's there's going to be more acts uh coming down the line um you know it's one of those things that once once they've got to workers and started doing network services you know there's a number of areas where they can expand within these acts but when we start thinking about additional acts it's kind of hard to conceive uh however it's it's it's one of those things that limits the imagination to a degree if if they're in your office and they are directing and monitoring all traffic of the internet there's a lot of things you can do within with as that traffic is flowing and so um it's

difficult to to to conceive but at the same point in time i you know the pace at which these guys are continued to innovate is is something special and so i i can't read between the tea leaves because by the time the tea leaves are out they've already moved on to the next thing they they move so fast so all right and the it's you mentioned this already but the true end game is to be as competitive with aws and a lot of their products or azure or google cloud correct that's kind of the end goal that's stated i mean that's that's definitely part of it i don't know if i would say the end goal because you know once again they're doing zero trust which isn't necessarily something that you see azure or aws doing so they their end goal is to make the internet faster better and

secure. I mean, that's a really broad topic of which the cloud computing is one of the big behemoths in that. And so definitely in that Act 3, we'll look at the workers, that serverless cloud platform, that is going to be in competition. But once again, I think, as I mentioned last time, it's not probably either or. It's not going to be if Cloudflare is successful, AWS has to die. It's most likely these will both grow substantially into the future should the cloud transition continue to go, which many, many people, including myself, believe it will. Okay. Before we get to the financial update, I'm impressed with Cloudflare overall, and it sounds like they innovate really quickly, and there's a lot of things going right for them. and i may have asked a question along these lines in the first episode but what is wrong with cloudflare is there anything that like could stop them from continuing to grow i mean so as we

kind of discussed last time and they're generally the same one is they're going as you guys can tell a number of different directions at once and when you do that you put strain on any any network you You put straight on any sales force, you put straight on any kind of R&D department. And so, you know, it's a situation that they can continue to go all these different directions, yet not fulfill the promises of one or more. And, you know, versus a company that is much more focused on just application services or just focused on Zero Trust or just focused on the cloud, you know they can divert all their resources all their mind uh time to to delivering that product to the market in the best way possible we're doing all these you know uh you know matt and michelle and the leadership team are getting pulled a number of different directions and we get pulled

you know you know something could slip through the trap the cracks and that's where the emphasis really has to be on the corporate structure the way that they uh you know have a distributed um decision-making process, you know, they have to have the right corporate structure in place in order to do something like this. Another area is, as we've kind of already discussed is, you know, they're not going out into it. They're not creating a new market. Let me take that back. They are creating a new market on the, the surrealist edge I would argue, but

they're going up against some really big, really well-established companies. We've mentioned AWS, we've mentioned Azure, which, you know, to be perfectly honest in certain aspects, Like some of these companies are also partnering with them. You know, Microsoft is rumored to be working with them on some stuff for their edge browser. But you're going up also against Google Cloud. You're going up against Palo Alto Networks. You're going up against Cisco.

You're going up against some just really big established companies that are, frankly, are very good at what they do. And so when you have competition and that competition gets a fire lit underneath them, do they get their act together? And do they start saying, hey, we can create an as-good-as-product and suck some of that air out of the room? And so that's really the two areas that the company could fall short. All right, let's go to the valuation Q1 results. I guess just any update on that. I know they just put out their numbers after we recorded. They did their IR presentation.

and like a lot of SaaS stocks, I think it got, it might've gotten 10 and a half almost since we were- I mean, if not, very close. And so, you know, they reported their first quarter numbers and their first quarter numbers

really came out quite well. The growth was actually above consensus. I believe the growth came in north of 50% again. And, you know, they forecasted to better than expected growth. The company was breakeven and on the operating line, which is kind of where they're looking at

maybe a slight loss. And so between what they reported and their guidance, it was really quite good. However, the stock actually had a really rough day that day, largely because we're in an environment where, hey, this company is growing really well, but where's the cash flow? Where is the free cash at this point?

And obviously a company at the life cycle that Cloudflare is in, spending all their incremental cash. They generate something around 75%, 77% gross margins. All that money is going to sales and marketing. All that money is going to research and development. All that money is going to building up their network and adding new points of presence. They're not really showing or delivering any operating profit at this point. Like the wider swath of software companies or companies that are growing very fast but aren't necessarily generating operating income or free cash flow, they've definitely taken their lumps over the

last number of quarters. And if my memory serves me right, I believe we're somewhere around 17 times today. And I want to say when we were talking, it was 17 times sales. And I want to say last time we spoke, we were north of 30 times sales. So it's only been a handful of weeks, But it definitely has been, you know, part of the market that is that is generating that free cash flow has been under significant pressure. And I think I have two questions here. First one, I'll let you hit the first one first. A lot of people expect the revenue to grow at a really high rate for a long time. I guess what are your maybe you can't pinpoint it exactly.

What kind of your broad expectations is this? you know can this grow at 30 percent revenue for a decade or is that maybe too overly optimistic um it's because it seems like they have that they've been able to escape the i don't know when someone kind of comes back to you know gdp growth or whatever um everyone talks about with that reversion to the mean sorry yeah no and uh to be perfectly frank i i am the last person that can ever say i can predict the future and tell you what a company is going to be able to grow at over the next decade. But what I can say is the stacking S-curves as Matt highlights is going to be very important if they do want to deliver on that 30% kind of revenue go through. And let's

also keep in mind, I can't think of any company that has grown at that level, at least once they've hit a certain threshold. I mean, you're talking, if they did that, they'd be becoming a $10 billion dollar revenue company. Not unheard of, but I mean, it's, I mean, it isn't like a walk in the park by any means to take your revenue at 30%. Very few, if any, have actually done that. So it's going to be imperative to stack those escorts and deliver on that security you've launched. And this TAM that you've, you know, you've expanded from 32 billion to, you know, something that they project somewhere north of 130 billion that you can actually penetrate into those, those TAMs. That's going to be, you know,

hugely important if they do want it to hit those kinds of numbers. What second one, when should we expect the operating leverage to kick in or is that something that's unknowable and really, really not something you're focusing on? Well, I mean, that, that's an excellent question. And I think that's a question that a lot of investors are asking at this point in time. So I think the first thing to, to acknowledge is that, you know, the company is currently right around break-even. I think their non-GAAP operating margin was around

2% in the first quarter. They've talked about the second half of this year being free cash flow positive. Obviously, that's not including stock-based compensation, but still, it is a positive cash flow figure. Their long-term model, obviously, is they do believe this model with those 75 to 80 percent gross margins can yield something like a 20 operating margin and and so you know the question is is you know as you've asked is you know what's that trajectory between here and there when when do we see that inflection and it's very difficult because if they continue to add new acts new escorts they're going to have to continue to invest in in delivering that um if their pace of innovation slows down maybe they can actually see that that uh

inflect sooner rather than later. However, there's still a lot of wood to chop. So I don't know when they'll generate positive earnings. The company has clearly stated that it's not in their near term forecasts, but the ability is definitely there down the road. Do you have any more questions? I think I was going to ask, I think you hit this, but is the moat in the bundle, Is that something important for investors to think about, all these bundled products for a big enterprise? You know, I think, and I wouldn't necessarily term it and put it in the terms of Moat, I put it in the terms of they are providing a lot more value than they're necessarily taking out. So the free tier is hugely valuable.

But what they're doing is they're making application services, zero trust, potentially their cloud platform and network security, so on and so forth. They're making it very accessible to people, making a very simple, highly effective way of conducting business over the Internet. And that's what they want to do. They want to deliver a lot more value than they necessarily reap out of the system. And that's a situation that the customers and companies really highly value, especially as we've now realized that the critical infrastructure of any company today is really, you know, really on top of their IT infrastructure, as well as their human capital. Those are huge critical infrastructures for every company today. And this company plays a key role on that IT stack. In other words, it's a non-zero-sum business.

You said it, not me. All right. Yeah. Well, I think that's all the questions we have. For any new listeners, where can they kind of keep up with you? Is there a good place to maybe see any of your work? Well, you know, we publish almost everything that we really kind of think about or talk about, whether it be in our weekly sitel weekly or on our website, nzscapital.com. I'm on Twitter, Joe. However, I'm more of a passive bystander there. So, but yeah, I would direct people towards either our weekly or the website to read up.

Perfect. All right. Well, maybe there'll be a part three somewhere in the future. But it's such a complicated company, but I think this time we got it from what I think me and Ryan's perspective, we understand it so much more. So I think the listeners probably got a lot of progress there as well. Well, I hope so. All right. Well, that's going to do it. I want to hit the disclosure here. Brett and I are not financial advisors, so anything we say or discuss here on Chit Chat Money is not formal advice or recommendation. We are, however, general partners at Arch Capital, so clients may have positions in the securities discussed in this podcast. thank you all for listening thank you to joe for coming on again we'll see you next time