Cloudflare

Cloudflare reported second-quarter results with sales of $696 million, up 36% from 28% growth last year. Adjusted operating margins contracted by 30 basis points due to increased investment in artificial intelligence infrastructure. Management raised its 2026 sales outlook by $58 million.

Why it matters: Cloudflare's consumption-based business model is a clear beneficiary of the ramp-up in AI spending. The firm's edge platform, Workers, is garnering strong developer adoption, with the number of developers building on Workers up to 7.4 million, up from 4.5 million in December. With solutions spanning security, development, and AI infrastructure, Cloudflare's revenue mix shift is trending more toward large enterprise customers. Channel partner sales, which reflect this enterprise demand, grew 67% in the quarter and now contribute 31% of total sales. We see this enterprise mix shift also strengthening Cloudflare's economic moat, with large accounts tending to be stickier than smaller ones. We see the firm's expanding net retention metric, up to 120% from 114% a year ago, as a positive sign of increased stickiness.

The bottom line: We are raising our fair value estimate for wide-moat Cloudflare to $266 from $235. Shares traded sharply higher after hours, likely due to a broad-based acceleration in the firm's business and strong results and outlook. Even after our fair value raise, shares appear expensive.

Bulls say: The firm's revenue is scaling up along with agentic traffic and AI inference spending. Our bull-case scenario turbo-charges our growth estimates and calls for a $370 fair value estimate. Much of the incremental upside is based on Cloudflare's ability to monetize agentic traffic to websites.

Coming up: Management raised its 2026 outlook to $2.87 billion. With two quarters left, we model further upside to these estimates, which we think are conservative.

Part of the divergence between our base and bull cases on Cloudflare can be attributed to the magnitude of monetization from agentic web traffic for the firm. For some background, after leveraging its infrastructure for network traffic monitoring, security, and developer tooling, the firm is now using its position on the infrastructure layer to create a net-new monetization opportunity by monetizing agentic traffic to websites.

Cloudflare, along with Coinbase and Stripe, has set up a protocol, x402, which allows websites to charge agents that crawl their sites. The per-crawl charge is infinitesimally small, likely fractions of a penny, but, at scale, it could drive meaningful dollars to websites that have seen human traffic plummet precipitously following Google's push into AI Overviews and AI Mode. Cloudflare, in turn, would collect a small transaction fee per crawl. To get a sense of how prevalent agentic scraping and crawling of websites is, management cited a healthcare website that had been scraped 800 million times in a month by AI systems, all while human traffic and associated ad dollars were declining.

With more than 50% of traffic flowing through Cloudflare's network from nonhuman sources and agent requests growing 1,700% year over year, our bull case on the name forecasts that this AI monetization strategy will be a material top-line driver for Cloudflare.

From a market sizing perspective, it is worth noting that Cloudflare processes 30 trillion transactions per day. Even if a tiny fraction of these transactions were monetized, with Cloudflare taking a small cut of the per-crawl charge, we estimate the overall top-line opportunity for Cloudflare from this monetization channel could be in the billions of dollars beyond our explicit forecast in the bull case. Further, since Cloudflare is already monitoring and securing this traffic, these dollars would have high incremental margins, further boosting their impact on Cloudflare's valuation in our discounted cash flow model.

Our fair value estimate for Cloudflare is $266 per share, implying a 2027 enterprise/sales multiple of 23 times.

We forecast Cloudflare’s revenue to grow at a 31% compound annual growth rate over the next five years, with secular tailwinds at its back. We view Cloudflare’s future growth as a result of three key drivers.

First, the firm’s security business is primed for growth as it lands bigger clients and upsells them more modules. Further, this vertical is poised for growth as a result of a general increase in cybersecurity spending as businesses deal with a more complex web of cybersecurity threats than before.

Second, the firm’s investment in the edge computing platform provides it with another driver of top-line growth. As edge computing becomes a larger part of the overall technology ecosystem, we believe Cloudflare will continue to drive meaningful margin and top-line expansion, spearheaded by its Workers platform.

Third, and more recently, we see AI infrastructure as an emerging growth driver. Cloudflare's ability to run inference workloads at the edge positions it as a picks-and-shovels beneficiary of enterprise AI adoption, a tailwind we expect to become more pronounced over the forecast period.

Cloudflare has consistently reported GAAP gross margins in the high-70s for the last few years. With continued investments in AI infrastructure, however, we expect gross margins to hover around the low-70s over the next five years. While AI puts pressure on gross margins, it enables the firm to grow its adjusted operating margins by increasing sales without having to scale research and sales costs to the same extent.

Cloudflare, similar to many other high-growth companies, has invested heavily in its research and sales divisions. This operating expenditure has kept a firm lid on Cloudflare's profitability, both GAAP and adjusted. As we look at the future, however, we see Cloudflare hitting an inflection point where the firm can effectively drive its operating leverage up by reducing its research and sales spending relative to revenue. Baking this scale-based operating leverage into our model, we forecast the firm’s adjusted operating margins to approach the 30% level in the next five years.

We believe Cloudflare merits a wide moat rating owing primarily to strong switching costs and network effects associated with its product offerings and core business. When analyzing Cloudflare, we find ourselves looking at two different companies. The first one is Cloudflare of today: a security-focused content delivery network, or CDN, that channels more than 20% of global internet traffic. The second one is what we think Cloudflare is setting itself up to become: a player in the public cloud and edge computing space, and an increasingly relevant beneficiary of the AI infrastructure buildout. With an increasingly large target addressable market (TAM), expanding upselling abilities, and a sticky product portfolio, we believe Cloudflare is more than likely to generate excess returns over the next 20 years and, therefore, merits a wide economic moat.

For a security-oriented company, Cloudflare has a differentiated distributed, serverless structure. Essentially, by having infrastructure in more than 330 cities across the globe, Cloudflare delivers internet traffic from the points of origination to delivery in a quick, efficient manner. At the same time, the firm can monitor copious amounts of internet activity, analyze impending threats, and reroute traffic around to ensure speed and security. Think of a typical distributed denial-of-service, or DDoS, attack, which overloads the target’s servers with activity and therefore crashes them. If a server’s bandwidth is a highway, DDoS seeks to block this highway, thus impeding any traffic on it. Cloudflare’s distributed network allows the firm to move traffic around until the increased activity subsides. For some perspective on the scale at play—Cloudflare blocks more than 200 billion cyber threats a day using its distributed network.

When considering the firm’s security business, the customer switching costs are apparent. Security spend is sticky, in our opinion. Customers who adopt security solutions do so to take uncertainty off the table—switching vendors often brings uncertainty back into play. Even while most of its clients are small- to medium-sized businesses, Cloudflare’s gross retention has remained above 90%—implying a customer lifetime of more than 10 years. At the same time, by upselling its customers into buying more security and performance modules, Cloudflare has a net retention rate above 120%. We expect increased customer stickiness as the firm expands its footprint by targeting bigger clients, a vertical where it is finding increased success.

Cloudflare’s distributed network structure has network effects built into the platform. Currently, more than 20% of global internet traffic goes through Cloudflare’s network, with more than one-third of all websites in the world using Cloudflare. The data generated by these websites helps Cloudflare track internet activity and improve its offerings related to web performance and security, leading to more data being channeled through Cloudflare’s platform and more websites using Cloudflare. Cloudflare also lets small websites use its basic security offerings for free. We do not view this move as altruistic but rather a means of trafficking more data, which Cloudflare can then utilize to improve its products and security apparatus. From a product development perspective, these free users also allow Cloudflare to test new products and methods of managing internet traffic in a “real-life” scenario. All in all, as more data flows through Cloudflare’s network, the security offerings improve along with the increased traffic. The security improvements then attract more traffic, and the virtuous cycle continues.

Quantitatively, despite the firm’s heavy spending on research and sales, Cloudflare’s security business consistently produces excess returns on invested capital. Further, the company has been investing heavily in areas of high growth within the security space. Two key growth verticals that we see as pertinent when thinking about Cloudflare’s overall security offerings, and their respective stickiness, are email routing and zero-trust security. Both of these growth verticals are poised to grow rapidly. Cloudflare’s current offerings in these verticals have seen high adoption, which improves Cloudflare’s overall value proposition and helps the firm create switching costs by selling more modules to existing/new clients.

Even if we were to ignore Cloudflare’s future ambitions as more than a security-focused CDN, we’d merit the firm with an economic moat due to the strong switching costs and network effects associated with its offerings. However, we think Cloudflare is more than just security and performance enhancement.

The biggest opportunity that we think Cloudflare stands to benefit from is edge computing, a natural fit for the firm’s distributed network structure. Edge computing represents a paradigm shift in storing, analyzing, and utilizing data. If the public cloud is a tree, the leaves on individual branches can be thought of as edge nodes. With edge computing, instead of asking the cloud data center to process all workflows, many of them can be executed on these edge nodes, improving response times and saving bandwidth. For example, if an individual asks a Google Home device to check the weather outside, instead of that request being processed at a Google Cloud Platform data center, it can be dealt with by a GCP node close to the user’s location—thereby eliciting a faster response to the user. For a company to harness the power of edge computing, having a distributed network of edge nodes, such as that of Cloudflare’s, is a prerequisite.

Currently, edge computing’s primary use is for applications such as gaming or high-level Internet of Things (as illustrated in the GCP example above). These applications typically require functions to be run on the edge while complex workflows are processed at the cloud data centers, a sensible division given the relatively constrained compute capacity of edge nodes. Looking further ahead, we view the continued rollout of 5G, the proliferation of connected devices, and the growing demand for low-latency AI inference as secular tailwinds that will expand edge computing's role meaningfully over the next decade.

While all three major public cloud providers (Amazon, Microsoft, and Google) have their own CDNs, the geographic expanse of their offerings is far smaller than Cloudflare’s network. We do not see this current advantage as durable, however. We expect these major cloud providers to attempt to build their own networks that will eventually match the breadth of Cloudflare’s network. To build a distributed network, these public cloud behemoths will have to change their delivery model, with centralized data centers giving way to a distributed network. Even if we assume that these public cloud giants are able to build these distributed networks, one roadblock these providers are bound to hit, which we see as Cloudflare’s true opportunity in this space, is an increasing enterprise aversion to cloud vendor lock-in. After renting space from these major public cloud providers for many years, enterprises are beginning to realize that getting their own data out of these vendors can result in egregious egress fees (essentially the cost of taking your data back from these big cloud providers). This dynamic, as proven by the increased adoption of multi-cloud strategies by large enterprises, primes the industry for disruption. We view Cloudflare’s disruption stemming from its ability to leverage its distributed network by providing enterprise clients a way to operate without the threat of cloud-provider monopsony.

We expect businesses to send more workflows to be processed at the edge over time. However, developers who wish for workflows to be processed at the edge are hampered by their ability to do so if the edge platform vendor is different than their public cloud vendor. To remediate this reluctance due to the lack of interoperability, every major public cloud provider (except Amazon) has signed up for a Cloudflare-led Bandwidth Alliance that allows users to transfer data from one provider to another for free/a nominal fee. As we think about Cloudflare’s edge computing platform, we view the general move within the cloud space toward lower egress fees favorably. The overall reduction in egress fees (including by Amazon) allows developers to use a hybrid, mix-and-match strategy with edge computing and public cloud vendors not necessarily being the same.

One may question why public cloud vendors would willingly sign up to an agreement that reduces their own switching costs, but we believe that edge computing is not a replacement for the public cloud. We think of edge computing as augmenting and enhancing the public cloud by offloading tasks that are either time or cost-sensitive. Developers, who often are primary users of these public cloud vendors, are increasingly critical of egress fees as these fees pigeon-hole their workflows into less efficient offerings. With edge computing not posing an existential threat to public cloud, and the vendors’ users demanding interoperability, we view the decision of public cloud vendors to reduce/remove egress fees as sensical.

As edge computing gains traction over the coming years, we expect broader enterprise adoption among organizations building out multiyear infrastructure strategies. We also see Cloudflare's distributed network as an increasingly compelling platform for AI inference at the edge—positioning the firm as a picks-and-shovels beneficiary of enterprise AI adoption. The edge computing and AI infrastructure opportunity is large, and Cloudflare does not need to be a winner-take-all player to be a meaningful beneficiary. For context, based on industry estimates and our own analysis, the combined public cloud and edge computing market is on track to exceed $1.5 trillion over the next five years. We believe Cloudflare's integrated blend of security, edge, and AI infrastructure capabilities will allow the firm to capture a meaningful share of this expanding TAM, and that these combined offerings will further reinforce its network effects and switching costs, thereby solidifying its economic moat.

Cloudflare has strong tailwinds behind its back as edge computing and inference-on-the-edge become more prevalent.

Cloudflare’s security business is set to grow at a fast clip due to the overall security spend of enterprises going up as they deal with more complex security issues.

Cloudflare has a long runway for growth in terms of enterprise penetration in its security business.

Cloudflare is in direct competition with well-established, far larger incumbents such as Amazon, Microsoft, and Google in the edge computing space.

Cloudflare is unprofitable on a GAAP profitability and may not achieve it for a few more years.

We believe that Matthew Prince, the firm’s founder and CEO, is a hugely influential person in the firm. If he were to leave or retire, Cloudflare’s future strategy and execution could suffer.