Cloudflare Deep Dive - Investor's Perspective

Is this the most misunderstood (and therefore, undervalued) tech company out there?

Issue #5

This is a long look at one of the companies I admire most but I also feel is most misunderstood. As a user, I’ve been a big fan and I really do think it points to the future of the internet, especially if geopolitical concerns end up making it more splintered.

I am doing this piece from an equity investor’s perspective into Cloudflare since that forces me to consider everything that matters (and I can actually act on it too!). Here’s a question for you - how much would you pay for analysis like this once a month? All comments welcome. If you like what you read and think others will too, spread the word.

So here goes: my Cloudflare investment memo 📝🧐

Happy birthday 10th Cloudflare! 🎉🎉🎉In my previous post, I wrote about the main software focused investment themes that I am focused on. It’s not often you come across a company that could potentially exist at the intersection of all of them 🤩. And that too within just 10 years!

In summary, I think the “market” is missing the following key points: 

1. The best technology companies have the ability to start off with one fantastically effective solution to a major problem and segue that into multiple offerings that they can upsell and/or launch new categories with. This is VERY difficult to achieve in practice since it requires changing multiple dimensions of a company’s approach (product, technology, sales, marketing, customer success) and aligning these factors in a way that they work well together. Cloudflare has achieved this and is continuing to execute amazingly well on this front.

2. The move towards programmable edge networks and edge computing in general, together with enabling serverless web development will be a core revenue driver over the next few years (minimal contribution to revenues at the moment).

3. Cloudflare is moving towards more of an enterprise sales model which should lead to further unit economic improvements whilst at the same time, quality of product means the self serve motion for SMBs can be maintained. 

4. The breadth of it’s product range should lead to better closing rates from mid-large sized corporates (given CIO decision making process is moving in the direction of LESS not more vendor management).

History:

Cloudflare traces its roots from a project that Matthew Prince and Lee Holloway started in 2004 to identify where email spamming was coming from (Nigerian princes watch out! ✔️). It was an immediate success and built the foundations of a community that would prove to be instrumental in Cloudflare’s later success.

After meeting his other Co-Founder, Michelle Zatlyn, at HBS in 2009, Prince and Zatlyn decided to extend the scope of Project Honey Pot to block unwanted internet activity rather than just identify it. Their timing was fortuitous; in the aftermath of the GFC, interest in software, web based technologies and entrepreneurship rocketed driving huge demand for its services. 🚀🚀🚀

Cloudflare also had the foresight to see that the future was in software defined networking and essentially built the company around this approach.

Why is Cloudflare so important right now?

There seems to be a misconception out there that Cloudflare is *just* a simple CDN provider. For example, do a quick Google search of ‘Cloudflare vs. Fastly’ (with Fastly offering somewhat similar services) and you get the following:

Nothing can be further from the reality. Cloudflare is a crazy combination of internet content speed optimisation, internet and network perimeter security in most of its forms, and increasingly, programmable networks, identity management and the enabler of massively distributed and easy to deploy web software apps. It’s more like 3-4 companies rolled into one, a paradigm usually reserved for the mega tech companies.

The entire world is moving towards operating on software stacks built around web/mobile apps (including discrete endpoints like IoT sensors). At the same time, these web/mobile apps are becoming more powerful with more features and yet, consumer expectations around performance, reliability, security and robustness are only becoming stricter.

The actual design and architecture of these types of apps is changing, particularly with the increasing popularity of services based software engineering concepts and APIs becoming incredibly popular increasing both the surface area of attack as well as the inherent complexity of deploying applications in a modular manner.

Increasingly intelligent end points (e.g. smart sensors and devices) with complex functionality, and the rise of massive online collaboration (including things like e-gaming) means that the initial heavy lifting of processing should happen closer to the physical location of the device before being sent to a central repository for further processing or storage. We’re living in a world where you can now get a Ring camera housed in a mini drone that can fly around your house if it detects something funny going on, checking out what is happening.

Development teams are becoming smaller / more agile (think of Amazon’s famous 2 pizza rule) and need to have the ease of not worrying about software deployment issues, which serverless computing facilitates. It’s amazing how much you can get done when you don’t have to think about the particulars of network management when building a web app. Also, think of the scale of software development talent that is coming out of the Emerging Markets world (e.g. Pakistan, Malaysia, Indonesia etc.). These teams are inherently small and need to iterate quickly to succeed. They need their apps to be performant since they tend to tackle a large, inter-regional marketplace from the get-go and since most are mobile first, performance is key.

Cost considerations are front and centre - a serverless approach where an intermediary like Cloudflare can handle the orchestrating of the actual deployment of the software and its components ends up being a lot cheaper than a non-serverless cloud approach for applications that don’t have the scale of something like Netflix because essentially, you’re only paying for what you use, rather than having it running all the time.

The Internet is splintering into geographical clusters due to geopolitical and compliance concerns. Programmable edge networks have the ability to easily and programmatically carve out data flows and restrict them to particular geographies.

All of the above necessitates the services that Cloudflare provides - it’s become a ‘must have’ rather than a ‘nice to have’. 🔥🔥🔥

So why does Cloudflare have incredible sources of durable competitive advantage? 🏰

Developer experience. It’s fair to say that developers are a vocal bunch of people and can be huge advocates of technology products within an organisation. Cloudflare has been building an engaged community since the beginning. With Cloudflare Workers, Cloudflare’s serverless edge compute platform, Cloudflare was able to get it into production well ahead of the competition (by a number of years) and have been improving it consistently based on real life user feedback. By getting these types of products like this in production earlier, they are able to create the positive flywheel effects that are required for platform success. 

The quality and quantity of engineering that has already been achieved across their product set is substantial. It’s difficult to quantify this but reading across their numerous blog posts and judging by their velocity of product release, it is clear that the depth and breadth of engineering challenges that have been dealt with will be very difficult to replicate. Cloudflare is solving incredibly challenging problems at scale. For example, this week’s release of Durable Objects, a mechanism to embed a program’s ‘state’ into an edge based, serverless delivery framework is technically extremely difficult to achieve in a fully featured way.

Cloudflare has approximately 95,000 to 100,000 customers (50% US / 50% ROW), including a long tail of SMBs, having a DBNER (dollar based net expansion rate) of 115% (as of June 2020) highlights that there is significant, real commercial value across the entirety of their product set. Higher DBNERs are usually associated with more large enterprise focused offerings as it is naturally easier to ‘land and expand’ with organisations with scale. With the sheer number of SMB clients, I would have expected a lower DBNER (~100-110), especially given the greater negative impact of the coronavirus on SMBs. Given the future focus on enterprise clients (see section referring to hiring plans), I expect DBNER to trend higher, further increasing the quality of revenue and increasing base levels of market multiples applied to Cloudflare.  

Product velocity: the ability to release cohesive products that build upon prior features or existing infrastructure in relation to evolving customer requirements, at scale and speed is something that most software organisations can never achieve. Cloudflare seems to have achieved a harmonious internal alignment of An example of this is the Cloudflare Access product which was based upon a previous feature (Argo Tunnel) and built upon the serverless edge system (Workers).

The ability to create in this manner implies to me that the product management organisation is highly effective and segmentation of the code base has been done properly, allowing either components to be reused effective or as is likely the case, each service to be architected well and the relevant APIs to be in place. Using the actual edge compute platform (Workers) for a production grade system of this calibre, as well as others, also shows its own maturity. 

Operational and Organisational Structure: 

Cloudflare is still founder-led with Matthew Prince remaining as the CEO and owning c10% of the equity. Michelle Zatlyn is still the COO. Unfortunately, Lee Holloway suffered from a terminal illness and had to leave the company. However, with Prince and Zatlyn at the helm, equity investors can rest assured that the vision and execution ability remains in place. Prince, in particular, is ‘technical enough’ to effectively lead such a complex tech organisation.

One thing I particulary like, and which speaks volumes about the quality of organisation within the company is that Cloudflare actively builds internal tools and platforms to help solve operational or organisational problems. A good example of this is an internal tool for conducting diagnostics on systems and how Cloudflare dealt with changes in organisational realities to make sure that it was still relevant and used properly:

“In September last year, an Engineering Manager at Cloudflare asked to transition Crossbow from a Product Engineering team to the Support Operations team. The tool had been a secondary focus and had been transitioned through multiple engineering teams without developing subject matter knowledge” 

Cloudflare appears to build internal tools at a relatively early phase of its development lifecycle. This is a highly under-rated capability which ensures more effective scalability as the organisation grows in complexity. A significant part of Cloudflare’s overall PPE balance (which includes server related costs) is associated with capitalised internal-use software ($42.7m as of June 2020, 21.5% of total PPE ex depreciation). 

Furthermore, they are willing to deprecate elements that they determine are not valuable enough for the whole organisation. The natural tendency for software companies is to try and preserve the effort that has gone into building anything, especially if it is for internal use. Politically, teams that have invested the time into building these features and teams that are using it will be extremely vocal about deprecating. To counteract this type of inertia speaks volumes about their ability to act in a rational manner.

“Through removing low-value/high-maintenance functionality and merciless refactoring, we were dramatically able to improve the quality of Crossbow and therefore improve the velocity of delivery. We were able to dramatically improve usage through enabling functionality to measure usage, receive feature requests in feedback loops with users and test-driven development. Consolidation of tooling reduced overhead of developing support tooling across the business, providing a common framework for developing and exposing functionality for Technical Support Engineers.”

Active communication seems to exist across this organisation. This is usually the first thing that tends to break down when organisations get to the level of scale that Cloudflare is at. If this type of culture is in place, it is highly likely that they are using the correct types of internal communication and information management tools, as well as inculcating the right types of behaviour to use these tools effectively.

Another interesting heuristic is that Cloudflare’s experimental technology unit is specifically mandated to liaise with the marketing department to understand customers’ specific use cases. It doesn’t exist in a silo, showing that the ‘DNA’ of the organisation, in general, marries together the need to innovate with a focus on end user demand.

Glassdoor metrics are positive. Even one of the ‘cons’ (technical debt) is a positive for me since it indicates that consideration is given to this impactful issue.

Employee NPS scores are consistently positive:

Future hiring plans 🧑‍💻: 

A review of Cloudflare’s hiring plans shows that the focus is going to be on the following: 

• An increased focus on driving enterprise adoption, i.e. to a higher LTV model with greater stickiness albeit with higher CAC. Clearly, the ‘make or break’ issue here will be getting the right people in place, especially in expansionary regions like Asia (although there is a much better pool of talent available compared to the past). At the same time, it is unlikely that Cloudflare’s product management teams will change product design from being able to facilitate their self serve model, particularly as the benefits of the optimized customer journey workflow will also accrue to enterprise clients.

• Engineering to keep maintaining and upgrading the core product set. Important for ongoing resilience but operating margin negative/neutral in the short term. 

• Creating new solutions related to programmable edge network, video streaming and management of containers (in a microservices context). 

• Big data analysis to enable clients to have better insights about the behavior of their networks and for Cloudflare to better anticipate/resolve perimeter attacks and overall resource utilisation, especially as the volume of potential attacks can increase exponentially as their serverless offering starts generating more traction. 

I expect Cloudflare’s strategy of driving increased engagement with it’s existing product set and delivering new, adjacent products to be highly effective.

Can Cloudflare achieve greater enterprise sales penetration? This will depend on the nature of the organisational structure they have put in place to help manage this. A quick review of LinkedIn shows that senior sales leaders come from larger, legacy firms such as Akamai (that tend to have larger enterprise clients) and have been at Cloudflare for enough time to be bedded into the organisation and for an appropriate sales framework to be created:

Head of Sales for North Asia: https://www.linkedin.com/in/jinwoong-kim-05685310/

Head of China Sales: https://www.linkedin.com/in/xavier-xuhui-cai-b45375130/

Global Head of Channels and Alliances: https://www.linkedin.com/in/matthewpharrell/

Head of EMEA Channel Sales and Partnerships: https://www.linkedin.com/in/akarzazi/

Culturally, Cloudflare seems to be a great place to work. They have just hired a friend of mine who was in VC as a product manager - https://www.linkedin.com/in/danielemolteni/ (relatively rare to see people go from VC back to an operating role that is not a founder position! 🤷). 

Financials:

High and stable gross margins indicating scope for substantial operating leverage. I would expect this to stay relatively stable over time or indeed increase from current levels given significant amounts of data infrastructure is already in place, commercial utilisation of edge computing is just starting, key products such as Access are just starting to monetise and Cloudflare has demonstrated it is able to build upon current product infrastructure to put new products in production with a rapid cadence. 

(Source: Public Comps)

Payback period has been increasing as a result of increasing sales and marketing expenses (up to around 22 months). As this gets bedded down, should expect it to stabilise. As I mentioned earlier, Cloudflare is looking to hire a large number of both outside and inside sales executives that will perform a more complex sales role. This indicates that they are preparing to shift more towards an enterprise orientated go-to-market strategy which, if successful, should lead to a plateauing of the payback period (albeit at a potentially higher level), but with a higher DBNER and a potentially higher revenue velocity. Cohort analysis at the time of the IPO indicated that cohorts were increasing in revenue generation and Cloudflare was already in the process of moving up the client size curve. 

(Source: Public Comps)

Consensus estimates 1-2 years out have been increasing, which I expect to ratchet up. EBITDA breakeven might be achieved earlier if the trajectory of product development continues, net retention increases and S&M expenses are bedded down faster leading to greater operating leverage. 

(Source: Koyfin)

Balance sheet : net cash (c$600m = 6 months of no-revenue opex in the worst case scenario 🎃). Cloudflare issued $500m convertible bond in May 2020 priced at 0.75% / year with 30% conversion premium and overall capped at $57.58, due May 15th 2025. This should be redeemed in full. I think further convertible issuance is likely given the pricing support available and will probably be treated positively by the market.  

Cloudflare has negligible deferred revenue balance in liabilities given current structure of customer base but expect that to increase if shift towards larger enterprise is executed. 

Cashflow: Cloudflare is running close to operating cashflow breakeven. Cloudflare has significant scope to achieve positive OpCF since their largest expense items (S&M, R&D) are largely within their control. Furthermore, if a move towards more enterprise heavy sales works, given the nature of enterprise contracts, expect positive cash flow impact (higher upfront cash flow with deferred balance in liabilities). Capex (running at c$16m-$24m/quarter) is manageable and unlikely to increase much further given focus on commoditized hardware.  

Valuation: 

DCF is probably the best way to try and value a company in this particular stage of expansion and growth. On a back of the envelope basis, if we assume that exit, relatively low growth, free cash flow margin is 50% (gross margins stay around 75%, R&D margin stabilises at 15-20% and S&M, SG&A margin ratchet down to 10-15%, negligible growth capex with some maintenance capex), with a WACC of 10% and 5% terminal growth, the market is pricing in around $600m of terminal FCF per year ($1.2bn terminal revenues). Considering that ARR was approx $400m as of June 2020 and growing at c50% / year, there is considerable latitude to overshoot these market implied assumptions. In reality S&M and SG&A will not get down to that level since the market opportunity is so vast, Cloudflare would be crazy to reduce spending on growth (their own ‘long term’ assumptions call for 27-29% S&M margin and 8-10% SG&A margin).  

I can personally easily see Cloudflare generating orders of magnitude more revenue and ultimately FCF based on its industry positioning. At a c$12bn EV, this is a phenomenal asset that is very affordable to big tech which puts a legitimate floor under the valuation. 

Comps:

The market opportunity is a hybrid of taking market share from legacy networking operators (e.g. Akamai, Cisco), network orientated endpoint solutions (e.g. ZScalar), programmable edge and CDN (Fastly) and serverless / cloud compute (AWS, Google Cloud, Azure). Serviceable, addressable market is at least $100bn / year. 

Fastly, it’s nearest competitor with a similar programmable edge approach but without the breadth of products, has a similar market cap ($10bn) but with lower ARR ($300m although growing at 60% / yr), lower gross margins (60%), lower R&D expense (22% of revs compared to 28%) and S&M expense, which will have no real choice but to increase. Fastly has a greater proven business profile (with higher DBNER at 138%) showing that the market places a premium on enterprise focused growth, which Cloudflare should be able to capitalise on going forward. 

Technicals / Catalysts:

Negligible short interest (currently c1 day to cover, $230m) - this is most likely to have been hedging out equity risk of convertible. 

Cloudflare Access has been given away for free until 1st Sept. 3Q 2020 should include some contribution from it and further guidance uplift. 

Workers Unbound, a significant upgrade to the Workers serverless platform went into production beta in July 2020. Given the potential market need and the increase in developer adoption, I would expect this to exit beta and into commercial production by the end of 2020, adding to guidance in 2021. 

Call option buying in Cloudflare seems to have been picking up as evidenced by an increase in implied vol across the vol smile. However, vol pickup hasn’t been huge indicating there’s still capacity for increased underlying equity flow in the future if retail call option buying increases again (facilitated by dealer gamma hedging).