28 September 2026, updated 29 September 2026 · Built from the research folder's earnings-call transcripts and filings, SEC EDGAR filings (FY2025 10-K, Q2 FY2026 10-Q, 2019 S-1), competitor 10-Ks and independent industry data · Not a valuation and not a recommendation.
The unit is the large customer — an account paying over $100,000 a year. 4,298 of them at FY2025 year-end paid about $384,000 each, left Cloudflare about $291,000 of gross profit apiece (inferred), supplied 69% of revenue, and spend 20% more every year.
| What the business is | Cloudflare runs one global network (more than 335 cities in over 125 countries, interconnected with over 13,000 networks) that sits between its customers and the internet, and sells security, performance, Zero Trust networking and developer compute on it. Customers run from free hobbyists to the Fortune 500, and no customer exceeds 2% of revenue. FY2025 revenue was $2,167.9 million (+30%) with 5,156 employees at year-end, cut to about 4,700 in May 2026 (FY2025 10-K; Q2 FY2026 10-Q; Q3 FY2025 and Q2 FY2026 calls). |
| Industry | Edge network services: content delivery, web and API security, SASE/Zero Trust and edge compute. Its core input is being commoditised: 100-gigabit IP transit prices fell 17% a year compounded from Q2 2023 to Q2 2026 (TeleGeography), and Akamai's delivery revenue shrank 9.5% a year from 2021 to 2025 (Akamai FY2025 10-K). |
| How it makes money | Subscriptions (Pro and Business per domain, monthly; Enterprise contracts of one to three years with a base fee plus variable usage), per-seat Zero Trust, metered developer products, and a growing share of multi-year pool-of-funds commitments drawn down across one rate card; revenue is recognised ratably or as consumed, SLA credits and sales allowances are netted from it, and the network cost of free users is booked in sales and marketing rather than cost of revenue. |
| Unit of economics | The large customer (over $100,000 annualised revenue): 4,298 at FY2025 year-end and 4,698 at Q2 FY2026, supplying 69% of FY2025 revenue; the average one paid about $384,000 and generated about $291,000 of gross profit in FY2025 (inferred), and the cohort spends 20% more each year (DNR 120%). |
| What protects it | Traffic it gets for free buys network terms rivals must pay for: free-tier scale earns open peering at 356 internet exchanges, the most of any network in PeeringDB, and ISP-hosted servers, while one software stack on every server lets new products ship at low marginal cost. A well-funded entrant can buy servers and transit but not the 26.1% of websites (W3Techs) whose traffic earns those terms. |
| What drives earnings | Large-customer count and expansion under pool-of-funds contracts; sales capacity times productivity, now amplified by channel partners; mix between high-margin SASE and lower-margin Workers; network capex intensity and GPU utilisation; stock-based compensation of about 21% of revenue separating non-GAAP from GAAP profit. |
| What to watch | Non-GAAP gross margin against the 75–77% target no longer restated in 2026; dollar-based net retention and large-customer net adds; stock-based compensation as a share of revenue and the June 2026 non-voting Class C recapitalisation. |
| Cycle exposure | Demand: low to medium — through the 2022–24 IT slowdown net retention fell 17 points but revenue growth never dropped below 27%. Sales execution: medium (Q1 2023 guidance cut). Input costs: medium, with memory, SSD and CPU shortages flagged in 2026. Current position: upswing on growth (36% vs a 27% trough) and retention (120%), trough on gross margin (73.1% vs 79.5% two years earlier). |
US dollars. Fiscal year ends 31 December; latest reported period is Q2 FY2026 (quarter ended 30 June 2026). Non-GAAP figures exclude stock-based compensation and related payroll tax, acquired-intangible amortisation and restructuring. (inferred) marks a conclusion reasoned from sourced figures, not a disclosed number.
Anyone who puts something on the internet has to solve the same three problems. It must be fast for users far away, it must survive attacks, and its employees, code and AI agents must reach it securely. Cloudflare solves all three by placing one network between the customer and the internet: a request to a customer's site, or from its employees, passes through a Cloudflare server in one of more than 335 cities, where it is cached, filtered, inspected or executed (Q2 FY2026 10-Q). The design choice that matters is that every service runs on every server in every city on commodity hardware (FY2025 10-K). A new product is therefore a software release onto an existing network, not a new build.
Management describes the product set as four "acts" (Q2 FY2025 call). Act 1 is the reverse proxy — CDN, DDoS mitigation, web application firewall, bot management — protecting public sites and APIs. Act 2 is the forward proxy — Zero Trust access, secure web gateway, WAN replacement — sold per seat as a SASE platform. Act 3 is the developer platform — Workers compute, R2 storage, Workers AI inference — metered by requests and execution time (FY2025 10-K). Act 4, introduced in 2025, charges AI crawlers and agents for access to publishers' content; management says it is "way too early" to model (Q2 FY2025 call).
Revenue by act is not disclosed (Q2 FY2026 call). Management ranks Workers as the fastest-growing act and SASE second, and says SASE carries "extraordinarily high" gross margins (Q3 FY2025 call); how that mix moves gross margin is taken up in Section 5.
The unit of economics is the large customer — an account paying more than $100,000 of annualised revenue. There were 4,298 at the end of FY2025 and 4,698 at Q2 FY2026; they supplied 69% of FY2025 revenue and 73% of Q2 FY2026 revenue (FY2025 10-K; Q2 FY2026 10-Q; Q4 FY2025 and Q2 FY2026 calls). On those figures the average large customer paid about $384,000 in FY2025 and produced about $291,000 of gross profit at the 75.8% non-GAAP gross margin (inferred). The remaining $672 million came from roughly 280,000 smaller paying accounts, around $2,400 each (inferred).
Management's own reporting confirms where the economics sit. The total paying-customer count — 332,466 at FY2025, up 40% — was dropped as a reported metric in 2026 because it "has become significantly less important to us" (FY2025 10-K; Q2 FY2026 10-Q). Large customers numbered 313 at FY2018 and 550 at FY2019 on the old annualised-billings basis, then 828, 1,416, 2,042, 2,756 and 3,497 at FY2020–FY2024 on the revenue basis (FY2019, FY2022 and FY2025 10-Ks). Their share of revenue has risen every year, from 46% in FY2020 to 73% (Q4 FY2021 and Q2 FY2026 calls), and pay-as-you-go plans were only 11% of revenue by Q2 2022, the last time the split was given (Q2 FY2022 call).
FY2018–FY2019 (lighter bars) counted on annualised billings; revenue basis from FY2020. Sources: FY2019, FY2022 and FY2025 10-Ks; Q2 FY2026 10-Q.
A typical unit starts free. A developer or small company puts a domain behind the Free plan, and the cost of carrying that traffic is booked in sales and marketing, not cost of revenue (2019 S-1; FY2025 10-K). Some upgrade to Pro or Business, priced per domain and paid by card. Enterprise contracts follow through field, inside or channel sales: typically one to three years, a base subscription plus variable usage, billed monthly or annually and due on receipt (FY2025 10-K). Revenue is recognised ratably with usage recognised as consumed, and service credits for missed SLAs are netted from revenue (FY2025 10-K).
The largest accounts increasingly sign pool-of-funds contracts: a committed spend, usually over more than three years, drawn down against one rate card for the whole portfolio and billed monthly (Q2 FY2024 and Q1 FY2026 calls). These were about 1% of new annual contract value in Q3 2023 and about 20% in Q4 2025 (Q3 FY2024 and Q4 FY2025 calls). Sales reps are paid on revenue as it is consumed (Q4 FY2024 call). At Q2 FY2026, contracted but unrecognised revenue stood at $2,732 million, 64% of it due within twelve months (Q2 FY2026 10-Q).
The free tier is an input, not charity. The 2019 S-1 lists what it buys: a "vast sensor network" that sees attacks on small sites before they reach enterprises, a "virtual quality assurance team," a recruiting and brand channel into large companies, and — most important economically — traffic scale that makes Cloudflare "valuable to a diverse set of global ISPs, improving the breadth and economic terms of our interconnections, bandwidth costs, and co-location expenses." A substantial majority of free users never pay (FY2025 10-K), and Prince says "we haven't actually worked that hard to convert free customers into paying customers" (Q1 FY2026 call). The free user pays in data and bargaining power, not revenue.
Cloudflare has added lines rather than exited them: Zero Trust in 2020, R2 object storage in 2022 and GPU inference in 2023 (Q1 FY2020, Q3 FY2022 and Q3 FY2023 calls). Its one forced retreat was China, where the Baidu partnership expired at the end of 2020 (2019 S-1) and the JD Cloud replacement came on terms the FY2025 10-K calls "less favorable to us"; it has since been extended to 2032 (Q2 FY2026 10-Q). China fell from 12% of revenue in 2016 to 4% in 2019 (2019 S-1; FY2019 10-K).
The industry sells one fixed asset — servers, points of presence and peering ports — in three ways. Delivery sells capacity by the gigabyte, security sells inspection per request or per seat, and compute sells execution time. Delivery is being commoditised because its main input keeps getting cheaper for everyone: TeleGeography measures 100-gigabit IP transit prices falling 17% a year compounded from Q2 2023 to Q2 2026, to as little as $0.03 per Mbps per month. Akamai's numbers show the consequence: delivery revenue fell from $1,873 million in 2021 to $1,257 million in 2025, which Akamai attributes to "downward pricing of contract renewals" and customers building their own delivery (Akamai FY2025 10-K).
The profit pool therefore sits in software layered on the network, not in bytes. Delivery-heavy vendors earn gross margins in the high 50s, while cloud security vendors earn 68–77% (table below). Cloudflare runs a delivery network but earned 74.5% in FY2025, on the security side of that divide.
| Company (fiscal year) | Revenue ($M) | Growth | Gross margin | GAAP op. margin |
|---|---|---|---|---|
| Akamai (FY2025) | 4,208.2 | +5% | ~59% | 13.5% |
| Fastly (FY2025) | 624.0 | +15% | 57% | (19.1%) |
| Zscaler (FY2026, Jul) | 3,352.5 | +25% | 76.8% | (4.0%) |
| Netskope (FY2026, Jan) | 709.0 | +32% | 68% | (92%) |
| Cloudflare (FY2025) | 2,167.9 | +30% | 74.5% | (9.6%) |
Sources: each company's latest 10-K on SEC EDGAR; Cloudflare from SEC XBRL data. Akamai's cost of revenue excludes acquired-intangible amortisation. Netskope's loss includes stock compensation recognised at its 2025 IPO.
The relevant market is global, not local: anycast routing sends each request to the nearest location, and a customer buys one network for every geography. In the long tail of the web Cloudflare is close to a monopoly. W3Techs finds it in front of 26.1% of all websites and 85.2% of sites using a known reverse proxy, against 1.7% for Amazon CloudFront and 0.7% for Akamai (W3Techs, 28 September 2026). HTTP Archive's 2025 Web Almanac independently puts Cloudflare at 58% of CDN-served HTML requests.
Revenue tells a different story, because websites are not revenue. Akamai's $4.2 billion is about 1.9 times Cloudflare's, and large media and enterprise traffic is under-weighted in site counts (inferred). SASE is a separate market with different leaders: Dell'Oro sizes it at $3.5 billion in Q2 2026, growing over 20% for five straight quarters, and names Palo Alto Networks and Netskope, not Cloudflare, among growth leaders (Dell'Oro, September 2025 and September 2026). With no primary public vendor-share data, Cloudflare's claim to be "neck and neck with Zscaler" (Q2 FY2025 call) is unverified.
Servers and transit can be bought by anyone, so hardware is not the barrier. What binds is the terms on which traffic enters and leaves the network. Cloudflare exchanges traffic at 356 public internet exchanges with an open peering policy — more than any network in PeeringDB, against 251 for Akamai, 167 for Amazon and 152 for Fastly (PeeringDB, 28 September 2026). ISPs peer with, and some host servers "for free or at a discount" for, a network carrying traffic their own users want (2019 S-1; FY2025 10-K). An entrant could copy the servers but not the traffic that earns those terms, and the free tier is what generates the traffic.
The architecture compounds the advantage. Wholesale bandwidth is billed on the greater of inbound and outbound traffic; a caching proxy always sends out more than it takes in, so a DDoS attack fills inbound capacity that is already paid for. "Even at these hyperscale attacks, the in is not ever getting higher than the out," Prince said (Q1 FY2025 call). That is how the company absorbed a roughly 30 Tbps attack (Q3 FY2025 call) without charging customers for attack size (Q2 FY2026 call), while scrubbing-centre competitors carry that capacity as dedicated cost.
“Given our scale, we are an attractive partner to ISPs globally. Deploying our equipment directly inside their networks can drive down their bandwidth costs and increase their performance. This allows us to negotiate better co-location and bandwidth costs from ISPs. So, as our network grows, we offer a greater benefit to ISPs and reap more favorable terms.”— 2019 S-1
Independent evidence supports part of that account. The share claim ("more than 20% of the web") is conservative against W3Techs. The peering-cost advantage is partially supported: the interconnect footprint is measurably the largest and gross margin sits 15 or more points above delivery peers, but Cloudflare discloses no unit bandwidth cost, so the advantage cannot be separated from product mix. The claim to interconnect with "over 13,000 networks" (FY2025 10-K) could not be verified, because public routing data undercounts private peering (CAIDA).
Three groups reinforce each other, and the loop shows how the pieces of the moat connect. Sites behind Cloudflare generate traffic that ISPs' own users want, which earns the peering and hosting terms described above; cheaper, denser capacity keeps the free tier affordable, which brings more sites (2019 S-1; FY2025 10-K). The same free tier is the developer funnel: developers' hobby projects "take Cloudflare to work with them" (2019 S-1), and paid-customer growth is now led by free developers "graduating" to small paid plans (Q4 FY2025 call). Code deployed on Workers runs where the traffic already arrives, so every app built there adds traffic and customers back into the first loop. Underneath sits a data loop: free users form a "vast sensor network" that improves the security models sold to paying customers (2019 S-1).
Strictly, this is not a network effect, and the distinction matters for durability (inferred). A customer gets no more value because other customers use Cloudflare; what compounds is cost — supply-side scale economies that any network with equal traffic would enjoy, which is why share (26.1% of websites against 1.7% for the next proxy, W3Techs) is the real barrier. The developer side is an ecosystem effect partly built by acquisition: Cloudflare bought the Astro web framework and the VoidZero JavaScript toolchain ($164.2 million) to make Workers the default deployment target (Q4 FY2025 call; Q2 FY2026 10-Q). The data loop is plausible, but no independent test of it was found. The only genuinely two-sided market is Act 4, where more paying AI agents would make publishers keener to gate content through Cloudflare and vice versa — and management calls it "way too early" to model (Q2 FY2025 call).
Solid arrows: what each group gives the next; dashed: what comes back. Sources: 2019 S-1; FY2025 10-K; Q4 FY2025 call. Only Act 4 (AI agents paying publishers) would be a true two-sided network, and it is not yet modelled.
Cloudflare has chosen one slice of the inference market. It does not rent out dedicated GPU clusters: asked about a competitor's nearly $3 billion AI infrastructure contract, Prince called letting "an AI company use your balance sheet and your credit rating" "just not attractive business for us" (Q2 FY2026 call). Instead it sells inference per request on GPUs spread across its cities — over 150 by Q1 2024 — inside servers that also carry CPU, memory and storage, so each workload is matched to the silicon that fits (Q1 FY2024 and Q1 FY2026 calls). The target is small, bursty, latency-sensitive work from applications and agents: inference should run on the device where possible, and "if it can't run there ... the next best place for it to run is in the network" (Q3 FY2025 call). Agents, Prince argues, need inference packaged with short-lived compute, storage and network access: "It's not simply the inference that matters" (Q2 FY2026 call).
The claimed edge is utilisation. Because customers pay only for work done and many share each GPU, management says GPU utilisation is approaching the 70–80% it reaches on CPUs, against "single digits" at hyperscalers, yielding "as much as 10x the amount of work off of the same GPU" (Q1 FY2026 and Q4 FY2025 calls). If true, that is a cost advantage of the same kind as the peering advantage — earned by pooling demand rather than owning more hardware (inferred). It is, however, a company claim without independent measurement, and no independent data sizes the edge-inference market at all.
| Competitor | Where it is strong | Cloudflare's angle |
|---|---|---|
| Hyperscalers (AWS, Azure, Google Cloud) | Capacity, frontier-model partnerships, enterprise cloud contracts; the "primary competition for inference workloads" (Q3 FY2025 call) | Pay per request with no annual GPU commitment; no egress fees on R2; neutrality across clouds (FY2025 10-K; Q4 FY2025 call) |
| GPU lessors and neoclouds | Dedicated clusters for training and large-batch inference; multi-billion-dollar contracts | Not contested, by choice (Q2 FY2026 call) |
| Akamai | Akamai Inference Cloud on NVIDIA Blackwell (Akamai 8-K, 28 October 2025) | Proxy in front of 26.1% of websites against 0.7% (W3Techs); broadest open peering (PeeringDB) |
| AI labs | Control the models; could restrict where their products run (Q2 FY2026 10-Q) | Over 80% of leading AI companies already use Cloudflare, mostly starting with security (Q3 FY2025 and Q2 FY2026 calls) |
Right-hand column: Cloudflare's own arguments, except where a measurement is cited.
Hyperscalers are the closest substitute for Acts 1 and 3. On 18 November 2025 AWS launched flat-rate plans bundling CloudFront, WAF, DDoS protection and DNS at $0, $15, $200 and $1,000 a month — a near copy of Cloudflare's plan ladder (AWS pricing pages). Its answer to bundling is neutrality: the 10-K argues customers fear lock-in and that Cloudflare does "not aim to compete with our customers" (FY2025 10-K).
In Act 2 the rivals are Zscaler, Palo Alto Networks and Netskope, who sell through channels carrying 90% or more of their sales; Cloudflare's channel share is 31% (Q4 FY2025 and Q2 FY2026 calls; Q2 FY2026 10-Q). Zscaler and Netskope already hold FedRAMP High authorisation. The GSA marketplace still listed Cloudflare's High offering as "in process" in May 2026, which a Cloudflare press release contradicts (GSA FedRAMP data). The 10-Ks show the frame moving: in FY2019 on-premises hardware vendors were "our primary competition"; by FY2022 that sentence was gone and Workers "are increasingly competing" with public clouds (FY2019 and FY2022 10-Ks).
Three forces could. Hyperscaler bundling caps what Cloudflare can charge small and mid-sized customers and, if it reaches enterprise, turns Act 1 into an attachment to cloud contracts. In Zero Trust, incumbents' channel reach and certifications slow Cloudflare's entry into the largest security budgets. And the scale that makes the network cheap also concentrates risk: one malformed file took down CDN, Zero Trust access and the dashboard together for almost six hours on 18 November 2025 (Cloudflare post-mortem), and a dominant shared-IP proxy draws regulators — both mechanisms are set out in Section 7.
The peer evidence points to one pattern for who wins here. Pure delivery loses, as Akamai's decline and Fastly's losses show; winners sell software per seat or per request on a network that is cheap to run and neutral across clouds. Cloudflare fits that pattern on structure — the dominant proxy position, the broadest open peering, security-grade gross margins. It has not yet proven it on enterprise SASE share, federal certification or GAAP profit, where it lost 9.6% of revenue in FY2025 against Akamai's 13.5% profit.
Revenue grew from $287 million in FY2019 to $2,168 million in FY2025 (SEC XBRL), and the rate has re-accelerated from a 27% low in Q4 FY2024–Q1 FY2025 to 36% in Q2 FY2026 (calls). Reported growth is organic growth. Acquisitions have been small technology tuck-ins — Replicate for $57 million, VoidZero for $164 million — of companies with "little, if any" customers (FY2025 10-K; Q2 FY2026 10-Q). Price is also minor: the only disclosed list-price rise was on Pro and Business plans around 2023, a "relatively small part of our business" (Q2 FY2024 call). Growth is volume: more customers, and more spending per customer.
| Period | Reported growth | Acquired | Existing customers (DNR − 100) | New customers (residual) |
|---|---|---|---|---|
| FY2024 | 28.8% | Immaterial | ~12 pts (avg. DNR 112%) | ~17 pts |
| FY2025 | 29.8% | Immaterial | ~16 pts (avg. DNR 116%) | ~14 pts |
| Q2 FY2026 | 36% | Immaterial | ~20 pts (DNR 120%) | ~16 pts |
Reported growth from SEC XBRL and the Q2 FY2026 release; quarterly DNR from the calls. The expansion/new split is (inferred): DNR measures a cohort's annualised revenue a year earlier and excludes free-to-paid upgrades, so the split is approximate. Acquired businesses had little or no revenue (FY2025 10-K).
The split explains both the 2024 slowdown and the recovery. When the largest customers moved to pool-of-funds contracts their annualised revenue first dipped, and net retention fell from 115% to 110% (Q3 FY2024 call). As the pools were drawn down — "on average, we are slightly ahead" (Q3 FY2025 call) — retention returned to 120%. New-customer bookings meanwhile grew at their fastest rate in more than five years in Q2 FY2026 (Q2 FY2026 call).
“What we're selling is the ability to get work done across our network. Cloudflare itself is effectively a giant scheduler where we can move workloads to wherever we have capacity anywhere in the world.”— Matthew Prince, Q3 FY2025 call
Large customers rose 27% to 4,698 and $1 million-plus customers grew 55% to 269 in FY2025 (Q2 FY2026 10-Q; Q4 FY2025 call). The mechanism is one rate card across more than 55 revenue-generating products: a customer that lands on Act 1 can spend its committed pool on Zero Trust or Workers without a new procurement (Q3 FY2025 call). The largest disclosed deals are $130 million over five years (Q1 FY2025 call) and a contract averaging $42.5 million a year (Q4 FY2025 release).
After Q1 2023, when more than 100 underperforming reps were replaced (Q1 FY2023 call), the sales organisation was rebuilt. Under a new President of Revenue productivity has now risen year on year for ten straight quarters and passed its 2021 peak (Q4 FY2025–Q2 FY2026 calls). The May 2026 cut of about 20% of staff "hardly touch[ed]" quota-carrying reps (Q1 FY2026 call); the President of Revenue leaves at the end of 2026 (Q2 FY2026 10-Q).
The fastest-growing act, now "a meaningful contributor to revenue" (Q2 FY2026 call) but carrying the lowest gross margin. Its adoption evidence, and what must go right for it to pay, are set out below.
Partners' share of revenue rose from 16% in FY2023 to 31% in Q2 FY2026, with channel revenue up 67% year on year (FY2025 10-K; Q2 FY2026 10-Q). It widens reach in Zero Trust, where rivals sell almost entirely through partners; whether partner margin is netted from revenue is not disclosed.
Customers "closely scrutinizing every deal" through 2024 gave way to confidence returning in the US from Q4 FY2024 (Q3 and Q4 FY2024 calls). US revenue growth accelerated from 20% in Q1 FY2025 to 41% in Q2 FY2026 (calls).
Workers is the fastest-growing act and the one with the largest stated ambition. Developers on the platform rose from over 2 million in Q1 FY2024 to 4.5 million at end-2025 and more than 7.4 million at Q2 FY2026, about 2 million of them added in Q2 alone against 1.5 million in all of 2025 (calls; a company with one account counts once). More than three-quarters of Workers growth comes from new customers (Q1 FY2026 call), and most AI "vibe-coding" platforms — Lovable, Replit, Base44 — build on Workers or deploy to it by default, as do AI-agent (MCP) servers from Asana, Atlassian, Stripe and PayPal (Q1 FY2025, Q4 FY2025 and Q2 FY2026 calls). Prince expects Act 3 to produce nine-figure deals "as we are able to take from hyperscalers" (Q2 FY2025 call); the largest so far is $130 million over five years, mostly Workers (Q1 FY2025 call).
Inference usage has grown far faster than inference revenue. Inference requests rose more than 700% quarter on quarter in Q2 2024 and "nearly 4,000%" year on year by Q1 2025, and AI Gateway requests rose over 1,200% (calls). Deals have scaled from a first $7 million one-year Workers AI contract (Q3 FY2024 call) to $15 million (Q2 FY2025 call) and an $85 million two-year platform deal with an AI company (Q4 FY2025 call). Yet AI inference was "a relatively de minimis portion of our overall revenue" in October 2025 (Q3 FY2025 call), and neither Workers nor inference revenue has been quantified since.
For adoption to become economics, three things must hold (inferred). Developer products' below-average gross margin must converge toward the company average; network capex must stay near its 14–15% guide as AI deals scale; and GPU utilisation must actually rise, which Prince says will show up in the company's engineering blog posts (Q1 FY2026 call). The evidence so far supports the adoption case and leaves the margin case open.
FY2026 guidance has been raised twice, to $2,864–2,870 million, or +32% (Q2 FY2026 release). Management targets $5 billion of annualised revenue by Q4 2028 from a $3 billion run rate in Q4 2026 (Q3 FY2025 call), which requires about 29% a year for two years (inferred). Act 4 could add a new pricing layer through per-request micro-payments by AI agents, but nothing in the sources quantifies it.
Gross margin is high because serving one more request on an existing network costs little. It has nonetheless fallen: non-GAAP gross margin went from 79.5% in Q1 FY2024 to 72.8% in Q1 FY2026, then 73.1% in Q2 FY2026, the first sequential rise in eight quarters (calls). Management gives three causes. Network cost is shifting from sales and marketing into cost of revenue as paid traffic outgrows free traffic, "literally a wash" at the operating line (Q1 FY2026 call). Developer products carry below-average gross margins (Q1 FY2026 call), and the 2024 extension of server life from four to five years, which cut FY2024 depreciation by $21.1 million, has lapped (FY2025 10-K).
The filings add a line the calls do not explain: third-party technology services costs rose $59.2 million in FY2025 and $30.1 million in Q2 FY2026 alone (FY2025 10-K; Q2 FY2026 10-Q). Management stopped restating its 75–77% long-term target in 2026 and now points to "unit economic margin" and operating margin (Q1 and Q2 FY2026 calls). That reframing is fair if cost is only moving between lines, but it also removes the yardstick for judging Workers' lower margins (inferred).
The quarterly path shows that the decline was absorbed below the gross line. From Q1 FY2024 to Q2 FY2026 non-GAAP gross margin read 79.5%, 79.0%, 78.8%, 77.6%, 77.1%, 76.3%, 75.3%, 74.9%, 72.8% and 73.1%; non-GAAP operating margin over the same quarters read 11.2%, 14.2%, 14.8%, 14.6%, 11.7%, 14.1%, 15.3%, 14.6%, 11.4% and 13.8% (calls). Operating margin held because much of the gross-margin loss was network cost that previously sat in sales and marketing.
Quarterly, Q1 FY2024 to Q2 FY2026. Source: earnings calls. Non-GAAP excludes stock compensation, acquired-intangible amortisation and restructuring.
Below gross profit the story is leverage. Non-GAAP operating margin rose from −25% in FY2019 to 14.0% in FY2025 (FY2019 and FY2025 10-Ks), mostly because non-GAAP sales and marketing fell from 52% of revenue in Q4 FY2019 to 33% in Q2 FY2026 (calls). GAAP operating margin was still −9.6% in FY2025. The gap is stock-based compensation, which with payroll taxes cost $489.9 million, 22.6% of revenue (FY2025 10-K). The non-GAAP profit is real in cash, but part of the wage bill is paid in shares.
Cash conversion exceeds reported profit for three reasons. Customers are billed ahead of service, leaving $852 million of deferred revenue at mid-2026; stock pay is non-cash; and interest on the cash pile earned $131.2 million in FY2025 (Q2 FY2026 release; FY2025 10-K). Operating cash flow of $603.1 million less $342.5 million of capex and capitalised software left free cash flow of $260.6 million, 12% of revenue (FY2025 10-K).
Capex is the main call on that cash. Servers are commodity and depreciated over five years, and because every server runs every service the company can add GPUs or storage inside existing boxes (Q1 FY2024 call). Management invests "behind the demand, not ahead" and often has hardware earning revenue before the vendor is paid (Q3 FY2025 call). Network capex has run at 8–15% of revenue — 10% in FY2024, about 13% in FY2025, guided at 14–15% for FY2026 — and the step-up reflects GPU deployment as demand shifted from AI training to inference (Q3 and Q4 FY2024 calls; later calls).
| FY2019 | FY2021 | FY2023 | FY2025 | |
|---|---|---|---|---|
| Revenue ($M) | 287.0 | 656.4 | 1,296.7 | 2,167.9 |
| GAAP gross margin | 77.9% | 77.6% | 76.3% | 74.5% |
| Non-GAAP operating margin | (25%) | (1%) | 9% | 14.0% |
| Free cash flow ($M) | (96.2) | (43.1) | 119.5 | 260.6 |
| Capex (PP&E) % of revenue | 15.1% | 14.2% | 8.8% | 14.6% |
| Stock comp. % of revenue | 12.8% | 13.7% | 21.1% | 20.8% |
Sources: SEC XBRL data (revenue, gross margin, capex, stock compensation); FY2019, FY2022 and FY2025 10-Ks (non-GAAP margin, free cash flow). Comparability: from 1 January 2024 servers are depreciated over five years instead of four, flattering FY2024–25 gross margin (FY2025 10-K); FY2023 capex was deliberately cut, with network capex guidance lowered to 8–10% (Q3 FY2023 call); stock compensation here excludes payroll tax.
From FY2019 to mid-2026 cash went, in order of size:
The pattern is consistent. Growth is funded by zero-coupon convertible notes — $575 million in 2020 (0.75%), then $1,294 million in 2021, $2.0 billion in 2025 and $2.5 billion in August 2026, all at 0% — with capped calls instead of buybacks to hedge dilution (FY2022 10-K; 8-Ks). Stock compensation is the dilution channel, and diluted weighted shares rose from 299.8 million in FY2020 to 348.4 million in FY2025, about 3% a year (SEC XBRL). The M&A hurdle is "very, very high" (Q1 FY2024 call).
Post-dating the reported figures: the $2.5 billion 2031 notes (0%, conversion price $496.94, capped at $854.12, net proceeds about $2,462 million) were issued on 13 August 2026, and the $1,293.75 million of 2026 notes matured on 15 August 2026 with principal payable in cash and any excess in shares (8-K 2026-08-13; Q2 FY2026 10-Q). Against $4.16 billion of cash and securities at 30 June 2026, after the $259.5 million capped-call cost that implies roughly $5.1 billion of cash against $4.5 billion of notes due 2030–2031 (inferred, before second-half cash flow). The settlement outcome is not in the sources.
Cloudflare sells into IT and security budgets, which bend rather than break. The 2022–24 slowdown is the test. Net retention fell from a 127% peak in Q1 FY2022 to a 110% trough in Q3 FY2024; in Q1 2023 sales cycles ran 27% longer, expansion deals 49% longer, and FY2023 revenue guidance was cut by about $54 million (Q1 FY2022, Q1 FY2023 and Q3 FY2024 calls). Yet annual revenue growth never dropped below 27%. Most revenue is contracted subscription while a slowdown hits bookings, which enter revenue slowly — "slow on their way down, but ... also slow on their way up" (Q3 FY2024 call).
| Region (billing address) | FY2025 revenue ($M) | Share | FY2025 growth |
|---|---|---|---|
| United States | 1,073.0 | 49% | +26.3% |
| EMEA | 598.6 | 28% | +28.3% |
| Asia Pacific | 329.8 | 15% | +47.8% |
| Other | 166.6 | 8% | +27.8% |
Source: FY2025 10-K. Growth calculated against FY2024. No customer exceeds 2% of revenue (Q3 FY2025 call); an industry-vertical split is not disclosed. Channel partners supplied 26% of FY2025 revenue (FY2025 10-K).
Constraints sit on the supply side. Non-cancellable bandwidth and co-location commitments are only $179.4 million in total (FY2025 10-K), so most network cost can flex with demand (inferred). The tighter constraint is components: the company expects shortages of memory, SSDs, CPUs and hard drives as suppliers reallocate to AI infrastructure, with costs that "may outpace our ability to adjust our pricing" (FY2025 10-K; Q2 FY2026 10-Q). Regulation is a slower constraint: EU NIS2 rules now name CDN and managed security providers directly (European Commission, Implementing Regulation 2024/2690).
Where the business sits now: an upswing on volume and retention, a trough on gross margin. Revenue growth is 36% against a 27% low, net retention 120% against a 127% peak and 110% trough, and non-GAAP gross margin 73.1% against 79.5% two years earlier (calls). Non-GAAP operating margin held at 13.8% in Q2 FY2026 against 14.0% for FY2025 (Q2 FY2026 release), so the growth is not being bought at the operating line. Whether the gross-margin decline is cyclical or permanent is not yet shown (inferred).
The downside the industry research points to is not a demand collapse but a squeeze: the price ceiling set by hyperscaler bundles (Section 3) meeting hyperscaler-driven memory and server inflation in capex — the combination Akamai already reports (Akamai FY2025 10-K). For Cloudflare that would show up as lower revenue per dollar of network capex and a gross margin that keeps falling, not as lost customers (inferred).
| Indicator | What it tells you | Where published |
|---|---|---|
| Large customers and their share of revenue | Growth of the unit of economics | 10-Q key metrics; earnings call |
| Dollar-based net retention | Expansion inside the installed base | 10-Q key metrics |
| Non-GAAP gross margin; third-party technology services cost | Whether margin has found its floor | Earnings release; 10-Q MD&A |
| Network capex % of revenue | Capital intensity of growth, GPU build | Earnings call |
| RPO and current RPO growth | Revenue already contracted | 10-Q revenue note; release |
| Channel share of revenue | Go-to-market shift | 10-Q Note 3 |
| Stock comp. % of revenue; share count | Dilution paid for non-GAAP profit | 10-Q / 10-K |
| W3Techs reverse-proxy share | Position in the long tail | w3techs.com (daily) |
| IP transit prices | Deflation of the core input | TeleGeography (annual) |
Before forming a thesis an investor would need to resolve three things: where gross margin settles as Workers grows, whether stock compensation falls as a share of revenue after the 2026 restructuring, and whether Act 4 produces revenue or remains a positioning claim.