Cloudflare CEO: The Internet's Business Model Is Dead

Yeah, so I mean there have always been bots that ran around online. The way Google works is they scrape the internet and they then build their index based on that. And historically throughout most of the history of the cloud, it was about 20% of traffic on the internet was bots and that held fairly consistent over a period of time until about two years ago when we started to see a real rise in bots driven mainly by AI and the LLMs and everything that was going on behind those. And last fall, in the fall of 2025, I was asked at what point will automated traffic pass human traffic? And we pulled the data and we sort of extrapolated out the trends and we thought that it was going to be the end of 2027. Fast forward to South by Southwest this year, March of 2026, and I was asked the same question again and we looked at the data again and we were like, 'Oh, wow. It's growing a lot faster than we expected. It's moved now to the first half of 2027.' And then, I was pretty shocked when my team came to me just a few weeks ago and they said, 'You won't believe it. But we actually had bot traffic pass human traffic online in the first half of 2026.' So I think what that shows is just how fast these different systems, again almost all driven by AI, are growing and they're really driving so much more traffic across the internet.

Yeah. So Cloudflare sits in front of a huge percentage of the internet and it's a super representative sample. And so as a result, we can always look at what are the general trends across the internet. We have a site we call Radar, if you go to radar.cloudflare.com, that's tracking a number of different things. One of those is how much human traffic is there, how much bot traffic is there. And in the last couple months, the bot traffic exceeded the human traffic. And I think that if you extrapolate this out, in 5 years I think you'll see a thousand times more bot traffic than human traffic. And if I had to take an over-under bet on that, I'd take the over. It's just growing at such an exponential rate that you're just going to see an enormous amount of the internet that's driven by these various bots and agents and other systems.

I think that agent, bot, crawler are all synonyms. It all means the same thing. It depends on whether you want to describe it in a sort of normatively positive way, in which case you call it an agent. If you want to describe it the ickiest way, you call it a crawler or a scraper. But it's the same thing behind the scenes. It's a machine that's accessing resources as opposed to a human eyeball driving a browser accessing those resources. And in this particular case, you still have a whole bunch of the scraper, crawler, hacker traffic. That hasn't changed that much. You still have some of the bots like Googlebot that are building search indexes. That hasn't changed that much. If anything, it's gone a little bit down. But the thing that's really driving this is what I think we would all call agents. If I go to ChatGPT or I go to Claude or any of these systems and I'm shopping for a digital camera, you're going to see thousands of times more site visits for that same activity, that same job to be done of shopping for a digital camera than if I did it myself. I might visit five sites if I'm personally trying to figure out what digital camera to buy, whereas my agent might visit 5,000. And that's what's really driving this increased demand.

Yeah, I think first of all, if this trend continues, there's just going to be an enormous amount of additional demand on the internet. I go back to during COVID, where over the course of 2 weeks we saw internet traffic double. If our projections are right, that's going to seem quaint very soon. In 5 years, you might have a thousand times as much traffic on the internet as you do today. And that's going to mean more servers, more network infrastructure, more CPUs, more GPUs, more memory, all of the things that have to serve these bots are going to be very important. And it's also going to mean we're going to have to figure out some new business model in order to fund that. Someone has to pay for it. The business model of the internet historically has been ads, and bots don't click on ads. So it's going to be something different going forward. I think the most interesting question in the world today is over the next 5 years, the business model of the internet's going to change radically, and what it changes to is totally undefined at this point.

We've got to figure out exactly what that is. And it's going to change a number of things, like what is a brand in an agentic world? A brand historically has been a way as a shortcut to tell humans this is something that has a certain set of expectations, will have a certain set of experience associated with it. If I see a Walmart logo on the side of a building, I know what it's going to be like when I walk in. If I see a Marriott logo, if I see a McDonald's logo, I know what that's going to be like. The thing about bots is they have an infinite amount of patience in order to discover everything that might be right. So the basic idea of what a brand is going forward is going to be very different than what it has been in the very much human-driven commerce and internet experience. I'm not sure that I have ideas of what that might look like. I think that Cloudflare will play some role in helping figure that out, but it's all going to get discovered over the next 5 years, and that's incredibly exciting.

Yeah. So what Cloudflare started out as was how can you take a firewall, a security product, and put it in the cloud. The original idea came from a realization that software was moving to the cloud, servers were moving to the cloud, therefore all the security and networking infrastructure had to move to the cloud as well. So that was the basic premise that we started with. If you signed up for Cloudflare 15 years ago and you put us in front of your website, what you were effectively doing was putting a bouncer in front of the website that could check anyone who was trying to come to it and then stop the bad ones. And then because we needed to make sure we didn't slow things down, we would also take a lot of the load off of your website and be able to for good visitors deliver the content significantly faster. So the original idea of Cloudflare was sort of performance and security in a very easy to adopt package. We knew as a business that in order to succeed, we eventually had to sell our services to major banks and governments and healthcare, all the things that we now count as customers. In the early days, those things were never going to trust us because we were a dopey little startup. We had no infrastructure, we had no data to actually provide the security services. So the thing that we did was we created a free, stripped-down version of the service with the idea of making it available to everyone. What was interesting, we expected it was going to be a bunch of SMBs and startups and individuals that would sign up. But it turns out that if you think of it as an XY axis, the X-axis is budget and the Y-axis is security issues, there's almost a perfectly diagonal line. The smaller your budget is, the fewer security issues you have. The bigger your budget is, the more security issues you have. So it turned out that even SMBs and startups wouldn't sign up even though it was free. But two groups defied that. One was hacker kids, because they're always attacking each other. Overnight, every hacker kid in the world signed up for Cloudflare, and then they were attacking each other trying to take us down. The other were human rights organizations, humanitarian organizations, nonprofits. Because if you're doing any of that work, nine times out of ten you're pissing somebody off, and oftentimes it's a government or something that will then attack you. So overnight, we had every humanitarian organization in the world, every hacker kid in the world using Cloudflare. They were all, and we all of a sudden came under just massive attacks. So we were constantly trying to figure out how do we stay in front of it, how do we actually continue to exist and thrive in this world. That forced us to build a number of different things. We built a registrar product so you could register domains because we had used a registrar and we came this close to our domain getting stolen, which would have been a disaster for us. We had to build DDoS mitigation, which initially we didn't think we wanted to build at all. We had to build a DNS infrastructure because we couldn't get anyone else to support us. We needed to build our own sort of VPN because everybody else was too slow or not secure enough. And eventually we had to build our own developer platform where our team could turn around and actually take the ideas that they had and deploy them in a way that was incredibly limited, sandboxed, and other things because at some point we got big enough that if we had an issue, it was incredibly disruptive to the world in terms of what we were doing. So the real story of Cloudflare has been we started with this idea that was pretty simple, which was how do you put a firewall in the cloud, and then we sort of created so many problems over time for ourselves that we had to solve. And in the process of solving those problems, we've built a whole series of products. Cloudflare today, unlike when we started, I have a hard time articulating exactly what it is that we do at some level. We're sort of the next generation AWS or Google Cloud where we've rethought how that works. We still provide security and performance across that, but we have additional products that take advantage of the network that we have in order to provide things like a cloud-based VPN and other things. And increasingly, because of the massive percentage of the internet that we sit in front of, we're increasingly playing a role in figuring out what's that business model of the internet of the future. Our mission is to help build a better internet, and I think anything that is in fulfillment of that mission is the sort of problem that we're always thinking about.

In the very beginning, when we launched, we had servers in five cities around the world: Chicago, Ashburn, Virginia, San Jose, California, Amsterdam, and Tokyo. Except Tokyo sort of, if we had been totally honest, deserved an asterisk because we couldn't totally figure out the routing. And if we got it wrong, a whole bunch of traffic from the US ended up hitting Tokyo. So we would literally turn the Tokyo servers on and off throughout the day depending on who was awake around the world. Today, fast forward, we're in over 350 cities worldwide. We're in over a thousand data centers worldwide. The minimum deployment is a rack of servers in some places, and in others we'll have hundreds of racks of servers, just depending on what's needed there. That was a huge focus behind the scenes, how do you figure out how to get into all of these places around the world. It's a series of stories of how did we create enough value to the ISPs around the world, the internet providers for consumers, that they would invite us to be into their buildings. I remember Telecom Pakistan was this incredibly difficult organization to work with. There's a lot of people in Pakistan, so there was a lot of traffic coming from it. It was all hitting our Frankfurt data center. I kept saying we should put servers in Pakistan, and our team kept saying, 'You don't understand. They're incredibly difficult. They've kicked Facebook out. They've kicked YouTube out. They've kicked Akamai out. They're never going to let us in.' Then out of the blue one day, we get an email from the guy who's the head of networks at Telecom Pakistan and he says, 'Hey, is there any way that we can get Cloudflare gear into our network and into our system?' I went to the email and I was like, 'I thought you said these guys were difficult.' So we got the guy who ran networks on the phone and I was like, 'Oh, we heard you were kind of difficult. Why do you want us there?' And he said, 'I'm a huge cricket fan. And the Pakistani national cricket team is a Cloudflare customer. They were a free customer. And I'm sick of the latency of backhauling the traffic to Frankfurt. So send us servers and we'll install them in our network.' So the secret to Cloudflare's success has always been how do we provide a huge number of services for free to a bunch of people, and then it ends up being that there's somebody in that group which is really important. We do other things as well. If you type in www.amazon.com, it turns out that Amazon gets to choose where www points. Verisign, which runs .com, gets to choose where amazon.com points. The question is who gets to decide where .com points? The answer is there are these 13 root servers that are out there that underly the internet. When I say a server, people picture a single box, but in these cases, they're often thousands of machines sitting behind this. They're run by organizations that you'd be sort of surprised by. USC has one, the University of Maryland has one, NASA has one. The reason there are 13 is because that's the amount that you can stick in a standard packet. So there will never be a 14th root server, and the organizations that run them will probably never change as well because this has become an incredibly political topic. China wants one, Russia wants one. So as a result, the University of Maryland will probably continue to run it even though, you know, why the University of Maryland? We provide the infrastructure for two of the 13 root servers. We don't run the root servers themselves, but they are on our network. That's incredibly important because anytime you send an email, anytime you click on a link, anytime you use an app on your phone, the very first thing that happens is a request to one of these root servers. We provide those services for free for two of the 13. We've been asked to do it for more, but we think two is sufficient. That's one of the things that when we go to an ISP anywhere in the world, we say, 'Hey, would you like one of the root servers to be running inside your network?' And they're like, 'Absolutely, that'll improve everything.' And in the process of getting that in, that then helps us all of the other services that we provide run on that same infrastructure. Because we've done the hard work to make it so that every service at Cloudflare can run on any one of our servers, when we can get into these places, it means that we have a really privileged access to the fundamental core of how the internet works.

No, I think networks inherently have network effects. As we have gotten bigger, our rate of growth of who uses us has continued to accelerate. There are multiple different network effects that are stacking on top of each other. One of them is we provide a VPN service and one of the most popular DNS services in the world, 1.1.1.1. Everyone who uses one of those things is inherently going to get access to everything else on Cloudflare a little bit faster. So as more people use one side of our network, it just makes the other side of our network much more valuable. And as more people use the other side of our network, it makes the other side of the network more valuable. Those things are very much compounding. Going forward, as we think about what the future business model of the internet is going to look like, I think that's going to be another place where it's going to make it incredibly compelling for as many people as possible to be on our network. It takes about 5 minutes to sign up for Cloudflare's basic services. It takes about 10 seconds to leave. While I think that there are things that are always driving the value behind Cloudflare, we have to constantly live up to providing that value. Otherwise, our customers aren't locked in in any way. If we're not providing service, if we're not creating value, the whole thing could go away very quickly.

And that's another one of the network effects that we have. We act almost like an immune system. An attack against any one of our customers benefits all of the customers that are out there. The story that Michelle, my co-founder, wouldn't want me to tell because it's a little blue, I guess, was that early on we used to have a bell that would go off anytime anyone signed up for Cloudflare. The bell went off and we all would run back to our laptops to see who had signed up. This was back in 2010 or maybe early 2011. I remember my eyes got wide and I blushed because it was a Turkish prostitution website that had signed up. I was like, 'Oh, okay. I guess we need an employee handbook or somebody to say there might be some colorful things that sign up for Cloudflare.' But then what happened next is the bell went off again and it was another Turkish prostitution site, and then another one, and by the end of the first week, over a thousand Turkish prostitution sites had signed up for Cloudflare. It was really strange because we didn't have a sales team. We hadn't marketed. We hadn't translated the website into Turkish. It wasn't like there were a bunch of Bulgarian escort sites signing up. For whatever reason, it was Turkish. Curiosity got the better of us, so we contacted one of the webmasters. We set up a Skype call with him. He was effusively thankful for Cloudflare. He said, 'You might not know this about Turkey, but as you go further west in Turkey, it's very European. They don't love what we do, but they kind of tolerate it. But as you go further east, it becomes a much more conservative, much more Muslim country. They think what we're doing is the epitome of evil. When someone read TechCrunch, they heard about you. We signed up. We are always getting these attacks, we assume, from sort of Muslim fundamentalist Eastern Turkish people. You protected us from this. By the way, there's not a lot of money in Turkish escort, so we're using the free version of your service. Thank you very much.' We have machine learning systems that will categorize attacks. We labeled this style of attacks the TE, which stood for Turkish Escort attacks. Anytime we'd see the TE attacks coming. Fast forward a year later, I was in our office late on a Thursday or Friday afternoon. The phone rings and it's a Dutch gentleman. He's calling from Baku, Azerbaijan. He says, 'The contest is tomorrow. We're completely offline. Everyone has told us you're the only ones who can help.' I was like, 'What contest?' I grew up in Park City, Utah. I hadn't traveled out of the country until college. I wasn't very familiar with things that happen around the rest of the world. So when he said Eurovision, I said, 'What's that?' He's like, 'No, it's a really big deal.' I was like, 'A song contest? Like it's American Idol with nationalism. Whatever. Just sign up for the service.' He's like, 'No, no, we need help.' What had happened was in the finals of Eurovision, one of the six contestants was transgender. Baku is a very relatively conservative Muslim country. Some people thought this was incredibly offensive that this was happening there, so they launched pretty significant attacks against them and knocked them offline. I came in the next morning and we had a bunch of French engineers. Their eyes were like saucers. They're like, 'Do you know who signed up last night?' I'm like, 'Oh yeah, that song contest.' They're like, 'No, no, you don't understand what a big deal it is.' For those of you who are also ignorant Americans in the audience, Eurovision gets more viewers than the Super Bowl. It's American Idol with nationalism. It's crazy. We protected them. We looked at the attacks and the system is identifying them and it goes TE. Exact same pattern, exact same attacker. Fast forward a year after that, I get a frantic call from the CTO of JP Morgan. He's like, 'We're under attack. They're taking offline a bunch of our consumer-facing services. We've heard you guys are really good at this. You need to bring your best solutions engineers and best salespeople and be in New York first thing Monday morning.' We didn't have salespeople. Our one network guy didn't own a suit. So we bought him a suit over the weekend and we all fly out Sunday night. We're in the JP Morgan offices first thing at 6:00 AM on Monday morning. They have this whole war room where they're dealing with this. They slide this stack of logs across the table. This guy on our team, his name's Sharif, he looks at it and goes, 'Oh, we know these guys. It's the Turkish Escort attackers.' What it turns out is it actually wasn't anyone in Turkey. It was originally a student in Iran who saw what was happening in Turkey and thought it was repugnant. He launched attacks against them, then saw the Eurovision contest, launched attacks against them. That got him recognized and he actually got brought into the Iranian military apparatus, the forward cyber offensive capabilities. At which point they attacked a bunch of US banks, which is how they came after this. The same guy to this day is running all of Iranian cyber attacks. When you see all of the things where they were creating the sort of Lego-style movies, it's this one guy who started out as attacking Turkish escorts. That shows the power of Cloudflare serving everyone helps us learn from even these weird corners of the internet. As a result, today almost every major financial institution in the world, almost every government, relies on us in order to stay safe online.

Yeah. And Michelle will be mortified. She's like, 'You need to stop.' It was funny. Allen and Company, the big investment bank, invited me to one of their conferences they do in Arizona. I told this story and I haven't been invited back since. So anyway, there you go.

No, no. It was interesting. I remember a VC early on said, 'Okay, you guys have gotten really popular, but how are you going to expand outside of the Bay Area?' I remember saying, and the person was just completely incredulous, I was like, 'We're really big in Tunisia, but we don't have anyone in the Bay Area.' It turned out that wherever the internet was slow, wherever it was more lawless, those were the places that we initially got most of our traffic. It actually took a really long time for us to win the tech natives, the YC crowd, the folks that would be what you would think would be our natural audience. Whereas if you went to Congo, 50% of the top hundred local websites in Congo were using Cloudflare because the further you were away from the tech epicenters, the more valuable what we provided was.

No one playbook. I say this to people and sometimes it frustrates them, but it wasn't like we wrote grand strategy memos on why we built a developer platform. We built it because we needed it. But that then turned out to be incredibly valuable in defining what Cloudflare is going forward. At some level, the story of Cloudflare has always been create these really thorny hard technical problems, solve them for ourselves, and in the process, that builds what it is that really drives the business going forward.

Yeah, I think first of all, we ended up getting to work with some incredible investors over time. Carl Ledbetter, Scott Sandell, Brad Burnham at USV. They really matched our style. Our style tended to be we thought of venture capitalists primarily as sources of money. Mostly, we wanted when we needed money, we wanted to be able to access capital with no thought leadership. We really just weren't like we didn't need help hiring. We didn't really want to buddy. We wanted people who would push us from time to time, would say, 'Hey, have you thought about what's over the horizon?' But weren't in our business being like, 'Well, I think you should price it at $22.99, not $21.99.' We know our business better than anyone else. So if you believe in us, do that and get out of the way. We saw lots of other varieties of that, people who really wanted to be kind of operators. I think there's not one way of doing this. For some founders, that's incredibly valuable to them and they want that. We talked to almost everyone that was out there. There were lots of people that just thought we were complete idiots. A guy at, like, a bunch of people at Accel Capital, like Santi and Gordon, who I love, but there was one guy who was just like, 'You're an idiot and we're never going to invest in you.' I get it. We kind of were. But that's okay because we found people who did believe in us and have done incredibly well coming along the journey with us. It made sense. But we were an odd company. If you look at the three of us that founded it, most companies get founded by people who are friends with each other. Michelle, Lee, and I, we were not friends. It wasn't that we were enemies. I think we had a ton of respect for each other, but we were just radically different people. To this day, Michelle has a giant pink piano in her living room. Her idea of a good time is at night to sit down with her kids, she plays piano, her husband plays guitar, and the kids sing along. That sounds like the lowest circle of hell to me. But we've obviously become friends over time because we built this together, but we were radically different as people. Some investors when they looked at us were like, 'How does this motley crew fit together?' But what was powerful was because we were so different. The way Michelle describes it is when you're starting a company, you want it to be like a Venn diagram where you've got big circles and they have just enough overlap that you can still communicate with the other people, but your lanes are incredibly clearly defined. In the 16, now almost 17 years that we've been at this, Michelle and I have never really had a fight. Because fundamentally, what I do and what she does are just in our own lanes and we can succeed in those lanes. Even though I am good at some things, she is good at a completely different set of things. That really drives a lot of what I think has caused us to be successful over time. We now get founders that are coming to us for advice all the time. One of the most common questions we get is, 'How did you guys split up responsibilities?' It depends on how snarky a mood I'm in. But if you're asking that question, it probably means you have the wrong co-founders. Because fundamentally, what you want is to cover as much surface area as possible and for each person to have a very distinct lane. In our case, Lee was the technical genius that was heads down writing code. He didn't want to be on the board, didn't want to meet with investors. But an absolute technical genius. Michelle was the operations person who would take a thing that worked once and figure out how to scale it to a million times. She ended up running a lot of our go-to-market organization, those things that you need to have real process and scale. And I'm a good storyteller. In the case of the VC thing, when Vinod Khosla was thinking of investing in us, I'm doing most of the talking because I'm the good storyteller. Michelle is thinking about, she was literally a Six Sigma Black Belt, she's a process person and she's incredibly good at that. I'm terrible at that. Lee's like, 'Why am I at this dinner? I could be having so many more productive things going on if I was just back writing code.' I don't blame people for saying, if you're pattern matching off, everyone's got to be a good storyteller. That wasn't what we were. But I actually think there's real strength in that because you want different people with different perspectives and different skills. That's part of why we were such a strong founding team.