Cloudflare's Michelle Zatlyn | Cyber Stewards

Thanks so much for having me. I'm so honored to be here. I used to come to conversations like this, I still do, and I learn so much from them every single time. And so I hope I can be helpful to some of your portfolio companies today. So it's great to see you. Thanks so much for having me and for all those warm, kind words.

Yeah, that's a big question. We could spend a lot of time talking about that, but I've gotten better at answering this question over the years. I make a joke about that because there's a lot of founders who might be working on big ideas, and sometimes it's hard to concisely consolidate and articulate what you're doing. And so I guess I make a joke because I've come a long way. So at the end of the day, we make anything connected to the internet—and when I mean anything, I really mean anything connected to the internet—faster, safer, and more reliable. So we do cybersecurity, performance, and reliability for anything connected online. And it's interesting, when I first started Cloudflare—we're about 11 years old as a company—it didn't quite start with that sort of pitch. It was a little bit of, 'Hey, we're helping democratize tools previously reserved for the giants. We're going to supercharge your website.' Oh, hey, I'm building a cybersecurity, performance, and reliability company. And I sometimes go to dinner parties—which we haven't been doing very much recently, but when we used to get together—and people kind of look the other way. They're like, 'That's so boring.' But 11 years in, we have over 27 million internet properties using our service, which is a lot. It's about 20% of the web connects to the internet through Cloudflare. That's a huge responsibility, a huge privilege. Big responsibility. Every day we stop, as you said, over 70 billion—with a B—cyber attacks coming to our customers' applications, workloads, websites. I mean, that's just an astonishing number. And it gets stopped because of technology, our teams of amazing engineers and product managers, of what they've built. We help make everything faster around the world. Everyone, all the legitimate users trying to go to our customer sites, faster, safer, and more reliable. And we add reliability in. And it turns out now that we've kind of gained the scale and people understand better what some of these things mean, all of a sudden people don't run away from me at dinner parties anymore. They're like, 'That's cool. Tell me more. How do you do it? And I didn't realize there were so many cyber attacks online. Why are people doing it? Who throws them? Why is it so hard? Why sometimes I go to some places online it's so fast and others it's really slow? And you know, why sometimes I can't get to where I'm going—the reliability side.' And so it's been really amazing to help build this backbone of the internet, the infrastructure, the roads, the bridges that kind of make everything work. And you kind of take bridges and roads for granted in cities, but when they don't work, it's really frustrating. I feel like we do that in the digital space. And just, you know, the last thing I'll say here—and I'm happy to go in any direction you want—is just 11 years ago when we started to build Cloudflare, it wasn't obvious exactly what we saw. We saw it. We saw the rise of cloud computing. So we were business school students when we started to work on Cloudflare. And AWS at the time, the dialogue, there was a lot of headlines in media saying, 'Is AWS a fad or not?' Like, a lot of people said real organizations will never use AWS for their workloads. Well, you turn out how wrong that ended up being. And so, but we saw storage and compute going to the cloud. We saw applications. We saw companies like Salesforce, even Workday, growing really quickly ahead of us. We kind of said, 'Well, if storage and compute are going to the cloud and applications are going to the cloud, the networking side—again, all the things that make the roads and the bridges—also will have to go to the cloud.' And that's what Cloudflare has built. We've built a globally distributed network that's a cloud-based service that makes anything faster, safer, and more reliable that used to be done by hardware boxes and software. So there you go.

I was at business school. I was doing my MBA at Harvard Business School. So I'm Canadian. I grew up in Canada. I'm proudly Canadian. I grew up in a province called Saskatchewan, which is kind of the prairie province of Canada, so maybe some of the middle of America equivalents. And there was not a lot of technology influences in my life where I grew up. I had a great—I come from a really close family. And in my family, my parents were very much, 'You have to study hard, you have to get good grades, and you can do anything you want in your life, but you can't go to university in the province. You have to leave. You have to go see more of the world. You can always come back. You have to go see more of the world.' And so I was lucky. My parents aren't tech entrepreneurs. I was talking to a woman this morning where both her parents were computer scientists. Like, that's just not—my family has a farming background. My dad's a lawyer. My mom was a teacher. Anyhow, long story short, I ended up going to college outside of the province. I went to McGill in Montreal. And what I tell this story because like basically my eyes got opened to a lot more of how big the world was. All of a sudden I went from a small city and a very underpopulated province to a much bigger platform within Canada. And all of a sudden there's all these kids from Toronto, Montreal there, and they were really smart, by the way. And I was like, 'Well, all of a sudden my good enough wasn't good enough.' So I had to stand up straighter. And I was competitive. I was used to being top of my class. I wanted to keep that. And I just kind of realized, 'Wow, the world's a lot bigger. It's a lot more competitive.' And I kind of got a taste of what else is there. So I got really hungry, wanted to learn, 'How else can I make an impact? Where else can I?' You just kind of go on this learning journey. Anyway, it brought me—ended up doing my MBA at Harvard Business School. And that was a whole another eye-opening of I thought I had kind of seen the top in Canada, and then I came to the US—much bigger country, much more competitive, very global program—and I just realized, 'My God, the world is a much bigger place than I realize, and I really want to make a dent in it.' And so I was at business school, I was pursuing, and I was really looking, 'What do I want to do after? I want to do something impactful.' And Harvard Business School is in Boston, so we were in Boston, and it was the first year the professors led a trip to Silicon Valley. And I signed up for it. And so we came to the valley in January of 2009 with a professor, a couple professors, and they introduced us. We met venture capitalists like you, Holly, and your partners. And we met early-stage entrepreneurs. We met late-stage entrepreneurs. Back in January '09, like I remember Mark Pincus was the big deal. He was a Harvard grad. Meeting him was like a big deal. So I was out here, and it really opened my eyes. You'd read about the Silicon Valley, but here I was spending a week here. And it was Wednesday, and we were down in Plug and Play in Sunnyvale—some folks listening might know that, you maybe even started your company there—and it was three early-stage founders who'd been going through their ideas. And again, here I was a student doing my MBA, and I saw these entrepreneurs up close and personal. And I walked out of the room and I said to another classmate on the trip, 'If that person could start a company, so could I.' And I don't mean it in a mean way. I meant it. And it kind of demystified—like, that person's not smarter than me or better than me. Like, I could do this. And it was really empowering. And to what was the best answer ever, Matthew Prince—it happened to be Matthew Prince—was like, 'Of course you could, Michelle.' And we literally in the hallway there started to exchange an idea. And this is how the conversation went: Matthew and I knew each other from class for a year and a half, and he's like, 'Of course you could, Michelle. Of course you start a company.' He's like, 'And I know there is something there with Project Honeypot.' And I said, 'Matthew, you always talk about Project Honeypot. What is it?' He's like, 'It's a community-based project I started. It's been around for six years, and we help track web spammers online.' I was like, 'How do you do that?' He's like, 'Well, small business owners sign up, they put honeypots on their website, and we track bad behavior.' And I said, 'Okay, what do the website owners get?' He's like, 'Karma points.' I'm like, 'Karma points? Yeah, we're tracking the bad guys.' I was like, 'Yeah, okay, so karma points. Okay, what do you do with the data?' He's like, 'Well, the data comes back to Project Honeypot. We go work with law enforcement agencies to take the bad offenders down.' And I said, 'Doesn't that take a long time?' He's like, 'Yes, years.' And I was like, 'Matthew, I just—why does anyone—and by the way, 80,000 small businesses had signed up for this thing—and I said, 'Why does anyone sign up for Project Honeypot?' I just couldn't understand. I did not have a big background in this. I didn't really understand the problem set. At this point, he got annoyed at me. He kind of put his hands up, 'Michelle, one day we'll use the security data to create a service that actually stops these things.' And that was the aha. That is what turns—like, that was the light bulb going off in the hallway. And the rest is kind of history. Where we started to work on this idea, it turned out that anything going online needs some cybersecurity protection, needs some sort of global—needs some sort of reliability. You need to build the infrastructure. And we were just three really smart, passionate people saying, 'I think we can do this.' And that's how I kind of took a very windy career path to get to where I am. But like, what you can accomplish with a group of smart people, the impact you can have in the world—it has all the ingredients of what I wanted on this huge global scale. And it's so rewarding. And I feel really lucky to get to do what I do.

So fast forward today, we're 2,200 people. We're publicly traded. We're on the New York Stock Exchange. We did over 600 million in revenue last year, growing 50%. So that's kind of where we are today. But when you start, you only hear about the failure. By the way, like it's most—all the data is like most companies fail, they don't succeed. And so we have always been a very big, ambitious team and an idea which is so amazing. But when you start, your question was like what was the reception like? It depends who I talk to. There are some people who loved it. Their eyes lit up that we were so big and ambitious, and they were like, 'I want to be a part of it.' But for every one of those conversations, I had nine conversations of like, 'I don't get what you're talking about. Who—like, are you an expert in this? Or are any of you an expert? Doesn't this already exist? Why—you're going to get crushed. And here are all the reasons it won't work.' And I just kind of share that story because I'm—there's a lot of founders listening or even early team members of early-stage companies, and the conviction you have to have to lean into an idea—it's not like it's obvious. If it was obvious, everyone would be doing it. It's really—of course, some people you talk to, it's obvious to, and they get really excited. And that's the thrill. Then like, 'Oh my God, you get it. Let's do this together. Come work with us. Come partner with us.' But there was a lot of people who wrote us off as, 'This is never going to work. This is crazy. You're for sure going to fail.' And I think that it doesn't feel good, but I almost think that's a sign of onto something really big that not everyone agrees with. If everyone agrees with it, it's probably—you can understand all the—I mentioned a little bit too—better. It's almost too clever by half, is maybe what I'm trying to say. So that was the original. But for us, we kind of got the first employees through our networks. There was somebody who was doing their PhD at University of Santa Cruz, and his adviser left. And he was doing a PhD in analytics. And turns out, if you're going to power a big portion of the internet, data is a big deal. You need analytics. You need someone who can handle all that. And so his adviser had just been recruited away to Google. And being a PhD student without an adviser is not a good place to be. And so we used that to say, 'Come, put what you're studying to use.' And he said, 'Okay, I'll go see where this leads.' I mean, that was the first person we recruited. The second person was a FreeBSD systems engineer, C programmer, because again, when you're going to build a global network that does all these things, you need to write a lot of low-level code. And we found this person on LinkedIn, and he was employed as a web developer at another cybersecurity company. And we kind of said, 'You seem like you're in the wrong job.' And he was—he's like, 'I'm only a web developer because of my visa status. It's the only way I get a visa. I'm a French engineer. I want to stay here.' And so when we told him, 'Hey, you can write C code, and we're trying to help make anything connected to the internet faster, safer, more reliable,' he's like, 'Oh my God, I'd love to be a part of that.' And that was kind of what—those people were so excited to lean in and join the team and build and come to work every day to do this. Don't get me wrong, I talked to a lot of people who said, 'I don't understand what you're doing,' or 'Come talk to me when you have a hundred million dollars in revenue,' which took many years, by the way. But that's a little bit of what we experienced early on. And I don't know—again, I think that's really a sign of you're onto something really big when not every single person gets it, but there's some people who did get it. And then just on the investor front, which is obviously always top of mind for founders, I guess my point of view is the following, or things that I've learned over the years, is that there's kind of two ways to raise money early on: you either raise on traction or you raise on a story. And Cloudflare was very much in the latter camp. We did not have revenue very early. Revenue took a long time. And so we really had to raise money on a story. So the idea that we had this big, audacious goal, we kept making progress, we showed progress, but it wasn't money—the progress was not monetary, it was other progress. And that was the way that we were able to end up raising some initial money, and then over time more money. And again, eventually the revenue came, but that was not what drove investors early on. And having met many investors in my career at this point, I think you want to pick ones that align with what you're trying to do and being honest about it. And I think that we were really lucky doing that at Cloudflare.

Yeah, for sure. Well, let me start by saying you ask 10 smart people this question, you will get 10 different answers. So there's lots of ways to be successful in life. So let me just start with that. There's lots of ways to build a successful company. I think that like my point of view on this will be literally different than some other very successful entrepreneur's point of view, because again, I think that there's multiple ways to do things. But for us, and we felt like this very early on, that at the end of the day, you have nothing without a great team. Like, so we really took getting great people to join our team incredibly seriously. And by that I meant like it was Matthew's part of—Matthew, Lee, and my job. We spent a lot of time involved in the recruiting early on. And as I kind of reflect back, I think part of it was because we did not have a track record. And so I think you have to—for the audience listening—you have to be honest with yourself: do you have a track record? We were post-MBA students who showed up in the Silicon Valley with very weak networks here. That was like the promise of Silicon Valley, right? Come here, you can be anybody and show up here and have a chance to build something big. But you're competing with Facebooks and the Googles who have a network, or even, you know, all the Greylock—all of you have a network. Like, you call somebody, they answer your call. I call someone back 11 years ago, they're like, 'Who are you? Like, I've never heard of you before.' And so I think early on we didn't have as much of a track record. I think if I started another company today, it'd be different. Like, I have a track record, I have a network, it would be different today. But back then we didn't. And so for the founders listening who don't have a big network or track record, I think one of the strategies we ended up employing that worked really well is that we were really involved. And so what I mean by that is like we reached out to people, we got on the phone with them, we did the phone screens. And I will tell you, it sets you apart than if you're talking to a recruiter at another startup. Like, it's just—if you're a candidate, an engineer, and you're talking to the founder of one company who's so passionate about what you do—and most founders are really passionate about what they're doing, otherwise they have such conviction and passion they wouldn't be doing it—versus a recruiter at another startup, it just gives you a different sort of dynamic that again, you have to have the right job, has to align, but it keeps you in the conversation. So now you can try and tilt the risk-reward in your favor. So that's one thing. We were very involved. Fast forward today, again, 2,200 people at Cloudflare, Matthew and I still each spend 20% of our time recruiting. 20% of our time—that's two hours a day or a day a week—so much time. And all of our hiring managers spend a lot of time. Like, at first it was us, but then what we ended up doing, pivoting, just like how this evolved over time, was of course we have a recruiting team, they're amazing, but they partner with the hiring managers to get great people to join Cloudflare. But it's the hiring manager that's responsible for hiring their team. They run the process, they partner with the recruiter, but it's—someone's coming to work for you and your team, you have to be involved. And it's interesting, we have over time—we've had a lot of senior executives join our team, and that's not how most companies run their recruiting. Most companies just don't—they outsource it to external recruiters or recruiting teams. And I've had several senior executives tell me over time, 'I was not a believer of this model, but now I am, because the retention ends up being a lot higher. People join, there's a lot more alignment and fit, and they stay a lot longer.' And so it's been, I think, a good thing. So that's one thing that we did that I think maybe will resonate with the audience—or two things, I guess, depending on how you count it. The other point I'll just bring up—and again, this was—we were back to our no one knew us—I think that early on, it's how do you get awareness about what you're doing? You think, 'I'm going to hire a PR firm and they're going to do some marketing for you or some PR,' but like, the journalists want to write stories about early-stage companies because most don't stick around. So it's hard. There's niches and there's things to do. And so it was like, how do you build an audience and awareness without spending a lot of marketing dollars? Because we did not have a lot of money early on. And one of the things that worked really well for us that I'm going to share with the audience that has ended up helping with this talent/people side is we started to write a lot. We built an audience. And what I mean by that is we literally wrote a corporate blog. And if you go to cloudflare.com/blog today, it's a very well-read blog. It's in fact gets more views than like a lot of media properties. And we don't advertise on it. But the point is, is we started to blog about technical problems we were having. And by technical problems, I literally—we had engineers saying, 'Here's the code that I'm using,' and people would like in the comments help us decipher the problem with the code. Like, it would be really like kind of very—we wouldn't do that now, but back then, you're a startup, you can do these things, you can have a personality. And it turned out that there are developers around the world, there's engineers around the world that were reading about this. And we started to build—and then they love to read our technical blog, and then they would apply to work at Cloudflare. And so all of a sudden, when someone's applying to work for your startup or your company, it changes the dynamics versus you reaching out to them. It's just—it's a different thing. They've expressed interest, and so then it's about lining up the fit and making sure expectations are right versus trying to convince someone to even learn about your company to come and learn about the role. And so we, for a long time—not anymore, but for a long time—50% of the people we hired applied through our website to work at Cloudflare. And that's how we ended up hiring them. And I remember when I have shared that with other founders, they're like, 'I don't even read our resumes that come through our website because that's never good quality.' And I think that that can become, again, a strategy you can use to help go find the right people, because the world is a big place. If you put out good content, people can help find you. Now, on the flip side, we were lucky. Matthew, my business partner, is a great writer. Our employee number 20 at Cloudflare ended up being our CTO. He's a very good technical writer. We had some very early teammates who were very good writers, and then it attracted more great writers. I've met some companies who like, 'I want to replicate the Cloudflare blog,' and they give it to their marketing team. And I'm like, 'Our blog is not run by our marketing team.' And they're like, 'What do you mean?' Like, 'Our blog is actually run by our—and they're like, 'That doesn't make any sense. The engineers surely aren't writing it.' I'm like, 'They kind of are. We have editors and we help, but like, it is by the team for the team.' It is. And so I think you kind of also have to know who you are, I guess, if you're going to take that strategy. I think it worked for us because it was really core to who some of the skill sets we had. So those are just some things that come to mind.

You know, one thing you said was traction early, so I just want to say a part of that and then I'll go through the milestones, because this is something that I try and share insights that maybe you don't always hear. Because again, I'm sure folks that are listening listen to others too, and I feel like there's some common advice you hear over and over again, and there's some things that I'm like, 'Why didn't anyone ever tell me this?' Because as soon as I learned it, I was like, 'I wish someone had told me this.' This is one of the things that I'd love to—you used the word traction early on. It's true, we did have traction early on, but it wasn't revenue traction. And I make that point in an important way because what I think is interesting as founders or leaders at early companies is you get to pick the metrics that you measure traction on. And it doesn't necessarily have to be revenue. Of course, revenue is the best one, but if you don't have it, pick other metrics that move quickly, because that's one way to help demonstrate traction. Of course, you have to—they have to be legitimate to your business. And so early on when we were setting up Cloudflare, we had a slide that opened every single board meeting. It was the exact same five metrics that we got to pick. And those metrics we picked on ones that would change quickly, because we wanted to demonstrate traction. And I think that you have a lot of decision on how to frame your business. And the ones early on were examples of how many customers were using Cloudflare, but customers move slowly, right? It's linear—one customer to one customer to one customer. And so that's not a very fast-moving metric usually. Sometimes it is if you're like Clubhouse. But the other metric that we ended up using was the number of page views that were touching our network. Because again, we were showing that we were trying to make things faster, safer, and more reliable. And so customers, you go one by one, but customers come with different amounts of traffic to the web applications or websites that they had. And that metric grew really quickly, because it was like if one customer had a, call it, website with 100 visitors, and then another customer showed up and their app got 100,000 pieces of traffic, all of a sudden that metric looked like it was growing. And it was an appropriate metric for us, because we had to make sure we could service that traffic, and that was really critical. And so—and we had three others, but that's an example of no one told us to pick that metric. We picked it to help demonstrate the progress we were making and the traction, because we knew revenue was going to be a lagging indicator in our business. And so I share that because I think for four years we used these same set of metrics, and at some point we started to have real legitimate revenue, and then revenue became one of them. It was actually revenue per employee, because we wanted to show how the leverage in our business. But like, that was just something I wanted to share so on the traction side, because I think that might be helpful to some folks. So some of my favorite moments—I mean, there's so many. I mean, there's no better feeling of shipping a product that customers love. Like, solving and talking to a customer and then being like, 'I love your service. Like, you literally have saved our bacon.' Or, you know, meeting people in person—like, sometimes I've had people have hugged us saying, like, 'I literally sleep better at night knowing you're in front of my infrastructure.' It's moments like that, then like, what we do matters. Kind of back to why did I start this? I want to do something that mattered. I want to make a dent in the universe. Like, I love that. And it's not me—it's never me—it's the collection of people at Cloudflare who get up every single day to build these things and to work really hard to put our best foot forward. I always played sports. I love being on a team. I love the team aspect. And I think as a leader in a growing tech company, you can have those same sort of aspects at work. And I love that. By the way, I've had a lot of jobs where that's not the case. So it's not—that's not a given. But you can create that sort of environment. And I think that those are some of my favorite moments. When we took our company public, I was so proud. How many people start companies and take them public? Very few. At the time, we were the 210th tech company to go public on the New York Stock Exchange in 10 years. And I remember going to meet all these public market investors. You're trying to get them to become shareholders in your company. By the way, if you raise money once, you're going to raise money many times. I've at this point raised over 1.5—what is it—billion dollars. It's a lot of money. Like, I've raised a lot of money between private and public shareholders. So if you don't like fundraising, you just learn to get good at it, because it doesn't go away. It's not going to go away. You might as well just learn the skill now. You'll save yourself a lot of headaches. But I just remember sitting in one of the public market investors' offices in New York before the pandemic—we did this stuff in person. It was interesting. You kind of think of—I mean...

I really like our venture capitalists, they're always rooting for our success, but I always kind of thought of public market investors as a bit, we don't care about what you're doing, I just want shareholder returns. That's kind of what my model of them was. And so we're meeting these investors in New York and they literally, the managing director looked at Matthew and I and he said to us, looked us like straight in the eye, so it'd be like staring me, and they're very intense people. And he was just like, you two should be very proud of what you've built because founders never get to the seat. And I was kind of like, laughed, and he's like, no, you're serious, I'm taking this really seriously. And I was like, you know what, it really was nice of him to say that. Like I kind of was like, I am proud. And so when we went public, we had 150 people at our team come to New York. There were current team members, we had former team members, we had our board, we had our families, because it turns out it takes a village to build a company, both at the company and outside of the company. And then we had celebrations in different cities. And I just remember looking out at the sea of people on the floor of the New York Stock Exchange and I was just like, this was such a proud moment for all 1,100 people. And I kind of had this moment of, we would not be here without every single person showing up and caring and putting their best foot forward every day. Like whether you were on the administrative staff or customer support, every single person did something that allowed us to get to this point. And that just was like a really amazing moment to celebrate as a leader. Like I just was like, it was definitely one of those proud moments where I was like, wow.

And then when the world needs you most, it turns out the internet often plays a role. And so in the last few years, you think of COVID as a public health pandemic, which it was, we all went through that. But when you couldn't see people in person, everyone shifted to online. They all used online to connect and to do things. So what has been less reported is basically overnight the traffic online doubled. And when you were a service like Cloudflare providing the infrastructure, it doubling in a two-week period was insane. And so it wasn't just us, it was all the cloud companies. I kind of look back and think how many network administrators, it engineers held the internet together when the world kind of needed it most. And sometimes I think like if COVID had happened 10 years ago, it would have been way rougher because we wouldn't have been able to stay connected in other ways. And not that it was easy, but I feel like people could connect to loved ones through video conferencing and whatnot. And 10 years ago, I really don't think it would have happened. And so that was something where it was just a moment where I'm like, I kept reading the news and be like, the world is a terrible place and like your friends are getting sick, your family's getting sick, it's so hard, you're taking care of your kids. It was like a very stressful time. But I would go to work, I almost escaped reality by going to work because the stuff we were doing mattered so much for people. And like that is a really good feeling if you can create that, or for me it was a really good feeling. And then I can keep going on the vaccine distribution, all those sites distributing the vaccine, they knocked it over, turns out infrastructure can help. So we had something protecting all of them. I mean we literally have videos of people whose jobs are to get vaccine distribution being like, thank you for saving lives. And I don't know, it makes you weather the bad days because there's of course bad days, I'm talking about all the good stuff, but it is a lot of proud moments over the course of my 11-year career at Cloudflare.