Google is the hero of the last 30 years of the internet. They financed the entire thing. The problem is that AI breaks that. 18 months ago, it was 20 times harder to get traffic from Google than it was 10 years ago. Now it's 50 times harder. It's 3,500 times harder to get traffic from OpenAI than the Google of old. Why did Sam and Elon start OpenAI? Because they were terrified that Google was going to run away with the whole game. Everything is started effectively as a counterweight to Google. And that's the puzzle.
That's Cloudflare CEO Matthew Prince speaking to me live on stage at South by Southwest in Austin, Texas in mid-March. Cloudflare helps facilitate more than 20% of all online traffic, which gives Matthew unique perspective about how AI is changing the internet and the motivations of the major tech platforms. He also shares his real-time experience on the front lines of cyber war with Iran. This is Matthew's second appearance on the show and he doesn't disappoint. So, let's get to it. I'm Bob Safian and this is Rapid Response.
You were on my show six months ago and since that time so much has changed. You talked about how the number of new websites has grown dramatically.
After plateauing for a really long time, actually declining for a little bit, we're now seeing the fastest creation of new websites that has happened in the entire history of the web.
We have the amount of bot traffic has gone from about 20% of all traffic to trending to 50%.
It'll be over half of internet traffic is generated by bots. And the business model of the future is unclear.
You gave this example about how even Walmart, Amazon and Target have wildly different business models, right? Wildly different approaches.
Walmart has said agents are welcome, come one, come all. Amazon is literally suing companies and it was just successful in a motion against Perplexity saying you are not, if you're an agent, allowed to shop on Amazon.com. Two of the smartest retailers in the world have wildly divergent strategies. That's so rare that that happens. And I think it just shows how uncertain everyone is about what the future's going to look like.
To add to all of this, we now have a conflict in the Middle East. And I wanted to ask you about this because I remember when you talked to me, you said, and I'm going to quote this, Cloudflare goes to war every day with Iranian hackers, Russian hackers, and North Koreans. Now, what is the status of that now with the conflict going on?
It was interesting. We sometimes see things we can't explain them, but on February 27th, the attacks coming out of Iran, from Iran targeting the west, increased 7x off baseline. So there's always sort of background and then on February 27th massive spike. Why? We're not sure. Did they get advanced warning that on the 28th the US was going to start bombing? Was it just coincidence? We're not sure, but we did see that massive spike.
Usually in kinetic conflicts, so what we saw Russia, Ukraine, we saw Israel, Hamas, cyber proceeds and then stays elevated through the entire time of when there's a physical war going on and then often lasts slightly after whenever sort of peace is declared. In this case it was different. So we saw a massive spike on the 27th and on the 28th it dropped down to less than 10% of baseline.
Less than 10% of what it had been before.
Before. We think that what had happened was that the US and Israeli strikes were so effective at disrupting command and control inside of Iran that even the hackers were sort of like, we're not sure what to do. Now that's coming back. We've seen a dramatic uptick in Iranian attacks. Striker, a big Michigan-based corporation, got completely compromised, looks like by Iranians. I think you're going to see a lot more of that because it is one of the things when you have sort of these asymmetric conflicts where you have a very powerful nation taking on a much weaker nation. Cyber is one of the ways that they can strike back.
I also think that we'll see a lot of other nation states that don't necessarily want to get blamed for cyber attacks. Russia is the largest offender of this. Russia is extremely vulnerable to cyber attacks themselves. And so I would have predicted that after the Russian Ukraine conflict starts in February of 2022 that we would have seen a massive uptick in the number of Russian cyber attacks that happened. That has not largely happened nearly as much. There have been some, but it's not to the wave that we thought.
But part of the reason we think, and again speculation, but part of the reason we think is because Russia itself is so vulnerable to attack that if they directly attack the US, we would come back at them and would shut down their entire power industrial base, a lot of different things. And so there's sort of a mutually assured destruction concept to cyber.
Russian attacks really ticked up when Israel Hamas took off and Russia was doing a lot to try and disguise their cyber attacks as if they were coming from Hamas or Iran. And so I would imagine that we're going to see a lot more Russian attacks that will be trying again to look like Iran.
And the efforts to sort of degrade Iran's capabilities that doesn't necessarily extend to cyber in the same way it does to other things.
One of the internal debates of Cloudflare right now is the Iranian internet was shut off. And the question is, did they do that to themselves because that's what they have historically done. They want to block it. It's a way to quell protests. Or did the US do that to them or Israel? Because typically in a kinetic conflict, the first thing that you do is you try to disable the communication systems of whoever you're about to bomb. And so that would be very normal. But on the other hand, the State Department went through extensive efforts to try and get things like Starlink and other things into Iran. It's not clear entirely whether Iran shut down the internet themselves or if the US and Israel shut it down.
The evidence that they did it to themselves is that there is still from some cellular networks and specifically from some SIM cards we see access and what that traffic is accessing is things that you would imagine elites inside of Iran trying to access. So a lot of cryptocurrency exchanges because if you're trying to get assets out, that's one of the ways that you would do it. A lot of sort of social media and news trying to see kind of what is going on in the world. That leans in the favor of they did it to themselves and they've basically whitelisted a certain set of elites.
The leans against it is the US is really good and Israel are very good at cyber. One of the discussions about AI is sort of for hackers like you want your AI to be better than their AI because they're using one and you're. Is that a factor in this engagement or not? Not as much yet.
AI is making everyone more efficient and that includes hackers. So the time from when a hacker gains access to a system to how much damage they can do has compressed massively. So that if in the past it might have taken days from you get access to one system how do you get access to the whole company, now it's taking hours or minutes in order to do that.
There's a tool made by a company called Salesloft called Drift. It got compromised by some Russian hackers and it gave the Russian hackers access to the vast majority of Salesforce clients. It was not nearly as harmful as possible because the hackers didn't understand Salesforce and so they were spending several days just trying. I mean, not a lot of people understand Salesforce.
They sometimes, even people at Salesforce.
People, yeah, like how do we have so many Salesforce administrators? And this was an attack that happened six months ago. I think what you see today is that AI would allow them to get much smarter.
To get up to speed that much faster.
That much faster and do that much more harm. That's the bad news. The good news is at the end of the day who wins in the AI race is whoever has the most data. Like, we can talk about chips, we can talk about researchers, those things will become commodities more and more over time. The thing that will differentiate is whoever has the most data and the good guys have more data than the bad guys.
At some level, we would have never described ourselves this way. But at some level, Cloudflare has always been an AI company where we take. I mean the reason we have a free service is because all of that is information that we can feed into machine learning algorithms to look for what the new security threats are. In the same way that we all three and a half years ago ChatGPT comes out we're like, whoa, that's amazing. Internally we'd had those machine learning systems that were finding things that we already knew about and identifying them more quickly.
But about three and a half years ago was the first time where our system started to identify threats that no human had identified before. And so I think there's going to be a bunch of horror stories around AI. There's going to be families that send their life savings to some, you know, gang member.
Yeah. I mean, the AI phishing data is bad. Yeah.
But like, I think the macro trend is that actually the internet is going to get and cyber is going to get a lot better because of AI. Even though you're going to have a whole bunch of headlines that are going to sound very scary.
Since the last time we talked, you've become much more vocal about AI layoffs. I've had other conversations with folks who are sort of like some of the layoffs you see, it's really just businesses like using AI as an excuse. You see this as more transformational.
Everybody should just be super honest with themselves which camp they're in. And there are two camps right now. There is a camp. It's like if we were in the business of screwing screws into floors, up until about 6 months ago we were doing it by hand and we were really good at it and we hired some of the best hand screwdrivers in the world. And then again there was talk for the last three years that oh this new technology is coming and we're going to have automatic electric screwdrivers and everyone's going to be so much more productive and we're like yeah we tried it it doesn't sort of work that well.
Then but somewhere around November, and anyone who's paying attention felt it, the screwdrivers got really good and the electric screwdrivers became incredibly effective and we now have people in one camp that are literally a hundred times more productive than they were before. They put down entire floors in a day when it would used to have taken us a month.
That's one camp. We have another camp who's like, 'Yes, yes, but I prefer my manual screwdriver. I'm so used to it. It's always worked well for me.'
And you told me that if I came here and I use my manual screwdriver that I would have a job forever. And I believed it when I said that. But I can't have a world where one employee is 100 times as productive as the other.
People are like, 'Are you losing sleep over AI?' I'm like, 'Yeah, I probably should be, but I'm not.' What I'm losing sleep over right now is that we have a bunch of our team that's using electric screwdrivers. We still have a bunch of our team that thinks that their job is to use manual screwdrivers and they're complaining that oh the electrical screwdrivers make mistakes or they do various things but they're missing the point.
And my job has to be how do I get those folks, they're really good with manual screwdrivers, to come along. And what's scary for them because it tends to be it's not the super senior people it's not the super junior people it's the people in the middle who said you told me this is the game I've been playing this game really really well. I've been doing that. How dare you change the rules on me? And if you do change the rules and I adopt them, how do I have any advantage over the intern, right? How am I going to be good with the electric screwdriver? I don't know. And everything that I was good at was I was really good with the manual screwdriver.
And that's a super scary thing for people who are sort of in the middle of their career. And what I am deeply worried about, this isn't a Cloudflare thing. This is an industry-wide thing. It's not even a tech thing.
Yeah. I was going to ask you like is this just, I mean I know it applies to software and coding but if you're in another business it's a funny thing because everyone expects machines to be perfect. These are not perfect machines. These are fallible machines but it's effectively like you have 100 times the number of employees right and they make mistakes but it's great they can check each other. They take a whole bunch of work that was pretty drudgerous, writing comments on code in finance, copying information from one spreadsheet to another in legal, summarizing a bunch of documents. I mean those are all things that humans did. We don't need that anymore. That doesn't mean we need fewer humans. I want, we Cloudflare will have more employees. We will continue to grow the number of employees at about the same rate that we have. But what I'm deeply worried about is how do I get the folks who are just worshiping their manual screwdriver to realize that the world.
And if I'm someone who like, you know, I'm using an electric screwdriver sometimes but not for everything in my job, I don't, it's totally fine. There's a time and a place. Be honest. If you think that your job is to convince people that electric screwdrivers are bad, you're a dinosaur.
And what I'm deeply afraid of is I think that there's a generation of people who are between the ages of about 25 and 40 who there's a real risk they're going to get completely left behind. It's also terrifying for society. Let's imagine you've got a, like unemployment rate spikes for people in that age group. That's the people who are going to start to become more politically active. Like the populism we've seen today could get even worse and even crazier.
And again, like I think a huge part of my job is how do I convince people the ship has sailed. We are not debating whether electric screwdrivers are better than manual screwdrivers.
And it's not a question of you're saying I'm in favor of it, it's just it is the reality.
It's not just us. It's every single company. And so what we saw out of Oracle, what we saw out of Atlassian, what we saw out of Block, everyone is going to do it. And even the companies that are growing like crazy and they might turn around and hire a whole bunch of new people. Like we're hiring over 1,111 interns. It's a number that means something to us. But why? We're pairing each of the interns with a more senior member of our team because usually the mentorship goes from senior to junior. We think it's going to be completely different this year where we think that our team needs to learn from the people who are sort of the natives at electric screwdrivers in order to understand it.
We had an outage last year. It was really bad. It was basically because a configuration file went out that was malformed. So, what's the solution to that? Well, we now have an employee effectively that doesn't need to sleep, doesn't need to eat, doesn't take breaks, and who's like information biases are completely uncorrelated with the rest of our team. And they can check every single configuration change before it goes out. Not to change it or even, but to flag it like this, hey, this might be a problem. And this employee is AI, is an agent, right?
And again, no, you're not going to hire someone to do that. You couldn't and they would inherently have biases and all kinds of things. It's a perfect use case for this and everyone's going to implement it. And by the way, the internet, the cloud, all these things are going to become massively more reliable because we can have something that just checks everything.
And there was a 14-day debate internally about whether or not we should do this. What the? Of course we should do that.
When we talked last time, the news that we were talking about was a new tool that Cloudflare had out about sort of helping to block AI bots from crawling content sites if they didn't want it. In that conversation, you said you sort of believed that the AI companies were trying to do the right thing. Has that perspective moved at all? Well, I mean, we've seen a lot of differentiation lately between Anthropic and OpenAI and how they're dealing with the government. Do you feel like that anything has moved in that?
I think I'm more convinced that that's the case. 80% of the AI companies use us and so we know them really well. We talk, all the big ones use us and they're not stupid and they understand that they are part of an ecosystem and they have to behave inside that ecosystem and they're going to act rationally.
And so in the case of media, like if you were just giving media away for free, of course they're going to take it. It's not the right answer for everyone. Like for Cloudflare, we don't want to block AI crawlers from crawling our knowledge base. We want the AI systems to be able to know how to use Cloudflare. So we don't block them. We welcome them. But if your business is selling ads or selling subscriptions, you might say, 'Hey, unless you compensate me, you don't get my stuff.' And that's rational. And so we're just providing the tools to do that.
What we have seen having now done that is that the deals that people are getting whether it's Dotdash Meredith or Condé Nast or other big media companies have gotten significantly better. Now there's still a lot that's there and the real challenge is it's sort of like a superhero movie like where the hero of the last movie becomes the villain of the next.
Like Google is the hero of the last 30 years of the internet. They financed the entire thing. They built a search engine and then they needed to create content in order to make the search engine valuable. So they built the monetization engine that powered the entire internet. And the business model of the internet was generate content, drive traffic, and then sell things, subscriptions or ads. That's been the business model of the internet. The problem is that AI breaks that. It doesn't work that way.
And so like at some level there has to be a value exchange. A lot of times you create something, you put Google Analytics on it just because you're just like, 'Wow, look how many people are reading it.' But that's gone way way way down because they're not reading it directly. They're reading the summary, the AI summary, cliff notes version of it.
