Latest / Business Strategy Talks with Fexingo: Competitive Advantage, Market Positioning, and Growth Planning / How Cloudflare Built a Moat by Seeing Everything
Transcript
- Lucas: So here's a number I keep coming back to — Cloudflare now handles roughly 20 percent of the world's web traffic, which means roughly one in every five requests a user makes on the internet passes through their reverse-proxy infrastructure. Luna: Twenty percent is staggering. I remember reading they were around 10 percent maybe six years ago. That's a lot of network growth in a short window. Lucas: Right, and the interesting part for a strategy show is not just the scale, but the kind of moat that scale creates. Cloudflare's core product — a reverse proxy that sits between the user and the origin server — doesn't just cache content or block attacks. It sees every request. And when you see that much traffic, you start to see patterns that nobody else can see. Luna: That's the data moat argument, isn't it? The more traffic you route, the better your machine learning models get at detecting threats, optimizing routing, predicting traffic spikes. Lucas: Exactly. And in Cloudflare's case, that learning loop is embedded directly into the product. When their system detects a new kind of DDoS attack on one customer's infrastructure, it automatically updates the rules for every other customer. No human intervention needed. So the value of the network increases for everyone with each new attack they absorb. Luna: That's a textbook network effect — but it's not a user to user network effect like Facebook or Uber. It's more like a data network effect: every new node makes the shared model smarter. Lucas: Right, and that distinction matters because it changes the competitive dynamics. A user to user network effect is hard to dislodge once you have critical mass, but a data network effect requires continuous investment in the model and the infrastructure that feeds it. Cloudflare spends heavily on its global network — they're in over 310 cities now — and that physical presence is a moat in itself. Luna: So the moat is actually two layers: the physical network of data centers, and then the intelligence layer on top that gets smarter with scale. Let's talk about how they turned that into a business. Because plenty of companies have big networks and data — Akamai had both before Cloudflare existed. Lucas: Akamai is the perfect contrast. Akamai was the dominant CDN for years — they had the best tech, the biggest customers, the most sophisticated traffic optimization. But they priced themselves like an enterprise software company. Premium contracts, long sales cycles, custom pricing. Luna: And Cloudflare came in with a freemium model. Free tier for small sites, very low fixed pricing for the pro tier. They were essentially saying 'we'll make money on volume.' Lucas: Exactly. And that pricing strategy was itself a moat-building decision. By making it frictionless to sign up — no sales call, no credit card for the free tier — they captured the long tail of the internet. Millions of small sites that Akamai would never bother with. And those small sites became the training data for their security models. Luna: So the free tier was really a data acquisition strategy. They were paying for the data with compute and bandwidth costs, and that data made the premium product better. Lucas: Precisely. And around 2017, they launched Cloudflare Workers — their edge compute platform. That's when the moat really started to thicken. Because Workers let developers run code at Cloudflare's edge nodes, meaning you could build applications that ran literally closer to your users than any centralized cloud provider could offer. Luna: And that shifts the moat from purely defensive — 'we protect your site' — to offensive — 'we can help you build better products.' Suddenly Cloudflare isn't just infrastructure you route traffic through; it's a platform you build on. Lucas: Right. And the key strategic insight there is that Workers is priced per request, not per compute hour. That's a huge difference from AWS Lambda, which charges per gigabyte-second of memory and compute time. For a lot of use cases — especially APIs and webhooks — Workers ends up being dramatically cheaper. Luna: So they're undercutting the hyperscalers on price for a specific workload, while also offering better latency because the code runs at the edge instead of in a regional data center. Lucas: And the data moat feeds into Workers too. Because Cloudflare's network has already optimized routing between all those edge nodes, a Worker running on their platform inherits that optimization automatically. You don't have to think about where to deploy your code — Cloudflare's algorithms decide the optimal placement based on real-time traffic patterns. Luna: That's a classic bundling advantage. The routing intelligence is a byproduct of the core CDN business, and they can layer it into Workers for free. Competitors like Fastly — who also have an edge compute platform — have to build that intelligence from scratch. Lucas: Fastly is actually a really interesting comparison. Fastly's edge compute product called Compute@Edge is technically very elegant — it's built on WebAssembly, it's sandboxed, it's fast. But Fastly doesn't have the same traffic scale as Cloudflare. Their network is smaller, which means their data moat is thinner. Luna: And that shows in the financials. Fastly has struggled to grow revenue at the same pace as Cloudflare. They've had some high-profile customer churn too — remember when they lost Pinterest a few years ago? Lucas: Yeah, that was a big blow. And it points to a vulnerability in the pure-play CDN model: if your main value proposition is speed, and the hyperscalers like AWS and Google start offering competitive edge services, you need something stickier. Cloudflare's moat is stickier because it's not just speed — it's security, it's the developer ecosystem, it's the data network effect. Luna: Let's talk about the security side specifically. Because Cloudflare's DDoS protection and Web Application Firewall are probably what most people know them for. How does the network effect work there? Lucas: So the basic idea is that every attack that hits any Cloudflare customer gets analyzed by their automated systems. They see the IP addresses, the attack patterns, the payload signatures. And they update their global threat database in real time. So if a new variant of a SQL injection attack hits a small e-commerce site on the free plan, by the time it tries to hit a Fortune 500 bank on the enterprise plan, Cloudflare already knows how to block it. Luna: That's a powerful narrative to sell to enterprise customers. 'You benefit from the attacks we see on millions of small sites, and your attacks help protect those small sites too.' It's almost like a mutual insurance pool, but for cybersecurity. Lucas: Exactly. And that symmetry is crucial. The free tier isn't just a loss leader — it's a sensor network. Every free site is a canary in the coal mine that feeds back to the central intelligence. Akamai never built that because they never targeted the long tail. Their sensor network was limited to their enterprise customers, which meant they had less data and slower response times. Luna: So the free tier was a strategic choice that Akamai couldn't replicate without basically throwing away their entire pricing model. That's a moat, but it's also a strategic commitment. Cloudflare has to maintain that free tier indefinitely, and that costs real money. Lucas: It does. Cloudflare's gross margins are around 77 percent — good, but not as high as pure software companies. The free tier drags on margins. But the trade-off is that it drives the network effect that makes the whole business defensible. And over time, as they add more paid products — Workers, Zero Trust, R2 storage — they can monetize that installed base more deeply. Luna: That's the classic 'expand revenue per customer' play. Once a developer is using Cloudflare for CDN and security, it's very easy to add Workers or R2 because it's the same console, same API, same billing. Lucas: And the switching costs are real. If you've built your application on Workers, you've written code that uses Cloudflare's specific APIs and runtime. Moving to Fastly or AWS would require a rewrite. So the moat deepens as customers build more on top of the platform. Luna: I want to push back a little, though. There's a risk that Cloudflare becomes too dependent on the free tier for data. What if a major competitor — say, a hyperscaler like AWS — decides to offer a free tier for their own CDN and security services? They have the scale and the capital to absorb that cost. Lucas: It's a fair concern. AWS CloudFront already exists, and it has a generous free tier. But the difference is that CloudFront is a side product for AWS, not the core business. AWS's incentives are to sell compute and storage. CloudFront exists to make those services work better. Cloudflare's entire existence depends on building the best edge network. That focus matters. Luna: So the moat is partly about focus and incentives. Cloudflare can't be outspent on edge because it's all they do. That's a version of the 'purity of mission' moat we've seen in other episodes. Lucas: Exactly. And there's one more layer I want to touch on — the developer ecosystem. Cloudflare has built a thriving community of developers building on Workers, writing plugins, sharing code. That community is itself a moat. Developers choose platforms based on where their peers are, where the tutorials are, where the open-source libraries live. Luna: That's the same moat that WordPress built, or that React built. A critical mass of third-party developers creates a gravitational pull that's hard to escape. Lucas: Right. And Cloudflare has been very intentional about it. They sponsor open source projects, they run hackathons, they publish detailed documentation. They even acquired a company called BrowserStack — well, they partnered closely with them — to make it easy to test Workers. Everything is designed to lower the barrier to entry and increase the switching cost to leave. Luna: So if I had to summarize Cloudflare's moat in a sentence, it would be: a two-layer network effect — physical and data — protected by a pricing strategy that turns every customer into a sensor, and deepened by a developer ecosystem that raises switching costs. Lucas: That's a great summary. And the key takeaway for business strategists is that Cloudflare didn't just build a better CDN. They built a system that gets more valuable as more people use it, and they priced it in a way that maximized adoption even at the expense of short-term margins. That's a blueprint that applies well beyond infrastructure. Luna: Before we wrap, I want to quickly mention something — these deep-dives take a lot of work to research and produce. And honestly, a small number of listeners who chip in monthly through buy me a coffee dot com slash fexingo are what make it possible to keep this show ad-free and independent. If these conversations have moved your thinking forward in some small way, that's the place to help keep them going. Lucas: Yeah, it really does make a difference. And we appreciate every person who's already part of that. Okay, back to the moat — one final thought. Cloudflare's biggest challenge going forward isn't technical; it's maintaining that focus as they expand into more products. The temptation to chase revenue in adjacent markets is real, and every new product dilutes the network effect if it doesn't feed back into the core. Luna: So the moat is strong today, but it requires disciplined strategy to keep it strong. That's a good note to end on. Lucas: Agreed. Thanks, Luna.