December 23, 2021, 10:59am EST (originally published on Forbes)

The most exciting products and the most rewarding tech stocks on the market today are the ones that challenge Big Tech. This is because the market will often underestimate the ability of an agile team to disrupt the incumbents despite substantial evidence that this is exactly what the tech industry is built to do.

What’s remarkable about Cloudflare is how the company has leveraged its content delivery network footprint to simultaneously be a leader in application and website security, then to further innovate with Zero Trust security combined with SASE network connectivity, and more recently to leverage the elimination of egress fees for object storage to attract developers. The latter is the most exciting as Cloudflare has already proven its ability in driving down costs and will now take on AWS head-to-head.

However, in light of Cloudflare’s impressive price movement this year, the company is now priced to perfection. When looking at its peers with similar or higher growth rates, which we discuss below, Cloudflare could see a 35% cut in its price to 40X forward sales and the company would still be fully valued.

Below, we look at the products driving Cloudflare to trade at a higher valuation and whether it’s a valuation the company can sustain.

Cloudflare’s Core Products:

Cloudflare is a well-known company that owns a predominant share of the CDN market. Content Delivery Networks contain a cached copy of website content on multiple servers located across the world to help improve page loading times. When a person visits the website, it will provide the content from the server closest to the end-user, which helps increase the delivery speed of the content. When a website is hosted on a server in the United States, the person browsing the website from any part of the globe, like Asia or Europe, will receive the content from the nearest location instead of the server in the USA. The Fastly outage this year shows the prominence of these CDN providers to where one outage can create downtime for sites, such as Amazon, Reddit and the New York Times.

According to data from W3Techs, 81.2% of all websites that use a CDN or reverse proxy rely on Cloudflare. We had discussed in a podcast earlier this year that Cloudflare is strong in the small to medium-sized business (SMB) category and offers free entry-level services. The penetration among SMBs is one reason why Cloudflare has an estimated annual revenue of $648 million this year with over 1 million customers compared to the enterprise-focused Akamai at $3.48 billion with roughly 50,000 customers. The overall revenue is low for its high customer count compared to Akamai partly because of the free-entry level.

According to Intricately, the cloud Content Delivery Network market is expected to grow at a compounded annual growth rate of 28% between 2020 and 2025. Cloudflare has the highest number of customers (this data includes free users). As of June 2020, Amazon Web Services has the highest share among enterprise customers with Cloudflare is in second place. Among the SMB customers, Cloudflare is leading all the other players. Cloudflare also has a better overall rating when compared to Fastly and also compared to Amazon Web Services in the Gartner Peer Insights.

The company has a large free customer base. In addition to the benefit of converting the free base to paid services it can use the free base to test the features before they are launched.

The free user base was mentioned by management in the earnings call,

“One of our secret to success is our broad customer base that we have millions of customers, many of whom use our services for free means that we have an eager pool excited to test new features before they're released. While traditional B2B companies have extensive QA team, we regularly ask volunteers from our community to be our earliest alpha testers. Our iteration cycles can then be extremely fast. And by the time a feature makes its production at one of our enterprise customers, it's full of proof, having been through the paces under real network conditions.”

Cloudflare has built a large footprint, which means the company already owns a large portion of the TAM for CDNs. The 81% footprint is impressive but one could argue this leaves little room for growth. Cloudflare’s potential in a largely-commoditized CDN market will come from the “extremely fast” iteration cycle. There’s ample evidence the company can execute as it now owns a large portion of the application and website security market, especially for DDoS attacks (distributed denial-of-service).

Because Cloudflare has a large global presence of servers and data centers, it’s particularly well suited for analyzing traffic to determine security risks. The company is able to analyze and detect attacks by running a background program known as a daemon on every server in every data center. The scans are shared as threat intelligence among the servers in each data center without affecting the latency of the CDN.

Cloudflare is able to mitigate at optimal locations in the tech stack, for example at L4 inside the firewall or at L7 inside the reverse proxy with a 403 error page. The company is advanced at preventing L3 DDoS attacks, which targets network equipment and infrastructure. The benefit of having access to more of the stack for security purposes is that CPU consumption and intra-data center bandwidth remains relatively unaffected. It’s also autonomous so Cloudflare is not using manual employees for this process.

DDoS attacks are essentially bots that send millions of requests to overload servers and to shut down a specific website by targeting its IP address. Often times, these bots are run from devices infected with malware and operated remotely by an attacker. Cloudflare recently detected and mitigated a 17.2 million request-per-second DDoS attack, which was three times larger than any previous DDoS attack on record. This is two-thirds the average rate per second that Cloudflare had served in all of Q2.

DDoS is one example of what the company offers and certainly Cloudflare has other security and network offerings based on their large footprint. They can also cross-sell security and CDN customers with WAN-as-service, or Magic WAN, which connects office networks through the local area network. The company also offers application delivery controllers located centrally within a customer’s infrastructure for Layer 3 through Layer 7 security for applications and APIs.

Cloudflare’s Move into Zero Trust

Across Cloudflare’s security products, an important one to focus on moving forward is Cloudflare One, which is a Zero Trust network-as-a-service. Zero Trust is gaining increasing acceptance due to rising security threats from data not being stored in one place. Secure access service edge (SASE) is a cybersecurity concept that utilizes Zero Trust to identify users and devices to deliver secure access to specific applications or data. The need for this has grown due to remote teams as SASE allows policy-based security no matter where the user, application or device is located.

Zero Trust Security is built on the premise that no one should be trusted within or outside the network. In the traditional security systems, it is difficult to obtain access from outside the network while those located inside the network were trusted. With Zero Trust, these trust assumptions are removed with tools such as multi-factor authentication, giving access for a limited time and to also verify, authorize and to have a continuous check on all the data points that are given access.

In the earnings call, the company’s CEO assured that the company’s proxy infrastructure could be used for both reverse proxy and forward proxy. He stated, “but it turns out that it's as easy to make the traffic flow one way through the pipe as it is to make it flow the other way through the pipe.” Its proxy has security features built-in and also has the capacity to increase customer’s traffic.

Earlier this year, the I/O Fund covered the launch of Cloudflare One, and the management’s belief in the shift from a traditional hardware-based security approach to a modern zero trust approach, and the company’s confidence to be a leader in making that transition.

Cloudflare One has been getting a good response from customers due to mitigating attacks and improving overall performance. On the earnings call, the company discussed a Fortune 500 pharmaceutical company which was using Cloudflare One that signed a $600,000 expansion deal to increase the total contract value to over $2 million. Another large European software company signed a three-year deal worth $600,000. According to October numbers, Cloudflare signed a social network company which has a contract value of more than $1 million annually. Another video conferencing company also moved to Cloudflare which has a contract value of about $8 million.

Due to the increasing hybrid work conditions, Cloudflare has announced new cloud firewall functionality for distributed environments to overcome the issues with traditional firewalls. The company’s rating on TrustRadius and also on capterra shows that it rates higher than Zscaler, which has also performed well in the market.

Cloudflare R2 storage

Cloudflare began to lead its cloud peers when the company announced its R2 storage product on September 28th, 2021. You can see the dark purple line start a sharp rise upward following the start of October.

R2 storage allows unstructured data to be stored without egress bandwidth fees, which are charged when developers retrieve data from a cloud provider like AWS. The egress fees are essentially a tax without any value. Markups are as high as 7900% in the United States region when calculating what AWS charges. This is an 80X bandwidth markup and was detailed here by Cloudflare’s management.

Eliminating egress fees with R2 Storage places Cloudflare in direct competition with Amazon’s S3. Cloudflare’s motivation is to win over developers and their loyalty.

In the words of Matthew Prince, “We want developers to keep developing, not worrying about their storage bill. Our aim is to make R2 Storage the least expensive, most reliable option for storing data, with no egress charges. I’m constantly amazed by what developers are building on our platform, and look forward to continued innovation as we expand the tools they have access to.”

Primarily, Cloudflare is hoping to attract developers for its Workers product, which is a serverless compute service for developers to build applications and deploy code at the edge. This removes the need for developers to maintain servers or spin-up containers. The cloud service provider (in this case, Cloudflare) provisions, scales and manages the infrastructure required to run the code. Cloudflare wants developers to choose them over the larger cloud providers because of their location at the edge. This is ambitious as most developers are accustomed to AWS, Google Cloud and Microsoft Azure, all three of which also offer serverless at the edge with plans to aggressively expand, such as AWS Lambda and its extension Lambda@Edge.

R2 Storage will help Cloudflare grow its addressable market and will help the company compete as a best-of-breed player in the trends towards multi-cloud. In response, Amazon has lowered prices by up to 31% but this may not be enough if Cloudflare plans to get rid of egress fees entirely. When Cloudflare announced R2 storage, the company’s co-founder and CEO, Matthew Prince, tweeted, “Why R2? Because it’s S3 minus the one most annoying thing: egregious egress.” The product will be launched soon and has a waitlist for customers.

Notably, the outcome from Cloudflare’s R2 Storage, and also the Bandwidth Alliance, which is a consortium of cloud providers who address bandwidth pricing issues, could end up forcing Amazon to drop its egress fees rather than lose customers. Also, as an investor, it’s not clear how much R2 Storage will contribute to Cloudflare’s top line considering the markup will be eliminated. Regardless, the market has rewarded the company for taking on AWS and my hunch is developers will support the cause regardless of AWS’s response.

Cloudflare has done well since its initial focus on the CDN and web security market, increased its TAM with Zero Trust Security, and now adds object storage as a way to attract developers for products like Workers. It is interesting to note that Amazon successfully grew by targeting companies that had good margins with a famous quote from Jeff Bezos, “Your margin is my opportunity.” Now, companies like Cloudflare are doing what Amazon did in its early days by toughening the competition. Amazon’s AWS is a profitable powerhouse, and if Cloudflare can disrupt this, it could be another game-changer for the company.

Financials

The market is excited about how Cloudflare has performed post-Covid as it’s clear the company did not need the one-time bump from 2020 as growth has been stable throughout 2021. Cloudflare decelerated in the most recent quarter —- but not by much; from 54% revenue growth last year to 51% revenue growth in the most recent quarter. The guide for next quarter is also a slight deceleration from 50% revenue growth last year to 47% this year. 

The company’s revenue growth was partly helped by growth in large customers with annualized revenue greater than $100,000. We also noticed a similar trend of large customer growth in the last quarter. The company exited the 3Q with 1,260 large customers, a net addition of 172 in the recent quarter for 71% growth. The company had 132,390 paying customers, which represents total customer growth of 31% YoY.

Cloudflare has also demonstrated its ability to be profitable. The company reported break-even adjusted earnings per share, which beat estimates by $0.04. The gross profit margin improved to 78.2% compared to 76.3% in the 3Q 2020. Adjusted gross margin improved to 79.2% compared to 77.3% in the 3Q 2020.

Adjusted net income came at $1.4 million or $0.00 per share compared to an adjusted net loss of $7.3 million or ($0.02) per share in the 2Q 2021 and adjusted net loss of $5.8 million or ($0.02) per share in the same period last year.

Net cash flow from operations was negative $6.9 million compared to a positive $2.0 million for the 3Q 2020. The company had cash and investments of about $1.8 billion at the end of the quarter, including about $790 million of net proceeds from the convertible note issuance in August.

The dollar-based net retention was 124%, the same as the 2Q 2021 and higher than the 3Q 2020 that was 116%.

The company’s revenue guidance for the 4Q is $184 million to $185 million, represents an increase of 46% to 47%. The adjusted earnings are expected to be between ($0.01) to break even. The full year revenue guidance is $647 million to $648 million, representing an increase of 50% and adjusted earnings per share are expected to be between ($0.06) to ($0.05).

Valuation:

Cloudflare has an eye-watering valuation of 47X EV to 1-year forward revenue. As a tech growth portfolio, the I/O Fund is certainly not the valuation police as we often find our best winners carry high valuations if a company is executing against the competitors.

However, it’s the growth rate of Cloudflare that makes me question if this valuation is appropriate. In regards to Cloudflare’s high-valued peers, we see that Cloudflare has one of the lowest revenue growth rates at 51% in the most recent quarter and free cash flow isn’t a strong factor here either. As mentioned, the only other stock on our list carrying this 1-year forward valuation is Snowflake, which had nearly double the growth.

Cloudflare’s analyst consensus for next year is revenue of $886 million with 20 analysts providing estimates. This represents growth of 37.2%. The analysts covering the stock are modeling Cloudflare to be profitable next year with $0.02 EPS. At this valuation, investors should feel confident there will be a beat and raise to at minimum 50% growth although the data above suggests revenue growth must be in the 60% range to be in the top 10 for valuation.

Conclusion:

By the sweat of its brow, Cloudflare has expanded a commoditized content delivery network footprint to become a leader in website and application security, and is not standing still with products such as Zero Trust and R2 Storage. However, being a great company is sometimes confused for a great stock. At the current valuation, Cloudflare has no room to explore these new markets and find its footing.

I have no doubt the company will execute, how it goes about this and if the timing of execution can meet Wall Street’s often unrealistic standards of quarterly perfection is the risk that investors take. This is certainly one to watch, or one to hold if you’re already in the stock, but to enter as of October requires hardened conviction in Cloudflare surprising to the upside on the 37% forward growth estimates for FY2022. We prefer to wait from the sidelines for a more attractive entry.

Please note: The I/O Fund conducts research and draws conclusions for the company’s portfolio. We then share that information with our readers and offer real-time trade notifications. This is not a guarantee of a stock’s performance and it is not financial advice. Please consult your personal financial advisor before buying any stock in the companies mentioned in this analysis. Beth Kindig and the I/O Fund do not own Cloudflare and there are no plans to enter the stock in the next 72 hours.