Cloudflare (NET) 10-K2021 FY Annual report

UNITED STATES

FORM 10-K

Indicate by check mark if the registrant is a well-known seasoned issuer, as defined in Rule 405 of the Securities Act. Yes ☒  No ☐

Indicate by check mark if the registrant is not required to file reports pursuant to Section 13 or Section 15 (d) of the Act. Yes ☐  No ☒

Indicate by check mark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days.  Yes ☒  No ☐

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files).  Yes ☒  No ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Act).  Yes ☐  No ☒

The aggregate market value of the common stock held by non-affiliates of the registrant, based on the closing price of the shares of Class A common stock on June 30, 2021 as reported by the New York Stock Exchange on such date was approximately $14,847 million. Shares of the registrant’s common stock held by each executive officer and director and by each other person who may be deemed to be an affiliate of the registrant have been excluded from this computation. This calculation does not reflect a determination that certain persons are affiliates of the registrant for any other purpose.

As of February 10, 2022, 278,481,102 shares of the registrant's Class A common stock were outstanding and 45,595,273 shares of the registrant's Class B common stock were outstanding.

This Annual Report on Form 10-K contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended, which statements involve substantial risks and uncertainties. Forward-looking statements generally relate to future events or our future financial or operating performance. In some cases, you can identify forward-looking statements because they contain words such as “may,” “will,” “should,” “expects,” “plans,” “anticipates,” “could,” “intends,” “target,” “projects,” “contemplates,” “believes,” “estimates,” “predicts,” “potential,” or “continue,” or the negative of these words, or other similar terms or expressions that concern our expectations, strategy, plans, or intentions.

Forward-looking statements contained in this Annual Report on Form 10-K include, but are not limited to, statements about:

You should not rely upon forward-looking statements as predictions of future events. We have based the forward-looking statements contained in this Annual Report on Form 10-K primarily on our current expectations and

projections about future events and trends that we believe may affect our business, financial condition, results of operations, and prospects. The outcome of the events described in these forward-looking statements is subject to risks, uncertainties, and other factors described in the section titled “Risk Factors” and elsewhere in this Annual Report on Form 10-K. Our Risk Factors are not guarantees that no such conditions exist as of the date of this report and should not be interpreted as an affirmative statement that such risks or conditions have not materialized, in whole or in part. Readers are urged to carefully review and consider the various disclosures made in this Annual Report on Form 10-K and in other documents we file from time to time with the Securities and Exchange Commission (SEC) that disclose risks and uncertainties that may affect our business. Moreover, we operate in a very competitive and rapidly changing environment. New risks and uncertainties emerge from time to time, and it is not possible for us to predict all risks and uncertainties that could have an impact on the forward-looking statements contained in this Annual Report on Form 10-K. We cannot assure you that the results, events, and circumstances reflected in the forward-looking statements will be achieved or occur, and actual results, events, or circumstances could differ materially from those described in the forward-looking statements.

The forward-looking statements made in this Annual Report on Form 10-K relate only to events as of the date on which the statements are made. We undertake no obligation to update any forward-looking statements made in this Annual Report on Form 10-K to reflect events or circumstances after the date of this Annual Report on Form 10-K or to reflect new information or the occurrence of unanticipated events, except as required by law. We may not actually achieve the plans, intentions, or expectations disclosed in our forward-looking statements, and you should not place undue reliance on our forward-looking statements. Our forward-looking statements do not reflect the potential impact of any future acquisitions, mergers, dispositions, joint ventures, or investments we may make.

In addition, statements that “we believe” and similar statements reflect our beliefs and opinions on the relevant subject. These statements are based upon information available to us as of the date of this Annual Report on Form 10-K, and while we believe such information forms a reasonable basis for such statements, such information may be limited or incomplete, and our statements should not be read to indicate that we have conducted an exhaustive inquiry into, or review of, all potentially available relevant information. These statements are inherently uncertain and investors are cautioned not to unduly rely upon these statements.

Investing in our Class A common stock involves numerous risks, including those set forth below. This summary does not contain all of the information that may be important to you, and you should read this risk factor summary together with the more detailed discussion of risks and uncertainties set forth in Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K. Below are summaries of some of these risks, any one of which could materially adversely affect our business, financial condition, results of operations, and prospects. In that event, the market price of our Class A common stock could decline, and you could lose part or all of your investment. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that adversely affect our business. Our Risk Factors are not guarantees that no such conditions exist as of the date of this report and should not be interpreted as an affirmative statement that such risks or conditions have not materialized, in whole or in part.

Cloudflare’s mission is to help build a better Internet.

In recent years, the technology industry has undergone a massive transition from on-premise hardware and software that customers buy, to services in the cloud that they rent. Organizations find themselves at different points in this transition to the cloud. Regardless of where organizations are in their transition, they all face a common set of challenges: they exist in a complex, heterogeneous infrastructure environment which exacerbates the fundamental problems of the Internet more than ever, and the on-premise hardware boxes that they once relied upon to solve these problems were never designed to work in such an environment. As more workloads move to the cloud, there is no point in installing additional hardware boxes on premise. An on-premise box will not solve the problems organizations now face. Nor can a business ship a hardware box to a cloud vendor. Even if they wanted to, there is literally no place to install such a box in the cloud.

The result is that a major architectural shift at the network layer is now underway. Previously, enterprises would often string together a diverse set of on-premise hardware boxes from different vendors to solve their network challenges. As these solutions move to the cloud, the network latency, support complexity, and cost of overhead makes stringing together multiple point-cloud solutions that only address a specific network need untenable. Customers are therefore looking to consolidate behind a single global cloud services provider.

Cloudflare is a global cloud services provider that delivers a broad range of services to businesses of all sizes and in all geographies—making them more secure, enhancing the performance of their business-critical applications, and eliminating the cost and complexity of managing individual network hardware. Our network serves as a scalable, easy-to-use, unified control plane to deliver security, performance, and reliability across on-premise, hybrid, cloud, and software-as-a-service (SaaS) applications. We serve comprehensive customer needs across security, performance, and reliability.

We have built an efficient, scalable network that allows us to rapidly develop and deploy our products for our customers.

We created a network architecture that is flexible, scalable, and gets more and more efficient as it expands. We designed and built our network to be able to grow capacity quickly and inexpensively; to allow for every server, in every city, to run nearly every Cloudflare service; and to allow us to shift customers and traffic across our network efficiently. We refer to this architecture as “serverless” because it means we can deploy standard, commodity hardware, and our product developers and customers do not need to worry about the underlying servers. Our software is designed to manage the deployment and execution of our product developers’ code and our customers’ code across our network. Because we manage the execution and prioritization of code running across our network, it means that we are both able to improve the performance of our highest paying customers, and also effectively leverage idle capacity across our network. We have chosen to utilize this idle capacity to create a free tier of service which has generated substantial global scale for us. In turn, this scale makes us attractive partners for Internet Service Providers (ISPs) globally, which reduces our co-location and bandwidth costs. As our network grows, these dynamics become even more powerful. Today, our network spans more than 250 cities in over 100 countries worldwide and interconnects with over 10,000 networks globally, including major ISPs, cloud services, and enterprises.

Key elements of our growth strategy include:

We deliver a suite of deeply integrated products that serve as a unified control plane for our customers. Customers can quickly and easily join Cloudflare by using just one of our products and expand over time by adding most products with a single click. Our integrated suite of products consists of (1) solutions for an organization's external-facing infrastructure (such as websites, apps, and APIs) to deliver security, performance, and reliability, (2) solutions to serve an organization's internal resources (such as internal networks and devices), (3) developer-based solutions, and (4) consumer offerings.

Cloudflare offers a suite of products to help ensure that external-facing infrastructure (such as websites, applications, and APIs) that are exposed to the Internet are safe from attack, fast, and reliable.

We provide an integrated cloud-based security solution designed to secure any combination of platforms, including public cloud, private cloud, on-premise, SaaS applications, and IoT devices. Our key security product offerings include:

Our performance solutions improve conversions, reduce churn, and improve visitor experiences by accelerating web and mobile performance, while keeping applications available. Our key performance product offerings include:

Our reliability solutions improve the overall operational experience of the Internet and allow our customers to run their digital operations much more efficiently. Our key reliability product offerings include:

Cloudflare provides a comprehensive, cloud-based network-as-a-service solution that is designed to be secure, fast, reliable, and define the future of the corporate network. Whereas some large companies had built their own proprietary networks to control and protect their employees working in virtual space, that model had significant limitations, including a price tag that was prohibitive for most companies and an inability to adapt well to increased use of mobile devices and remote work. By leveraging the public Internet, Cloudflare brings together in a single

pane of glass how employees connect, on-ramps for branch offices, secure connectivity for applications, and controlled access to SaaS.

Broadly speaking, the Cloudflare internal infrastructure solution has two components: (i) on-ramps, which connect users, devices, or locations to Cloudflare's network; and (ii) filters, which are the products that protect, inspect, and privilege data.

These products connect a user, device, or location to Cloudflare's edge. This effectively enables Cloudflare to act as a secure WAN for all entities on a corporate network regardless what device they use or where they are located.

By leveraging our serverless platform, developers can build serverless applications that scale without needing to spend time and effort on infrastructure or operations. This enables them to deliver more performant applications that have instant global scale, all while improving their productivity. Our key serverless products include:

Our consumer products make it easy for individuals to have a performant and secure Internet experience. Adoption of our consumer offerings makes our business offerings more powerful and adoption of our business offerings improves our consumer offerings. Our consumer offerings also have been an effective and differentiated marketing channel to increase the awareness of our brand. Our key consumer product offerings include:

We view our millions of free and paying customers (excluding customers of our consumer offerings), which manage millions of Internet properties on our network, as part of a broad, global community.

As of December 31, 2021, we had over 140,000 paying customers across more than 170 countries. Our paying customer base is highly diversified across organizations of all sizes in every major industry vertical including technology, healthcare, financial services, consumer and retail, industrial, non-profit, and government. Our large customer count has increased from 526 as of December 31, 2019 to 828 as of December 31, 2020 to 1,416 as of December 31, 2021. Refer to Part II, Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations for additional information regarding the definitions of our "paying customers" and "large customers."

No single customer accounted for more than 10% of our revenue in the years ended December 31, 2021, 2020, or 2019.

Our distributed and proprietary network is the core of our technology, and enables us to move data seamlessly from nearly any point on earth in a fast, efficient, and reliable manner. Our network has been built from the ground up as a single software stack we developed that runs our products in more than 250 cities and over 100 countries worldwide. This allows us to scale quickly while offering a wide range of products and simultaneously lowering operating expenses.

We have developed a single software stack that is responsible for all of our products. We have been able to efficiently scale our network by building it with commodity hardware components that are powered by our proprietary software. This integrated stack has made scaling, debugging, optimizing, and operating our network and products easier and cheaper. It also allows us to deploy changes across our entire worldwide network in a matter of seconds. In addition, we embed encryption chips into the motherboards of our servers that are designed to preclude anyone else from running unauthorized software on our equipment. This allows us to securely and quickly expand our infrastructure far and wide in order to offer the best service and drive down operating costs.

Our serverless network design allows each individual machine in our global network to run our software suite and provide our products. We have built coordination software that ties together these thousands of machines into a single global network that allows us to efficiently route traffic to different physical locations and to individual machines. This enables us to maximize utilization of our commodity hardware and provide different service levels to different customers. It also allows our network to get more efficient and powerful as we add each incremental server, regardless of where it is located. Every time we add a server or add a new city, our entire network improves.

Our network and products are API-driven and designed for developers. We have an API-first mentality, which means anything a customer can do via our web interface can also be performed by our API. This allows our customers to easily embed our service in their own workflows. For example, a customer can use our web interface or API to change its custom configuration and that will be rolled out globally by our configuration software in seconds. This contrasts with many other vendors’ solutions where configuration changes can take hours and require professional services.

Our software is designed to spread loads dynamically across our entire distributed network depending on current network conditions and traffic priority. This enables us to deliver different quality of service depending on what customers pay us, ensuring our highest paying customers get the best performance and permitting us to serve our lower paying and free customers from excess capacity.

Given the distributed and highly efficient nature of our network, we can easily develop new features and products on our platform and deploy them without significant incremental costs. The flexibility of our serverless platform allows us to open it to third parties to write code directly on our network through our Cloudflare Workers product.

Our research and development organization is responsible for the design, development, testing, and delivery of our global network and products. Our R&D team's structure allows us to build a broad swath of products while continuing to innovate. One group works closely with our product management organization to improve, refine and expand our existing products. A second independent group builds greenfield opportunities that aim to expand our market and reach new markets. In addition, our research team is focused on ensuring that our network, products, and customers are secured with the latest cryptography.

We prioritize investment in research and development. Those investments have continued to result in the launch of new products that have helped us attract new customers and sell more products to our existing customers.

We have a multi-pronged go to market approach that allows us to efficiently serve the needs of very small to very large customers. By using a combination of web sales, direct sales, and indirect sales, we are able to serve the greatest diversity of customers across all sizes.

We sell our pay-as-you-go plans through our website and hosting partners where a customer can either start on a free or paid plan and, as we demonstrate value, upgrade over time. Our pay-as-you-go customers are able to sign up for our Pro or Business plans that are payable monthly. Pay-as-you-go customers are able to onboard and customize our products through our website and pay for their subscription using a credit card. Our automated and easy to use process enables us to efficiently onboard thousands of new customers per day without requiring any interaction with our sales team. As pay-as-you-go customers evolve their usage of our products, some upgrade to an Enterprise plan for greater control, higher service levels, or productivity-related tools.

We sell our Enterprise plan directly through our technically-oriented inside and field sales teams, and also indirectly through our ecosystem of partners. Our Enterprise plan customers, which we refer to as our contracted customers, typically are replacing on-premise hardware with cloud network services, or consolidating multiple existing cloud services onto one global cloud services provider with Cloudflare. For large contracted customers, our relationships often start with a portion of the customer’s overall network needs and expand over time as they consolidate other vendors’ services and increase their adoption of our products.

Our marketing aims to clearly communicate the value of our offerings to a large and diverse set of global customers at scale. We drive organic awareness and adoption of our products by providing a free offering that enables millions of users to experience the benefits of our global network before they adopt our pay-as-you-go offerings or contract for our Enterprise plan. We engage with developers across blogs, social media, and other channels to help build our brand and visibility among technical communities. In addition, our consumer products, including 1.1.1.1 and Warp, provide an effective and differentiated marketing channel to expand the awareness of our brand.

We invest in a variety of targeted digital and non-digital marketing activities and programs to build awareness, engage with prospects, and build pipeline for our global sales teams. We also share stories of how large customers are rapidly adopting our services across use cases, industry verticals, and geographies, to communicate customer trust and our market momentum.

We compete in the market for network services primarily across three categories:

The principal competitive factors in the markets in which we operate include:

We believe that we are positioned favorably against our competitors based on these principal competitive factors.

We want everyone at Cloudflare to have rewarding careers so we invest in development opportunities, aligned with both behaviors and results, to build leadership skills across the company, at all levels.

We believe that attracting, motivating, and retaining talent at all levels is vital to our success. Our total rewards programs are built to engage employees, provide support, and encourage career best performance. Through programs that drive employee retention and engagement, we also improve our ability to support customers and protect the long-term interests of our stockholders. We provide our employees with competitive salaries, opportunities for equity ownership, and a comprehensive benefits package that promotes well-being across all aspects of their lives, including health care, life and disability insurance, financial savings, family forming and caregiving benefits, and flexible vacation time. We also offer remote-friendly and flexible work schedules, which allows us to draw from a much larger talent pool and provides potential and current employees with additional opportunities to grow their careers at Cloudflare, while also providing environmental and other benefits.

Diversity, Equity, and Inclusion

We believe that much of our innovation and success is rooted in the diversity of our teams and our commitment to inclusion. We have fostered an inclusive culture through the development of employee-led communities, educational offerings, incorporating behaviors into performance, and reviews of our processes and policies for fairness and inclusion. In recognition of our inclusive culture, we were named one of Human Rights Campaign's 2021 Best Places to Work for LGBTQ Equality. We remain committed to extending our diversity and inclusion initiatives across our global workforce.

We value diversity at all levels and are committed to promoting the advancement of leaders from different backgrounds. We work with our managers to develop strategies for increasing the diversity of their teams and ensuring inclusion, equity, and fairness. An important component of our diversity, equity, and inclusion strategy is to grow a diverse talent pool, and we have established recruiting partnership programs with various organizations to reach underrepresented groups. We are focused on understanding our diversity and inclusion strengths and opportunities in order to execute a strategy to support further progress.

Our success depends in part upon our ability to protect and use our core technology and intellectual property rights. We rely on a combination of patents, copyrights, trademarks, trade secrets, know-how, contractual provisions, and confidentiality procedures to protect our intellectual property rights. As of December 31, 2021, we had 180 issued patents and more than 75 pending patent applications in the United States and abroad. These patents and patent applications seek to protect our proprietary inventions relevant to our business. Our issued patents are scheduled to expire between 2030 and 2040, and cover various aspects of our network and products. In addition, we have registered “Cloudflare” as a trademark in the United States and other jurisdictions and we have filed other trademark applications in the United States. We are also the registered holder of a variety of domestic and international domain names that include “Cloudflare” (including “Cloudflare.com”).

In addition to the protection provided by our intellectual property rights, we enter into proprietary information and invention assignment agreements or similar agreements with our employees, consultants, and contractors. We further seek to control the use of our proprietary technology and intellectual property rights through provisions in our subscription agreements.

Cloudflare, Inc. was incorporated in the state of Delaware in July 2009. Our principal executive offices are located at 101 Townsend Street, San Francisco, California 94107, and our telephone number is (888) 993-5273.

Our website is located at https://www.cloudflare.com and our investor relations website is located at https://cloudflare.NET. Copies of our Annual Reports on Form 10-K, our Quarterly Reports on Form 10-Q, our Current Reports on Form 8-K, our Proxy Statements for our annual meetings of stockholders and amendments to these reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, as amended, are available free of charge on our investor relations website as soon as reasonably practicable after we file such material electronically with or furnish it to the Securities and Exchange Commission (the SEC). The SEC also maintains a website that contains these filings at www.sec.gov.

We have used, and intend to continue to use, our website, investor relations website, news website (https://www.cloudflare.com/press), blog (https://blog.cloudflare.com), and social media accounts, including our Twitter account (@Cloudflare), our Facebook account (@Cloudflare), and our Instagram account (@cloudflare), as a means of disclosing material non-public information and for complying with our disclosure obligations under Regulation FD.

The contents of the websites provided above are not intended to be incorporated by reference into this Annual Report on Form 10-K or in any other report or document we file with the SEC. Further, our references to the URLs for these websites are intended to be inactive textual references only.

The effects of the ongoing COVID-19 pandemic have materially affected how we and our customers, vendors, and partners are operating our businesses, and the duration and extent to which this will impact our future business and operations, results of operations, financial condition, and cash flows remain uncertain.

COVID-19, we activated our business continuity plan and took several precautionary steps early to safeguard our business and our people, including implementing travel bans and restrictions, temporarily closing offices and transitioning to a fully remote working environment, and canceling participation in various industry events.

The COVID-19 pandemic also presents challenges as substantially all of our workforce is currently working remotely and assisting new and existing customers who are in many circumstances also working remotely. The ongoing continuation of remote work by our employees during the pandemic potentially may negatively impact their morale, as well as potentially lead to increases in employee attrition. Subject to the availability and receipt of vaccinations by our employees and the existence of low infection rates in the various jurisdictions where we have offices, particularly in the face of the recent outbreak of the Omicron variant, we currently are planning for the reintroduction of our employees to some or all of our offices in 2022.

Any of the negative impacts of the ongoing COVID-19 pandemic, including those described above, alone or in combination with others, may have a material adverse effect on our business and operations, results of operations, financial condition, and cash flows. Any of these negative impacts, alone or in combination with others, also could exacerbate many of the other risk factors discussed below in this Part I, Item 1A “Risk Factors” of this Annual Report on Form 10-K. The full extent to which the COVID-19 pandemic will negatively affect our business and operations, results of operations, financial condition, and cash flows will depend on future developments that are highly uncertain and cannot be predicted, including the scope, severity, and duration of the pandemic and actions taken by governmental authorities and other third parties in response to the pandemic.

We have a history of net losses and may not be able to achieve or sustain profitability in the future.

We have experienced rapid revenue growth, which may not be indicative of our future performance.

Our rapid growth may also make it difficult to evaluate our future prospects. Our ability to forecast our future results of operations is subject to a number of uncertainties, including our ability to effectively plan for and model future growth. If we fail to achieve the necessary level of efficiency in our organization as it grows, or if we are not able to accurately forecast future growth, our business, results of operations, and financial condition could be harmed.

If we are unable to attract new paying and free customers, our future results of operations could be harmed.

If our efforts to attract new paying customers are not successful, our revenue and rate of revenue growth may decline, we may not achieve profitability, and our future results of operations could be materially harmed. If our efforts to attract new free customers are not successful, the benefits to our network and product development cycles from our strategy of providing a free subscription plan will be diminished.

Our business depends on our ability to retain and upgrade paying customers and, to a lesser extent, convert free customers to paying customers, and any decline in renewals, upgrades, or conversions could adversely affect our future results of operations.

Our future financial performance also depends in part on our ability to continue to upgrade paying customers to higher-tier subscriptions or additional paid products and, to a lesser extent, to convert free customers into paying customers. Conversely, our paying customers may convert to lower-cost or free plans if they do not see the marginal value in paying for our higher-cost plans, thereby impacting our ability to increase revenue. Moreover, our free customers have no obligation to transition to paying customers at any point. In order to expand our commercial relationship with our customers, existing paying and free customers must decide that the incremental cost associated with such an upgrade is justified by the additional functionality. For example, some of our paying customers may decide that our Enterprise plan offerings do not provide sufficient incremental value to upgrade from our pay-as-you-go offering. Our customers’ decision whether to upgrade their subscription is driven by a number of factors, including customer satisfaction with the security, performance, and reliability of our network and products, customer security and networking issues and requirements, general economic conditions, and customer reaction to the price for additional products. If our efforts to expand our relationship with our existing paying and free customers are not successful, our financial condition and results of operations may materially suffer.

If we are unable to effectively attract, expand, and retain sales to large customers, or we fail to mitigate the additional risks associated with serving such customers, our business, results of operation, and financial condition may suffer.

Historically, the implementation period to start using, or expanding the use of, our products has been short, with most customers under our pay-as-you-go plans implementing usage of our products within a matter of minutes and our sales cycle for customers under our Enterprise plan typically lasting less than one quarter. These implementation periods have remained generally consistent during the ongoing COVID-19 pandemic. As our sales

force targets an increasing number of large customers for new and expanded product sales, these larger enterprises may undertake a more significant evaluation and negotiation processes than we have experienced in the past, which could lengthen our sales cycle materially.

In addition, our sales efforts typically involve educating our prospective large customers about the uses, benefits, and value proposition of our network and products. Our sales force develops relationships directly with our customers and our channel partners through account penetration, account coordination, sales, and overall market development. Potential large customers often view the subscription to our products, including any expansion of those subscriptions, as a significant strategic decision and, as a result, in some cases require considerable time to evaluate, test, and qualify our network and products prior to entering into or expanding a relationship with us. As a result, we spend substantial time and resources on our sales efforts without any assurance that our efforts will produce a sale. Subscriptions to our products, including expanded subscriptions, often are subject to budget constraints, multiple approvals, and unanticipated administrative, processing, and other delays. As a result, it is difficult to predict whether or when a sale to a prospective large customer will be completed, how much incremental revenue will result from such sales, and when revenue from a subscription will be recognized or will cease.

Further, our ability to improve our sales of products to large customers is dependent on us continuing to attract and retain sales personnel with experience in selling to larger enterprises. Also, because security breaches or a network outage with respect to larger, high-profile enterprises are likely to be heavily publicized, there is increased liability and reputational risks associated with serving these customers if we experience a security breach or network outage. We also believe that large customers may be more likely than our smaller customers to terminate or reduce their usage of our products in such circumstances.

Once we begin selling to a large customer or expand our sales to a large customer, if we fail to retain the large customer or to retain the same amount of sales to the large customer, then the adverse impact on our result of operations and financial conditions could be significant during any specific quarter and could also result in potentially greater and unexpected variability in our results of operations and financial condition from quarter to quarter.

Activities of our paying and free customers or the content of their websites or other Internet properties, as well as our response to those activities, could cause us to experience significant adverse political, business, and reputational consequences with customers, employees, suppliers, government entities, and others.

Although offering a free plan for certain of our products is an important part of our business strategy, we may not be able to realize all of the expected benefits of this strategy and the costs and other detriments associated with our free plan could outweigh the benefits we receive from our free customers.

We face intense and increasing competition, which could adversely affect our business, financial condition, and results of operations.

Our competitors provide both on-premises, appliance-based solutions, and cloud-based services that have functionality similar to our network and products. We expect competition to increase as other established and emerging companies and start-ups enter the markets for products and solutions for security, performance, and reliability, in particular with respect to cloud-based solutions, as customer requirements evolve and as new products, services, and technologies are introduced. If we are unable to anticipate or effectively react to these competitive challenges, our competitive position could weaken, and we could experience a decline in revenue or our growth rate that could materially and adversely affect our business and results of operations.

Our potential competitors include large companies with substantial infrastructure, such as global telecommunications services provider partners and public cloud providers. These companies could choose to enter the markets for products and solutions for security, performance, and reliability, including by acquiring existing companies, developing their own internal solutions, or establishing cooperative relationships with businesses that may allow them to offer more comprehensive solutions or to offer solutions for lower prices or to adapt more quickly than us to new technologies and customer needs. As our business continues to grow and we increase our market share for various products and services, these larger companies may increase their focus on us as a competitor and the actions they undertake to compete with our business and products. Additionally, if an increasing portion of web content is housed on another company’s network or portions of the Internet are otherwise privatized, it could reduce the demand for our products and increase competitive pressure on us. These competitive pressures in our markets or our failure to compete effectively may result in price reductions, fewer subscriptions, reduced revenue and gross margin, increased net losses, and loss of market share.

Our current and potential future competitors include a number of different types of companies, including:

Many of our existing and potential competitors have or could have substantial competitive advantages including, among others:

In particular, some of our larger competitors have substantially broader and more diverse product and services offerings, which may allow them to leverage existing commercial relationships, incorporate functionality into existing products, sell products and services with which we compete at zero or negative margins, offer fee waivers and reductions or other economic and non-economic concessions, bundle products and solutions, maintain closed technology platforms, or render our products unable to interoperate with such platforms. If they were to engage in predatory practices, it could harm our existing product offerings or prevent us from creating viable products in other segments of the markets in which we participate. If our competitors are able to exploit their advantages or are able to persuade our customers or potential customers that their products are superior to ours, we may not be able to compete effectively and our business, financial condition, and results of operations may be materially affected.

If we do not effectively expand, train, and retain our sales force, we may be unable to add new contracted customers, or increase sales to our existing customers and our business would be adversely affected.

A majority of our revenue in the year ended December 31, 2021 was from contracted customers that were acquired through our inside and field sales teams, and we expect the amount of our revenue from these customers will continue to increase for the foreseeable future. As a result, our financial condition and results of operations are dependent to a significant degree on our ability to attract and retain qualified sales personnel and the ability of our dedicated sales personnel to acquire new contracted customers and expand our relationships with our existing contracted customers. Our sales representatives typically engage in direct interaction with our prospective contracted customers. Increasing our customer base and achieving broader market acceptance of our network and products will depend, to a significant extent, on our ability to expand and further invest in our sales and marketing operations and activities. There is significant competition for sales personnel with the advanced sales skills and technical knowledge we need. We believe that selling subscriptions to our products requires particularly talented sales personnel that understand both cloud-based and appliance-based solutions, as well as the key differences between them. Our ability to achieve significant growth in revenue in the future will depend, in large part, on our success in recruiting, training, and retaining sufficient numbers of these talented sales personnel in both the United States and international markets. In addition, our ability to effectively recruit and retain qualified sales personnel outside the United States is reduced if we do not have a local subsidiary and office in that country or, if we do have such a subsidiary and office, we will experience increased costs in operating in that country.

As we continue to focus on revenue growth, we are seeking to increase our rate of hiring sales personnel and any delays in making these sales hires could have an adverse impact on our ability to increase revenue, particularly with respect to our sales to contracted customers. In addition, new sales hires require significant training and may take significant time before they achieve full productivity. As a result, our new sales hires and planned sales hires may not become as productive as we would like or as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals. In addition, due to our rapid growth, a large percentage of our sales team is new to our company and inexperienced in selling subscriptions to our products, and therefore these personnel

may be less effective than our more seasoned employees. Experienced sales personnel are particularly sought after in our industry and we believe our company's recent growth and increased profile may result in increased efforts by other companies to hire our sales personnel. As a result, we may have to expend significant resources to retain our most productive sales employees. Even with considerable effort, we may be unsuccessful at retaining our experienced sales employees, which would adversely impact our business, results of operations, and financial condition.

Furthermore, hiring sales personnel in new countries, or expanding our existing presence in the countries in which we currently operate, requires upfront and ongoing expenditures that we may not recover if the sales personnel fail to achieve full productivity or that may be recovered on a more delayed basis than expected. We cannot predict whether, or when or to what extent, our sales will increase as we expand our sales force or how long it will take for sales personnel to become productive. If we are unable to hire, train, and retain a sufficient number of effective sales personnel, or the sales personnel we hire are not successful in obtaining new customers or increasing sales to our existing customer base, our business and future growth prospects will be materially and adversely affected.

If we fail to effectively manage our growth, we may be unable to execute our business plan, maintain high-quality levels of customer support, ensure the reliability and security of our network, adequately address competitive challenges, or maintain our corporate culture, and our business, financial condition, and results of operations would be harmed.

Managing our growth will require significant capital expenditures and allocation of valuable management and employee resources. If we fail to manage our expected growth, the uninterrupted and secure operation of our network and products and key business systems, our corporate culture, our compliance with the rules and regulations applicable to our operations, the quality of our products, and our ability to compete could suffer. Any failure to preserve our culture also could further harm our ability to retain and recruit personnel, innovate and create new products, operate effectively, and execute on our business strategy.

Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business.

We rely on our co-founders and other key technical, sales, and management personnel to grow our business, and the loss of one or more key employees or the inability to attract and retain qualified personnel could harm our business.

To execute our growth plan, we must attract and retain large numbers of highly qualified personnel in a number of job markets globally. In particular, it is critical for us to attract and retain engineering talent in our fast growing industry. Competition for these personnel in the San Francisco Bay Area, where our headquarters is located, and in London, Singapore, Austin, Texas, and other locations where we maintain offices or employ remote personnel, is intense, especially for experienced sales professionals and for engineers experienced in designing and developing cloud applications. We have from time to time experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications. For example, in recent years, recruiting, hiring, and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of high-profile cybersecurity attacks on global corporations

and governments. Many of the companies with which we compete for experienced personnel have greater resources than we have and may provide higher levels of compensation or benefits. In addition, job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment. Volatility or lack of performance in our stock price may affect our ability to attract and retain our key employees. In addition, upon vesting of equity awards, particularly after the significant increase in the price of our Class A common stock since our initial public offering (IPO) in 2019, many of our employees have acquired or may soon acquire a substantial amount of personal wealth. This may make it more difficult for us to retain and motivate these employees, and this wealth could affect their decision about whether or not they continue to work for us. Any failure to successfully attract, integrate, or retain qualified personnel to fulfill our current or future needs could materially and adversely affect our business, results of operations, and financial condition.

We believe our long-term value as a company will be greater if we focus on growth, which may negatively impact our profitability.

If we are not able to maintain our brand, our business and results of operations may be adversely affected.

Independent industry and financial analysts often provide reviews of our products, as well as those of our competitors. Perception of our offerings in the marketplace may be significantly influenced by these expert reviews. In addition, the difficulty or inability of us to periodically provide certain types of financial information about our business and products requested by industry analysts could adversely impact these analysts’ reviews of our products. If reviews of our products are negative, or less positive than those of our competitors’, our brand may be adversely affected. The performance of our channel partners also may affect our brand and reputation, particularly if customers do not have a positive experience with our channel partners. The promotion of our brand requires us to make substantial expenditures, and we anticipate that the expenditures will increase as our markets become more competitive and we expand into new markets. Expenditures intended to maintain and enhance our brand may not be cost-effective or effective at all. If we do not successfully maintain and enhance our brand, we may have reduced pricing power relative to our competitors, we could lose customers, or we could fail to attract potential new customers or expand sales to our existing customers, all of which could materially and adversely affect our business, results of operations, and financial condition.

Adverse economic conditions, including reduced spending on products and solutions for network security, performance, and reliability, may adversely impact our revenue and profitability.

Our relatively limited operating history makes it difficult to evaluate our current business and prospects and may increase the risk that we will not be successful.

We have limited experience with our pricing models, particularly for our newer products and solutions, and we may not accurately predict the long-term rate of paying customer adoption or renewal, or the impact these will have on our revenue or results of operations.

We also have limited experience in determining which products and functionality to offer as part of our subscription plans and which to offer as add-on products. Our limited experience in determining the optimal manner in which to bundle our various products and functionalities could reduce our ability to capture the value delivered by our offerings, which could adversely impact our business, results of operations, and financial condition.

Our growth depends, in part, on the success of our strategic relationships with third parties, and if we fail to continue to expand, grow, and retain these relationships then our business, results of operations, and financial condition may be adversely impacted.

Our ability to maintain customer satisfaction depends in part on the quality of our customer support. Failure to maintain high-quality customer support could have an adverse effect on our business, results of operation, and financial condition.

We also rely on channel partners in order to provide frontline support to some of our customers, including in regions where we do not have a significant physical presence or the customers primarily speak languages other than English. If our channel partners do not provide support to the satisfaction of our customers, we may be required to hire additional personnel and to invest in additional resources in order to provide an adequate level of support, generally at a higher cost than that associated with our channel partners. There can be no assurance that we will be able to hire sufficient support personnel as and when needed, particularly if our sales exceed our internal forecasts. To the extent that we are unsuccessful in hiring, training, and retaining adequate support resources, our ability to provide high-quality and timely support to our customers will be negatively impacted, and our customers’ satisfaction with our network and products could be adversely affected. Any failure to maintain high-quality customer support, or a market perception that we do not maintain high-quality customer support, could adversely affect our reputation, business, results of operations, and financial condition, particularly with respect to our large customers.

Our business depends, in part, on sales to the United States and foreign government organizations, which are subject to a number of challenges and risks.

In addition, we must comply with laws and regulations relating to the formation, administration, and performance of contracts with the public sector, including U.S. federal, state, and local governmental organizations, as well as foreign governmental organizations, which affect how we and our channel partners do business with governmental agencies. Selling our products to the U.S. government, whether directly or through channel partners, also subjects us to certain regulatory and contractual requirements, including expanded compliance obligations under the Federal Acquisition Regulations (FARs). Failure to comply with these requirements by either us or our channel partners could subject us to investigations, fines, and other penalties, which could have an adverse effect on our business, results of operations, and financial condition. For example, the U.S. Department of Justice (the DOJ) and the General Services Administration (the GSA) have in the past pursued claims against and financial settlements with vendors under the False Claims Act and other statutes related to pricing and discount practices and compliance with certain provisions of GSA contracts for sales to the federal government. The DOJ and GSA continue to actively pursue such claims. Violations of certain regulatory and contractual requirements could also result in us being suspended or debarred from future government contracting. Any of these outcomes could have a material adverse effect on our revenue, results of operations, and financial condition. Any inability to address these risks and challenges could reduce the commercial benefit to us or otherwise preclude us from selling subscriptions to our products to government organizations.

We rely on third-party software for certain essential financial and operational services, and a failure or disruption in these services could materially and adversely affect our ability to manage our business effectively.

Our business is exposed to risks associated with credit card and other online payment processing methods.

Because we recognize revenue from subscriptions for our products over the term of the subscription, downturns or upturns in new business may not be immediately reflected in our results of operations and may be difficult to discern.

By contrast, a significant majority of our costs are expensed as incurred, which occurs as soon as a customer starts using our network and products. As a result, an increase in customers could result in our recognition of more costs than revenue in the earlier portion of the subscription term. We may not attain sufficient revenue to maintain positive cash flow from operations or achieve profitability in any given period.

If our estimates, assumptions, or judgments relating to our critical accounting policies prove to be incorrect or financial reporting standards or interpretations change, our results of operations could be adversely affected.

Additionally, we regularly monitor our compliance with applicable financial reporting standards and review new pronouncements and drafts thereof that are relevant to us. As a result of new standards, or changes to existing standards, and changes in their interpretation, we might be required to change our accounting policies, alter our operational policies and implement new or enhance existing systems so that they reflect new or amended financial reporting standards, or we may be required to restate our published financial statements. Such changes to existing standards or changes in their interpretation may have an adverse effect on our reputation, business, financial

condition, and profit and loss, or cause an adverse deviation from our revenue and operating profit and loss target, which may negatively impact our results of operations.

Future acquisitions, strategic investments, partnerships, or alliances could be difficult to identify and integrate, divert the attention of key management personnel, disrupt our business, dilute stockholder value, and adversely affect our results of operations, financial condition, and prospects.

In order to expand our network and product offerings, we also may enter into relationships with other businesses, which could involve joint ventures, preferred or exclusive licenses, additional channels of distribution, or investments in other companies. Negotiating these transactions can be time-consuming, difficult, and costly, and our ability to close these transactions may be subject to third-party approvals, such as government regulatory approvals, which are beyond our control. Consequently, we cannot assure you that these transactions, once undertaken and announced, will close or will lead to commercial benefit for us.

In connection with the foregoing strategic transactions, we may:

These challenges related to acquisitions or other strategic transactions could adversely affect our business, results of operations, financial condition, and prospects.

Certain of our key business metrics could prove to be inaccurate, and any real or perceived inaccuracies may harm our reputation and negatively affect our business.

We rely on assumptions and estimates to calculate certain of our key business metrics, such as dollar-based net retention rate. We regularly review and may adjust our processes for calculating our key business metrics to improve their accuracy. Our key business metrics may differ from estimates published by third parties or from similarly titled metrics of our competitors due to differences in methodology. If investors or analysts do not perceive our key business metrics to be accurate representations of our business, or if we discover material inaccuracies in our key business metrics, our reputation, business, results of operations, and financial condition would be harmed.

We may need additional capital, and we cannot be certain that additional financing will be available on favorable terms, or at all.

Problems with our internal systems, networks, or data, including actual or perceived breaches or failures, could cause our network or products to be perceived as insecure, underperforming, or unreliable, our customers to lose trust in our network and products, our reputation to be damaged, and our financial results to be negatively impacted.

There can be no assurance that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats, and we cannot guarantee that our systems and networks or those of our third-party service providers have not been breached or otherwise compromised, or that they and any software in our or their supply chains do not contain bugs, vulnerabilities, or compromised code that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support us and our services. Unauthorized access to, other security breaches of, or security incidents affecting, systems, networks, and data used in our business, including those of our vendors, contractors, or those with which we have strategic relationships, even if not resulting in an actual or perceived introduction of ransomware, malware, or other malicious code or other actual or perceived breach of our customers’ networks, systems, or data, could result in the loss, compromise, corruption or other unavailability of data, disruptions to our and our customers' products, systems, networks, and operations, loss of business, reputational damage adversely affecting customer or investor confidence, regulatory investigations and orders, litigation, indemnity obligations, damages for contract breach, penalties for violation of applicable laws or regulations, significant costs for remediation, and other liabilities.

Additionally, in the absence of malicious actions, our network and products may experience errors, failures, vulnerabilities, or bugs that cause our products not to perform as intended and the likelihood of these problems may increase as we continue to expand the number and complexity of products that we offer to our customers through our global network. For example, from time to time we are subject to “route leaks” that involve the accidental or, less commonly, illegitimate advertisement of prefixes, or blocks of IP addresses, which propagate across networks such as ours and can lead to incorrect routing of traffic across our network, taking traffic offline, or in extreme cases, potential interception of customers’ traffic by attackers. For example, in June 2019, a route leak spread by a major telecommunications services provider caused significant disruption to our traffic and that of many other providers. Although events like this are outside our control, they could materially harm our reputation and diminish the confidence of our current and potential customers in our network and products. In addition, deployment of our network and products into other computing environments may expose these errors, failures, vulnerabilities, or bugs in our products. Any such errors, failures, vulnerabilities, or bugs may not be found until after they are deployed to our customers and may create the perception that our network and products are insecure, underperforming, or unreliable. For example, in July 2019, we deployed an update to our web application firewall and certain aspects of the related software code resulted in excessive consumption of computing resources across our network, resulting in an outage on our network. In April 2020, our core co-location facility in the U.S. Pacific Northwest experienced an outage of approximately 4-1/2 hours as a result of an error that occurred during planned maintenance activities at that facility and, during the outage, our customers lost access to certain features included in our products. In July 2020, a configuration error in our backbone network caused increased latency and slowness for customers using our products in certain areas lasting approximately 30 minutes. While the June 2019 route leak and the July 2019, April 2020, and July 2020 outages did not have a material impact on our results of operations or financial condition, any similar events that may occur in the future may have a material adverse impact on our results of operations or

financial condition. In addition, in the event network outages or similar events occur, these events can require additional capital expenditures to lessen the chance that similar events will occur in the future.

We also provide frequent updates and enhancements to our network and products, which increase the possibility of errors. Our quality assurance procedures and efforts to report, track, and monitor issues with our network may not be sufficient to ensure we detect any such defects in a timely manner. For example, in February 2017, a bug in our software code that processes computer information requests was identified. Instead of the requested data, in certain circumstances this bug, which became known as “Cloudbleed,” caused our servers to output data that was not requested. The erroneous data output by our system included, but was not limited to, a portion of our customers’ secure data. There can be no assurance that our software code is or will remain free from actual or perceived errors, failures, vulnerabilities, or bugs, or that we will accurately route or process all requests and traffic on our network. Given the trillions of Internet requests that route through our network on a monthly basis and the large array of Internet properties (e.g., domains, websites, application programming interfaces (APIs), and mobile applications) we service, the impact of any such error, failure, vulnerability, or bug can be large in terms of absolute numbers of affected requests and customers.

Actual or perceived problems with our network or systems, or those of our vendors, contractors, or those with which we have strategic relationships, could result in actual or perceived breaches of our or our customers’ networks and systems or data. Actual or perceived breaches or other security incidents from these or other causes could lead to claims and litigation, indemnity obligations, regulatory audits, proceedings, and investigations and significant legal fees, significant costs for remediation, the expenditure of significant financial resources in efforts to analyze, correct, eliminate, remediate, or work around errors or defects, to address and eliminate vulnerabilities, and to address any applicable legal or contractual obligations relating to any actual or perceived security breach or incident. They also could damage our relationships with our existing customers and have a negative impact on our ability to attract and retain new customers. Because our business is focused on providing secure and high performing network services to our customers, we believe that our products and the networks and systems we use in our business could be targets for hackers and others, and that an actual or perceived breach of, or security incident affecting, our networks, systems, or data, could be especially detrimental to our reputation, customer and channel partner confidence in our solution, and our business. Additionally, our products are designed to operate without interruption, including up to a 100% uptime guarantee for our Business and Enterprise plans. If a breach or security incident were to impact the availability of our network and products, our business, results of operations, and financial condition, as well as our reputation, could be adversely affected.

Any cybersecurity insurance that we carry may be insufficient to cover all liabilities incurred by us in connection with any privacy or cybersecurity incidents or may not cover the kinds of incidents for which we submit claims. For example, insurers may consider cyber attacks by a nation-state as an “act of war” and any associated damages as uninsured. We also cannot be certain that our insurance coverage will be adequate for data handling or data security liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, results of operations, and financial condition, as well as our reputation.

If our global network that delivers our products or the core co-location facilities we use to operate our network are damaged, interfered with, or otherwise fail to meet the requirements of our business or local regulations, our ability to provide access to our network and products to our customers and maintain the performance of our network could be negatively impacted, which could cause our business, results of operations and financial condition to suffer.

As we have expanded our global network, for efficiency reasons we have increased the amount of automation that is used to update and maintain our network. While we believe this increased automation generally makes our network more reliable and robust, if portions of this automation were to fail then the impact could apply to all or substantially all of our co-location facilities, instead of the more localized impact if we were not using automation. In addition, the components of our global network are interrelated, such that disruptions or outages affecting one or more of our network co-location facilities may increase the strain on other components of our network. Concurrent disruptions or outages at a number of our network co-location facilities may lead to a cascading effect in which heightened strain on our network causes further disruptions or outages, particularly within the regions where the disruptions and outages occur. In addition, the failure of any of our core co-location facilities for any significant period of time, particularly our U.S. core co-location facility, could place a significant strain upon the ongoing operation of our business, as we have only limited redundant functionality for these facilities. Such a failure of a core co-location facility could degrade and slow down our network, reduce the functionality of our products for our customers, impact our ability to bill our customers, and otherwise materially and adversely impact our business, reputation, and results of operations.

If our customers’ or channel partners’ access to our network and products is interrupted or delayed for any reason, our business could suffer.

The following factors, many of which are beyond our control, can affect the delivery, performance, and availability of our network and products:

The occurrence of any of these factors, or our inability to efficiently and cost-effectively fix such errors or other problems that may be identified, could damage our reputation, negatively impact our relationship with our customers, or otherwise materially harm our business, results of operations, and financial condition.

Detrimental changes in, or the termination of, any of our co-location relationships, ISP partnerships, or our other interconnection relationships with ISPs could adversely impact our business, results of operations, and financial condition.

The efficient and effective operation of our network also relies upon a series of mutually beneficial arrangements with other Internet infrastructure companies. These arrangements are often referred to as “peering” or “interconnection” agreements, and allow us and our ISP partners to reduce bandwidth costs related to operating our respective networks. If the underlying competitive, business, or operational incentives supporting these arrangements were to change, we or our partners might terminate these agreements or allow them to expire. Many of our peering or interconnection agreements have a term of three years or less, after which such agreements auto-renew on an annual basis. Changes to the underlying incentive structure of peering arrangements may result from parties seeking to take advantage of an essential position or enter into exclusive arrangements, changes to U.S. or international laws, regulations, or policies, increasing competition between us and these Internet infrastructure providers, or changes in the norms governing the relationships among Internet infrastructure providers. Without

favorable peering arrangements, we would incur significantly increased costs to continue to provide our products at their current levels and such increased costs could adversely impact our business, results of operations, and financial condition. In addition, to the extent that additional countries begin to regulate peering with outside networks, our costs may increase and our business and results of operations could be adversely impacted.

If our network and products do not interoperate with our customers’ internal networks and infrastructure or with third-party products, websites, or services, our network may become less competitive and our results of operations may be harmed.

We may not deliver or maintain interoperability quickly or cost-effectively, or at all. These efforts require capital investment and engineering resources. If we fail to maintain compatibility of our network and products with our customers’ internal networks and infrastructures, our customers may not be able to fully utilize our network and products, and we may, among other consequences, lose or fail to increase our market share and number of customers and experience reduced demand for our products, which would materially harm our business, results of operations, and financial condition.

Because we provide some of our products through a reverse-proxy, which is a network arrangement in which Internet user requests initially are directed to our network’s servers rather than those of our customers, the source of some traffic may be difficult to ascertain. When they cannot identify the source of the traffic, some governments, third-party products, websites, or services may block our traffic or blacklist our IP addresses. If our customers experience significant instances of traffic blockages, they will experience reduced functionality or other inefficiencies, which would reduce customer satisfaction with our network and products and likelihood of renewal.

We rely on a limited number of suppliers for certain components of the equipment we use to operate our network and any disruption in the availability of these components could delay our ability to expand or increase the capacity of our global network or replace defective equipment.

The actual or perceived failure of our products to block malware or prevent a security breach or incident could harm our reputation and adversely impact our business, results of operations, and financial condition.

Companies are increasingly subject to a wide variety of attacks on their networks and systems, including traditional computer hackers; malicious code, such as viruses and worms; distributed denial-of-service attacks; sophisticated attacks conducted or sponsored by nation-states; advanced persistent threat intrusions; ransomware; phishing attacks and other forms of social engineering; employee, vendor, or contractor errors or malfeasance; and theft or misuse of intellectual property or business or personal data, including by disgruntled employees, former employees, or contractors. External events, like the ongoing conflict between Russia and Ukraine, can increase the likelihood of attacks. No security solution, including our products, can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security incident. Accordingly, our security products may be unable to detect or prevent a threat until after our customers are impacted. As our products are adopted by an increasing number of enterprises and by increasingly larger enterprises, it is possible that the individuals and organizations behind cyber threats will focus on identifying ways to circumvent or defeat our security products. If our network is targeted by attacks specifically designed to disrupt it, it could create the perception that our security products are not capable of providing adequate security. As a provider of security products, any perceived lack of security to our network or any of our products could erode our customers’ and potential customers’ trust in our network and products. Moreover, a high-profile security breach of, or security incident impacting, another cloud services provider could cause our customers and potential customers to lose trust in cloud solutions generally, and cloud-based products like ours in particular. Any such loss of trust could materially and adversely impact our ability to retain existing customers or attract new customers.

Our customers must rely on complex network and security infrastructures, which include products and services from multiple vendors, to secure their networks. If any of our customers becomes infected with malware, or experiences a security breach or incident, they could be disappointed with our products, regardless of whether our security products are intended to block the attack or would have blocked the attack if the customer had properly configured our products or their network, or taken other steps within their control. For example, in April 2017, we published details of a web cache deception attack method that exploits the misconfiguration of websites to circumvent reverse-proxy systems such as ours. While the vulnerability associated with this attack method relates to misconfiguration of websites outside of our control, a customer experiencing a security event related to this vulnerability may nevertheless blame us or become dissatisfied with our products as a result. Additionally, if any enterprises that are publicly known to use our network and products are the subject of a cyber attack that becomes publicized, this could harm our reputation and our current or potential customers may look to our competitors for alternatives to our network and products. Customers subject to cyber attack also may seek to hold us legally liable for any loss or lack of access to sensitive data or highly valued assets that results from such an attack. Although our customer agreements provide significant limitations on our potential liability to our customers for such claims and we do not believe current legal theories would hold a service provider like us liable for such customers’ losses, potential adverse future changes in laws applicable to such claims could result in significant liabilities for us.

From time to time, industry or financial analysts and research firms test our network and related security products against other security products. Our products may fail to detect or prevent threats in any particular test for a number of reasons, including misconfiguration. To the extent potential customers, industry or financial analysts, or testing firms believe that the occurrence of a failure to detect or prevent any particular threat is a flaw or indicates that our products do not provide significant value or provide less value than competitive solutions, our reputation and business could be materially harmed.

Any real or perceived flaws in our network, or any actual or perceived security breaches of, or security incidents impacting, our customers, could result in:

Any of the above results could materially and adversely affect our business, results of operations, and financial condition.

Abuse, misuse, or other unauthorized use of our internal network, including network services tools, could cause significant harm to our business and reputation.

We may choose to make public disclosures in press releases, on our website and blog, through social media, and in other ways about our network, systems, products, and technology, which may include negative events, when we are not otherwise required by applicable law and those disclosures could materially and adversely impact our business, reputation, and results of operations.

We provide service level commitments under our Enterprise subscription plan customer contracts and our Business subscription plan terms of service. If we fail to meet these contractual commitments, we could be obligated to provide credits for future service or allow customers to terminate their subscriptions and our business could suffer.

If our products do not obtain and maintain market acceptance, our ability to grow our business and our results of operations may be adversely affected.

Despite our efforts, we can provide no assurance that our cloud-based products will obtain market acceptance or that competing products or services based on other cloud-based and/or on-premises technologies will not achieve market acceptance. If we fail to achieve market acceptance of our products or are unable to keep pace with industry changes or obtain necessary product certifications, our ability to grow our business, results of operations, and financial condition will be materially and adversely affected.

We may not be able to respond to rapid technological changes or develop new products and features that are attractive to our current and prospective future customers.

Our ability to attract new customers and increase revenue from existing customers will depend in significant part on our ability to anticipate and respond effectively to these forces on a timely basis and continue to introduce enhancements to our network and develop new products. If new technologies emerge that deliver competitive products and services at lower prices, more efficiently, more conveniently, more securely or reliably, or are higher performing, these technologies could render our network and existing products less attractive to our current and

prospective future customers, or obsolete. The development of novel attacks or exploits by criminal or malicious elements or hostile state actors also could render our network and existing products less effective or obsolete. The success of our business depends on our continued investment in our research and development organization to increase the integrity, reliability, availability, and scalability of our products. We may experience difficulties with development, design, or marketing of such enhancements to our network and products that could delay or prevent their development, introduction, or implementation. For example, in the past we have announced the development of new products and features or the release of new products or features for beta testing and the timing for the general release of the product or feature has been substantially later than we initially expected. We also have in the past experienced delays in the planned expansion of our network and in our internally planned or publicly announced release dates of new products and new features and capabilities, and there can be no assurance that planned expansions of our network will occur on schedule and that new products, features, or capabilities will be released according to schedule. Any delays could result in adverse publicity, loss of revenue or market acceptance, or claims by customers brought against us, all of which could have a material and adverse effect on our reputation, business, results of operations, and financial condition.

Activities of our paying and free customers or the content of their websites and other Internet properties may violate applicable laws and/or our terms of service and could subject us to lawsuits, regulatory enforcement actions, and/or liability in various jurisdictions.

Several U.S. federal statutes may apply to us with respect to various activities of our customers, including: the Digital Millennium Copyright Act (the DMCA), which provides recourse for owners of copyrighted material who believe their rights under U.S. copyright law have been infringed on the Internet; and section 230 of the Communications Decency Act (the CDA), which addresses blocking and screening of content on the Internet. Although these and other similar legal provisions provide limited protections from liability for service providers like us, those protections may not be interpreted in a way that applies to us, may be amended or removed in the future, or may not provide us with complete protection from liability claims. If we are found not to be protected by the safe harbor provisions of the DMCA, CDA or other similar laws, or if we are deemed subject to laws in other countries that may not have the same protections or that may impose more onerous obligations on us, we may owe substantial damages and our brand, reputation, and financial results may be harmed.

Policies and laws in this area remain highly dynamic, and we may face additional theories of intermediary liability in various jurisdictions. Many policymakers in the United States have called for a re-examination of CDA section 230 and the EU is negotiating a new Digital Services Act and Digital Markets Act to update the rules governing digital services like ours, including replacing the eCommerce Directive and imposing additional legal requirements on service providers. In addition, in 2019, the EU approved a Copyright Directive that will impose additional obligations on service providers and failure to comply could give rise to significant liability. Other laws and pending legislation at the EU level (terrorist content, child sexual abuse materials), in the United Kingdom (online harms), Australia (online harms), and India (Information Technology Rules), as well as other new laws like them, may also expose Internet companies like us to significant liability. We may incur additional costs to comply with these new laws, which may have an adverse effect on our business, results of operations, and financial condition.

Current and future litigation subjects us to claims for very large potential damages based on a significant number of online occurrences under statutory or other damage theories. Such claims may result in liability that exceeds our ability to pay or our insurance coverage. Even if claims against us are ultimately unsuccessful, defending against such claims will increase our legal expenses and divert management’s attention from the operation of our business, which could materially and adversely impact our business and results of operations.

Our policies regarding user privacy could cause us to experience adverse business and reputational consequences with customers, employees, suppliers, government entities, and other third parties.

We publish a transparency report on a semi-annual basis to provide details of law enforcement and government requests we receive. Our transparency report also includes a list of certain actions we have not taken in response to law enforcement requests. If we are ever required by law enforcement to take one or more of the actions covered by those disclosures, then we would have to remove the applicable disclosures from our transparency report. Both the publishing of our transparency report and, conversely, the potential narrowing of the list of actions we have not taken in response to law enforcement requests could damage our business and reputation.

Our business could be adversely impacted by changes in Internet access for our customers as a result of competitive behavior or laws specifically governing the Internet.

In addition, there are various laws and regulations that could impede the growth of the Internet or online services, and new laws and regulations may be adopted in the future. These laws and regulations could involve interconnection and network management; taxation; tariffs; privacy; data protection; information security; content; copyrights; distribution; electronic contracts and other communications; consumer protection; and requirements for the characteristics and quality of services, any of which could decrease the demand for, or the usage of, our

products. Legislators and regulators may make legal and regulatory changes, or interpret and apply existing laws, in ways that require us to incur substantial costs, expose us to unanticipated civil or criminal liability, or cause us to change our business practices. If these changes are implemented, it could have an adverse and negative impact on our business. In addition, we may be banned from providing our products in certain countries, which would prevent our ability to grow our business in such markets and would also have a detrimental impact on the performance and scope of our network. Russia, for example, announced their intent to block designated virtual private networks in December 2021, and has included one of our products, Cloudflare WARP, to its list of banned services. These changes or increased costs could materially harm our business, results of operations, and financial condition.

Failure to comply with laws and regulations applicable to our business could subject us to fines and penalties and could also cause us to lose customers or otherwise harm our business.

If any governmental sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, results of operations, and financial condition could be adversely affected. In addition, responding to any action will likely result in a significant diversion of our management’s attention and resources and an increase in professional fees. Enforcement actions and sanctions could materially harm our business, results of operations, and financial condition.

Additionally, companies in the technology industry have recently experienced increased regulatory scrutiny. The rapid growth of our business and the products that we offer may also result in increased regulatory scrutiny of our company in particular. Any reviews by regulatory agencies or legislatures may result in substantial regulatory fines, changes to our business practices, and other penalties, which could negatively affect our business and results of operations. Changes in social, political, and regulatory conditions or in laws and policies governing a wide range of topics may cause us to change our business practices. Further, our expansion into a variety of new fields also could raise a number of new regulatory issues. These factors could negatively affect our business and results of operations in material ways.

Our actual or perceived failure to comply with privacy, data protection, and information security laws, regulations, and obligations could harm our business.

We are subject to anti-corruption, anti-bribery, and similar laws, and noncompliance with such laws can subject us to criminal penalties or significant fines and harm our business and reputation.

We cannot assure you that all of our employees and agents have complied with, or in the future will comply with, our policies and applicable law. As we continue to increase our international sales and business and expand our network globally, our risks under these laws may increase. The investigation of possible violations of these laws, including internal investigations and compliance reviews that we may conduct from time to time, could have a material adverse effect on our business. Noncompliance with these laws could subject us to investigations, severe criminal or civil sanctions, settlements, prosecution, loss of export privileges, suspension or debarment from U.S. government contracts and other contracts, other enforcement actions, the appointment of a monitor, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, whistleblower complaints, adverse media coverage and other consequences. Other internal and government investigations, regulatory proceedings, or litigation, including private litigation filed by our stockholders, may also follow as a consequence. Any investigations, actions, or sanctions could materially harm our reputation, business, results of operations, and financial condition. Further, the promulgation of new laws, rules or regulations or new interpretations of current laws, rules or regulations could impact the way the we do business in other countries, including requiring us to change certain aspects of our business to ensure compliance, which could reduce revenue, increase costs, or subject us to additional liabilities.

We may face fines, penalties, or other costs, either directly or vicariously, if any of our partners, resellers, contractors, vendors or other third parties fail to adhere to their compliance obligations under our policies and applicable law.

We may have exposure to greater than anticipated income tax liabilities and may be affected by changes in tax laws, which could adversely impact our results of operations.

Our tax provision could also be impacted by changes in accounting principles, changes in U.S. federal, state, or international tax laws applicable to corporate multinationals, other fundamental law changes currently being considered by many countries, and changes in taxing jurisdictions’ administrative interpretations, decisions, policies, and positions.

Additionally, in March 2018, the European Commission released a proposal for a European Council directive on taxation of specified digital services. The proposal calls for an interim tax on certain revenues from digital activities, as well as a longer-term regime that creates a taxable presence for digital services and imposes tax on digital profits. We do not yet know the impact this proposal, if implemented, would have on our financial results. A number of other jurisdictions are considering enacting similar digital tax regimes. These efforts are alongside the OECD’s ongoing work, as part of its Base Erosion and Profit Shifting Action Plan that, if implemented, provides a long-term, multilateral proposal on taxation of the digital economy. Any of the foregoing changes could have an adverse impact on our results of operations, cash flows, and financial condition.

Our results of operations may be harmed if we are required to collect sales and use, gross receipts, value-added, or similar taxes for our products in jurisdictions where we have not historically done so.

Our international operations require us to exercise judgment in determining the applicability of tax laws, which may subject us to potentially adverse tax consequences.

Our future effective tax rate may be affected by such factors as changes in tax laws, regulations, or rates, changing interpretation of existing laws or regulations, the impact of accounting for stock-based compensation, the impact of accounting for business combinations, changes in our international organization, and changes in our overall levels of income before tax. In addition, in the ordinary course of our global business, there are many intercompany transactions and calculations where the ultimate tax determination is uncertain. Although we believe that our tax estimates are reasonable, we cannot ensure that the final determination of tax audits or tax disputes will not be different from what is reflected in our historical income tax provisions and accruals. There can be no assurance that the outcomes from these continuous examinations will not have an adverse effect on our results of operations.

Our ability to use our net operating loss carryforwards and certain other tax attributes may be limited.

Utilization of our net operating loss carryforwards and other tax attributes, such as research and development tax credits, may be subject to annual limitations, or could be subject to other limitations on utilization or benefit due to the ownership change limitations provided by Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the Code), and other similar provisions. Under Sections 382 and 383 of the Code, if a corporation undergoes an “ownership change,” the corporation’s ability to use its pre-change net operating loss carryforwards and other pre-change attributes, such as research tax credits, to offset its post-change income may be limited. In general, an “ownership change” will occur if there is a cumulative change in our ownership by “5-percent shareholders” that exceeds 50 percentage points over a rolling three-year period. Similar rules may apply under state tax laws. We may have experienced various ownership changes, as defined by the Code, as a result of past financing transactions (or other activities), and we may experience ownership changes in the future as a result of subsequent changes in our stock ownership, some of which may be outside our control.

Our net operating loss carryforwards may also be subject to limitations in other jurisdictions. For example, California recently enacted legislation suspending the use of net operating losses for taxable years 2020, 2021, and 2022 for many taxpayers. Net operating loss carryforwards and other tax assets could expire before utilization and could be subject to limitations, which could harm our business, revenue, and financial results. It is also possible that Congress will enact additional legislation, some of which may adversely impact our business.

Our international operations expose us to significant risks, and failure to manage those risks could materially and adversely impact our business and results of operations.

The expansion of our existing international operations and entry into additional international markets will require significant management attention and financial resources. Our failure to successfully manage our international operations and the associated risks could limit the future growth of our business. In particular, we are exposed to risks in China, which amounts to a significant part of both our short-term and long-term revenue growth plans. Our Chinese operations are substantially dependent on our relationship with JD Cloud & AI and due to economic and political challenges in servicing the Chinese market, the loss of this arrangement could have a significant adverse effect on our business and results of operations.

Geo-political events, including the ongoing conflict between Russia and Ukraine, may increase the likelihood of certain of these risks materializing or heighten their impact on us in affected regions. In addition, heightened use of trade restrictions and sanctions, including tariffs or prohibitions on technology transfers to achieve diplomatic ends could impact our ability to conduct our business as planned.

Our business could be adversely impacted by the decision of foreign governments, Internet service providers, or others, to block transmission from Cloudflare IP addresses in order to enforce certain Internet content blocking efforts.

Our network presence within China is dependent upon our commercial relationship with JD Cloud & AI and any detrimental changes in, or the termination of, that relationship could jeopardize our ability to offer an integrated global network that includes China.

In 2019, we learned that we may have failed to comply with certain U.S. export-related filing and reporting requirements and may have submitted incorrect information to the U.S. government in connection with certain hardware exports. Upon learning of these potential violations and associated export control requirements, we promptly initiated a voluntary internal review and are taking remedial measures to prevent similar export control anomalies from occurring in the future. In May 2019, we submitted an initial voluntary self-disclosure to the Bureau of Industry and Security regarding potential violations of EAR and a voluntary self-disclosure to the Census Bureau regarding potential violations of the Foreign Trade Regulations. In July 2019, we filed the full and complete voluntary self-disclosures. The voluntary self-disclosure to the Census Bureau was completed with no penalties in November 2019. The voluntary self-disclosure to the Bureau of Industry and Security was completed with no penalties in June 2020.

In May 2019, we submitted an initial voluntary self-disclosure to OFAC related to our non-compliance with certain economic and trade sanctions programs, and we filed the full and complete voluntary self-disclosure to OFAC in July 2019. Specifically, we identified that our products were used by, or for the benefit of, certain individuals and entities included in OFAC’s Specially Designated Nationals and Blocked Persons List, including entities identified in OFAC’s counter-terrorism and counter-narcotics trafficking sanctions programs and individuals or entities affiliated with governments currently subject to comprehensive U.S. sanctions or located in regions subject to comprehensive sanctions. A small number of these parties made payments to us in connection with their use of our products. In January, July, September, and December 2020, as well as March, June, September, and November 2021 we responded to additional questions from OFAC. The voluntary self-disclosure, which we may supplement as appropriate, remains under review by OFAC.

Although we have implemented, and are working to implement additional controls and screening tools designed to prevent similar activity from occurring in the future, there is no guarantee that we will not inadvertently provide our products to additional individuals, entities, or governments prohibited by U.S. sanctions in the future.

Additionally, we currently provide products to certain OFAC-sanctioned regions based upon general licenses issued by OFAC to engage in such activity. We continue to review the OFAC sanctions and our practices to verify compliance.

These efforts related to export controls and OFAC sanctions could result in negative consequences for us, including costs related to government investigations, financial penalties and harm to our reputation. The impact on us related to these matters could be substantial.

In addition, various countries regulate the import of certain technologies and have enacted or could enact laws that could limit our ability to provide our products and operate our network or could limit our customers’ ability to access or use our network and products in those countries.

If we are found to have violated the U.S. or foreign laws and regulations, we and certain of our employees could be subject to civil or criminal penalties, including the possible loss of export privileges and fines. We may be materially and adversely affected through penalties, reputational harm, loss of access to certain markets, loss of customers, or otherwise. Obtaining the necessary authorizations, including any required license, for a particular transaction may be time-consuming, is not guaranteed, and may result in the delay or loss of sales opportunities. In addition, changes in our network, products, or screening process, or changes in export, sanctions, and import laws, could delay the introduction and sale of subscriptions to our products in international markets, prevent customers in certain countries from accessing our network and products or, in some cases, prevent the provision of our network and products to certain countries, governments, persons, or entities altogether. Any decrease in our ability to sell our products could materially and adversely affect our business, results of operations, and financial condition.

We are exposed to fluctuations in currency exchange rates, which could negatively affect our results of operations.

As our international operations expand, an increasing portion of our revenue and operating expenses is incurred outside the United States and is denominated in foreign currencies, such as the British Pound and Singapore Dollar. Accordingly, our revenue and operating expenses are increasingly subject to fluctuations due to changes in foreign currency exchange rates. As we continue to expand our international operations, we may become more exposed to foreign currency risk or remeasurement risk. If we become more exposed to currency fluctuations and are not able to successfully hedge against the risks associated with currency fluctuations, our results of operations could be materially and adversely affected.

We are currently, and may be in the future, party to intellectual property rights claims and other litigation matters that, if resolved adversely, could have a material impact on our business, results of operations, or financial condition.

Indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement and other losses.

From time to time, customers require us to indemnify or otherwise be liable to them for breach of confidentiality, violation of applicable law, or failure to implement adequate security measures with respect to their data stored, transmitted, or accessed using our network and products. Our standard Enterprise plan agreements provide limited indemnification to our customers based on third-party claims related to our violation of intellectual property rights, and some of our Enterprise plan agreements offer indemnification for claims beyond that scope. The existence of such a dispute may have adverse effects on our customer relationship and reputation and we may still incur substantial liability related to them.

Any assertions by a third party, whether or not successful, with respect to such indemnification obligations could subject us to costly and time-consuming litigation, expensive remediation and licenses, divert management attention and financial resources, harm our relationship with that customer and other current and prospective customers, reduce demand for our products, and harm our brand, business, results of operations, and financial condition.

Our failure to protect our intellectual property rights and proprietary information could diminish our brand and other intangible assets.

In order to protect our proprietary technologies and processes, we rely in part on trade secret laws and confidentiality agreements with our employees, consultants, and third parties. These agreements may not effectively prevent disclosure of confidential information and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. In addition, others may independently discover our trade secrets or develop similar technologies and processes, in which case we would not be able to assert trade secret rights against them. Laws in certain jurisdictions may afford little or no trade secret protection, and any changes in, or unexpected interpretations of, the intellectual property laws in any country in which we operate may compromise our ability to enforce our intellectual property rights. We may not be effective in policing unauthorized use of our intellectual property rights, and even if we do detect violations, costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights, and any such litigation could be unsuccessful, lead to the invalidation of our proprietary rights, or lead to counterclaims by other parties against us. If the protection of our proprietary rights is inadequate to prevent use or appropriation by third parties, the value of our network and products, brand, and other intangible assets may be diminished and competitors may be able to more effectively replicate our network and products and their features. Any of these events could materially and adversely affect our business, results of operations, and financial condition.

We depend and rely upon software and technologies licensed from third parties to operate our business, and interruptions or the unavailability of these technologies may adversely affect our products, network, business, and results of operations.

If we are unable to license necessary technology from third parties now or in the future, we may be forced to acquire or develop alternative technology, which we may be unable to do in a commercially feasible manner or at all, and we may be required to use alternative technology of lower quality or performance. This could limit and delay our ability to offer new or competitive products and increase our costs of production. As a result, our business and results of operations could be significantly harmed.

We cannot be certain that those from whom we license software and other technology are not infringing the intellectual property rights of third parties or have sufficient rights to the licensed intellectual property in all jurisdictions in which we may sell our products. Accordingly, our use of this intellectual property may expose us to third-party claims of infringement. In addition, many licenses are non-exclusive and may not prevent our competitors from licensing the same technology on equivalent or more favorable terms.

Some of our technology incorporates “open source” software, we license some of our software through open source projects and we voluntarily make available some of our software on an open source basis, which could negatively affect our ability to sell our products, subject us to possible litigation, and be used by other companies to compete against us.

Any unanticipated disclosure of, or litigation regarding, our source code and any open source software incorporated into our source code could result in adverse judgments and liabilities, require us to reengineer all or a portion of our network and products, limit the marketing of our products, provide an advantage to our competitors or other entrants to the market, create new security vulnerabilities or highlight existing security vulnerabilities in our network and products, and reduce or eliminate the value of our network and products. We cannot assure you that our processes for controlling our use of open source software in our network and products will be effective.

The trading price of our Class A common stock may be volatile, and you could lose all or part of your investment.

In addition, in the past, following periods of volatility in the overall market and the market price of a particular company’s securities, securities class action litigation has often been instituted against these companies. This litigation, if instituted against us, could result in substantial costs and a diversion of our management’s attention and resources.

The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our initial public offering, and it may depress the trading price of our Class A common stock.

Future transfers by holders of shares of Class B common stock and the cessation of employment by holders of our Class B common stock generally result in those shares converting to Class A common stock, subject to limited exceptions, such as certain transfers effected for estate planning purposes and transfers between related entities. The conversion of Class B common stock to Class A common stock will have the effect, over time, of increasing the relative voting power of those individual holders of Class B common stock who retain their shares in the long-term.

In July 2017, FTSE Russell and Standard & Poor’s announced that they would cease to include most newly public companies utilizing dual or multi-class capital structures in their indices. Affected indices include the Russell 1000, Russell 2000, and Russell 3000 and the S&P 500, S&P MidCap 400, and S&P SmallCap 600, which S&P indices together make up the S&P Composite 1500. Under the announced policies, our multi-class capital structure in some cases may make us ineligible for inclusion in some or all of these indices, and as a result, mutual funds, exchange-traded funds, and other investment vehicles that attempt to passively track these indices may not invest in our stock if we are not included. It is unclear what effect, if any, these policies have on the valuations of publicly traded companies excluded from the indices, but it is possible that they may depress these valuations compared to those of other similar companies that are included.

Substantial future sales could depress the market price of our Class A common stock.

The market price of our Class A common stock could decline as a result of sales of a large number of shares of such stock, and the perception that these sales could occur may also depress the market price of our Class A common stock.

Under our investors’ rights agreement, certain stockholders can require us to register shares owned by them for public sale in the United States. In addition, we file registration statements to register shares reserved for future issuance under our equity compensation plans. As a result, subject to the satisfaction of applicable exercise

periods, the shares issued upon exercise of outstanding stock options or upon settlement of outstanding RSU awards are available for immediate resale in the United States in the open market.

We have broad discretion over the use of the net proceeds from our financing activities, and we may not use them effectively.

Delaware law and provisions in our amended and restated certificate of incorporation and amended and restated bylaws could make a merger, tender offer, or proxy contest difficult, thereby depressing the market price of our Class A common stock.

These anti-takeover defenses could discourage, delay, or prevent a transaction involving a change in control of our company. These provisions could also discourage proxy contests and make it more difficult for stockholders to elect directors of their choosing and to cause us to take other corporate actions they desire, any of which, under certain circumstances, could limit the opportunity for our stockholders to receive a premium for their shares of our capital stock, and could also affect the price that some investors are willing to pay for our Class A common stock.

Our amended and restated bylaws provide that the Court of Chancery of the State of Delaware and the federal district courts of the United States will be the exclusive forums for substantially all disputes between us and our stockholders, which could limit our stockholders’ ability to choose the judicial forum for disputes with us or our directors, officers or employees.

Any person or entity purchasing or otherwise acquiring any interest in any of our securities shall be deemed to have notice of and consented to this provision. These exclusive-forum provisions may limit a stockholder’s ability to bring a claim in a judicial forum of its choosing for disputes with us or our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees. If a court were to find the exclusive-forum provision in our amended and restated bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving the dispute in other jurisdictions, which could harm our results of operations.

Our Class A common stock market price and trading volume could decline if equity or industry analysts do not publish research or publish inaccurate or unfavorable research about our business.

An active trading market for our Class A common stock may not be sustained.

We do not intend to pay dividends for the foreseeable future.

In May 2020, we issued $575.0 million in aggregate principal amount of the 2025 Notes and in August 2021, we issued $1,293.8 million in aggregate principal amount of the 2026 Notes. Our ability to make scheduled payments of the principal of, to pay interest on or to refinance our indebtedness, including the Notes, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control. Our

business may not generate cash flow from operations in the future sufficient to service our debt and make necessary capital expenditures. If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt, or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive. Our ability to refinance any future indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations. In addition, any of our future debt agreements may contain restrictive covenants that may prohibit us from adopting any of these alternatives. Our failure to comply with these covenants could result in an event of default which, if not cured or waived, could result in the acceleration of our debt.

In addition, our indebtedness, combined with our other financial obligations and contractual commitments, could have other important consequences. For example, it could:

Any of these factors could harm our business, results of operations, and financial condition. In addition, if we incur additional indebtedness, the risks related to our business and our ability to service or repay our indebtedness would increase.

The conditional conversion feature of the Notes, when triggered, may adversely affect our financial condition and operating results.

Transactions relating to the Notes may affect the value of our Class A common stock.

In connection with establishing their initial hedges of the capped call transactions, the applicable option counterparties or their respective affiliates entered into various derivative transactions with respect to our Class A common stock and/or purchased shares of our Class A common stock concurrently with or shortly after the pricing of the applicable series of Notes. From time to time, the option counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our Class A common stock and/or purchasing or selling our Class A common stock or other securities of ours in secondary market transactions prior to the maturity of the applicable series of Notes (and are likely to do so following any conversion, repurchase, or redemption of such Notes, to the extent we exercise the relevant election under the applicable capped call transactions). This activity could also cause a decrease and/or increased volatility in the market price of our Class A common stock.

We are subject to counterparty risk with respect to the capped call transactions.

If we fail to maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable regulations could be impaired.

The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting. We are continuing to develop and refine our disclosure controls and other procedures that are designed to ensure that information required to be disclosed by us in the reports that we file with the SEC is recorded, processed, summarized, and reported within the time periods specified in SEC rules and forms and that information required to be disclosed in reports under the Exchange Act is accumulated and communicated to our principal executive and financial officers. We are also continuing to improve our internal control over financial reporting. In order to maintain and improve the effectiveness of our disclosure controls and procedures and internal control over financial reporting, we have expended, and anticipate that we will continue to expend, significant resources, including accounting-related costs, and significant management oversight. In addition, our independent registered public accounting firm is required to audit the effectiveness of our internal control over financial reporting pursuant to Section 404(b) of the Sarbanes-Oxley Act annually. Testing, or the subsequent testing by our independent registered public accounting firm, may reveal material weaknesses or significant deficiencies. If material weaknesses are identified or we are not able to comply with the requirements of Section 404 in a timely manner, our reported financial results could be materially misstated, we could receive an adverse opinion regarding our internal control over financial reporting from our independent registered public accounting firm, we could be subject to investigations or sanctions by regulatory authorities, and we could incur substantial expenses.

Our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business. Further, weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future. Any failure to develop or maintain effective controls or any difficulties encountered in their implementation or improvement could harm our results of operations or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods. Any failure to implement and maintain effective internal control over financial reporting also could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that we will eventually be required to include in our periodic reports that will be filed with the SEC. Ineffective disclosure controls and procedures and internal control over financial reporting could also cause investors to lose confidence in our reported financial and other information, which would likely have a negative effect on the trading price of our Class A common stock. In

addition, if we are unable to continue to meet these requirements, we may not be able to remain listed on the NYSE.

Our business is subject to the risks of catastrophic events.

Our partners, suppliers, and customers are also subject to the risk of catastrophic events. In those events, our ability to deliver our products in a timely manner, as well as the demand for our products, may be divided on account of factors outside our control.

Further, the effects of climate change on the global economy and the technology industry are rapidly evolving. While we seek to mitigate our business risks associated with climate change by establishing robust environmental programs and partnering with organizations who are focused on mitigating their own climate-related risks, there are inherent climate-related risks wherever business is conducted. Any of our locations may be vulnerable to the adverse effects of climate change. For example, our corporate headquarters in the San Francisco Bay Area and one of our core co-location facilities located in the U.S. Pacific Northwest have experienced and may continue to experience, climate-related events and at an increasing frequency, including drought, water scarcity, heat waves, wildfires and resultant air quality impacts and power shutoffs associated with the wildfires. Additionally, while some employees have returned to our offices, it will remain difficult to mitigate the impact of these events on our employees continuing to work remotely. Changing market dynamics, global policy developments and increasing frequency and impact of extreme weather events on critical infrastructure in the United States and elsewhere have the potential to disrupt our business, the business of our partners, suppliers and customers, and may cause us to experience higher attrition, losses and additional costs to maintain or resume operations.

The requirements of being a public company may strain our resources, divert management’s attention, and affect our ability to attract and retain executive management and qualified board members.

In addition, changing laws, regulations, and standards relating to corporate governance and public disclosure are creating uncertainty for public companies, increasing legal and financial compliance costs, and making some activities more time consuming. These laws, regulations, and standards are subject to varying interpretations, in

many cases due to their lack of specificity, and, as a result, their application in practice may evolve over time as new guidance is provided by regulatory and governing bodies. This could result in continuing uncertainty regarding compliance matters and higher costs necessitated by ongoing revisions to disclosure and governance practices. We intend to invest substantial resources to comply with evolving laws, regulations, and standards, and this investment may result in increased general and administrative expenses and a diversion of management’s time and attention from revenue-generating activities to compliance activities. If our efforts to comply with new laws, regulations, and standards differ from the activities intended by regulatory or governing bodies due to ambiguities related to their application and practice, regulatory authorities may initiate legal proceedings against us and our business may be adversely affected.

Failure to comply with the aforementioned rules and regulations may make it more expensive for us to maintain director and officer liability insurance, and in the future we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage. These factors could also make it more difficult for us to attract and retain qualified members of our Board of Directors, particularly to serve on our audit committee and compensation committee, and qualified executive officers.

As a result of disclosure of information in our filings with the SEC, our business and financial condition are visible, which we believe may result in threatened or actual litigation, including by competitors and other third parties. If such claims are successful, our business and results of operations could be adversely affected, and even if the claims do not result in litigation or are resolved in our favor, these claims, and the time and resources necessary to resolve them, could divert the resources of our management and adversely affect our business and results of operations.

None.

Our corporate headquarters is located in San Francisco, California, where we lease approximately 81,000 square feet. Of the total leased space in San Francisco, approximately 66,000 square feet is concentrated in our adjoining buildings located at 101 Townsend Street and 111 Townsend Street pursuant to lease agreements expiring in October 2022. In addition, we lease approximately 15,000 square feet at 634 Second Street pursuant to a lease agreement expiring in December 2027.

We also maintain offices around the world including Austin, Texas; London, United Kingdom; Lisbon, Portugal; and Singapore to support our global team.

We lease all of our facilities and do not own any real property.

We believe that our facilities are suitable to meet our current needs. We intend to expand our facilities or add new facilities as we add employees and enter new geographic markets, and we believe that suitable additional or alternative space will be available as needed to accommodate any such growth.

From time to time we are subject to legal proceedings and claims arising in the ordinary course of business. We are not presently a party to any legal proceeding that we believe is likely to have a material impact on our business, results of operations, or financial condition.

Future litigation may be necessary, among other things, to defend ourselves or our customers by determining the scope, enforceability, and validity of third-party proprietary rights or to establish our proprietary rights. The results of any litigation cannot be predicted with certainty, particularly in the areas of unsettled and evolving law in which we operate, and an unfavorable resolution in any legal proceedings could materially affect our future business, results of operations, or financial condition. Regardless of the outcome, litigation can have an adverse impact on us

because of defense and settlement costs, diversion of management resources, and other factors. For additional information, see "Risk Factors - Activities of our paying and free customers or the content of their websites and other Internet properties could subject us to liability" and "We are currently, and may be in the future, party to intellectual property rights claims and other litigation matters that, if resolved adversely, could have a material impact on our business, results of operations, or financial condition" and Note 8 to the consolidated financial statements included in this Annual Report on Form 10-K.

Not applicable.

The following graph compares (i) the cumulative total stockholder return on our Class A common stock from September 13, 2019 (the date our Class A common stock commenced trading on the NYSE) through December 31, 2021 with (ii) the cumulative total return of the Standard & Poor's 500 Index and Standard & Poor's Information Technology Index over the same period, assuming the investment of $100 in our Class A common stock and in each index on September 13, 2019 and the reinvestment of dividends. The graph uses the closing market price on September 13, 2019 of $18.00 per share as the initial value of our common stock. The comparisons are based on historical data and are not indicative of, nor intended to forecast, future performance of our Class A common stock.

None.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes appearing elsewhere in this Annual Report on Form 10-K. In addition to historical financial information, the following discussion contains forward-looking statements that are based upon current plans, expectations, and beliefs that involve risks and uncertainties. Our actual results may differ materially from those anticipated in these forward-looking statements as a result of various factors, including the impact of the COVID-19 pandemic and those other factors discussed in the section titled “Risk Factors” and in other parts of this Annual Report on Form 10-K. Our fiscal year end is December 31.

Overview

Cloudflare’s mission is to help build a better Internet. We have built a global network that delivers a broad range of services to businesses of all sizes and in all geographies—making them more secure, enhancing the performance of their business-critical applications, and eliminating the cost and complexity of managing individual network hardware. Our network serves as a scalable, easy-to-use, unified control plane to deliver security, performance, and reliability across their on-premise, hybrid, cloud, and software-as-a-service (SaaS) applications.

Our Business Model

Our business model benefits from our ability to serve the needs of all customers ranging from individual developers to the largest enterprises, in a cost-effective manner. Our products are easy to deploy and allow for rapid and efficient onboarding of new customers and expansion of our relationships with our existing customers over time. Given the large customer base we have and the immense amount of Internet traffic that we manage, we are able to negotiate mutually beneficial agreements with Internet Service Providers (ISPs) that allow us to place our equipment directly in their data centers, which drives down our bandwidth and co-location expenses. This symbiotic relationship that we have with ISPs and the efficiency of our serverless network architecture allows us to introduce new products on our network at low marginal cost.

We generate revenue primarily from sales to our customers of subscriptions to access our network and products. We offer a variety of plans to our free and paying customers depending on their required features and functionality.

Key elements of our business model include:

Initial Public Offering

Opportunities, Challenges, and Risks

We believe that the growth of our business and our future success are dependent upon many factors, including growing our customer base, expanding our relationships with existing paying customers, developing and successfully launching new products, expanding into additional market segments, expanding our base of free customers, and developing and maintaining favorable peering and co-location relationships. Each of these factors presents significant opportunities for us, but also poses material challenges and risks that we must successfully address in order to grow our business and improve our operating results. We expect that addressing these challenges and risks will increase our operating expenses significantly over the next several years. The timing of our future profitability, if we achieve profitability at all, will depend upon many variables, including the success of our growth strategies and the timing and size of investments and expenditures that we choose to undertake, as well as market growth and other factors that are not within our control. In addition, we must comply with complex, uncertain, and evolving laws, rules, and regulatory requirements across federal, state, and international jurisdictions. If we fail to successfully address these challenges, risks, and variables, our business, operating results, financial condition, and prospects may be adversely affected.

COVID-19 Update

The rapid spread of the COVID-19 virus and variants, such as the Delta and Omicron variants, have resulted in authorities around the world periodically implementing and relaxing numerous measures to contain the virus, such as travel restrictions and bans, quarantines, shelter-in-place orders, and limitations on business activities. The COVID-19 pandemic and these containment measures that have been in effect from time to time in various countries and territories since early 2020 have had, and are expected to continue to have, a substantial negative impact on businesses around the world and on global, regional, and national economies. Although vaccines for COVID-19 have been developed and are being administered in the United States and other countries around the world, the expansion of administering these vaccines to additional people within these countries, the long-term efficacy of these vaccines, and the receptivity of many people to receiving these vaccines, remain uncertain.

To date, the COVID-19 pandemic has impacted our employees, our network, and our customers in a number of ways, and this impact could worsen if and to the extent the pandemic continues or becomes more severe.

Non-GAAP Financial Measures and Key Business Metrics

Non-GAAP Loss from Operations and Non-GAAP Operating Margin

Free Cash Flow and Free Cash Flow Margin

Paying Customers (> $100,000 Annualized Revenue)

Dollar-Based Net Retention Rate

Components of Our Results of Operations

Revenue

The typical subscription and support term for our contracted customers is one year and subscription and support term lengths range from one to three years. Most of our contracts with contracted customers are non-cancelable over the contractual term. Customers may have the right to terminate their contracts for cause if we fail to perform in accordance with the contractual terms. For our pay-as-you-go customers, subscription and support term contracts are typically monthly.

Cost of Revenue

As our customers expand and increase the use of our global network and products driven by additional applications and connected devices, we expect that our cost of revenue will increase due to higher network and bandwidth costs and expenses related to operating in additional co-location facilities. However, we expect to continue to benefit from economies of scale as our customers increase the use of our global network and products. We intend to continue to

invest additional resources in our global network and products and our customer support organizations as we grow our business. The level and timing of investment in these areas could affect our cost of revenue in the future.

Gross Profit and Gross Margin

Sales and Marketing

Research and Development

General and Administrative

Interest Income

Interest Expense

Loss on Extinguishment of Debt

Other Income (Expense), Net

Results of Operations

The following tables set forth our consolidated results of operations for the periods presented in dollars and as a percentage of our revenue for those periods:

Comparison of the Years Ended December 31, 2021 and 2020

Operating Expenses

Non-Operating Income (Expense)

$5.7 million related to the amortization of capitalized internal-use software costs and $3.0 million related to the amortization of acquired developed technology, an increase of $7.3 million in depreciation expense related to purchases of equipment located in co-location facilities, and an increase of $3.7 million in employee-related costs due to a 55% increase in headcount in our customer support and technical operations organizations. The remainder of the increase was primarily due to $3.7 million of increased third-party technology services costs, registry fees, and payment processing fees.

Gross margin did not significantly fluctuate during the year ended December 31, 2020 as compared to the year ended December 31, 2019.

Operating Expenses

Non-Operating Income (Expense)

Liquidity and Capital Resources

As of December 31, 2021, we had cash and cash equivalents of $313.8 million, including $13.4 million held by our foreign subsidiaries. Our cash and cash equivalents primarily consist of cash and highly liquid money market funds. We also had available-for-sale securities of $1,508.1 million consisting of U.S. treasury securities, commercial paper, and corporate bonds. As of December 31, 2021, the Company's investment portfolio consisted of investment grade securities with an average credit rating of AA. We have generated significant operating losses from our operations as reflected in our accumulated deficit of $680.8 million as of December 31, 2021. We expect to continue to incur operating losses and cash flow from operations that may fluctuate between positive and negative for the foreseeable future due to the investments we intend to make in our business, and as a result we may require additional capital resources to execute on our strategic initiatives to grow our business.

We believe that our existing cash, cash equivalents, and available-for-sale securities will be sufficient to meet our working capital and capital expenditure needs for at least the next 12 months. For the period beyond the next 12 months, we believe we will be able to meet our working capital and capital expenditure needs from our existing cash, cash equivalents, and available-for-sale-securities, the cash flows from our operating activities and, if necessary, proceeds from potential equity or debt financings. Our assessments of the period of time through which our existing financial resources will be adequate to support our operations and our expected sources of capital for the future operation of our business after such period of time are forward-looking statements and involve risks and uncertainties. Our actual results could vary as a result of, and our near- and long-term future capital requirements will depend on, many factors, including our growth rate, subscription renewal activity, the timing and extent of spending to support our infrastructure and research and development efforts, the expansion of sales and marketing activities, the timing of new introductions of products or features, the continuing market adoption of our global network and products, and the impact of the ongoing COVID-19 pandemic to our and our customers', vendors', and

partners' businesses. We may in the future enter into arrangements to acquire or invest in complementary businesses, services and technologies, including intellectual property rights, and such acquisitions and investments could increase our need for additional capital. We have based our estimates on assumptions that may prove to be wrong, and we could use our available capital resources sooner than we currently expect. Additionally, some of the factors that may influence our operations are not within our control, such as general economic conditions and the length and severity of the COVID-19 pandemic. We may be required to seek additional equity or debt financing from time to time in the future. In the event that additional financing is required from outside sources, we may not be able to raise it on terms acceptable to us or at all. If we are unable to raise additional capital when desired, or if we cannot expand our operations or otherwise capitalize on our business opportunities because we lack sufficient capital, our business, operating results, and financial condition would be adversely affected.

In addition to the contractual obligations described above, as of December 31, 2021, we had $7.2 million recognized as total restricted cash on our consolidated balance sheets which consisted of $6.7 million in letters of credit outstanding in favor of certain landlords for office space and $0.5 million in short-term restricted cash. The letters of credit renew annually and expire on various dates through 2028.

Operating Activities

Net cash used in operating activities during the year ended December 31, 2020 was $17.1 million, which resulted from a net loss of $119.4 million, adjusted for non-cash charges of $163.3 million and net cash outflow of $61.1 million from changes in operating assets and liabilities. Non-cash charges primarily consisted of $56.3 million for stock-based compensation expense, $49.4 million for depreciation and amortization expense, $21.6 million for amortization of convertible note discount and issuance costs, $19.8 million for non-cash operating lease costs, $17.3 million for amortization of deferred contract acquisition costs, $3.4 million for provision for bad debt, partially offset by $6.1 million of deferred income taxes. The net cash outflow from changes in operating assets and liabilities was primarily the result of a $36.3 million increase in deferred contract acquisition costs due to increased sales commissions from the addition of new customers, a $33.0 million increase in accounts receivable, net, which

increased due to our growing customer base and timing of collections from our customers, a $20.7 million decrease in operating lease liabilities, a $13.9 million increase in prepaid expenses and other assets, partially offset by a $25.2 million increase in deferred revenue, and a $17.1 million increase in accrued expenses and other current liabilities.

Net cash used in operating activities during the year ended December 31, 2019 was $38.9 million, which resulted from a net loss of $105.8 million, adjusted for non-cash charges of $79.8 million and net cash outflow of $12.9 million from changes in operating assets and liabilities. Non-cash charges primarily consisted of $36.6 million for stock-based compensation expense, $29.5 million for depreciation and amortization expense, and $10.8 million for amortization of deferred contract acquisition costs. The net cash outflow from changes in operating assets and liabilities was primarily the result of a $14.6 million increase in deferred revenue, and a $13.5 million increase in accounts payable, accrued expenses, and other liabilities, partially offset by a $20.1 million increase in deferred contract acquisition costs due to increased sales commissions from the addition of new customers, an $11.2 million increase in accounts receivable, net, which increased due to our growing customer base and timing of collections from our customers, and a $9.2 million increase in prepaid expenses and other assets.

Investing Activities

Net cash used in investing activities during the year ended December 31, 2020 of $515.3 million resulted primarily from the purchases of available-for-sale securities of $1,267.0 million, capital expenditures of $56.4 million, and the capitalization of internal-use software development costs of $18.6 million and cash paid for acquisitions, net of cash acquired of $13.9 million. These activities were partially offset by proceeds from maturities of available-for-sale securities of $840.2 million.

Net cash used in investing activities during the year ended December 31, 2019 of $417.6 million resulted primarily from the purchases of available-for-sale securities of $537.4 million, capital expenditures of $43.3 million, and the capitalization of internal-use software development costs of $14.0 million. These activities were offset by proceeds from the sales and maturities of available-for-sale securities of $177.0 million.

Financing Activities

Net cash provided by financing activities of $504.9 million during the year ended December 31, 2020 was primarily due to $575.0 million gross proceeds from issuance of the 2025 Notes, $10.9 million proceeds from issuance of Class A common stock pursuant to the ESPP, and $7.7 million of proceeds from the exercise of vested and unvested stock options, partially offset by $67.3 million cash paid for the purchase of the capped calls related to the 2025 Notes, $12.5 million cash paid for issuance costs on the 2025 Notes, $8.1 million payment of tax withholding on RSU settlements, and $0.4 million of payments of tax withholding on Class A common stock issued pursuant to the ESPP.

Net cash provided by financing activities of $570.8 million during the year ended December 31, 2019 was primarily due to $570.5 million in net proceeds from the IPO, after deducting underwriting discounts and commissions, and $6.0 million of proceeds from the exercise of vested and unvested stock options, partially offset by $5.3 million of payments of deferred offering costs.

Off-Balance Sheet Arrangements

As of December 31, 2021, we did not have any relationships with unconsolidated organizations or financial partnerships, such as structured finance or special purpose entities, which would have been established for the purpose of facilitating off-balance sheet arrangements or other contractually narrow or limited purposes.

Critical Accounting Estimates

Our consolidated financial statements are prepared in accordance with U.S. GAAP. The preparation of these consolidated financial statements requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenue and expenses, and related disclosures. Such estimates include, but are not limited to, allowance for doubtful accounts, deferred contract acquisitions costs, the period of benefit generated from the deferred contract acquisition costs, the capitalization and estimated useful life of internal-use software, the assessment of recoverability of intangible assets and their estimated useful lives, useful lives of property and equipment, liability and equity allocation of convertible senior notes, the determination of the incremental borrowing rate used for operating lease liabilities, the valuation and recognition of stock-based compensation expense, uncertain tax positions, and the recognition and measurement of current and deferred income tax assets and liabilities. None of these estimates are critical accounting estimates for the preparation of our consolidated financial statements. Our estimates are based on historical experience and various other assumptions that we believe to be reasonable under the circumstances, and we evaluate our estimates and assumptions on an ongoing basis. Due to the ongoing COVID-19 pandemic, there is ongoing uncertainty and significant disruption in the global economy and financial markets. We are not aware of any specific event or circumstance that would require an update to our estimates or assumptions or a revision of the carrying value of assets or liabilities as of March 1, 2022, the date of issuance of this Annual Report on Form 10-K. These estimates and assumptions may change in the future, however, as new events occur and additional information is obtained. Our actual results could differ from these estimates.

Recent Accounting Pronouncements

We have operations in the United States and internationally, and we are exposed to market risk in the ordinary course of our business.

Interest Rate Risk

Our cash equivalents and our investment portfolio are subject to market risk due to fluctuations in interest rates. Our future investment income may fall short of our expectations due to changes in interest rates or we may suffer losses in principal if we are forced to sell securities that decline in market value due to changes in interest rates. However, because we classify our securities as “available-for-sale,” no gains or losses are recognized due to changes in interest rates unless such securities are sold prior to maturity or declines in fair value are determined to be other-than-temporary.

In August 2021, we issued $1,293.8 million in aggregate principal amount of the 2026 Notes. The 2026 Notes do not have regularly scheduled interest payments; therefore, we do not have economic interest rate exposure on the 2026 Notes. We carry the 2026 Notes at face value less the unamortized debt discount and issuance costs on our consolidated balance sheets. Generally, the fair market value of the 2026 Notes will increase as interest rates

decline and decrease as interest rates rise. In addition, the fair market value of the 2026 Notes fluctuates when the market price of our Class A common stock fluctuates.

In May 2020, we issued $575.0 million in aggregate principal amount of the 2025 Notes. In August 2021, we entered into privately-negotiated exchange agreements with certain holders of the 2025 Notes to exchange approximately $400 million in aggregate principal amount of the 2025 Notes for an aggregate of $400.7 million in cash (including accrued interest) and approximately 7.6 million shares of our Class A common stock. The 2025 Notes have a fixed annual interest rate; therefore, we do not have economic interest rate exposure on the 2025 Notes. We carry the 2025 Notes at face value less the unamortized debt discount and issuance costs on our consolidated balance sheets. Generally, the fair market value of the 2025 Notes will increase as interest rates decline and decrease as interest rates rise. In addition, the fair market value of the 2025 Notes fluctuates when the market price of our Class A common stock fluctuates.

We do not believe a hypothetical 10% increase or decrease in interest rates during any of the periods presented would have a material impact on our consolidated financial statements.

Foreign Currency Risk

The supplementary financial information required by this Item 8, is included in Part II, Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations, under the caption "Quarterly Results of Operations Data," which is incorporated herein by reference.

To the Stockholders and Board of Directors

Cloudflare, Inc:

As discussed in Note 2 to the consolidated financial statements, the Company has changed its method of accounting for leases as of January 1, 2020 due to the adoption of the FASB Accounting Standards Codification No. 842, Leases.

The Company’s management is responsible for these consolidated financial statements, for maintaining effective internal control over financial reporting, and for its assessment of the effectiveness of internal control over financial reporting, included in the accompanying Management's Report on Internal Control over Financial Reporting. Our responsibility is to express an opinion on the Company’s consolidated financial statements and an opinion on the Company’s internal control over financial reporting based on our audits. We are a public accounting firm registered with the Public Company Accounting Oversight Board (United States) (PCAOB) and are required to be independent with respect to the Company in accordance with the U.S. federal securities laws and the applicable rules and regulations of the Securities and Exchange Commission and the PCAOB.

We conducted our audits in accordance with the standards of the PCAOB. Those standards require that we plan and perform the audits to obtain reasonable assurance about whether the consolidated financial statements are free of material misstatement, whether due to error or fraud, and whether effective internal control over financial reporting was maintained in all material respects.

Our audits of the consolidated financial statements included performing procedures to assess the risks of material misstatement of the consolidated financial statements, whether due to error or fraud, and performing procedures that respond to those risks. Such procedures included examining, on a test basis, evidence regarding the amounts and disclosures in the consolidated financial statements. Our audits also included evaluating the accounting principles used and significant estimates made by management, as well as evaluating the overall presentation of the consolidated financial statements. Our audit of internal control over financial reporting included obtaining an understanding of internal control over financial reporting, assessing the risk that a material weakness exists, and testing and evaluating the design and operating effectiveness of internal control based on the assessed risk. Our audits also included performing such other procedures as we considered necessary in the circumstances. We believe that our audits provide a reasonable basis for our opinions.

A company’s internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in

accordance with generally accepted accounting principles. A company’s internal control over financial reporting includes those policies and procedures that (1) pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect the transactions and dispositions of the assets of the company; (2) provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the company are being made only in accordance with authorizations of management and directors of the company; and (3) provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use, or disposition of the company’s assets that could have a material effect on the financial statements.

The critical audit matter communicated below is a matter arising from the current period audit of the consolidated financial statements that was communicated or required to be communicated to the audit committee and that: (1) relates to accounts or disclosures that are material to the consolidated financial statements and (2) involved our especially challenging, subjective, or complex judgments. The communication of a critical audit matter does not alter in any way our opinion on the consolidated financial statements, taken as a whole, and we are not, by communicating the critical audit matter below, providing a separate opinion on the critical audit matter or on the accounts or disclosures to which it relates.

We have served as the Company’s auditor since 2014.

Santa Clara, California

March 1, 2022