Cloudflare: Charting A Course Through The Cloud But Overvalued (NYSE:NET)

Investment Thesis

After reaping the low-hanging fruits of its disruptive growth model, Cloudflare (NYSE:NET) now faces more intense competition because competitors are expanding into full-stack cloud services. With continued negative net income, volatile cash flow, and an increased debt burden, it is more difficult for the company to expand its infrastructure build-up to reach new levels of growth. Despite an over 40% drop in its stock price, the company remains overvalued.

Qualitative Highlights

Company Overview

Cloudflare, headquartered in San Francisco, is a leader in firewall and protection platform services over WAAP (Web Application and API Protection) appliances and Iaas (Infrastructure as a service)-native WAAP. It was founded in 2009 to provide a web security solution but soon expanded to improve both site performance and protection. Client service continues to be based on this combination. It has more than 3,000 employees building its portfolio of cloud-delivered applications and security services.

There are three segments in its business: the Web application firewall (WAF) called Cloudflare Application Services, Distributed denial-of-service (DDoS) protection called Cloudflare Network Services, and client-side protection similar to VPN called Cloudflare Zero Trust Services. It is also expanding into serverless offerings, which include a cloud computing platform called “Workers”, object storage called “R2,” and an SQLite database called “D1”.

Strength

First of all, Cloudflare provides a unified platform for different firewall functions. Cloudflare provides an “Integrated Global Cloud Platform” that consolidates multiple layers of service segments into one place and is available globally. The unified platform brings application services, network services, and a new security center into one dashboard. With it, customers can create robust rules with a simple rule builder that can be deployed easily to all applications, specific applications, or subsets of traffic. An integrated platform is appealing to customers that are conscious of cost-saving propositions, especially during the economic downturn. Since many of the largest WAAP service providers have integrated platforms, this advantage can help it to stay ahead of smaller or niche players in the field.

Second, Cloudflare has a global presence and different sizes of customers. It has a free version of its most basic services and a $200/month budget service with more features for budget-conscious users. Therefore, it is able to have a large base of small and midsize businesses (SMB) and personal customers worldwide. Via its large and diverse customer base, it gathers intelligence about network attacks and safety and, in turn, makes its service more robust. This is what makes Cloudflare distinctively different from some of the more established providers, most of whom don’t offer a long-term free version.

Third, Cloudflare has a robust ecosystem of channels and technical partnerships. A free version of the company’s website helps it retain a vibrant online community. This makes the company an easy choice for users in their infancy of website building. It also makes it an important one to work with for other application platforms due to its sheer volume. This grass-roots growth model helps explain why it was able to expand so fast. Its Dollar-Based Net Retention rate has been at or above 124% in the past five quarters, although it’s been slipping in the past two quarters. In its presentation, the company explained that the Dollar-Based Net Retention rate(DBNR) measures its ability to retain and expand recurring revenue from existing customers.

Fourth, Cloudflare has a strong overseas business presence. According to its Q3 presentation, 47% of its revenue comes from overseas markets. It has a strong foothold in Asia/Pacific. It is already the most developed WAAP provider in that region, and it continues to expand and increase hiring locally. In time, it could have a more balanced revenue stream should economic growth diverge among different regions of the world.

Fifth, Cloudflare joined EU Cloud Code of Conduct in May this year. This helps to boost confidence and trust in its cloud services. As it becomes a leader in the field, it is imperative that it remains a “good” player to contribute to the healthy growth of the space. As privacy concerns increasingly become a front-and-center topic in web protection, the company has made the right decision. We will get back to this point later.

Overall, we see Cloudflare providing a robust WAAP service that is balanced between security and speed and has a healthy mix of large enterprise customers v.s. SMBs and personal customers, a 50/50 split between domestic vs. overseas revenue, and continuing to build on a grass-roots growth model.

Weakness/Risks

Operationally, Cloudflare faces several challenges to continue growing at a fast pace.

The company lacks a comprehensive environment for developers to create more sophisticated deployments. The company doesn’t offer containers orchestrated with Kubernetes for apps built on its platform. It hinders the company from having hybrid deployment of both a pure-play cloud-delivered WAAP provider and offering the option to run as an agent. Building such an offering across its network would be prohibitively expensive for it. Instead, it offers isolated instances of the Google-created V8 Javascript engine called “V8 isolates”. Users will need to write code in a Javascript environment. This means its serverless cloud computing platform Workers is not a general-purpose platform. It is required that applications meet a tightly constrained set of requirements, such as Javascript-based functions and a certain package size and runtime duration. And it also lacks a library of tools and templates to help facilitate adoption. It is very adept at creating customized solutions for its largest clients. However, this level of service is not feasible to scale. This goes hand-in-hand with the users’ complaints of not receiving sufficient support in adoption. Despite the company’s excellent pre-sale support, post-sale support leaves much to be desired because comprehensive adoption is not easy without a systematic template. The company’s emphasis on scalability poses a trade-off between lightweight/fast and comprehensive platform-native organic growth. We think in the long term, the latter is more critical. True organic growth will lower the cost for a technology company over time, while the opposite would raise bills for maintaining an ever-expanding platform. This explains why even with a quadrupling increase in its R&D expenses, its operating expenses rise even faster. For a pure technology company that emphasizes scalability, this is not a sign of organic growth.

More importantly, Cloudflare has limits in its integrated system – it is not a full-service cloud provider. It doesn’t have products like databases or message queues. It has had partnerships with other database providers since April 2021. It offers connectivity options with database providers such as Macrometa and Fauna. There are pros and cons to taking apart the backend this way. For large mature companies, this provides flexibility as it allows them to add Cloudflare to their services without overhauling the current infrastructure. But for the growing start-ups, they will need to look for multiple solutions on the backend, which will increase the cost. Since the company has a large number of customers who are SMBs or personal accounts, this is probably one of the areas they can improve to tune in to customers’ growth. It said in the Q3 earnings call that its first database product, “D1”, is coming before the end of the quarter. According to its blog, D1 works as a serverless database that uses SQLite, so it’s easy to set up and get running. But SQLite, by nature, is light but not comprehensive; it might not be compatible with a heavy large database once being scaled up. It hasn’t announced its pricing for D1 yet. From its blog, it seems like sticking to lower costs would be part of the company’s signature disruptive offering. We applaud its attempt to grow in this direction but also note that this is one of the areas where Cloudflare is facing head-to-head competition with Amazon(AMZN) Web Services(AWS), Microsoft Azure, and Google Cloud Platform, which provide complete hyperscale cloud solutions. We like that Cloudflare is trying to introduce a more cost-effective alternative solution to Amazon’s dominance in the cloud computing space, but we worry about whether it has the financial ability to support this at a rapid pace.

Financially, by looking at some hard numbers of the metrics, we can further assess the health of its operation. Cloudflare’s net income has been negative since its IPO. In Q3, the gap between revenue and gross profit has also been widening to the largest of $296 million, with a revenue of $253.9 million for the quarter. The gap is larger than the revenue because of negative Net Income.

Its dollar-based net retention rate is at 124%, as we quoted in a chart from the company’s presentation earlier, with a 200 bps decrease QoQ, and the same YoY. It is still at a high level. It aims at reaching 130% for said rate. However, it has to be put in the context of the cost and profit to acquire and maintain such retention. From the chart below, we can see that the Operating Expenses are negatively correlated with EBITDA. From our estimate, the correlation of the two indicated for every $1 of the Operating Expenses spent, the company loses 23 cents of EBITDA. Although this is an overly simplified way to depict the flow, it’s nonetheless telling.

To look at this from a historical perspective, the Cost of Revenue has never come down, while its Earnings From Operation have dramatically dropped since Q4 of last year. Many investors would overlook this and justify it with the company’s rapid growth and market share grabbing. For a 13-year-old start-up that is now becoming an established leader in the field, we beg to differ. We will return to this point in the sections below.

And higher borrowing didn’t seem to form a pattern of boosting EBITDA. It is a downward slope for earnings with growing liabilities.

Cloudflare’s quarterly free cash flow has mostly been negative. Although it has been increasing, so is its volatility.

Underneath its fast expansion of services and infrastructure, Cloudflare has been raking in more debt than ever. Its Debt-To-Equity ratio reached over 300% in Q3, the highest for the 12-year-old company. How much more can the company borrow?

The company has made large payments towards lowering its debt in the past two years. However, its total debt continues climbing. The company needs to serve this increasing debt burden with its volatile cash flow we just looked at.

Another way to see its liquidity picture is to look at how the receivables spread to average daily sales. The days to fully collect its receivables have been rising from 160 to almost 200 days. Although that came down from a peak of almost 230 days, it is still more than half a year for the company to collect all the outstanding sales. It’s not in any immediate danger as its quarterly current ratio is at around 6 times. But when combined with the volatile quarterly cash flow, we see constrain here in serving its debt while still maintaining the fast pace of infrastructure expansion.

To recap, by choosing scalability instead of a comprehensive platform, Cloudflare has disrupted the CDN space and has become a leader within a short period of time. However, at this stage, this strategy is also showing its flaw of ever-growing expenses and facing increasing competition when it attempts to migrate to a more comprehensive offering. The widening gap between revenue and gross profit, continuing climbing of debt, rising operating expenses with achieving less EBITDA, and the rising days to turn receivables into revenue aren’t helping its liquidity. To us, all these are not signs of organic scalability or becoming more so.

There are also near-term currency risks: the US represented 53% of its revenue, and 47% came from overseas. The strengthening of the U.S. Dollar will erode half of its revenue once converted. Although this might be a short-term risk, it is nonetheless a headwind for its already volatile cash flow. Since it is showing commitment to foreign market expansion, such as in Asia, we would like to see Cloudflare have a Forex risk hedging strategy to help mitigate this risk factor.

Competition And Profitability

Now, we are getting to the interesting part, let’s take a look at its profitability. It’s shown as a strength in its presentation that its Gross Profit Margin has consistently been just under 80% since its IPO. This is an enviable number for any company. However, all of its other margins are consistently below zero, such as Operating Margin and EBITDA Margin. See the chart below. In particular, its Net Margin has gotten as low as negative 60% a year ago. It has recovered to negative 16% in Q3, which is the best since the IPO. Would it soon cross back to a positive number, stay sub-zero treading water, or drop lower?

To answer that question, we cast a glance at its competitors. The CDN/WAAP space has always been very competitive. According to its CEO Matthew Prince disclosed during the earnings call in August 2022, the company has 29% of the Fortune 1000 as its paying customers. Cloudflare’s large customers now stand at 60% of its revenue. This is a 61% YoY large customer growth in Q2 2022. To grow the largest paying customers, Cloudflare would need to either consolidate the fragmented parts of the market that currently have other smaller but niche providers or take share from large competitors such as Akamai(AKAM), Imperva(IMPV), and Amazon Cloud Front. Either one is not easy. According to the Magic Quadrant report by Gartner released in August this year, Cloudflare faces Akamai and Imperva in competition as technical leaders, while Amazon Web Services is not too far behind as a challenger. The others are niche players with their own advantages and are hard to replace, including Microsoft(MSFT) Azure, Fastly(FSLY), and Google(GOOG) Cloud CDN.

To understand these providers’ competition history, Google Trend can probably best paint the picture.

As we can see, Akamai used to be the dominating one, with Cloudflare and Amazon CloudFront started rising fast in 2015. They took market share from Akamai, while Cloudflare has been taking off since 2019. And now it is leading the space by the largest number of customers. See the chart below.

We can see that, according to Intricately, from a user-base point of view, Cloudflare’s SMBs revenue base is facing competition from Amazon, while its large enterprise revenue base is facing competition from both Amazon and Akamai. The latter is a well-regarded and long-established provider in the field, often leading the security updates by several steps.

As Cloudflare looks to move beyond providing firewall and web protection services, it newly offers serverless programmability of the edge, such as combing storage, database, and computing all on its cloud with Workers, R2, and D1. But its competitors have been getting into this space for a while, such as Akamai EdgeWorkers, Amazon CloudFront with Lambda@Edge, or Fastly Varnish. Although Cloudflare has a pricing advantage in its Workers platform, the expense for the existing DNS and firewall customers to rewrite their application to use Cloudflare’s cloud platform would prove too costly. For its future growth that actually involves both its firewall services and cloud backend platform, its best shot is going for the Net-New growth of existing and future clients. To look at this from the scope of a bird-eye-view, we asked how fast the world of the World Wide Web grows. According to Siteefy, valid new websites created yearly are about 8.07% of the total number of websites. Cloudflare’s Net-New growth in the full-stack cloud computing space will majorly come from this 8.07% and new applications from its existing customers.

Last but not least, anyone familiar with internet security and related services would know that internet users and website owners strongly dislike having a gatekeeper. Gatekeeper means one single provider that is so dominating it is almost like the keeper of the gate for the traffic flow, deciding what gets in and out. This, of course, comes down to the origin and future development of the internet, which we won’t delve into here. Cloudflare is not there yet, but it’s getting close. It reported that 95% of the world’s population is within ~50 ms of a Cloudflare data center. Let that sink in for a moment. Some online communities already have chatters about Cloudflare being too big or a too-common choice. It s not a bottomless pool that the company can keep growing at the same pace.

We see its rapid market share growth in the past few years as the result of grabbing the low-hanging fruits as Cloudflare disrupted the CDN/WAAP space with its unique development model. If we look ahead for the next ten years, to maintain a similar growth trajectory, the company is coming up against more established and tested providers such as Akamai, more niche providers such as Fastly, and providers in more specialized full-stack cloud services such as AWS, Microsoft and Google. Within the service space only provides firewall and web protection, it could also meet the natural limit of how big one CDN service provider can dominate without prompting pushback. For the company to migrate to a more comprehensive platform will need a lot more investment and expenses. Therefore, we believe that if the company’s earnings become positive, its long-term average growth would probably be in the single digits.

Quantitative Highlights

Financial Overview

Cloudflare’s results in Q3 were a mixed bag. Revenue was rising to the highest level at $253.9 million, a 7% increase QoQ and 42% increase YoY, continuing its uninterrupted trend of quarterly increase in revenue since IPO. Quarterly, the company’s GAAP Gross Profit is $191.9 million or a 75.58% Gross Margin. Its Operating Income/Loss is at negative $45.9 million, or 18.1% of total revenue, widening the loss from $26.5 million or 15.4% in YoY. And its TTM Quarterly EPS is negative 69 cents. In the meantime, the Debt to Equity ratio has risen to 319.29%.

Valuation

Cloudflare’s negative free cash flow hasn’t made it easy to evaluate its current price. We use 6.25% for its Cost of Equity, 6.19% for its WACC, and Cost of Debt 5%, with an Effective Tax rate of -14% given by its Q1 2021 earnings call. The beta we used for it was 1.08. Incorporating all the analysis above, we assess the price of Cloudflare with our proprietary models and Discounted Cash Flow analysis. For the stock to reach the $50 price range it was flirting with, it will need to consistently achieve low double-digit growth every year in its levered free cash flow for the next ten years. We don’t think that is a highly likely scenario, given how volatile it has been. With our most bullish scenario, where the company only suffered a slightly negative impact from the economic slowdown and eventually reached double-digit growth, the price is $43.72. While the most bearish scenario, where the company continues its pattern of highly volatile free cash flow that eventually stabilizes into single-digit growth a few years out, the price is $25.32. And in our base case, where the company suffers some set back due to economic slowdown but eventually recovers into double-digit growth with less volatility than in the past six years, the company is valued at $30.37. And this is already at double its IPO price of $15, considering it has never left the negative earnings territory.

Drawing Parallel Comparison

Due to the remarkably similar pattern in their price collapse, we stack up Akamai’s first 800 trading days’ history v.s. Cloudflare’s past 316 days’ trading history. AKAM’s debuted its IPO at the height of the dot-com bubble period, and Cloudflare’s IPO in 2019 was earlier than the peak of the current stock market bubble we are in. So it took Cloudflare about two years to reach its recent peak. But the path of elevation and quick descent has a lot of resemblances. Granted, the past is not a perfect prediction of the future. Cloudflare is not the same company as Akamai. Akamai is a more established provider in the space, while Cloudflare is a newcomer greatly disrupting the same space and has been taking the shares from Akamai. And even the macroeconomic conditions we are in are not entirely the same as at the beginning of this century. But we see something inherently similar, both companies quickly took to the dominant position in the CDN space, and there was even less competition when Akamai rose to prominence. How would Cloudflare’s price go from here? It probably won’t fall as sharp and as flat as Akamai during the Doc-Com bubble burst, which eventually recovered and rose to currently in the $90-120’s. But Cloudflare needs to find a more organic way to grow. It isn’t only about scaling but also upgrading the value added to its existing customers, nurturing its grass-roots base to have more platform-native innovation. We don’t mean giving out money to the start-ups on its platform, as it reported in the Q3 earnings call, but actually allowing the democratization to take root at the developer level.

Conclusion

Cloudflare provides cheaper and faster firewall and website protection in the CDN space with free and low-cost versions to the smallest customers while at the same time increasingly serving large enterprises. This model of growth has greatly disrupted the business and has propelled it to a leading position worldwide. As we cheer for its growth, we also see constraints ahead for it to be both scalable and comprehensive at the same time, which will pose prohibitively high costs. It is possible the company will see more market headwinds ahead. While it is likely to overcome difficulties and continues its growth, it will not be meteorically as in the past two years. Although we remain constructive on the company, we deem the current price too rich and recommend a “hold” at this stage. New investors can look for price below $25.32 before accumulating a long-term position. We will closely look for more organic growth in upgrading its platform to a comprehensive service provider while better managing its debt and expenses.