{"id":4293,"date":"2026-05-12T13:55:06","date_gmt":"2026-05-12T17:55:06","guid":{"rendered":"https:\/\/paulsyng.com\/blog\/?p=4293"},"modified":"2026-10-10T10:25:40","modified_gmt":"2026-10-10T14:25:40","slug":"cloudflare-built-the-internets-immune-layer","status":"publish","type":"post","link":"https:\/\/paulsyng.com\/blog\/cloudflare-built-the-internets-immune-layer\/","title":{"rendered":"Cloudflare built the internet\u2019s Immune Layer"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong><em>A note before you read this: <\/em><\/strong>I&#8217;ve been watching Cloudflare for a long time. What Matthew Prince, Michelle Zatlyn, and Lee Holloway built, and what the team continues to build, sits in a category of its own. Fifteen years of decisions that quietly hold up a meaningful portion of the open internet is not a small thing, and I don&#8217;t take it lightly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I like looking past what a company says it does, into what its decisions prove it is. That&#8217;s what this is. I pulled from public filings, founder interviews, blog posts, case studies, customer language, and press coverage, and I&#8217;ve cited as I went. If anything is off, the intention is not to misrepresent. Read it as one outside reader doing his honest work.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The whole premise is one question: what business are you in? No one can read their own label. This is me reading yours.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"how-to-read-this-analysis\">How to read this analysis<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">This piece sits on a four-level positioning canvas. Quick shorthand so the references don&#8217;t slow you down.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Level 4. POSITION.<\/strong>\u00a0The concept that becomes synonymous with you in customers&#8217; minds. Volvo, safety. Tesla, the future. Cannot be claimed out loud. Has to be proven over the years until customers say it for you.<\/li>\n\n\n\n<li><strong>Level 1. FRAME.<\/strong>&nbsp;The words you use to express your positioning. Taglines, decks, bios. Easy to copy. The frame is not the position; it describes the position.<\/li>\n\n\n\n<li><strong>Level 2. EXECUTE.<\/strong>\u00a0The measurable outcomes that validate the claim. Actions, metrics, results (verbs). Strong execution without a clear concept proves useful, not different.<\/li>\n\n\n\n<li><strong>Level 3. LIVE.<\/strong>\u00a0When positioning shows up in resource allocation, hiring, partnerships, and org structure. The test: if a competitor were handed your P&amp;L, what would shock them?<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The sequence runs 4 \u2192 1 \u2192 2 \u2192 3. Most companies operate at 1 while claiming 4. The gap between where a company operates and where it claims to be is where this analysis lives.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><em>PS:\u00a0<a href=\"https:\/\/monopoly.ceo\" target=\"_blank\" rel=\"noopener\">Monopoly<\/a>\u00a0uncovered all the insights you\u2019ll read in this perspective.<\/em><\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image alignwide size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/i0.wp.com\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/Cloudflare_Thumb.png?resize=1024%2C576&#038;quality=80&#038;ssl=1\" alt=\"\" class=\"wp-image-4298\" srcset=\"https:\/\/i0.wp.com\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/Cloudflare_Thumb.png?resize=1024%2C576&amp;quality=80&amp;ssl=1 1024w, https:\/\/i0.wp.com\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/Cloudflare_Thumb.png?resize=300%2C169&amp;quality=80&amp;ssl=1 300w, https:\/\/i0.wp.com\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/Cloudflare_Thumb.png?resize=1536%2C864&amp;quality=80&amp;ssl=1 1536w, https:\/\/i0.wp.com\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/Cloudflare_Thumb.png?w=1920&amp;quality=80&amp;ssl=1 1920w\" sizes=\"auto, (max-width: 1000px) 100vw, 1000px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"part-1-the-story-they-tell\">Part 1: The Story They Tell<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ask Matthew Prince what business he is in, and the answer arrives clean. He runs a &#8220;connectivity cloud.&#8221; A single global network that protects, connects, and builds the internet for anyone who shows up, from a hobbyist blogger to a Fortune 100 bank.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The mission, repeated for fifteen years, is to &#8220;help build a better Internet.&#8221; Michelle Zatlyn, his co-founder and now President and Co-Chair, will correct anyone who drops the word &#8220;help.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The story has a clean arc. Three pillars at founding: security, performance, and reliability. One global anycast network where every service runs in every data center. A free tier that lets anyone on the internet protect their site in five minutes, paid for by enterprise customers further up the curve.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Prince will tell you the network is the product. 300+ cities, 120+ countries, 12,000+ interconnects, roughly 20% of all web traffic, six billion monthly users. $1.67B in 2024 revenue, 77.3% GAAP gross margin, 29% YoY growth, all while giving away unlimited DDoS protection to anyone who wants it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">He will credit the architecture. Lee Holloway, the third co-founder and original technical lead, designed it that way before anyone called it a moat. Commodity hardware, clever software, every service on every server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">He will credit the developer&#8217;s flywheel. Free users pull peering deals. Peering deals lower bandwidth costs. Lower bandwidth costs let the free tier stay free. Free users grow into paying users, then enterprise customers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">He will credit Birthday Week, the annual product launch ritual where Cloudflare announces new features as &#8220;gifts back to the Internet,&#8221; with being observed every year since its founding.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Michelle, asked the same question, describes the product as &#8220;a digital bouncer and personal trainer.&#8221; She talks about &#8220;one seamless experience for cloud&#8221; as the killer attribute, and points out that Cloudflare has grown without acquisition, so there is no integration debt across the platform.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then there is the developer story. Workers runs on 300+ data centers; AI inference runs in 180+ cities; a single click deploys code globally in under a minute. Prince and Zatlyn will both point to this as evidence that Cloudflare is no longer just a security and CDN. The story extends to enterprise expansion: 3,497 customers paying $100K+ in FY24, 173 paying $1M+, and Forrester reporting 238% three-year ROI.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The narrative is consistent across the leadership team. Connectivity cloud, network at scale, seamless platform, mission to help build a better internet. The metrics back it. The marketing reinforces it. The press repeats it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the story they tell. It&#8217;s accurate. It&#8217;s also not the position.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"part-2-the-hidden-position\">Part 2: The Hidden Position<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cloudflare doesn&#8217;t own the connectivity cloud. It doesn&#8217;t own performance, security, or even infrastructure. It implicitly owns\u00a0<strong>open-internet immunity<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By immunity, I mean the felt state of being protected by the same layer that protects the internet itself, regardless of your size, your politics, your budget, or whether you pay. Cloudflare&#8217;s customers don&#8217;t really buy a service. They get a kind of standing on the open internet that they could not earn on their own.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That noun isn&#8217;t in any Cloudflare press release. It doesn&#8217;t need to be. The decisions have been proving it for fifteen years.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Listen to what customers actually say, unprompted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;We don&#8217;t even think about it anymore.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;My pager didn&#8217;t go off last night.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Put it behind Cloudflare.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;I don&#8217;t know of a lot of security teams that can say that.&#8221; <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Without Cloudflare&#8217;s protection, our website and app would be vulnerable to attacks, potentially impeding our ability to provide timely and reliable information to those who need it most.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;in front of your content.&#8221; (Matthew Prince&#8217;s own framing)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Notice what is missing. No one says they bought a connectivity cloud. No one says they subscribed to a CDN-plus-security platform. They describe the state they entered. Protected. Quiet. Allowed to exist.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That sounds like immunity to me. Less as a metaphor borrowed from biology, more as a literal description of what the customer experiences. A defensive layer they didn&#8217;t have to build, that absorbs the cost of being attacked, that lets them stop firefighting and start operating.<\/p>\n\n\n\n<h4 class=\"wp-block-heading alignwide\">Now strip every Cloudflare tagline, every keynote slide, every investor deck. Look only at the decisions.<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Universal SSL in 2014. <\/strong>Free encryption for every domain on the free tier, at a real revenue cost. The board pushed back. Prince did it anyway. Encryption was an immune response the internet needed. Cloudflare provided it for free.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Project Galileo, also in 2014.<\/strong> Free enterprise-grade protection for journalists, human rights groups, and civil society. 2,600+ organizations across 111 countries; about 96 million DDoS attacks blocked every day.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Athenian Project.<\/strong> Free protection for state and local election infrastructure. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Project Pangea. <\/strong>Free transit for underserved community networks. Critical Infrastructure Defence Project. Free Zero Trust for U.S. hospitals and utilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Every program follows the same pattern. Take the immune response Cloudflare can manufacture at scale, hand it to whoever needs it most, and refuse to means-test by wealth.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">R2 launched with zero egress fees, while Cloudflare publicly attacked AWS for &#8220;egregious egress.&#8221; The Bandwidth Alliance does the same thing structurally. The position underneath: the internet is a public layer, and charging tolls to leave is a tax on existence.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In July 2025, Cloudflare enabled default blocking of AI bots and announced pay-per-crawl. The framing was protective. Publishers, not scrapers, deserve the immune system&#8217;s defences. More than a million sites adopted the one-click block in less than a year.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then there are the takedowns Cloudflare hates having to make. Daily Stormer in 2017, 8chan in 2019, Kiwifarms in 2022. Each one was accompanied by a Prince blog arguing against his own decision. From the Daily Stormer post: &#8220;My rationale for making this decision was simple: the people behind the Daily Stormer are assholes, and I&#8217;d had enough. Let me be clear: this was an arbitrary decision.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A CEO publicly arguing against his own arbitrary power is hard to read as marketing. It looks more like a costly signal that the immune layer is supposed to be content-blind. The exceptions get named as exceptions, which reinforces the rule.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When Cloudflare had its November 2025 outage, Prince&#8217;s first public statement was, &#8220;We let the Internet down today. On behalf of the entire @Cloudflare team, I&#8217;m sorry.&#8221; The Internet. Not the customers. That is utility language. The host is sorry, not the vendor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Prince has used the same framing for years. &#8220;Given Cloudflare&#8217;s critical role in the Internet ecosystem, any outage of our systems is intolerable.&#8221; And, &#8220;Every month, six billion users traverse our network. If Cloudflare is executing its functions effectively, its presence often goes unnoticed.&#8221; Invisibility as success is the standard to which an immune layer holds itself. You only notice it when it fails.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pricing decisions, refusals, free programs, takedown rationales, outage apologies. They all point at the same noun. An immune layer for the open internet, available to everyone, paid for by enterprise customers further up the curve.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The architecture proves it structurally. Every service runs in every data center. There is no premium edge node, no enterprise-only city. The free-tier user in Lagos and the Fortune 500 bank in New York hit the same plane. That isn&#8217;t a product design choice. It&#8217;s a positioning choice expressed in code. Lee Holloway built it that way in the early years, and Prince has refused for fifteen years to differentiate by tier in the routing fabric. The immune layer is the same for everyone. Only the higher-order services are paid.<\/p>\n\n\n\n\n<div class=\"wp-block-columns jetpack-paywall-simple is-layout-flex wp-container-core-columns-is-layout-f56f613f wp-block-columns-is-layout-flex\" style=\"display: inline-block; width: 90%\">\n    \n    <div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\" style=\"background-color: #F6F7F7; padding: 32px; 24px;\">\n        \n        <h2 class=\"has-text-align-center wp-block-heading\" style=\"margin: 0 0 12px; font-weight: 600;\">Subscribe to keep reading<\/h2>\n        \n        \n        <p class=\"has-text-align-center wp-block-paragraph\"\n           style=\"text-align: center;\n                  color: #50575E;\n                  font-weight: 400;\n                  font-size: 16px;\n                  font-family: 'SF Pro Text', sans-serif;\n                  line-height: 28.8px;\">\n        Become a paid subscriber to get access to the rest of this post and other exclusive content.\n        <\/p>\n        \n        \n        <div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"text-align: center;\">\n            \n            <div class=\"wp-block-button\" style=\"display: inline-block; margin: 10px 0; border-style: none; padding: 0;\">\n                <a href=\"https:\/\/paulsyng.com\/blog\/?post_type=post&#038;p=4293\" class=\"wp-block-button__link wp-element-button\" data-tracks-link-desc=\"paywall-email-click\" style=\"display: inline-block;\n                          padding: 12px 15px;\n                          background-color: #3858e9;\n                          color: #FFFFFF;\n                          text-decoration: none;\n                          border-radius: 5px;\n                          font-family: &#039;SF Pro Display&#039;, sans-serif;\n                          font-weight: 500;\n                          font-size: 16px;\n                          text-align: center;\" data-wpcom-track>Subscribe<\/a>\n            <\/div>\n            \n        <\/div>\n        \n    <\/div>\n    \n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>A note before you read this: I&#8217;ve been watching Cloudflare for a long time. What Matthew Prince, Michelle Zatlyn, and Lee Holloway built, and what the team continues to build, sits in a category of its own. Fifteen years of decisions that quietly hold up a meaningful portion of the open internet is not a [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":4299,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","_jetpack_newsletter_access":"paid_subscribers","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":true,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"{title}\n\n{excerpt}\n\n{url}","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false,"jetpack_post_was_ever_published":false,"rank_math_title":"","rank_math_description":"","rank_math_canonical_url":"","rank_math_focus_keyword":""},"categories":[83],"tags":[],"class_list":["post-4293","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-gravity-report"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack-related-posts":[],"jetpack_shortlink":"https:\/\/wp.me\/p7CVvN-17f","jetpack_featured_media_url":"https:\/\/i0.wp.com\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/cloudflarefounders.jpeg?fit=700%2C525&quality=89&ssl=1","_links":{"self":[{"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/posts\/4293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/comments?post=4293"}],"version-history":[{"count":14,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/posts\/4293\/revisions"}],"predecessor-version":[{"id":90185,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/posts\/4293\/revisions\/90185"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/media\/4299"}],"wp:attachment":[{"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/media?parent=4293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/categories?post=4293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/tags?post=4293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}