{"id":4293,"date":"2026-05-12T13:55:06","date_gmt":"2026-05-12T17:55:06","guid":{"rendered":"https:\/\/paulsyng.com\/blog\/?p=4293"},"modified":"2026-05-12T13:55:08","modified_gmt":"2026-05-12T17:55:08","slug":"cloudflare-built-the-internets-immune-layer","status":"publish","type":"post","link":"https:\/\/paulsyng.com\/blog\/cloudflare-built-the-internets-immune-layer\/","title":{"rendered":"Cloudflare built the internet\u2019s Immune Layer"},"content":{"rendered":"\n<p><strong><em>A note before you read this: <\/em><\/strong>I&#8217;ve been watching Cloudflare for a long time. What Matthew Prince, Michelle Zatlyn, and Lee Holloway built, and what the team continues to build, sits in a category of its own. Fifteen years of decisions that quietly hold up a meaningful portion of the open internet is not a small thing, and I don&#8217;t take it lightly.<\/p>\n\n\n\n<p>I like looking past what a company says it does, into what its decisions prove it is. That&#8217;s what this is. I pulled from public filings, founder interviews, blog posts, case studies, customer language, and press coverage, and I&#8217;ve cited as I went. If anything is off, the intention is not to misrepresent. Read it as one outside reader doing his honest work.<\/p>\n\n\n\n<p>The whole premise is one question: what business are you in? No one can read their own label. This is me reading yours.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"how-to-read-this-analysis\">How to read this analysis<\/h4>\n\n\n\n<p>This piece sits on a four-level positioning canvas. Quick shorthand so the references don&#8217;t slow you down.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Level 4. POSITION.<\/strong>\u00a0The concept that becomes synonymous with you in customers&#8217; minds. Volvo, safety. Tesla, the future. Cannot be claimed out loud. Has to be proven over the years until customers say it for you.<\/li>\n\n\n\n<li><strong>Level 1. FRAME.<\/strong>&nbsp;The words you use to express your positioning. Taglines, decks, bios. Easy to copy. The frame is not the position; it describes the position.<\/li>\n\n\n\n<li><strong>Level 2. EXECUTE.<\/strong>\u00a0The measurable outcomes that validate the claim. Actions, metrics, results (verbs). Strong execution without a clear concept proves useful, not different.<\/li>\n\n\n\n<li><strong>Level 3. LIVE.<\/strong>\u00a0When positioning shows up in resource allocation, hiring, partnerships, and org structure. The test: if a competitor were handed your P&amp;L, what would shock them?<\/li>\n<\/ul>\n\n\n\n<p>The sequence runs 4 \u2192 1 \u2192 2 \u2192 3. Most companies operate at 1 while claiming 4. The gap between where a company operates and where it claims to be is where this analysis lives.<\/p>\n\n\n\n<p><strong><em>PS:\u00a0<a href=\"https:\/\/monopoly.ceo\" target=\"_blank\" rel=\"noopener\">Monopoly<\/a>\u00a0uncovered all the insights you\u2019ll read in this perspective.<\/em><\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image alignwide size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/Cloudflare_Thumb-1024x576.png\" alt=\"\" class=\"wp-image-4298\" srcset=\"https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/Cloudflare_Thumb-1024x576.png 1024w, https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/Cloudflare_Thumb-300x169.png 300w, https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/Cloudflare_Thumb-1536x864.png 1536w, https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/Cloudflare_Thumb.png 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"part-1-the-story-they-tell\">Part 1: The Story They Tell<\/h2>\n\n\n\n<p>Ask Matthew Prince what business he is in, and the answer arrives clean. He runs a &#8220;connectivity cloud.&#8221; A single global network that protects, connects, and builds the internet for anyone who shows up, from a hobbyist blogger to a Fortune 100 bank.<\/p>\n\n\n\n<p>The mission, repeated for fifteen years, is to &#8220;help build a better Internet.&#8221; Michelle Zatlyn, his co-founder and now President and Co-Chair, will correct anyone who drops the word &#8220;help.&#8221;<\/p>\n\n\n\n<p>The story has a clean arc. Three pillars at founding: security, performance, and reliability. One global anycast network where every service runs in every data center. A free tier that lets anyone on the internet protect their site in five minutes, paid for by enterprise customers further up the curve.<\/p>\n\n\n\n<p>Prince will tell you the network is the product. 300+ cities, 120+ countries, 12,000+ interconnects, roughly 20% of all web traffic, six billion monthly users. $1.67B in 2024 revenue, 77.3% GAAP gross margin, 29% YoY growth, all while giving away unlimited DDoS protection to anyone who wants it.<\/p>\n\n\n\n<p>He will credit the architecture. Lee Holloway, the third co-founder and original technical lead, designed it that way before anyone called it a moat. Commodity hardware, clever software, every service on every server.<\/p>\n\n\n\n<p>He will credit the developer&#8217;s flywheel. Free users pull peering deals. Peering deals lower bandwidth costs. Lower bandwidth costs let the free tier stay free. Free users grow into paying users, then enterprise customers.<\/p>\n\n\n\n<p>He will credit Birthday Week, the annual product launch ritual where Cloudflare announces new features as &#8220;gifts back to the Internet,&#8221; with being observed every year since its founding.<\/p>\n\n\n\n<p>Michelle, asked the same question, describes the product as &#8220;a digital bouncer and personal trainer.&#8221; She talks about &#8220;one seamless experience for cloud&#8221; as the killer attribute, and points out that Cloudflare has grown without acquisition, so there is no integration debt across the platform.<\/p>\n\n\n\n<p>Then there is the developer story. Workers runs on 300+ data centers; AI inference runs in 180+ cities; a single click deploys code globally in under a minute. Prince and Zatlyn will both point to this as evidence that Cloudflare is no longer just a security and CDN. The story extends to enterprise expansion: 3,497 customers paying $100K+ in FY24, 173 paying $1M+, and Forrester reporting 238% three-year ROI.<\/p>\n\n\n\n<p>The narrative is consistent across the leadership team. Connectivity cloud, network at scale, seamless platform, mission to help build a better internet. The metrics back it. The marketing reinforces it. The press repeats it.<\/p>\n\n\n\n<p>This is the story they tell. It&#8217;s accurate. It&#8217;s also not the position.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"part-2-the-hidden-position\">Part 2: The Hidden Position<\/h2>\n\n\n\n<p>Cloudflare doesn&#8217;t own the connectivity cloud. It doesn&#8217;t own performance, security, or even infrastructure. It implicitly owns\u00a0<strong>open-internet immunity<\/strong>.<\/p>\n\n\n\n<p>By immunity, I mean the felt state of being protected by the same layer that protects the internet itself, regardless of your size, your politics, your budget, or whether you pay. Cloudflare&#8217;s customers don&#8217;t really buy a service. They get a kind of standing on the open internet that they could not earn on their own.<\/p>\n\n\n\n<p>That noun isn&#8217;t in any Cloudflare press release. It doesn&#8217;t need to be. The decisions have been proving it for fifteen years.<\/p>\n\n\n\n<p>Listen to what customers actually say, unprompted.<\/p>\n\n\n\n<p>&#8220;We don&#8217;t even think about it anymore.&#8221;<\/p>\n\n\n\n<p>&#8220;My pager didn&#8217;t go off last night.&#8221;<\/p>\n\n\n\n<p>&#8220;Put it behind Cloudflare.&#8221;<\/p>\n\n\n\n<p>&#8220;I don&#8217;t know of a lot of security teams that can say that.&#8221; <\/p>\n\n\n\n<p>&#8220;Without Cloudflare&#8217;s protection, our website and app would be vulnerable to attacks, potentially impeding our ability to provide timely and reliable information to those who need it most.&#8221;<\/p>\n\n\n\n<p>&#8220;in front of your content.&#8221; (Matthew Prince&#8217;s own framing)<\/p>\n\n\n\n<p>Notice what is missing. No one says they bought a connectivity cloud. No one says they subscribed to a CDN-plus-security platform. They describe the state they entered. Protected. Quiet. Allowed to exist.<\/p>\n\n\n\n<p>That sounds like immunity to me. Less as a metaphor borrowed from biology, more as a literal description of what the customer experiences. A defensive layer they didn&#8217;t have to build, that absorbs the cost of being attacked, that lets them stop firefighting and start operating.<\/p>\n\n\n\n<h4 class=\"wp-block-heading alignwide\">Now strip every Cloudflare tagline, every keynote slide, every investor deck. Look only at the decisions.<\/h4>\n\n\n\n<p><strong>Universal SSL in 2014. <\/strong>Free encryption for every domain on the free tier, at a real revenue cost. The board pushed back. Prince did it anyway. Encryption was an immune response the internet needed. Cloudflare provided it for free.<\/p>\n\n\n\n<p><strong>Project Galileo, also in 2014.<\/strong> Free enterprise-grade protection for journalists, human rights groups, and civil society. 2,600+ organizations across 111 countries; about 96 million DDoS attacks blocked every day.<\/p>\n\n\n\n<p><strong>Athenian Project.<\/strong> Free protection for state and local election infrastructure. <\/p>\n\n\n\n<p><strong>Project Pangea. <\/strong>Free transit for underserved community networks. Critical Infrastructure Defence Project. Free Zero Trust for U.S. hospitals and utilities.<\/p>\n\n\n\n<p>Every program follows the same pattern. Take the immune response Cloudflare can manufacture at scale, hand it to whoever needs it most, and refuse to means-test by wealth.<\/p>\n\n\n\n<p>R2 launched with zero egress fees, while Cloudflare publicly attacked AWS for &#8220;egregious egress.&#8221; The Bandwidth Alliance does the same thing structurally. The position underneath: the internet is a public layer, and charging tolls to leave is a tax on existence.<\/p>\n\n\n\n<p>In July 2025, Cloudflare enabled default blocking of AI bots and announced pay-per-crawl. The framing was protective. Publishers, not scrapers, deserve the immune system&#8217;s defences. More than a million sites adopted the one-click block in less than a year.<\/p>\n\n\n\n<p>Then there are the takedowns Cloudflare hates having to make. Daily Stormer in 2017, 8chan in 2019, Kiwifarms in 2022. Each one was accompanied by a Prince blog arguing against his own decision. From the Daily Stormer post: &#8220;My rationale for making this decision was simple: the people behind the Daily Stormer are assholes, and I&#8217;d had enough. Let me be clear: this was an arbitrary decision.&#8221;<\/p>\n\n\n\n<p>A CEO publicly arguing against his own arbitrary power is hard to read as marketing. It looks more like a costly signal that the immune layer is supposed to be content-blind. The exceptions get named as exceptions, which reinforces the rule.<\/p>\n\n\n\n<p>When Cloudflare had its November 2025 outage, Prince&#8217;s first public statement was, &#8220;We let the Internet down today. On behalf of the entire @Cloudflare team, I&#8217;m sorry.&#8221; The Internet. Not the customers. That is utility language. The host is sorry, not the vendor.<\/p>\n\n\n\n<p>Prince has used the same framing for years. &#8220;Given Cloudflare&#8217;s critical role in the Internet ecosystem, any outage of our systems is intolerable.&#8221; And, &#8220;Every month, six billion users traverse our network. If Cloudflare is executing its functions effectively, its presence often goes unnoticed.&#8221; Invisibility as success is the standard to which an immune layer holds itself. You only notice it when it fails.<\/p>\n\n\n\n<p>Pricing decisions, refusals, free programs, takedown rationales, outage apologies. They all point at the same noun. An immune layer for the open internet, available to everyone, paid for by enterprise customers further up the curve.<\/p>\n\n\n\n<p>The architecture proves it structurally. Every service runs in every data center. There is no premium edge node, no enterprise-only city. The free-tier user in Lagos and the Fortune 500 bank in New York hit the same plane. That isn&#8217;t a product design choice. It&#8217;s a positioning choice expressed in code. Lee Holloway built it that way in the early years, and Prince has refused for fifteen years to differentiate by tier in the routing fabric. The immune layer is the same for everyone. Only the higher-order services are paid.<\/p>\n\n\n\n<h4 class=\"wp-block-heading alignwide\">Strip the words. What pattern remains? <\/h4>\n\n\n\n<p>A company that has spent fifteen years giving away the most expensive parts of being on the internet, refusing to charge tolls competitors charge as a matter of course, and publicly arguing against its own ability to police its customers. That reads less like a vendor and more like an immune layer.<\/p>\n\n\n\n<p>Map the competitive territory through this lens, and the picture clarifies.<\/p>\n\n\n\n<p>Akamai owns &#8220;enterprise CDN,&#8221; or &#8220;secure delivery at scale.&#8221; It is a category noun. It cannot also be the immune layer because it serves only those who can pay enterprise prices.<\/p>\n\n\n\n<p>Fastly owns &#8220;programmable edge,&#8221; a derivative noun, and a narrow one. Fastly&#8217;s own marketing frames itself in terms of Cloudflare, not the other way around.<\/p>\n\n\n\n<p>AWS CloudFront owns a checkbox inside AWS. It is a bundled feature, not a concept. It also cannot be the open internet&#8217;s immune layer when it is, in fact, its egress tollbooth.<\/p>\n\n\n\n<p>Zscaler is synonymous with &#8220;Zero Trust&#8221; in the CISO&#8217;s mind. A category shorthand in enterprise security, narrower than what Cloudflare does and limited to the corporate perimeter. F5, Cisco, and Imperva own &#8220;hardware appliance security,&#8221; which is precisely the category Cloudflare is replacing.<\/p>\n\n\n\n<p>Every competitor&#8217;s noun describes a product or a category. Cloudflare&#8217;s actual noun, the one its decisions prove, describes a relationship between the customer and the internet itself. That is category transcendence. The competitors are arguing about who makes the best appliance. Cloudflare is arguing about who gets to exist online without permission.<\/p>\n\n\n\n<p>The clearest residue is in the verb. &#8220;Put it behind Cloudflare&#8221; has no equivalent among competitors. No one says &#8220;put it behind Akamai&#8221; as an instinct. No one says &#8220;put it behind Fastly&#8221; reflexively. The procedural language has formed around one company because the experience has formed around one company.<\/p>\n\n\n\n<p>The benefit is a faster, safer, and more reliable infrastructure. The implicit position is immunity at the internet scale.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"part-3-the-identity-layer\">Part 3: The Identity Layer<\/h2>\n\n\n\n<p>The customer who chooses Cloudflare is entering a layer, more than they are buying a service. That sounds abstract until you hear from the people who actually choose.<\/p>\n\n\n\n<p>A developer with a side project at 2 a.m. puts it behind Cloudflare. A Fortune 500 CISO consolidating five vendors puts it behind Cloudflare. A Belarusian human rights group facing state-sponsored attacks puts it behind Cloudflare. A U.S. state election commission, a regional hospital, a publisher trying to charge AI companies for content, a Substack writer, a Shopify storefront, all put it behind Cloudflare.<\/p>\n\n\n\n<p>The unifying thing is the moment they stopped feeling like the internet was happening to them.<\/p>\n\n\n\n<p>Before Cloudflare, they were small, at the mercy of attackers, platforms, egress fees, and bandwidth bills. After, they are on a layer that absorbs the cost of being attacked, which lets them stop firefighting and operate at internet scale regardless of size.<\/p>\n\n\n\n<p>Choosing Cloudflare says something specific about the chooser. It says you take infrastructure seriously. It says you understand that the open internet is a layer worth defending, and you&#8217;d like to be on that layer.<\/p>\n\n\n\n<p>For a developer, it says, &#8220;I ship globally on day one, the way Google and Netflix do.&#8221; For a small civil society organization, it says, &#8220;We exist online because someone with capacity decided our voice was worth protecting.&#8221; For an enterprise CISO, it says, &#8220;We operate at the right layer; we are on the network.&#8221; For a publisher in 2025, it says, &#8220;I have a seat at the table when AI companies want my content.&#8221;<\/p>\n\n\n\n<p>They are all participants in the open internet&#8217;s immunity. They all moved one layer up. That position rhymes with the founders themselves.<\/p>\n\n\n\n<p>Prince calls himself a &#8220;free-speech absolutist&#8221; and a &#8220;recovering lawyer.&#8221; The lawyer instinct shows up in his content posts. Due Process is the principle he keeps elevating above Free Speech in his content decisions. He seems constitutionally allergic to discretionary power, including his own. That allergy reads to me as the temperament of an immune layer, less so a content moderator.<\/p>\n\n\n\n<p>He talks about Cloudflare&#8217;s role this way. &#8220;We&#8217;re focused on redesigning the fundamental aspects of the internet, which were established without foresight into their future implications.&#8221; And, &#8220;If the internet&#8217;s business model breaks, that&#8217;s not great for Cloudflare.&#8221;<\/p>\n\n\n\n<p>That second sentence is the giveaway for me. It is the language of an organ explaining its dependency on the body. Cloudflare&#8217;s health is downstream of the internet&#8217;s health, which means that defending the internet is, operationally, the same as defending Cloudflare. The position isn&#8217;t a posture. It&#8217;s a structural fact.<\/p>\n\n\n\n<figure class=\"wp-block-image alignwide size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/1684951038693-1024x683.jpeg\" alt=\"\" class=\"wp-image-4297\" srcset=\"https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/1684951038693-1024x683.jpeg 1024w, https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/1684951038693-300x200.jpeg 300w, https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/1684951038693.jpeg 1080w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Michelle Zatlyn brings the customer-side identity. The story she tells most often is the early customer who said, &#8220;My pager didn&#8217;t go off last night,&#8221; or &#8220;I had a full night&#8217;s sleep.&#8221; She is naming the private feeling of immunity in the language of the operator. The pager is the symbol of being at the mercy of the internet. Silence is the symbol of immunity restored.<\/p>\n\n\n\n<p>Lee Holloway built the structural conditions for any of this to work. The anycast architecture, the cell design, and the rule that every service runs in every data center were Holloway&#8217;s choices in code before they were anyone&#8217;s positioning. The founders&#8217; letter calls him &#8220;the genius who architected our platform.&#8221; The architecture is the position. A network that can absorb attack traffic at every node, everywhere, behaves like an immune layer because that is what it is.<\/p>\n\n\n\n<p>The identity isn&#8217;t bolted on. The founders&#8217; temperaments, the architect&#8217;s code, and the customer&#8217;s experience all converge on the same concept.<\/p>\n\n\n\n<p>When a developer reaches for Cloudflare, they are not consciously evaluating. They are running an automatic motion. The phrase &#8220;put it behind Cloudflare&#8221; functions as a verb in technical communities. The decision is fast and unexamined because the wiring has been built across thousands of small consistent experiences. The free tier, the Birthday Week gifts, the Daily Stormer blog, the AI bot block, and the seamless onboarding. All of it firing together.<\/p>\n\n\n\n<p>Compare that to &#8220;connectivity cloud.&#8221; When a buyer encounters that phrase, the analytical brain wakes up. What is a connectivity cloud? Is it a CDN? Is it security? Is it different from a regular cloud? The phrase invites evaluation. The customer translates &#8220;leading connectivity cloud company&#8221; back into &#8220;a CDN-plus-security platform with marketing.&#8221; The implicit position survives this. The explicit framing does not.<\/p>\n\n\n\n<p>That is the cognitive shape of Cloudflare&#8217;s strengths and weaknesses. The position is procedural within the technical buyer. The language is declarative everywhere else. Operating at Level 1 with the new vocabulary, owning Level 4 in customer minds with a different vocabulary that lives one layer underneath.<\/p>\n\n\n\n<p>The customer isn&#8217;t really the person who needs the connectivity cloud. The customer is the operator who has decided they refuse to be small on the internet anymore.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"part-4-the-success-mechanics\">Part 4: The Success Mechanics<\/h2>\n\n\n\n<p>Any single Cloudflare tactic looks brilliant on its own. Stacked, they read like a position quietly picking its own distribution.<\/p>\n\n\n\n<p>The free tier. Giving away unlimited DDoS protection, free SSL, free DNS, and free CDN to anyone forever should look reckless on a spreadsheet. It was inevitable the moment Cloudflare&#8217;s identity was locked in as the layer that protects the open internet. An immune layer cannot means-test its hosts.<\/p>\n\n\n\n<p>Project Galileo. Free enterprise-grade protection for 2,600+ public interest organizations would look like charity to most CFOs. As a costly signal, it is deafening. Cloudflare protects people who can&#8217;t pay because that&#8217;s what the noun requires.<\/p>\n\n\n\n<p>The &#8220;no acquisitions&#8221; stance. Cloudflare could have bought its way into Zero Trust, observability, edge compute, and consolidated faster. It refused. Every service in every server only works if every service is built natively to run on the same plane. Holloway&#8217;s architecture is the position; an acquisition spree would have shattered it.<\/p>\n\n\n\n<p>R2&#8217;s zero-egress pricing and the public AWS attack. Egress is the tax that breaks the open internet, and an immune layer that collects it stops being one. The &#8220;egregious egress&#8221; post reads less like a marketing tactic and more like the immune layer naming a pathogen.<\/p>\n\n\n\n<p>Birthday Week. Fifteen years of bundling launches into one September week is a marketing rhythm if you read it as one. It is also a ritual. Cloudflare announces products as &#8220;gifts back to the Internet,&#8221; not as launches to customers. A guardian gives. The cadence is the proof. The cadence is the position.<\/p>\n\n\n\n<p>The takedowns. Daily Stormer, 8chan, Kiwifarms. Read as content moderation, they look like the inconsistencies that weaken Cloudflare&#8217;s neutrality story. Read as costly signals, they are the named exceptions that reinforce the rule. Each one was accompanied by Prince publicly arguing against his own decision.<\/p>\n\n\n\n<p>The AI bot default block and pay-per-crawl in July 2025. As a product feature, it is one more security checkbox. As a position move, it is the immune layer identifying a new pathogen class and acting on behalf of the internet&#8217;s content layer, not just on behalf of paying customers.<\/p>\n\n\n\n<p>The 2024 decision to prioritize resilience over launch velocity after the year&#8217;s reliability stumbles. Cloudflare chose to optimize for uptime over feature cadence. That is the choice a public utility makes. Immune layers fail toward steadiness.<\/p>\n\n\n\n<p>Each of these costs real money or real opportunity. Each could be reversed only by changing what the company structurally is. Connectivity cloud copies overnight. Fifteen years of subordinating revenue to neutrality does not.<\/p>\n\n\n\n<p>The pricing tells the same story underneath. The free tier is the most expensive marketing instrument in B2B tech, and it returns 77.3% gross margin at $1.67B in revenue because the network is so dense and so efficient that giving away protection costs almost nothing at the margin. The free tier is pricing-as-proof. It is the costliest available declaration that protection is supposed to be universal and paid for by enterprises that want differentiated capabilities.<\/p>\n\n\n\n<p>Network effects look different through this lens. A CDN&#8217;s network effect is bandwidth efficiency. An immune layer&#8217;s network effect is learning. Cloudflare sees more bad traffic than almost anyone on earth. Six billion monthly users, roughly 20% of all web traffic, about 96 million DDoS attacks blocked every day through Project Galileo alone. Every attack on a free user trains the system that protects an enterprise customer. The free tier is the antibody factory.<\/p>\n\n\n\n<p>Capability and need meet at the noun. Cloudflare&#8217;s structural capability is one network everywhere, every service on every server, no acquisition debt, commodity hardware with software differentiation. The market&#8217;s emotional need is to stop feeling small, to stop firefighting, to belong on the layer the giants use, to defend the open internet at internet scale. Capability and need land in the same place.<\/p>\n\n\n\n<p>Most of this has been working without Cloudflare consciously framing any of it as &#8220;open-internet immunity.&#8221; Prince writes about due process. Zatlyn talks about a connectivity cloud. The marketing copy says &#8220;connect, protect, build everywhere.&#8221; The position runs underneath the language. The language hasn&#8217;t caught up.<\/p>\n\n\n\n<p>That&#8217;s the gap. Cloudflare is over-built and under-named. The structural commitments are decades ahead of the explicit articulation. Most companies have the opposite problem. The risk here is that Cloudflare keeps trying to invent category language to describe the product, when the real opportunity is to name the customer transformation that the product produces.<\/p>\n\n\n\n<p>The numerical residue confirms the position is forming underneath. Customers describe themselves through the product (&#8220;I&#8217;m on Cloudflare&#8221;). The verb &#8220;put it behind Cloudflare&#8221; is unprompted. Competitors define themselves relative to Cloudflare; Cloudflare doesn&#8217;t define itself relative to anyone. Fortune 1,000 customers cross 300; $1M+ customers grew 47% YoY to 173 in FY24.<\/p>\n\n\n\n<p>The technical buyer feels the position because the decisions are consistent. The general public knows Cloudflare as the company behind the CAPTCHA, or the one that had the big outage. There is no shorthand for what Cloudflare actually is. In a Fast Company interview, Prince acknowledged the 2025 goal of changing that perception. The gap closes when the language names the transformation.<\/p>\n\n\n\n<p>Fifteen years of costly signals lie beneath a vocabulary still finding itself.<\/p>\n\n\n\n<figure class=\"wp-block-image alignwide size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/T100Companies-cloudflare-1024x683.webp\" alt=\"\" class=\"wp-image-4301\" srcset=\"https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/T100Companies-cloudflare-1024x683.webp 1024w, https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/T100Companies-cloudflare-300x200.webp 300w, https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/T100Companies-cloudflare-1536x1024.webp 1536w, https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/T100Companies-cloudflare-2048x1365.webp 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"part-5-the-coaching-moment\">Part 5: The Coaching Moment<\/h2>\n\n\n\n<p>Matthew, you think you built a connectivity cloud. What you actually own implicitly is\u00a0<strong>open-internet immunity<\/strong>.<\/p>\n\n\n\n<p>Your customers aren&#8217;t buying a network. They&#8217;re buying the right to exist online without permission.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Why the free tier worked:<\/strong> because an immune layer cannot means-test its hosts.<\/li>\n\n\n\n<li><strong>Why Project Galileo worked:<\/strong> because protection that costs the protected nothing proves the noun better than any tagline.<\/li>\n\n\n\n<li><strong>Why R2 zero-egress and the AWS attack worked: <\/strong>because egress is the tax that breaks the open internet, and the layer underneath it cannot collect it.<\/li>\n\n\n\n<li><strong>Why &#8220;put it behind Cloudflare&#8221; became a verb:<\/strong> because the procedural motion is the immunity.<\/li>\n\n\n\n<li><strong>Why the takedown blogs worked:<\/strong> because a CEO publicly arguing against his own arbitrary power is what neutrality at internet scale looks like in practice.<\/li>\n<\/ul>\n\n\n\n<p>Here is the specific opportunity. Every decision Cloudflare makes can pass through one filter.\u00a0<em>Does this deepen open-internet immunity?<\/em>\u00a0The connectivity cloud frame can&#8217;t answer that question. Immunity can. Pay-per-crawl deepens it. The default AI bot blocking deepens it. Anything that quietly gates protection by wealth weakens it. Anything that hides who is making the discretionary call weakens it. Anything that lets enterprise customers buy a faster lane than civil society gets weakens it. The filter is unambiguous, which is why it is useful.<\/p>\n\n\n\n<p>The gap between where you are and where you could be:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><em>Current implicit position:<\/em>&nbsp;the layer in front of the internet for everyone, paying or not.<\/li>\n\n\n\n<li><em>Explicit ownership position:<\/em>&nbsp;Cloudflare is open-internet immunity.<\/li>\n<\/ul>\n\n\n\n<p>You operate at the first. You market at a third thing called the connectivity cloud that doesn&#8217;t quite map to either.<\/p>\n\n\n\n<p>Now the deeper distinction.<\/p>\n\n\n\n<p>The functional benefit layer is real and important. Faster sites. Lower bandwidth bills. Consolidated security vendors. Fewer pager alerts. Five-minute onboarding. Hardware appliances retired. Forrester reports 238% three-year ROI. Applied Systems says &#8220;less than half the cost&#8221; of the vendors they replaced. Fullscript says 8x faster deployments.<\/p>\n\n\n\n<p>That is what your customers receive. It is not what they become.<\/p>\n\n\n\n<p>What they become is harder for them to articulate, which is why the language never quite arrives. They become someone protected by the same layer that protects the internet itself. Someone who runs critical infrastructure with a small team because the giants&#8217; plumbing is now their plumbing. Someone who exists online without asking permission from anyone bigger.<\/p>\n\n\n\n<p>The Tech4Peace quote from Galileo says it cleanly. &#8220;Without Cloudflare&#8217;s protection, our website and app would be vulnerable to attacks, potentially impeding our ability to provide timely and reliable information to those who need it most.&#8221; They are naming an existence-level change.<\/p>\n\n\n\n<p>The Applied Systems CISO names the same thing from a different seat. &#8220;I don&#8217;t know of a lot of security teams that can say that.&#8221; That&#8217;s identity language. Who they are now.<\/p>\n\n\n\n<p>The benefit is the proof. <br>The transformation is the position.<\/p>\n\n\n\n<p>Benefits get competed away. Fastly will match a latency number. AWS will bundle a feature. Akamai will discount enterprise contracts. None of them can compete with a fifteen-year accumulation of costly signals that prove a customer is no longer alone on the internet. That kind of transformation doesn&#8217;t clone inside a roadmap cycle.<\/p>\n\n\n\n<p>A few questions to sit with.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>What changes about the product roadmap if every new feature has to pass the filter, &#8220;does this make our customer more immune to the open internet&#8217;s failure modes, or less&#8221;?<\/li>\n\n\n\n<li>When Cloudflare publishes outage post-mortems, to whom is the apology for? Customers, or the internet itself? You said the latter in November 2025. Is that consistent in every other comms moment?<\/li>\n\n\n\n<li>What language would Galileo participants, Athenian election commissions, and AI-bot-blocking publishers use if you asked them, in their own words, who they are now that they are on Cloudflare?<\/li>\n\n\n\n<li>Is &#8220;help build a better Internet&#8221; the mission language, or is it the transformation language? If it&#8217;s a mission, what is the transformation noun underneath it?<\/li>\n\n\n\n<li>What would the dashboard, the onboarding, and the support tier all look like if they were designed to deliver immunity?<\/li>\n<\/ol>\n\n\n\n<p><strong><em>Open-internet immunity. The benefit is the proof. The transformation is the position.<\/em><\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"a-closing-note\">Finally<\/h2>\n\n\n\n<p>I have been watching Cloudflare from the outside for years, as most readers of this report have. I keep noticing the same thing. The decisions land in one place. The language lands somewhere a little lighter, a little to the side.<\/p>\n\n\n\n<p>That is a fixable problem, and it is the rare kind of fixable that does not require a new product, a new structure, or new capital. The work has already been done. The naming is what is missing.<\/p>\n\n\n\n<p>I will keep watching Cloudflare. I suspect, sometime in the next few years, the language will catch up to the structure. When that happens, the noun will stop being something I notice and start being something everyone says.<\/p>\n\n\n\n<figure class=\"wp-block-image alignfull size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"671\" src=\"https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/L6HJNOYJD5LC5CLJ3NWU7O7KEE-1024x671.jpg\" alt=\"\" class=\"wp-image-4300\" srcset=\"https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/L6HJNOYJD5LC5CLJ3NWU7O7KEE-1024x671.jpg 1024w, https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/L6HJNOYJD5LC5CLJ3NWU7O7KEE-300x197.jpg 300w, https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/L6HJNOYJD5LC5CLJ3NWU7O7KEE-1536x1007.jpg 1536w, https:\/\/paulsyng.com\/blog\/wp-content\/uploads\/2026\/05\/L6HJNOYJD5LC5CLJ3NWU7O7KEE-2048x1342.jpg 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Uncover Your Position<\/h2>\n\n\n\n<p>Every company has a hidden position. The concept their decisions prove but their language hasn\u2019t named. The noun that explains every success and every confusion. The identity transformation their customers experience but cannot articulate.<\/p>\n\n\n\n<p>Cloudflare&#8217;s is <strong>open-internet immunity<\/strong>. <\/p>\n\n\n\n<p>What\u2019s yours?<\/p>\n\n\n\n<p>The\u00a0<strong>CEO Clarity Starter Kit<\/strong>\u00a0is a focused DIY 60-minute engagement that reveals what concept your company actually owns, what level you operate at, whether you\u2019re proving implicitly or claiming explicitly, and what single transition would unlock your next stage of growth.<\/p>\n\n\n\n<p>For enterprises ready to go deeper,\u00a0<strong>Monopoly<\/strong>\u00a0is the full strategic system: crystallizing the noun, aligning every level of the business around it, and building the structural proof that makes your position unassailable.<\/p>\n\n\n\n<p>Stop naming the benefit. Start naming the transformation.<\/p>\n\n\n\n<p>Learn more about the&nbsp;<a href=\"https:\/\/kit.ceo\/\" target=\"_blank\" rel=\"noreferrer noopener\">CEO Clarity Starter Kit \u2192<\/a><br>Explore&nbsp;<a href=\"https:\/\/monopoly.ceo\/\" target=\"_blank\" rel=\"noreferrer noopener\">Monopoly \u2192<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A note before you read this: I&#8217;ve been watching Cloudflare for a long time. What Matthew Prince, Michelle Zatlyn, and Lee Holloway built, and what the team continues to build, sits in a category of its own. Fifteen years of decisions that quietly hold up a meaningful portion of the open internet is not a [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":4299,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":"","rank_math_title":"","rank_math_description":"","rank_math_canonical_url":"","rank_math_focus_keyword":""},"categories":[83],"tags":[],"class_list":["post-4293","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-gravity-report"],"_links":{"self":[{"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/posts\/4293","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/comments?post=4293"}],"version-history":[{"count":13,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/posts\/4293\/revisions"}],"predecessor-version":[{"id":4311,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/posts\/4293\/revisions\/4311"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/media\/4299"}],"wp:attachment":[{"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/media?parent=4293"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/categories?post=4293"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/paulsyng.com\/blog\/wp-json\/wp\/v2\/tags?post=4293"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}