Combined average of Moat (AI Resilience), Growth, and Valuation scores.
Moat Score
Cloudflare's global edge network processes 215 billion threats daily, creating a threat-intelligence flywheel that compounds with scale and is unreplicable by any single competitor.
Cloudflare's moat rests on three interlocking pillars: Proprietary Data Flywheel, Network Effects, and Platform Bundling:
- Threat Intelligence Flywheel (Proprietary Data): With 215 billion cyber threats blocked daily across 332,000+ customers — including 38% of the Fortune 500 — Cloudflare operates the world's largest internet threat sensor network. This telemetry feeds security products in real-time, creating a data moat that grows more valuable with every new customer added to the network.
- Edge Network Effects & Architecture: Cloudflare's 300+ city network delivers sub-100ms latency to 95% of the world's connected population. Every server in every city can perform every function simultaneously — DDoS mitigation, SASE, DNS, compute, and AI inference. This architecture is 10+ years in the making and cannot be replicated quickly; the performance it delivers improves for all customers as the network scales.
- Platform Bundling Depth (SASE + Zero Trust + Workers): Cloudflare sells CDN, DDoS protection, Zero Trust access, SASE (Magic WAN, Gateway, DLP), R2 storage, Workers serverless compute, and AI inference from a single unified dashboard. Once enterprises deploy multiple modules — such as the 7-year, $12.7M/year SASE deal closed in Q1 2025 — the configuration, integrations, and workflow dependencies create multi-year switching costs exceeding those of most pure-play cybersecurity vendors.
Moat Verdict
Cloudflare is a net beneficiary of AI — the shift from human users to AI agents as the primary internet traffic source creates massive demand for Cloudflare's edge network, security layer, and Workers compute runtime. The proprietary threat-intelligence data flywheel and network effects are the two most AI-resilient moats, both of which strengthen as AI-driven attack vectors increase the value of real-time threat data. The primary AI risk is that hyperscalers bundle security capabilities into their managed AI platforms, reducing the independent security and CDN market. Overall, Cloudflare's architecture — where AI inference, security, and networking converge at the same edge node — positions it as critical infrastructure for the agentic internet.
69.9 resilient · 65.0 vulnerable · 80/20 = 68.9 · = 69
Open a moat to read its note.
Security engineers trained on Cloudflare's unified dashboard, Workers CLI, and Zero Trust policy engine invest significant institutional knowledge — Teams migrating would need to retrain and rebuild configurations. AI slightly weakens this moat by abstracting infrastructure management.
Full SASE deployments (Magic WAN + Gateway + DLP + Access + Magic Firewall) are deeply configured per enterprise network topology, and a 7-year deal shows the switching cost is real. That configuration is the customer's policy, not Cloudflare-owned logic competitors cannot replicate. Same bar as Palo Alto and CrowdStrike detection rules (intact). The franchise is the edge network and threat data, already scored on networkEffects and proprietaryData.
Cloudflare's 1.1.1.1 resolver processes a significant fraction of global DNS queries, giving it unique internet-wide visibility. AI is slightly weakening this by enabling threat-intel synthesis from other data sources, but the volume advantage remains.
Global BGP peering engineers, DDoS research team, and cryptography experts (TLS 1.3 adoption) represent genuine talent scarcity. AI augments but does not replace this specialisation.
CDN, DDoS, SASE, Zero Trust, DNS, R2, Workers and AI Gateway from one platform is a real multi-product expansion path, but Akamai, Zscaler and the hyperscalers each contest large parts of it; the bundle raises switching cost without being one competitors cannot match. Re-rated from strong to intact in the proof-point pass.
215 billion threats blocked daily across 332,000+ customers is operationally valuable, but AWS WAF, Akamai, and Google Cloud Armor see comparable global traffic and generate equivalent threat intelligence from their own networks. The dataset improves Cloudflare's products but is not 'proprietary' in the FICO/Evidence.com sense — competitors have functional equivalents.
FedRAMP authorisation and GDPR/CCPA/NIS-2 compliance make Cloudflare procurable for government and regulated buyers — table stakes that AWS, Azure and Akamai also hold, so they bar small entrants rather than peers. Previously weakened, which scored a real if shallow barrier as an eroded moat; intact, like Salesforce, Datadog and Snowflake.
Cloudflare sits in front of roughly 20% of websites (W3Techs), and that vantage point feeds threat intelligence to every customer, but it is a data flywheel rather than a two-sided network, and the Workers developer loop is scale, not users making each other better off. Re-rated from strong to intact in the proof-point pass.
Every HTTP request from a Cloudflare customer transits Cloudflare's network — embedded in the critical path of web traffic. Claude managed agents and agentic AI workloads deepen this embedding significantly: Cloudflare AI Gateway is the canonical rate-limiting, caching, and observability layer for managed agent API calls, meaning enterprises configure their entire agent infrastructure pipeline through Cloudflare. The shift from human HTTP traffic to AI agent HTTP traffic structurally upgrades Cloudflare's transaction embedding from infrastructure-level to agent-orchestration-level — every agent tool call is a Cloudflare-embedded transaction. The position is not exclusive, though: AWS shipped the same x402 agent-payment protocol GA in CloudFront and WAF in June 2026, two weeks before Cloudflare's Monetization Gateway opened a waitlist. Status holds at strong on the installed request path Cloudflare already owns, not on being the only edge that can bill an agent.
Cloudflare manages DNS zones and SSL certificates as systems of record for domain identity. With AI Gateway, Cloudflare is emerging as the canonical configuration and observability layer for managed agent deployments — enterprises store rate limits, LLM provider routing, caching rules, and agent call logs in Cloudflare's platform. While not a system of record for financial or HR data, the growing role as the authoritative configuration layer for enterprise AI agent infrastructure upgrades this from weakened to intact.
A global edge footprint lets Cloudflare serve bandwidth and compute at a unit cost smaller CDNs cannot, but Akamai and the hyperscalers operate comparable networks.
Buyers are enterprises choosing on switching cost, integration and performance, which the other pillars rate. The name carries reputation, not a price premium it could hold on brand alone.
Moat in 5–10 years
Cloudflare's moats hold at their current level. Transaction embedding is the strong pillar, resting on the request path of the roughly 20% of websites it already sits in front of, and agent traffic adds volume to that path. AWS matching the x402 agent-payment protocol in CloudFront and WAF shows the agent layer is contestable, so no widening is called on AI Gateway until it shows up as a disclosed share or revenue figure. The intact pillars, matched by Akamai and the hyperscalers on scale, data and certifications, have no mechanism moving them a step.
No moat trending · 69 holds
Combined average of Moat (AI Resilience), Growth, and Valuation scores.
Moat Score
Cloudflare's global edge network processes 215 billion threats daily, creating a threat-intelligence flywheel that compounds with scale and is unreplicable by any single competitor.
Growth Score
Q1 2026 — still the most recent reported quarter — delivered $639.8M revenue (+34% YoY) against a $620.8M consensus. FY2026 guidance was raised to $2.805–2.813B, non-GAAP operating income to $418–421M (from $378–382M guided in February) and EPS to $1.19–1.20, with Q2 guided to $664–665M (+30%). At the June 9 Investor Day management raised the long-term operating margin target to 30%+ (from 20%+) and the FCF margin target to 30–35% (from ~25%), committed to Rule of 50 by FY2027 and GAAP profitability by 2028 at the latest, and disclosed segment ARR growth for the first time: Cloudflare One +43% and Developer +137% in 2025. The counterweight is that the margin inflection has not begun — Q1 operating margin was 11.4%, 30bp lower YoY, Q2 is guided to 13.6% against 14.1% a year ago, and gross margin fell 210bp sequentially to 72.8% as free traffic converts to paid and lower-margin Workers volume scales, which is why the long-term gross margin floor was widened from 75% to 70%. RPO grew 36% YoY (from +48% in Q4) and DBNRR slipped 2pp to 118%. The 20% workforce reduction (~1,100 roles, $140–150M of charges) is both the source of the guided H2 leverage and the main execution risk; the Q2 print on August 6 is its first test.
Valuation Score
At ~$284 NET trades ~14% above its $250 base target, ~26% of the way from base to the $380 bull case and ~119% above the $130 bear. The June–July AI-agent re-rating carried it to a 52-week high of $293.80 on July 30 as Bank of America ($330 from $255), Oppenheimer ($330) and Morgan Stanley ($305) raised targets into the print, well through the ~$251 consensus. NTM P/S has re-expanded to ~36× and forward non-GAAP P/E to ~238×, which prices the June 9 Investor Day framework — 30%+ long-term operating margin, 30–35% FCF margin, Rule of 50 by FY2027 — as delivered rather than as a target, through a restructuring whose first evidence arrives with Q2 results on August 6. The margin of safety that existed at the May ~$150 low and the June ~$234 level is gone.
The Connectivity Cloud Moat
Cloudflare's moat rests on three interlocking pillars: Proprietary Data Flywheel, Network Effects, and Platform Bundling:
- Threat Intelligence Flywheel (Proprietary Data): With 215 billion cyber threats blocked daily across 332,000+ customers — including 38% of the Fortune 500 — Cloudflare operates the world's largest internet threat sensor network. This telemetry feeds security products in real-time, creating a data moat that grows more valuable with every new customer added to the network.
- Edge Network Effects & Architecture: Cloudflare's 300+ city network delivers sub-100ms latency to 95% of the world's connected population. Every server in every city can perform every function simultaneously — DDoS mitigation, SASE, DNS, compute, and AI inference. This architecture is 10+ years in the making and cannot be replicated quickly; the performance it delivers improves for all customers as the network scales.
- Platform Bundling Depth (SASE + Zero Trust + Workers): Cloudflare sells CDN, DDoS protection, Zero Trust access, SASE (Magic WAN, Gateway, DLP), R2 storage, Workers serverless compute, and AI inference from a single unified dashboard. Once enterprises deploy multiple modules — such as the 7-year, $12.7M/year SASE deal closed in Q1 2025 — the configuration, integrations, and workflow dependencies create multi-year switching costs exceeding those of most pure-play cybersecurity vendors.
Moat Verdict
Cloudflare is a net beneficiary of AI — the shift from human users to AI agents as the primary internet traffic source creates massive demand for Cloudflare's edge network, security layer, and Workers compute runtime. The proprietary threat-intelligence data flywheel and network effects are the two most AI-resilient moats, both of which strengthen as AI-driven attack vectors increase the value of real-time threat data. The primary AI risk is that hyperscalers bundle security capabilities into their managed AI platforms, reducing the independent security and CDN market. Overall, Cloudflare's architecture — where AI inference, security, and networking converge at the same edge node — positions it as critical infrastructure for the agentic internet.
69.9 resilient · 65.0 vulnerable · 80/20 = 68.9 · = 69
Open a moat to read its note.
Security engineers trained on Cloudflare's unified dashboard, Workers CLI, and Zero Trust policy engine invest significant institutional knowledge — Teams migrating would need to retrain and rebuild configurations. AI slightly weakens this moat by abstracting infrastructure management.
Full SASE deployments (Magic WAN + Gateway + DLP + Access + Magic Firewall) are deeply configured per enterprise network topology, and a 7-year deal shows the switching cost is real. That configuration is the customer's policy, not Cloudflare-owned logic competitors cannot replicate. Same bar as Palo Alto and CrowdStrike detection rules (intact). The franchise is the edge network and threat data, already scored on networkEffects and proprietaryData.
Cloudflare's 1.1.1.1 resolver processes a significant fraction of global DNS queries, giving it unique internet-wide visibility. AI is slightly weakening this by enabling threat-intel synthesis from other data sources, but the volume advantage remains.
Global BGP peering engineers, DDoS research team, and cryptography experts (TLS 1.3 adoption) represent genuine talent scarcity. AI augments but does not replace this specialisation.
CDN, DDoS, SASE, Zero Trust, DNS, R2, Workers and AI Gateway from one platform is a real multi-product expansion path, but Akamai, Zscaler and the hyperscalers each contest large parts of it; the bundle raises switching cost without being one competitors cannot match. Re-rated from strong to intact in the proof-point pass.
215 billion threats blocked daily across 332,000+ customers is operationally valuable, but AWS WAF, Akamai, and Google Cloud Armor see comparable global traffic and generate equivalent threat intelligence from their own networks. The dataset improves Cloudflare's products but is not 'proprietary' in the FICO/Evidence.com sense — competitors have functional equivalents.
FedRAMP authorisation and GDPR/CCPA/NIS-2 compliance make Cloudflare procurable for government and regulated buyers — table stakes that AWS, Azure and Akamai also hold, so they bar small entrants rather than peers. Previously weakened, which scored a real if shallow barrier as an eroded moat; intact, like Salesforce, Datadog and Snowflake.
Cloudflare sits in front of roughly 20% of websites (W3Techs), and that vantage point feeds threat intelligence to every customer, but it is a data flywheel rather than a two-sided network, and the Workers developer loop is scale, not users making each other better off. Re-rated from strong to intact in the proof-point pass.
Every HTTP request from a Cloudflare customer transits Cloudflare's network — embedded in the critical path of web traffic. Claude managed agents and agentic AI workloads deepen this embedding significantly: Cloudflare AI Gateway is the canonical rate-limiting, caching, and observability layer for managed agent API calls, meaning enterprises configure their entire agent infrastructure pipeline through Cloudflare. The shift from human HTTP traffic to AI agent HTTP traffic structurally upgrades Cloudflare's transaction embedding from infrastructure-level to agent-orchestration-level — every agent tool call is a Cloudflare-embedded transaction. The position is not exclusive, though: AWS shipped the same x402 agent-payment protocol GA in CloudFront and WAF in June 2026, two weeks before Cloudflare's Monetization Gateway opened a waitlist. Status holds at strong on the installed request path Cloudflare already owns, not on being the only edge that can bill an agent.
Cloudflare manages DNS zones and SSL certificates as systems of record for domain identity. With AI Gateway, Cloudflare is emerging as the canonical configuration and observability layer for managed agent deployments — enterprises store rate limits, LLM provider routing, caching rules, and agent call logs in Cloudflare's platform. While not a system of record for financial or HR data, the growing role as the authoritative configuration layer for enterprise AI agent infrastructure upgrades this from weakened to intact.
A global edge footprint lets Cloudflare serve bandwidth and compute at a unit cost smaller CDNs cannot, but Akamai and the hyperscalers operate comparable networks.
Buyers are enterprises choosing on switching cost, integration and performance, which the other pillars rate. The name carries reputation, not a price premium it could hold on brand alone.
Moat in 5–10 years
Cloudflare's moats hold at their current level. Transaction embedding is the strong pillar, resting on the request path of the roughly 20% of websites it already sits in front of, and agent traffic adds volume to that path. AWS matching the x402 agent-payment protocol in CloudFront and WAF shows the agent layer is contestable, so no widening is called on AI Gateway until it shows up as a disclosed share or revenue figure. The intact pillars, matched by Akamai and the hyperscalers on scale, data and certifications, have no mechanism moving them a step.
No moat trending · 69 holds
Growth Analysis
Growth Drivers
Key Risk
Two converging risks: (1) the 20% workforce reduction disrupts go-to-market and product velocity for 2–3 quarters so the guided H2 operating leverage never appears — FY2026 non-GAAP operating income lands below the $418–421M guide and DBNRR slips under 116% by Q4 2026; (2) hyperscalers match Cloudflare's agent-infrastructure products at their own edge before Cloudflare monetises them — AWS shipped x402 agent payments GA in CloudFront and WAF in June 2026, two weeks before Cloudflare's Monetization Gateway opened a waitlist with no pricing or launch date — leaving Cloudflare to compete for agent workloads on the contested CDN/SASE ground where Palo Alto and Zscaler bundle aggressively and RPO growth decelerates below 25%
Score Derivation
88.7 base + 1.3 trajectory − 5 risk = 85
Base 88.7 (26–30% CAGR, midpoint 28) + 1.3 trajectory (Workers and agent infrastructure accelerating; Cloudflare One and large-customer expansion stable) + 0 margin (stable) − 5 moderate key risk = 85. Three inputs were re-rated in the August 2026 review and each costs points. Margin moves from expanding to stable because the direction is guided, not observed: the FY2026 operating income guide does imply 14.9% against 14.0% in FY2025, but Q1 printed 11.4% (−30bp YoY), Q2 is guided 50bp lower YoY, and gross margin is falling with its own long-term floor cut from 75% to 70% — the entire expansion sits in an H2 the restructuring has not yet delivered. Restore expanding on the first quarter that prints YoY operating margin expansion. Large-customer expansion moves to stable because its measures disagree: count growth +23% → +23% → +25% but large-customer revenue growth +42% (Q3 2025) → +38% (Q1 2026) and DBNRR 119 → 120 → 118. Cloudflare One is stable rather than accelerating because +43% ARR growth for 2025 is the only rate Cloudflare has disclosed for it — one point cannot establish a direction. Severity stays moderate: the deceleration already visible in RPO and DBNRR is charged in the drivers and the base, so the risk term carries only the unmaterialised half — that the restructuring costs more velocity than it buys, and that hyperscalers match the agent-infrastructure products before Cloudflare monetises them.
Price Scenarios (12–24 Months)
Price vs Targets
Dashed lines mark the 12–24 month bear, base and bull targets. Daily closes.
Valuation Multiples
| Trailing P/E (GAAP) | N/A |
| Forward P/E (NTM, non-GAAP) | ~238× |
| PEG Ratio | N/A |
| Price / Sales (NTM) | ~36× |
| Price / FCF | ~346× |
NET trades at ~36× NTM P/S after the AI-agent rally extended from June into a late-July run to a 52-week high — the multiple has not just round-tripped the May restructuring selloff but pushed well past its ~27× March level to a cycle high. It is the widest premium in the security book, though by less than this file previously claimed: coverage carries CrowdStrike at ~27× and Palo Alto at ~16.5×, not the ~16× and ~11× cited in July. The market is paying for the agentic-internet thesis — agent requests +1,700%, Developer ARR +137%, the July 1 Monetization Gateway — rather than for the 30% revenue growth alone. At ~238× forward non-GAAP P/E and ~346× TTM FCF, the cash-margin path is the swing factor: only if the 1,100-person reduction converts into the guided H2 operating leverage and a 30–35% long-term FCF margin does the multiple compress to a defensible level for a 30% grower. With the stock above its base target going into the August 6 Q2 print, the risk/reward is execution-priced-in rather than patience-rewarded.
Approximate figures as of August 2026.
Where We Are vs Targets
Loading live price…
The 20% workforce reduction disrupts go-to-market velocity and product execution for 2–3 quarters while hyperscaler bundling erodes CDN/SASE share, compressing P/S to ~16× on $2.81B 2026 revenue.
- Agentic-AI-first restructuring removes too much sales capacity too fast — large-customer ACV growth stalls below 18% YoY through Q4 2026 as deal cycles slow and the 7-year SASE momentum cools
- DBNRR slips further from 118% to 114–116% for two consecutive quarters as enterprises pause SASE expansion amid macro uncertainty and AWS CloudFront + Security Hub bundling displaces Cloudflare's CDN layer at 5%+ of Fortune 500 accounts
- Gross margin compresses below 73% as edge infrastructure CapEx to support AI inference workloads exceeds revenue contribution from Workers AI through 2026
- Multiple re-rates to ~16× NTM P/S as growth decelerates toward 24% and FCF margin expansion stalls at 14–15% despite the cost actions
Cloudflare delivers raised FY2026 guidance ($2.81B, +29–30% YoY; EPS $1.19–1.20) with DBNRR stabilising at 118% and FCF margin expanding toward 18–20% as the agentic-AI-first restructuring delivers the targeted operating leverage by H2 2026.
- FY2026 revenue lands at $2.81B with large customers growing 22%+ YoY and RPO sustaining 30%+ growth through contracted multi-year SASE and AI Gateway deals
- FCF margin expands to 18–20% by Q4 2026 as the 1,100-person reduction (~$140M annualised cost base) compounds with operating leverage on a 30% revenue base
- Workers AI and AI Gateway establish Cloudflare as default edge inference infrastructure for AI agent traffic, contributing $150M+ incremental ARR by year-end 2026
- DBNRR re-anchors at 118–120% by Q4 2026 as the AI-first sales motion displaces seat-based CRM/security workflows with agent-driven upsell
AI agent traffic creates a new internet infrastructure cycle — Cloudflare's agentic-AI-first pivot lands the company as the default runtime for autonomous agents, re-accelerating revenue toward 35%+ and pushing FCF margin to 25%+ ahead of schedule.
- AI agent traffic on Workers exceeds 20% of Cloudflare's total request volume by end of 2026, driving a new consumption-based revenue layer on top of the subscription base and pushing ARR growth toward 40%
- Cloudflare wins 3+ sovereign government cloud contracts in Europe under EU Data Act/NIS-2 compliance, establishing a government revenue stream and locking in decade-long regulatory relationships
- SASE displacement of Zscaler at 3–4 Fortune 100 accounts adds >$100M ACV, validating Cloudflare's ability to compete in the largest enterprise security deals
- FCF margin reaches 25%+ by Q4 2026 — inside the 30–35% long-term target set at the June Investor Day — as the AI-first cost base compounds with revenue scale, supporting ~37× NTM P/S on ~$3.65B FY2027 revenue
NET: common questions
Is Cloudflare stock a buy?
We rate Cloudflare Hold, with a composite score of 71/100: moat 69, growth 85 and valuation 60. The valuation score is struck against our bear, base and bull targets and moves with the price.
What is Cloudflare's moat?
Cloudflare scores 69/100 on moat. Cloudflare's global edge network processes 215 billion threats daily, creating a threat-intelligence flywheel that compounds with scale and is unreplicable by any single competitor.
How fast is Cloudflare expected to grow?
We estimate 26–30% a year over the next three to five years, for a growth score of 85/100.
What is Cloudflare's price target?
Our base case is $250, with $130 in the bear case and $380 in the bull case.