Introduction
Cloudflare was founded on July 26, 2009, by Matthew Prince, Michelle Zatlyn, and Lee Holloway, growing out of Project Honey Pot, an earlier anti-spam tracking tool Prince and Holloway had built together. Prince and Zatlyn met while both were studying at Harvard Business School, where the earliest version of the Cloudflare business plan — then titled ‘Project Web Wall’ — won the school’s business plan competition in April 2009 before the team settled on the name Cloudflare, reflecting the idea of a ‘firewall in the cloud.’ The company is headquartered in San Francisco and went public on the New York Stock Exchange under the ticker NET in September 2019.
What the company does
Cloudflare operates a global network that sits in front of websites and applications to absorb distributed denial-of-service (DDoS) attacks, filter malicious traffic through its web application firewall (WAF), and manage bot traffic, while also offering Cloudflare One, a Zero Trust network access platform that lets enterprises secure remote access to internal applications without a traditional VPN. Because that same global network also underpins Cloudflare’s content delivery, DNS resolution (1.1.1.1), and edge-computing products (Workers), security and performance are deeply intertwined in Cloudflare’s architecture in a way that is less true of security vendors that operate as a narrower overlay on top of a customer’s existing infrastructure.
Who it serves
Cloudflare’s customer base spans an unusually wide range, from small website operators using its free tier for basic DDoS protection to large enterprises paying for Cloudflare One’s Zero Trust access controls and dedicated support. According to W3Techs data cited in Cloudflare’s own materials, the company’s infrastructure was used by approximately 21.3% of all websites as of January 2026, a scale that makes changes to Cloudflare’s default security settings and product defaults consequential for a meaningful share of the internet’s traffic, not just for its direct paying customers.
Company background
Matthew Prince has served as Cloudflare’s chief executive since its 2009 founding, with co-founder Michelle Zatlyn serving as chief operating officer. Cloudflare’s SEC filings describe a company whose security and connectivity products increasingly serve as infrastructure for AI-enhanced applications as much as traditional websites, a shift the company has leaned into through products like Workers AI and AI Gateway. In May 2026, Cloudflare announced it would eliminate more than 1,100 positions — about a fifth of its workforce — across engineering, HR, finance, and marketing, with Prince telling employees in a letter that the company’s internal AI usage had grown more than 600% over the prior three months and that many eliminated roles reflected tasks increasingly handled by AI-driven workflows rather than a response to slowing growth; the announcement came alongside record quarterly revenue.
Product and AI capabilities
Cloudflare has extended its security portfolio specifically to address risks introduced by AI applications: Firewall for AI is designed to defend applications built on large language models against prompt injection and related attacks, while AI Gateway provides observability, caching, security, and routing for organizations’ AI API traffic, and Workers AI lets developers run machine-learning models directly on Cloudflare’s network using serverless GPUs. Cloudflare has also applied its own infrastructure scale to fraud and bot detection, introducing Ephemeral IDs in 2025 to identify fraudulent behavior by tracking a short-lived, generated client identifier rather than relying primarily on IP address reputation, which has become less reliable as more legitimate and malicious traffic alike routes through shared cloud infrastructure and VPNs.
Key developments
Cloudflare’s May 2026 announcement that it would cut more than 1,100 jobs while shifting to what it called an agentic AI-first operating model drew significant attention because it came from a company reporting record revenue at the same time, explicitly separating the layoffs from any suggestion of financial distress. Prince’s public framing — that AI had already absorbed a meaningful share of engineering, HR, finance, and marketing work internally — positioned Cloudflare as one of the more forthright public companies about using its own AI product philosophy to restructure its own workforce, rather than only marketing that philosophy to customers.
Why it matters
Cloudflare’s scale means its security defaults function almost like public infrastructure, making features like Firewall for AI and Ephemeral IDs relevant well beyond Cloudflare’s direct customer base. Its May 2026 layoffs, explicitly tied to internal AI adoption, also make Cloudflare one of the clearest public test cases for how a technology company applies its own AI-first messaging inward, at a moment when many vendors talk about AI-driven efficiency for customers without disclosing comparably specific effects on their own headcount.
Sector context
Within Brel’s cybersecurity coverage, Cloudflare is best understood as network-layer infrastructure with deeply embedded security features, distinct from endpoint, email, or cloud-posture vendors elsewhere in this batch, and its Firewall for AI product places it alongside a small number of vendors building defenses specifically for AI application traffic rather than general web traffic.
Sources and references
This profile is based on Cloudflare’s official ‘Our Story’ page, its SEC Form 10-K filing, Cloudflare’s Wikipedia entry, and Bloomberg’s May 2026 news report on Cloudflare’s workforce reduction and its stated connection to internal AI adoption.