This episode of Founders' Field Guide is brought to you by Doc Sent Dioxin is the standard for founders to share their pitch decks with VCs when they are raising capital with Docs and you control who has access to your fundraising materials. And you always know what's happening with your pitch deck after you send it to VCs, actually open it. What slides did they spend the most time on? Did they share it with others? Founders are using docs and to fundraise, but also to share investor updates with their board or to send their sales pitches to prospects for better security and engagement.

I personally know a number of successful startups that have been able to raise using docs and check out docs and dotcom to start your free trial if you're curious to hear more about docs and stay tuned. At the end of this episode where I talk to Docs and CEO Ross Huddleston, this episode of Founders Field Guide is also brought to you by NetSuite. If you're an entrepreneur, you know how hard running a businesses don't let quick books and spreadsheets slow you down any more.

NetSuite makes running a business simpler and faster, whether it's centralizing your multiple payment systems, ditching old spreadsheets and outdated software. Only NetSuite gives you the visibility and control over your financials, H.R. inventory, e-commerce and more in one place instantly, whether you're doing a million of revenue or hundreds of millions of revenue during the twenty two thousand other companies using NetSuite right now to save time and money for your business schedule your free product tour right now at NetSuite, dot com forward slash invest.

That's NetSuite, dot com forward slash invest.

Oh, hello and welcome everyone. I'm Patrick O'Shaughnessy and this is Founders Felgate. Founders Field Guide is a series of conversations with founders, CEOs and operators building great businesses. I believe we are all builders in our own way and this series is dedicated to stories and lessons from builders of all types. You can find more episodes at Investor Field Guide dot com.

Patrick O'Shaughnessy is the CEO of O'Shannassy Asset Management, all opinions expressed by Patrick and podcast guests are solely their own opinions and do not reflect the opinion of O'Shannassy asset management. This podcast is for informational purposes only and should not be relied upon as a basis for investment decisions. Clients of O'Shannassy Asset Management may maintain positions in the securities discussed in this podcast.

My guest today is Michelle Zetlin. Michelle is the co-founder and CEO of CloudFlare, a now 25 billion dollar business which she helped take public last year. CloudFlare helps businesses make their websites faster and more secure. And over 25 million websites are running CloudFlare today. In our conversation, we discussed the catalysts for starting CloudFlare, explore the layers of the Internet and the future of distributed storage and computing power, and discuss how and why CloudFlare operates its network across 200 cities globally.

We close with the importance of finding and working with great co-founders as partners. As you build a business, I hope you enjoy our conversation. So, Michelle, I would love to begin by setting some context around CloudFlare and its history, and I thought a neat place to begin would be with you describing Project Honeypot. What was Project Honeypot and how did it start?

Report was created by two of my co-founders, Matthew Prince and Lee Holloway. And Project Honeypot is a community based project where any website owner can go to project blog and get a piece of code and basically install another site and it becomes a virtual honeypot. And what that honeypot does, it looks for bots or people trying to do malicious things online and catch them in the act and send all that data back to honeypot to kind of become a petri dish of information around who's doing bad things online and why.

When you first started it, what question were you trying to answer?

Actually, a cool story was where does spam come from? And the whole point, I know that was not the question, but I want to give a little bit more context. This is a story. So before Paul Graham did Y Combinator, he ran an antispam conference out of MIT. This is back in 2003 and 2004. There's probably some listeners who maybe have been there before. And Matthew was invited to come give a talk and he gave a talk and he won the best speech of the conference award.

And he had this can of spam. He actually for a long time had the kind of spam. And so he was invited back to come back and give a second talk to this next year. And of course, the stakes are high. He has to compete for best speaker award again. And he was like, well, I can't give the same talk. So you had to get a new talk.

And so the first time was around the laws, around spam and whatnot. And so the second year is like what would be really cool is if we could have an initiative to say, where does spam come from online? Again, this is back in 2004. And to answer that question, Emily Holloway created this project, Project Honeypot, and the whole point they launched at that conference during the speech. And the whole point was to say, where does Web spam come from?

And to start to provide insights and data that we can use to create products and services over time to help solve the problem that ended up becoming the impetus for CloudFlare almost a decade later.

Talk me through that very specific I like that phrase. Idioms like when you're conceptualising of CloudFlare in the very beginning, how did you decide what to attack first? Like who to do it for these initial decisions? I feel like a really weighty and hard to make. How did you navigate that problem?

So I was a student. I was doing my MBA at Harvard Business School. I say this because it's very relevant. And so I was a good student. Would do when you're examining a problem, as I said, to survive. And so we said Disturbia to actually all of these website owners who happen to be part of a tiny part community and surveyed them on the problem. We said we had a hypothesis. We have a thesis of that. If you are a big company, they were good cybersecurity solutions.

But if you or anybody else, they were bad. And that was bad for the Internet was our general thesis. And so we started by going to figure out whether there was a real problem here. And so we went to talk to the potential customer set and that potential customers that were small business owners, I.T. administrators, developers who all had to be part of this project honeypot community. And we I said we sent them a survey and it was the first half of the survey was tell us how much you care about this problem.

So it was like, how often do you think about what spammers like one through 10? Like a lot. Very little. How much time, how much, how much do you care about this? And then the second part of the survey was, and what do you do to solve the problem if you care about it? And, you know, there's some things in your career, obviously, there's lots of things you forget, but there's some things that are forever imprinted.

And I just remember getting some really survey results back from the survey we sent out. And the answers were just unbelievable. It was Web spammers are the scourge of the Internet. They're criminals. They steal resources. What spammers make me believe in the death penalty. And so they're just very strong reaction to the survey. So very quickly, I was like, wow, there's a problem here. And that was your idea was it was like, wow, there's clearly a problem here.

We still don't know all the sides of it. But there was something there was a string to go pull on and see where else it would go. And that's where it started. And then after that, it's what could we come up with a technical solution to actually solve the problem? The second part of the survey where I said, what were they using? So there's clearly a problem with the one you were asking everybody, these small businesses, IT administrators, entrepreneurs, developers, what they were doing to solve the problem.

The answer was basically nothing, Band-Aid like duct tape on their servers. And there was no good common technical solution. And this was one of those places where there's a problem. Could we build a technical solution to the problem? And often a lot of really great businesses. That's where you find them. It's when you can use technology to solve a known problem.

In the very first iteration, what specific pieces of defense did CloudFlare offer its users?

So when we first launched our service in September of 2010, we ended running a private data. We were really good at Web level spam or Web level cyber attacks, things like bots trying to come to your website to get to. See if there were any open doors like the probings, so we were really good at removing the box, we were really good at no malicious actors online, we just increased the friction to them to be able to get to your website or your blog.

We launched was really focused on websites, blogs and really stopping bad actors from being able to steal resources or do malicious things.

So cyber security is obviously sounds very important. My guess is most people have not thought about or engaged with the concept that much other than if something bad happened to them, or they probably read about a bunch of credit card data getting leaked or these sorts of things. Talk us through a little bit of the back story here. How would you describe cybersecurity and its importance in sort of the aspects of it to someone fully uninitiated?

I really think the cybersecurity industry itself a disservice for its first 15 years that it was created where it was really the cybersecurity experts that were the ones who spoke about it. And it wasn't a business issue. It was a leadership issue. It was just it wasn't about running a business issue is really don't go talk to information security. Go talk to him, talk to Tom, who's on the infosec team. He'll deal with it. And I think that's why we find ourselves in some of these issues.

And so when it comes to cybersecurity, I actually think people think it's harder than it should be. It's really than it is. It's not that hard to understand the ABCs. You're in the top quartile. And I really do think it's something that every leader across a business should have awareness around. It's not just the chief security officer or the chief information security officer that should be thinking about this. I really think it's a responsibility across all leaders, like marketing leaders, for example, have a responsibility to think about cybersecurity, where they're picking tools that they're going to adopt and when they're thinking about their daughter, all these sorts of services to track their visitors.

What are those secure? Are, you know, could they do something malicious to hurt your brand? And so I do think it's something that the best leaders say understand a little bit, and it's not that complicated. And so that's my pitch for why everyone needs to understand a little bit about it, from the marketers to the engineering to the CEO to the boards. And I think that, unfortunately, it's taken some really high profile bad incidences or breaches to raise the awareness.

But it's really one of these things where we should all be raising the tides in security. We all need to play a role and understand the ABCs.

You're better positioned if you go back to the early customer set, what felt like the first big break in the company's history.

There's been many AHA's I call those like the Azores along the way or the light bulb goes off. So the one was the survey results before we had the company, which is clearly there was again, this. Aha, you found something and found something.

And so then when you build something, you need to get some initial users. So we were running a private data, so we were getting initial customers on board and feedback. And that was the good old days where I used to call every single customer after they on board had to find out, like, how did you like why did you what are you seeing?

How do you think about it? Like trying to understand? Because it's one thing to build it, something to describe what you're doing and hearing it from the words of customers is helpful. And I just remember we thought we were a cybersecurity and that we were really focused on that. And I remember we launched this first part of our product, which we were embarrassed by. And you often hear this from builders saying that I was really embarrassed by the product, that I was definitely embarrassed by the product, that the first version of the product thinking, oh, it doesn't have all these things that we had left on our list to do, but we had to ship it.

We had to get in the hands. There was no analytics can see what it was doing. So you, like customers signed up and they had no feedback loop of what it was doing for it. And I thought that was a big deal. But I was interesting. Early on, these initial customers would send email saying, oh, my God, thank you, thank you, thank you. And I was like, how are we getting thankyous when we can't even prove to them that we're doing it?

Turned out they can measure because they were IT administrators or developers and they really knew a lot about monitoring their server load. And all of a sudden they put CloudFlare in front and they're like, wow, my server load decreased by 50 percent and all these resources are freed up. And now I can serve all the legitimate traffic much better. And so not only have you taken off all of this scourge of the Internet, all these automated robots roaming for something to latch on to, to do something bad, you've stopped that completely.

And in the process, you've speed up my website. And at this point, we weren't very distributed. It was really early. We kind of had two points of presence. So we were not expecting performance to be part of the value proposition so early. And so it was one of these some of the initial customers in a product that our team was pretty and this is not ready yet. Already seeing a lot of benefit, I think just was almost a flywheel to what we had seen the year before with the survey results of there's a real problem here and there was just no good solution.

So even though our solution was maybe the first tiny centimeter in a very long roadmap, it was already delivering a lot of value for some segment of customers, which is the best feeling as a builder, I mean, the most rewarding feeling, if you think about it, even to.

What tends to happen if you're not protected in some way, something like CloudFlare sitting in between a website and a website visitor or something like this, like what are the risks that you're helping mitigate consumer or your customers?

Employees expect it to be fast or responsive. It's not fast response. If you leave, you go somewhere else. And the problem is, is like some of the biggest sites are really fast. They're like lightning fast. And so the first is global performance. It just has to be it just has to load very quickly. And especially if you're an e commerce retail store. I mean, for every one hundred milliseconds, you lose revenue. So I think it's just we are all used to speed.

So performance is a big one. The other big one is there's a lot of Prater's builders who put things online because they love to build and create. They have a passion. They want to see it, and that's what they're doing. And then all of a sudden there's a kid who isn't at school because they're in covid lockdown, who, instead of throwing eggs at houses, is trying to say, can I knock that project offline for fun? Because they're curious.

Right. And that happens. And all of a sudden, this amazing idea and passion project you have is now offline. And it's not always kids. It can be up to nation states as well when it's money involved. But the point is, is there are things where brute force attacks where it's like I'm just going to overwhelm whatever you've put online so nobody can get to it. So it's called a denial of service attack. I'm going to try and get some of these credentials so that I can log in and edit the content on your website, or I can log in and get secrets within your businesses.

So those are very different sort of security issue, but a really real one. Whether you're a blogger who has a blog with content on it, it's like you don't want someone else without permission going into that. Or if your large organization, you want to make sure that employees are accessing the workloads and applications that they should have access to. But it shouldn't be someone who who is unauthorized. There's also just a lot of automated bots trying to find any technology is just a bunch of code pieced together.

And a lot of people use third party software provider. So Microsoft, this Oracle, that legacy software and their vulnerabilities that get exposed to that. And these are like public information of these new saying, oh, if you're using this version of WordPress or this version of Oracle, go patch your software and that takes time. So between the time that you find out that you need to patch your software like SOLVIT to doing it, for some companies it can take one hundred and twenty days.

I can tell you that the hackers write a program very much faster than one hundred twenty days and the people who have patched it because then they go exploit it to either embarrass that company saying you're not taking cybersecurity almost like an activist, you've got to take this more seriously or to do real damage. And so there's lots of different ways. And so far does is we act like the personal trainer and security guard for whatever you're putting online. We speed it up like the personal trainer to make it look good.

It's more reliable. It makes it all shiny. So for legitimate visitors, it's like a great experience. And then the folks who are doing malicious activity online, whether it's the kids trying to prove something to something really serious, we help provide that layer of protection so you don't have to worry about it or that added layer of protection. We give you time to go pack your stuff because we can patch it in real time at the edge while you go update your server.

One hundred and twenty days, but you're now protected. You have a stop gap between those 120 days. I remember when we hired our CTO, it was really early employee number twenty eight on top of his offer letter, Matthew Prince, my business partner, said, let's go patch the Internet together. And a lot of ways the personal trainer and the bodyguard. And it's kind of like patching the Internet's kind of fixing some of these security holes, the reliability goals, some of the performance goals through a global network like CloudFlare that you mentioned, this layers, which for some reason gave you this visual of like being able to be attacked, like through the air, on land, in the sea and through submarines or something.

What are those equivalents in your world? I think people have probably heard dogs attack or denial of service attack before, but probably have no idea what that means. What is that like? What are the weapons being used offensively against the people that CloudFlare is built to protect?

There are many layers and there's also different types of attack vectors. And I think a good way to think about it is let's go saying you're going to an ATM to get money and you show up to the ATM and Patrick is standing in front of you. OK, well, he's going through his transaction. No big deal. You wait in line, you get your turn in line to get the ATM or the bank cashier. I mean, whatever you want.

Now, let's say that there are fifteen hundred people in front of you at the line and you can't actually get access to it, ATM or the cashier. And you're not sure of the fifteen hundred. Who are the Patric's and who are the people who are there just to cause a headache so that you can't get it. And that's the analog example to what happens in the digital world. So you want to go to your favorite website, the Founders Field Guide Landing Page and.

Patrick has a certain amount of resources to stand that up, you need a server, you write code like it sets it up there, and that server can handle a certain number of people at any single time coming to it. But if you have so many people overwhelmingly coming to it, it'll fall over, kind of like the ATM. You just you get stuck. So then the real viewers who want to come listen, can't get access to it.

This happens all the time. That's what it does, is it's like it's trying to put more through the water hose so none of the legitimate visitors can actually get to what they want to do. And it happens all the time. And it's a very violating thing. If you're a brand, like if you're a company trying to run your business, all of a sudden your customers can't come to your website. You're knocked offline because somebody decided to throw some more traffic at you than you're used to waiting.

That's not a good day. That's an emergency. That's all hands on deck. And just to give you examples where this happens, flower stores before Valentine's Day is time to take orders. People are looking at bouquet options and they will say pay us X number of dollars. Otherwise, we're going to knock off your site offline before Valentine's Day. And they often pay the ransoms because they don't want to get knocked offline before their busiest time of the season, where they want to be able to take orders from their customers.

And you think, oh, that never happens. It happens all the time. It happens between in some industries where there's like really strong competitions against competitors do these sorts of things because it gives them an edge. All of a sudden they're online and their competitors aren't. And so it's a wide range. It can be the kids throwing a bunch of eggs just for I don't want to take the test. So I'm going to knock the online test taking site offline.

So it's like pulling the fire alarm bell, all of the analog, like the fire alarm going off at school, which is kind of funny to really serious. I think they are kind of a virtual analogies to all of that. And anyway, a service like Clever can help. And part of our mission is to help build a better Internet. And so when I go back to that I DMAs that you described, that whole reason why we did this was like, wow, if we could help make the Internet safer, if we can help make this less of a headache for everyone, that would be pretty cool.

And that's what we've done. And so just to give you a sense of how we've done that today, we have over twenty five million Internet properties, small businesses, 16 percent of the fortune, one thousand developers, I.T. administrators that are using our service. And we set up seventy two billion cyber attacks daily. Holy cow. And this is the power of technology.

If you think about in the early days when, of course, you're working hard to build and I'm sure stuff's breaking and you're learning at a crazy rapid pace. If I said to you, you have to go back and do it all again, which part of that building process would you be like, oh, God. Like, I don't want to have to go through and learn all those lessons again. Like that was the hardest part about building the product.

You can't see me because this is audio, but I've a lot of gray hair from that for. Yes. And I have a lot of scar tissue. So just for the founders listening, especially if your early stage founder, I mean, things break and that happens. I think what's important is how fast you react and learn from it and make sure it doesn't happen again. That would be my biggest lesson learned. I think if you beat yourself up for a breaking like you could really get into a depressed state, you got to keep going.

You got to learn. We eventually said, OK, we're just not going to ever make the same mistake twice like that was our bar and how fast we learned. And of course, we want to get ahead of these things, but just doing things for the first time, you miss things. And so I think that's the silver lining and maybe a good lesson. But some examples. I mean, we started kind of the exact opposite of how companies are starting today.

So you have an advantage. But we started with ten of us sitting in the same room in Palo Alto, California, and then the ten of us relocated up to San Francisco. We went into the office every single day. We sat next to each other every single day. We could read each other's minds and we up until twenty people, we were all in the same room. We never wrote anything down because of that ever, because it slowed everything down.

If you have to write first, right? No, just do your building up the code, do this. And so we never took the time to write down why we were doing something or the thought process. We were all in the same room, so we were sharing it verbally. We went really quickly for those first twenty people, which was wonderful. But fast forward to when we had sixty five people and we might not all be in the same room or even if we were all in the same room.

You can't listen to six five people at once. That became hard to not have written things down and we got better at it, but we still were great at it. But it really took to when we were north of one hundred people to start to get much more disciplined about. We've got to write things down because now we don't have people in the same office and they have no earthly idea why we made this decision eighteen months ago. And it's a huge learning curve for that person trying to figure it out.

And so we got to make this easier. So that's one. I would write things down more early on. It sounds simple, but I think it's really important in a company like Get Lab, which is one hundred percent distributed, I mean, they're dogs like what they write down is their documentation is absolutely world class. If anyone wants to know how you do it, go look at it's all online. It's all open for all of. US to learn from everything is documented because of the exact opposite reason none of them are together, so they write everything down and everyone's working asynchronously.

And in this world, in a post covid world, if we have more synchronous work, I think that's going to be really important. So we've got a lot better at over the year, but it was painful there. I have a lot of scar tissue from not writing things down early. We would have we would have gone faster later if we had done that. So that's one. And then the other thing I would say is, and this is a high class problem, but it's true is we had great product market fit.

We found a problem. We had a great technical solution, and we grew like bananas, which was great. But we never really did any marketing. We were just growing like people were telling them. It was like word of mouth, which is an investor's like dream. You're like, wow, that's really inexpensive. It's true. The other lesson is going from founder to now business owner is if you have good product work fit and you have real scale and you're on to something, likely it's going to become something really big and clouser today, something really, really big.

And when you have a really, really big marketing is a discipline and an investment. And I wish we had started earlier, we basically grew to 80 million dollars in revenue with three people on our marketing team, which is good. But then to stand that up after the fact was hard.

What have you learned now about effective marketing? What are the key parts of that discipline?

Earned media is very powerful where you can have others helping amplify your story versus having to pay for everything that goes a long way. Every dollar goes further in that regard. And so whether you're doing it through your community or social or media or speaking, especially if you're on a known brand, either you as the founder or you as the company owner, a brand, that's a good way to help amplify and seem a lot bigger than you are without having to spend as much bidding on an ad word that big established brand might pay or the Super Bowl ads or the billboards.

Those costs a lot of money. So you have to make every dollar go further. And so we're always trying to think about what can we do? That's clever. And so early on, we had a big community, these people talking about us on forums and community boards, and that just got the word of mouth. And people signed up for our customer acquisition was really easy because we had people talking about us around the world and then we did a lot to help amplify that with media and speaking, doing these things like podcasts, I hope some of you will go check out and sign up for our service like it matters.

I bet you most of your listeners have never heard of Hoffler and they're like, oh, wow, I'm going to go look into it. And hopefully if you have a cybersecurity or performance reliability issues, I'm going to I'm going to go try CloudFlare. Like that's one of the reasons why I do this. Not only to meet you, Patrick, is to help raise our awareness with a new audience, to say everyone wants to be faster, safer, more reliable.

If you have an app or an Internet property, so do things that are clever. If you're doing just the exact same thing as everyone else, then you've got to be a better at execution. Otherwise you're going to be paying more. Can you talk about the interesting concept uncovered when exploring clouds of sharks versus mosquitoes?

This is for the builders and the audience. I've been building platform for ten years. It's been an amazing adventure, the amazing experience, and I get to meet a lot of entrepreneurs along the way and we're really lucky. We are a huge success story. We went from an idea. We've taken a public where over. I don't know what our market cap is, but it's over 15 billion or market 20 something going in the twenty seven. Our cab company wants five billion here.

Are there? Well, I just I don't pay. I dive. I'm focused on running the business. I guess that's the good thing. It's a huge success story. So, I mean, a lot of founders who are like, I want that. And again, we obsessed over this problem and then getting the group of people to come help us solve the problem versus sometimes this mosquito and shark analogy is what people really focus obsess over early on is how do I raise money?

And raising money can be important for certain types of business. But really, it becomes a lot easier if you focus on finding a problem that needs solving because then the money will come easier. And so I think that the mosquito and shark analogy was actually Bill Gates put out this research six years ago now that basically said, you know, most people are worried about sharks in the world as the greatest risk. But really, what you should really be focused on are the mosquitoes, because they kill a lot more people every year and don't focus on the sharks.

Like how do you raise money? You should really focus on the mosquitoes. Are you solving a meaningful problem? How do you get people to come and work with you on that problem? Because you can only go so far with one person. You need a team and you need to commit to a team. And it's one thing to find co-founders and the other thing to get the first couple of people. But recruiting employee number twenty five to come join your company is so hard unless you have something like why would they do that?

There are a lot of good jobs in the world. It's very hard, makes it easier. You get a higher quality person. If you're solving a meaningful problem that is there, you can demonstrate it and you create a bigger value proposition around it. Then you're more likely to be able to go get the people you need, whether it's the engineers or the product managers that you really need to make it all come to life. And that's I think that sometimes gets missed in the I want to be written up in TechCrunch because I raised some money.

And you're focusing. The wrong thing. How do you think about through the course of the company's history, what to choose to do next? One of the big tropes has become like, keep the main thing. The main thing, like focus wins be the best that one specific thing, maybe it's protection or something. But now, obviously, CloudFlare does a number of different things, and my suspicion is that will continue to be the case. Talk me through that decision making framework, like what have you learned about when to focus, when to expand, when to try something new, when to experiment, I guess, is a question on capital allocation, like what makes good capital allocation, in your opinion?

Art and a science capital allocation matters locks or is a finite amount of money and people and time within an organization. So you have to figure out how to spend that and where you can get the most, where are the best places to invest. So I think it's really important. We've done two things that are interesting, like from early on, we are so ruthlessly focused on getting things done, starting a project, there's a middle and then you ship it and you go to the next thing we were really set up to, what are we doing?

Who's doing it? Did it get done OK? And that pace of shipping, I think, is different company to company to company. And I actually think it can become a huge superpower, if you like. I think it makes this a little bit easier because you're like, OK, we have what time, how much people, how much time do we have left? What are we going to do with that? And so we are always very focused and we still are to this day of prioritizing and who's doing what and what are we going to do and did we do it and holding ourselves accountable.

So when I look at companies I admire, like Salesforce and you talk to Parker Harris, they're what I had to call them a few months ago. And I said, Parker, teach me everything. And he said, like, we still to this day or does the pace at which we execute things is really high and we're just obsessed about it. So I think that's an important one. The second thing is and it's so interesting that organizations, I think, struggle with and we did something different is we have a core business.

We observe the core business is where we make a lot of our revenue great. But we also think there's a huge opportunity. We want to invest into the future. And what we found and we've always had a lot of vision and we think that we're very early innings of what's possible. And early on, what happened would happen is we had one R&D organization, one product engineering organization. And what happened is when the priorities came, all of the things that were over the horizon got prioritized for things that were known quantities.

Now like this is part of our core service. We know there's revenue attached to it. We should be doing this now. And that's great for now. But you're kind of mortgaging your future if you keep doing that. And so we did something that we think is interesting where we said, OK, we have to invest in the core. Even within that, you've got to prioritize what's most important. We have a whole process to do that, and that's generally works really well.

But we also set up a second R&D team where their job is to just think about the future, what's over the horizon, and they don't get measured on how much revenue it generates the next quarter. They're much more over the horizon. It's like, hey, help us throw a lot of spaghetti at the wall and figure out what's next. And we put them in a different location. We are still, at this point, a very San Francisco centric company.

We're no longer that. And we took someone, senior team who was really good at getting ideas out. And we gave them some resources and he moved to Austin and he set up what we called at the time, the project strategy team and at the time, which is now the emerging tech team, which is they just build the future. And we saw that team today. And it's pretty cool that we have been able to do that. I don't know if that of every company, but it lets us prioritize the core products, the core business, while still investing in our what we call our next act.

What I asked publicly what the most interesting thing about CloudFlare was just before our conversation, some large percent of the people said the workers program. Can you describe what that is? Many people mentioned it as almost like a sneaky potential competitor to the major cloud providers in some certain ways. Talk us through the workers program and what's exciting there.

So let's talk a little bit about what Klopfer does. Haven't talked a lot about how we do it. And the geek in me is like how we do it is so cool and it's relevant to this question. And so maybe just like one vote how we do it and then explain how that worker fits in. So I've talked about the personal trainer and the bouncer for your website, your apps, people, your employees or third party contractors accessing information. The how we do it is we run a global network so clobbers in two hundred cities around the world.

So we have hardware that we have a real capex cost on our balance sheet and we run all this hardware there. And if I am in San Francisco trying to go to Iraq, I will get right into the closest kind of CloudFlare point of presence, which for me is in San Francisco, serros versus if I get on a plane, which I'm not doing right now, but if I was on a plane, I went to London and I went to the same, tried to access my same sort of thing.

I had hit our London platform in London for the present. And if I'm in South Africa, I'd hit somewhere in South Africa, somewhere in 200 cities around the world and at each of those cities. That's how if you're legitimate, we're making your experience better. And if you're not legitimate, we're increasing the friction to protect our customers. So the foundational element of our global network, we've built this network. There aren't that many companies. We're building global networks like we are one of very few.

And it sets us apart all of our software, all the code we write, all of the firewall, like all of the VPN, it runs at these 200 cities around the world. So we're running code and a lot of places, that's where our technology sets. It's really neat. So it really does act like the immune system for the Internet. And so now what workers is what if you can write code and each of those two hundred cities around the world, what if you can put code into the network?

The networks are already doing performance and security and encryption and identity management. Well, can I also do computer in? That's the whole. And so Sun Microsystems had a saying. Their tagline used to be the network is the computer. They were right. They were just twenty years, twenty five years too early. When Oracle bought Sun, they forgot to reregister that trademark. So Klopfer now owns it and then is becoming the computer and the operating system for the Internet.

It's we're making things fast, safe, reliable. But can you also start to build applications into that? And again, we're not going to build them, but I sure hope the next builder does. And so there's a whole paradigm shift. It's called Serverless. And the whole point is, well, you're not speeding up a server anymore. Before I used to buy an EMC or Dell or HP server. And then and now you might be spinning up as you or us or Google cloud instant's.

These are going to pick a region. You're spinning up Google Cloud. You've got to pick a region. And again, those businesses are doing extremely well. Are there some of the things that you spin up a server for that can be done at the network layer? So can you take some of those workloads and put them in the Twin Cities around the world? And so we see developers doing that. We see big companies doing that. There's some good when you run code in the network, you can fix some big business problems.

So like I've had a lot of large organizations, they were a content company and they have a global audience and they're like the water marking on our content, like the licensing of our content is a big deal. And to do that, checking the server side just slowed everything down. And they're like, man, we can't the blatancy penalty we can't do on the server side, doing it in someone's browser app is impossible. Do you think we could try and write a worker to solve that?

And we did because we wanted to be. So if they said, yeah, you have access to this content in this region, that code can now run across Klopfer. We can do it in the region versus that ever having to go to the server or the client side. And so it's like a third place to write code, which is really exciting. And the question is if you can get storage distributed, because right now you can't really it's hard to run a large database distributed.

But that's the limiting factor, one of the limiting factors right now. But if you can get that, then we'll all of a sudden the conversation becomes what's appropriate to write on the server, what's appropriate to write for a client. A client is either like your app on your phone or your browser. And what's appropriate to write in this now new third place to write code in the network closer to eyeballs and I think with where you can update it and have the control over it.

So it's super exciting. It's early. I think it's going to take five, six, seven years for this to really come to fruition. But in the interim, I love that we're helping our enterprises solve problems like watermarking content. It sounds silly, but it literally went from a top five board level discussion to they literally saw revenue generation from doing that. And so I love that we can invest in it while we wait to see how this paradigm shift plays out.

I love the. This is like a potentially new creator tool or platform that sounds I don't want to say it happened by accident, but it sort of became possible because of a different way that you were doing something had to be more distributed based on what you were doing. Give us a sense for like when I think of cloud, I just think, oh, it just happened somewhere. Like Cloud is someone else's computer. This is I don't have to deal with it, but I have no idea like where those computers are.

So when you say you're in two hundred cities, is that an order of magnitude more than like a typical cloud provider to orders? What is the difference? Why does that matter so much?

This is actually back to what we said. I didn't go deep into it, but there are different layers to the Internet, like there's different layers of how the Internet works and how technology environments work. So if you're a enterprise, there's kind of three tiers to your enterprise stack. You need the store compute layer. So servers where the content actually sits or the workloads actually said then there's an application tier on top of your computer. And like those would be companies in the past, like the sap of the world, Microsoft, Oracle, where they used to have applications that were software.

And what we've in the last decade is a huge proliferation of cloud based application companies. And so those are kind of called the SAS companies. Right. So Salesforce took content relationship management, which was something that used to buy from Microsoft, Oracle and SAP and did it way better in the cloud and dynamic. And so now companies are enterprises are adopting a piece of that and they might use Workday for H.R. and they might be taking box for their storage documents, storage.

And you can also create your own application bundle without just having to buy for those three. And you probably also use Microsoft or SAP for something else, your ERP. But there's this huge proliferation that you can mix and match, and those are all the cloud based application providers. And so there's many of them like many, many, many, many, many. And sometimes as application providers actually almost all the time build on one of the cloud based or compute providers.

So those are the areas of the world, Google cloud of the world, the applause of the world where they are able to exist, because also it's easy to spin up workloads applications through one of the big cloud storage compute. So we will say cloud providers, there's like the storage compute providers, like literally the people who are selling the store, the computer, instead of buying on premise servers, you're using Google or Amazon or Azure or Cloud. IBM is there and they're really big.

They spend like a billion dollars a quarter. It's hugely capital intensive. And then because of that, there's all these applications that have existed and a huge proliferation and people are trying different sorts of things. And that's great. We sit at the network layer, the one layer of the tier that no one pays any attention to where we used to be, like you used to have to buy a load balancer from or a firewall from a hardware vendor or when optimization for a promoter to make all those other things work.

That's also moved to the cloud. So all three of these tiers, whether you're the network applications or compute, went from a world where you were buying hardware and software to cloud based services that you rent. And I think that often when you say where are the clouds? How do they compete or how do they compare? It depends on which tier you're talking about, because eight of us cynosure their cloud looks different than what the application providers are doing, which looks different than what Cloud is doing, because we all play in a different place on the stack and play a different role of where we came from.

And so for us, two hundred point presence is a lot and 200 cities a lot. It's a big network. It's much bigger than something like an eight of us because they're doing something different. They have different regions around the world. And those regions, those points that they have are much, much bigger than ours, whereas we need to be in a lot of places because we'd be close to the eyeballs.

That sounds like a big chicken and egg problem, that if having the distributed network is key to be close to eyeballs to make your service effective and they're expensive and hard to build. What was a to be doing that, did you decide? Is the sequencing really important or are you just getting denser? Talk me through how you did that. It sounds really harsh.

I don't know if our secret sauce, but it kind of is it's it is what makes CloudFlare like it is our foundational element to understand. It's not something that a lot of people are doing. Put it that way. It's rare. And so to build a global network, you need Internet traffic because it becomes a currency. You need Internet traffic so you can buy your way into things like Equinix and Terremark. You rent space. That's their business. They sell space for you to be able to put your servers or gear around the world.

But there are only in so many locations. They're not in two hundred. If you're going to get to go into the ISPs, you have to get invited into the Internet service providers in each of the regions around the world. And clever as three points presence in Pakistan. And the reason why a three point presence in Pakistan is because the local ISP there said, hey, I see a lot of traffic that I have to pay for it to get back to Frankfurt.

Can you please send your gear to us? I'll put it into my cages here in Pakistan. And not only will it. Make the Internet faster for now, all the citizens of Pakistan going to these websites behind CloudFlare, but now I don't have to pay the third party transit provider to backhaul Internet traffic back to Frankfurt. And so we basically send our gear to Pakistan and all of a sudden we take costs out of how much it costs us to run this network around the world, which is why we can deliver really good value.

And if we had no traffic from Pakistan, the ISP there would never invite us into there. It's like a you can call them up and pick. That's not the business they're in. They're in a different business of selling Internet service, access to the citizens of Pakistan. And they see this as a way to making it a symbiotic because most of the world, aside from the US you pay for, the more you consume the Internet and region. And the fastest way to get someone to consume more Internet is to make it faster.

Talk me through a little bit your experience on the finance side of the business. Obviously, you took the company public. You've been there from the beginning, and the financial needs of a company changed a lot over time as it evolves. There's been a lot of talk about do you go public through IPOs or direct listings or specs? What is the relationship with Wall Street? One of my favorite discussions I had with John Coleson at Stripe is like is accounting even right for these new kinds of businesses?

It doesn't seem to really capture the essence of the business in the same way that it might an old school, factory based business or something. What's been your experience thinking through that part of the business of is the finance world equipping businesses like yours in the right ways with the right tools?

We've lived a fairy tale existence for I don't know how else to describe it. I mean, the founders started the company. We get along. Two of the three of us are still there. The third person just got a terrible health issue. There's a really sad Wired article, very well written, the Wired article. But keep your Kleenex nearby. It's a very sad story of health issue. We took our company public on the New York Stock Exchange.

Our stock is up a lot. In the 14 months we we took, our company probably went public at just over five billion or more cap. And now we're at a 20 billion market caps. We've delivered a ton of our way to our shareholders. Both our venture we raised before we went public. We had raised just over three hundred million in venture from amazing venture partners like NEA and Pillion and Venrock Union Square Ventures out of New York. And then some of the public market investors were early, like Fidelity and Franklin Templeton.

And then we raised more money in the market and then we did another convertible debt offering just in May. So at this point, I've raised something like one point four billion dollars and the culture club was going well.

And we reported Q3 earnings a couple of weeks ago and we did a good job. The results were very good. So I guess things are working just fine for a company like CloudFlare, to be perfectly honest. I think that big idea, big market cap and we've executed on it. The system has worked very well for us, like the existing system. I think that there are lots of companies that might not want to swing for the fences. They don't want to they're trying to create a twenty billion dollar market cap company.

They're trying to solve something and they just need a little bit of money. And I think that might be harder or whatnot. But for us, the system, we are kind of the Hollywood fairy tale story of what entrepreneurs dreams are made of.

What have you learned about an evolving relationship with your founding partners and what's important about keeping that relationship strong through a lot of stress and challenging, as you said, gray hair.

Yeah, gray hair. I think that it's so interesting. As I moved to the valley and I've been here for ten years, we show up here in the summer of 09. So we kind of lived through a lot of drama the last ten years with Twitter. There's just been lots of drama in the tech industry and I didn't really understand how that ever happened. We have so busy building CloudFlare. I didn't really understand. Ten years later, I now understand exactly how founders end up hating each other, how venture and founders get at odds with each other, and how boards can really mess up companies.

It's all three. You hear terrible stories about all three. I see how all of those can happen now and we are really lucky that never happened to us. And part of it was lucky, but it was also good decision making. I have a saying pick co-founders wisely. I actually think the same thing with life partners, pick life partners and pick your co-founders wisely because they has a huge impact on if you want to build something, if you picked the wrong co-founder, I mean, you're just the odds are already stacked against you.

That just makes it even harder. And it's kind of the same thing with life partner. You pick their own life partner. It's hard to build. So picking your co-founders matters a ton, but sort of picking your investors and so does picking your board members like they all kind of go hand in hand. And there are definitely places along the way where we made really hard calls. And I just give you a couple of examples. We at some point it was like a series see was our series.

We were not known entities when we moved to the Valley to start Klopfer, like Matthew Lee and I, we were not known quantities. We do not have a brand as builders here. We done interesting things before, but we showed up here, kind of new kids on the. And we were very under the radar, we raised some money or quickly, and it was this idea of like, well, if you can make this happen, this is going to be big.

Which is why we were able to raise a little bit of money with two million dollars, which back then seemed like a lot of money. Now, a founder raising a two million dollar round is like nothing like a that's like an angel round the back. Then that was a big deal. You can just see how fast the market has changed the financing part. The market's changed in 10 years. Y Combinator existed, but it wasn't it wasn't a thing.

Exactly. So how fast forward a couple of years into CloudFlare. We're having good traction. We're scaling we're raising our series C and any and Heligoland Ventracor investors. And they were super amazing partners to us. And we started to get interest from some like famous venture capitalists, like brand name famous, like the celebrity venture capitalists that you read about in the books. And that felt really good, like was great. And we actually ended up getting a term sheet from somebody who's very well known at a very big valuation like it was north of a billion dollars.

And again, that's not the end game, but we are working incredibly hard, try to overcome all these obstacles, building what you're so passionate about, trying to invent the future. And you kind of have someone who's been in the game for a long time give you this big term sheet at these high valuation. It feels good. So we were like, wow. But every time we met with this particular investor, clearly great. Great. What he does, his vision for Clouthier was always different.

The Matthews's about every single time. And we were in the business. Yeah, there was a little bit like friction. Well it almost like dancing around. Well we kind of see it this way or he was a very, very free service. Get rid of the free service. We're like, well, we do the tropics, we get the network in Pakistan. And he's like, I don't get it. Get rid of the roof quite like that.

And so when you get to church, you take it to your boards, we take it to our board. And we were worried that it was going to lead to disastrous outcomes. And so we actually ended up walking away from that term sheet and we didn't have a plan B, there was not another one to go to. So we instead of raising was money at this high valuation that we spun the board up with a famous investor, we kind of said this doesn't feel right.

And I think that it's going to cause more headaches in the long term and not aligned and distraction to the business. So we're walking away now to our board's credit. They said, OK, now we had enough cash on the balance sheet to fund the business. It wasn't like we needed the money. And I think we all got very way six months later, which is an eternity in startup land. We finally closed our series C from Square Ventures, much better fit like vision.

They totally got literally. They loved. What we were doing was they were great partners and the valuation was like less than half. This was not a ten percent difference. I mean, it was a huge difference. Now you can play things out. But I will say that I'm pretty sure that was a good decision that saved ourselves a lot of hassles after the fact. And it was not an easy decision. Neither of those like unwinding the first one and then taking the other end.

And then again, we in that we had more offers. There are people with higher valuations, but we really like us, Vince. We always optimized for the investor in the person. And so I guess I don't know, in the world more than ever, leadership matters. We've made lots of mistakes, too, is one of the things you made mistakes on. And I have lots of scar tissue with that. But I do think we made some good decisions where, like, we always optimize for the person that whether it was the executive joining CloudFlare or the investor or the board member.

And I think because of that, we've kind of had low drama in those cases and people trying to do the right thing. So it's been a very positive experience. And so I feel very fortunate to live through that because you just all of those stories about VCs and founders and boards and the executive team looking well are true. We've been able to kind of create our own path until now. And so I think that's been really healthy for the business.

I love it as a theme that spending extra time to find the right people in every key seat is a high reward time well spent trying to focus on for everybody. Even if you're moving really fast as a startup like you guys have been and were still slowing down, to find the right people seems to always be a good idea. It's just hard to do it right. It's hard to say no to a billion dollar billion dollar check or a billion dollar valuation.

What are you most excited about in the future? I get to meet a lot of entrepreneurs, and what I'm most excited about is if we are on something big, there's this huge shift, again, from hardware and software that you're on to services in the cloud. You read deals like we have with great global network that's super flexible. It can do a lot of things. When we went public last year, Matthew, I wrote a founder's letter because we were better led business.

The very last sentence of the founders letter said. And we're just getting started. And the reason why we say that is we really feel like we're just getting started. I think that some of that got teased out here where there's these huge shifts. Where can the network become the computer? Can you start to do compute in the network? Can you take all this hardware that's sitting in data centers around the world with all those and move it into the net?

Work through a service like CloudFlare, holy smokes, if that works, can you really front everything like it's it feels like we're onto something very big. And so what I'm most excited about sometimes people say, why do you still come to work? And what I'm really most excited about is I feel a huge, immense responsibility to make sure that we reach our full potential as a business opportunity. And there are a lot of opportunities that get created. Some are shinier than others and they're not all the same size.

And so I guess what I like to think about as an entrepreneur is how do you make sure the opportunity you picked becomes its full potential? And again, I think we're just really early innings and we're running as fast as we can to become an iconic company that a lot of people admire.

I wish we had more time here. We've gone through a lot of time very quickly, so I'm forced to turn to my traditional closing question. I have learned a ton today. I really appreciate all of this. I'm glad to ask the questions so that we could explore workers in detail. I think that just sounds like the most interesting. The network is the computer is something I've got to go wrap my head around. So thanks for all the time.

My traditional closing question, which I'll ask you as well, is to ask what the kindest thing that anyone's ever done for you is.

No, that's a good question, but it makes me smile. I like that. I think about all I mean, there's something I'm so lucky. Well, look, I guess my fairy tale of entrepreneurship story really started at the halls of HBS at Harvard Business School, where I met Matthew Prince and we got the band together to do this and it's created this. So the way I ended up there is probably maybe what I would describe as it's been such a big impact on my life is this is a good story because I think we could all do a little bit of it is I was at my older sister lives in Boston.

I was living in Canada at the time, and I went to a party she was having and one of her friends who I did not know, like I did not know this person very well, actually. I think he was an investor. He's like, so what are you up to? What you do is like in Toronto, working as a product manager to Cheeba. And I said, and I've applied to do my MBA. He's like, oh, at schools you're applying to as a typical American.

At the time, I was like a little bit like put back. So I listed my school's out as applied to any zuweid. You applied to Harvard and I grew up in the middle Saskatchewan, Canada. I lived in Toronto. I mean, I applied to good schools. I guess I just didn't think that should apply to Harvard. I didn't say that to him. I said, oh, you know, it's really competitive. I'm not sure I don't have any lineage there.

I don't even know. He like literally to me the I at the dinner party or this cocktail party, said Michelle, he's like, I don't know you very well, but if you don't put your name in the hat, you're certainly never going to get polled. And I literally went home that day and I looked up the application process for Harvard Business School and I was like, all right. And they added it to my list of schools. And next thing I know, here we are 12 years later.

I love it.

Great place to close again. I've learned so much. I'm going to go Google Serverless for the next couple of hours and learn more. I really appreciate it. Thank you again.

Awesome. Thank you so much for having me. This episode was brought to you by Doc, sent in this four part miniseries. I sit down with Docs and CEO and co-founder Russ Hiddleston to hear the origins of docs and the problems that solving and what the future may hold. In this week's episode, Docs and CEO Russ Hiddleston and I discussed the origin of dioxin and why Russ decided to start the business.

So just because the accent has a bit of history, I thought a neat place to begin would be with a historical thumbnail sketch of the business, what was the sort of story around its original founding? And maybe walk us through the chapters of Dotson's history as you see them so far.

So we started to send in twenty thirteen. And as context, this is my second start up. The first one we sold to Facebook as a talent acquisition and I had to fundraise for that one. And fundraising is just really frustrating because you don't get any feedback. You often don't hear anything back at all. I also worked at Dropbox as an intern in 2010 and I always thought that their links sending model should be helpful for this, but they didn't end up building it.

So in 2013, I ran around and I asked all the major companies that I thought should build docs and Google, Microsoft Box, Dropbox, I said, hey, why don't you build on top of your longstanding model analytics and control and forward tracking? And I had this whole list of things and they all said maybe later, but I just they weren't going to do it. And we got some acquisition offers and we were going to build something else for them.

So I said, OK, we got to go start this company. That's what we did in 2013 and raised our seed round at the end of 2013. Fast forward to today. We've got a little over sixteen thousand companies that are customers and they range across all sorts of different use cases we thought of. It is just like, hey, let's just throw this out there and see what happens. And it turns out the way we built tocsin is really flexible, really useful.

It's great for founders fundraising. It's great for business fundraising, it's great for salespeople, customer success, people, investment banking, M&A, e-signature. And so we really just followed along what people want in the product and we just keep unblocking them. And as we've done that, it becomes more useful. It becomes more widely used. And it's been a really fun journey.

What did you learn in the first five years of dioxins history that really stands out? Because I think the company really sounds like an inflection point in twenty eighteen. What lessons do you remember from that first chapter?

So the very first chapter, we thought dioxin might be a B2C company. We weren't sure. So it just said document analytics and it was a free product. And then I accidentally sold some big sales deals because it's really useful for sales teams and still is. So our board said, hey, go sell to big sales teams. So we did. So we changed our website from saying document analytics to saying sales enablement. And then fast forward over time.

Doing up on sales is expensive and it's complicated and that's fine. But we always had this just inbound interest, like people just signing up for tocsin. And in twenty eighteen I did this project where I looked at, OK, well what are the other use cases for docs. And we got the sales ones great. But we got all these support requests, people being like are you the service that does blah blah blah. And we say yes and then they'd start paying us.

So I talked to investment bankers, I talked to founders, I talked to investors, all sorts of different use cases. And I realized that taxand is a horizontal technology that we need to market vertically. So we then figured out that our brand promise is around control and we put that on the website. And then we started documenting all the different use cases because people who are creative would figure out, oh, I can use doxxing for this, but for every one of those there are there are ten more that aren't that created.

So you go to our website now, you'll see different use cases and we spell out how Derksen is useful there. And that's created a flywheel basically where people get and links. They tell people about it. They come to our website. They're like, oh my gosh, that would be useful.

And then they sign up to find more episodes. We sign up for our weekly summary visit, Investor Field Guide. Dotcom, thanks for listening to Founders' Field Guide.