NET

클라우드플레어
Cloudflare, Inc. · CIK 1477333
NET 리스크 변화 알림 받기
이번 보고서
2025 연차보고서
10-K · 기간 말 2025. 12. 31. · 제출 2026. 2. 26.
비교 기준
2024 연차보고서
10-K · 기간 말 2024. 12. 31.
SEC 원문 ↗
0
새 리스크 항목
4
신규 문단
83
수정 문단
15
삭제
+2%
분량 변화
AI 한국어 요약

한 줄 요약

2025년 11·12월 소프트웨어 업데이트로 인한 대규모 네트워크 장애, AI 수요발 서버 부품 부족 전망, 관세, 유럽 규제 당국의 실제 제재 등 이미 현실화된 사건이 리스크 요인에 대거 추가됐습니다. 반면 성장 둔화 관련 표현은 다소 누그러졌습니다.

주목할 변화

  • 신규자체 소프트웨어 배포로 인한 대규모 서비스 장애2025년 11월과 12월 글로벌 네트워크에 소프트웨어 업데이트를 배포하다 광범위한 서비스 중단이 발생했다고 시스템 장애, 고객 접속 중단, SLA(서비스 수준 약정) 세 항목에 모두 명시했습니다. 이 장애는 SLA 보상 의무도 촉발했습니다. 2025년 6월 Workers KV 서비스가 제3자 스토리지 장애로 수 시간 중단된 사례도 추가됐습니다. 회사는 이 6월 장애가 사업에 중대한 영향은 없었다고 밝혔습니다. "deployments of software updates to our global network resulted in widespread service unavailability"
  • 신규AI 인프라 수요발 서버 부품 부족 전망2021~2022년 공급난 사례를 삭제하고, 올해 메모리(DIMM), 기업용 SSD, CPU, 대용량 HDD에서 심각한 부족이 예상된다는 문장을 새로 넣었습니다. 원인으로는 AI 인프라로의 생산능력 재배치와 하이퍼스케일러 수요 증가를 지목했습니다. "we expect significant component shortages that may impact our server supply chain during the current year"
  • 강화관세·보복 조치를 독립 리스크로 격상기존 인플레이션·고금리 문단을 삭제하고 그 자리에 관세 문단을 신설했습니다. 관세는 신규 고객 확보, 기존 고객의 업그레이드 결정, 해외 사업, 부품 공급가 등 여러 항목에 추가됐습니다. 회사는 장비 원가 상승과 기업 지출 지연을 우려합니다. "future tariffs could cause the costs of the equipment we use to operate our global network to increase, corporate spending to become delayed or curtailed"
  • 신규해외 규제·소송의 실제 제재2025년 12월 이탈리아 규제 당국이 콘텐츠 규제 미준수를 이유로 약 €14.2백만의 과징금을 부과했고, 회사는 과징금과 규제 자체에 모두 불복하고 있습니다. 2025년 10월에는 일본 법원이 저작권 침해 콘텐츠와 관련해 회사에 손해배상 책임을 인정했으며 회사는 항소했습니다. 이 밖에 EU Data Act의 서비스 전환(switching) 의무, DSA 투명성 보고 요건, EU AI Act도 새로 거론됐습니다. "an Italian regulator issued an administrative fine of approximately €14.2 million"
  • 강화보안 사고 사례 추가와 내부자 위협 구체화2025년 8월 CRM에 연동된 제3자 채팅 에이전트가 침해돼 일부 고객 연락처·지원 정보에 무단 접근이 발생했다고 추가했습니다. 또한 국가 배후 세력이 과거 실제로 입사를 시도한 적이 있다고 표현을 바꿨습니다. 이전에는 가능성 서술에 그쳤습니다. "nation-states and their agents, in the past have sought direct or indirect employment at Cloudflare"
  • 신규사용량 기반 과금 모델의 변동성개발자 플랫폼 등 일부 제품은 사용량에 따라 과금되며, 고객에게 사용을 지속하거나 늘릴 의무가 없다는 점을 새로 명시했습니다. 매출 인식 리스크와 비용 구조 조정 리스크 항목에도 사용량 감소가 추가됐습니다. "there is no obligation to continue to use the product or increase usage"
  • 강화전환사채 구조 확대기존 2026년 만기 전환사채(미상환 잔액 $1,293.8백만)에 더해 2030년 만기 전환사채 $2,000.0백만이 새로 리스크 서술에 포함됐습니다. 상환, 전환 시 현금 지급, 캡드콜 관련 리스크도 두 시리즈 모두로 확장됐습니다. "$2,000.0 million in aggregate principal amount of the 2030 Notes were outstanding"
  • 완화성장 둔화·영업 사이클 표현 완화매출 성장 둔화를 "최근 둔화했고 계속될 수 있다"에서 "과거 주기적으로 둔화한 적이 있고 다시 그럴 수 있다"로 바꿨습니다. 대형 고객 영업 사이클 장기화도 "periodic/continue"에서 "occasional/reoccur"로 톤을 낮췄습니다. "has periodically slowed in past periods and may slow again"

읽는 법

이번 변경의 핵심은 가정형 리스크가 실제 사건 기록으로 바뀌었다는 점입니다. 자체 배포로 인한 대규모 장애, 고객 정보 접근 사고, 유럽 과징금이 여기에 해당합니다. 따라서 향후 보고서에서 SLA 보상 규모, 장애 재발 여부, 과징금·항소 결과가 어떻게 진행되는지 추적해 볼 만합니다. 아울러 AI발 부품 부족과 관세는 네트워크 증설 비용에 영향을 줄 수 있는 요인입니다. 사용량 기반 과금 비중이 커지는 점과 함께, 설비투자와 매출의 변동성을 볼 때 참고할 대목입니다.

원문 비교
  1. 신규Adverse economic conditions, including reduced spending on products and solutions for network security, performance, and reliability, may adversely impact our revenue and profitability.
    The United States government has implemented, or threatened to implement, tariffs on some or all of the goods imported into the United States from a number of other countries around the world. In response, many of the countries subject to these tariffs have themselves implemented or threatened to implement tariffs, taxes, or other retaliatory measures on U.S. goods or services or U.S. companies, or have restricted or threatened to restrict the operations of certain U.S. companies in those countries. The implementation, or threatened implementation, of tariffs, taxes, and other restrictions on goods, services, or businesses by the United States and other countries and the resulting additional costs and uncertainties may cause the costs of our products to increase. Additionally, future tariffs could cause the costs of the equipment we use to operate our global network to increase, corporate spending to become delayed or curtailed, increase rates of inflation, reduce economic growth rates, create an economic downturn or recession, or result in other similar or unexpected adverse effects on our business, financial condition, or results of operations.
  2. 신규If we are unable to attract new paying and free customers, our future results of operations could be harmed.
    •the potential implementation of tariffs or retaliatory measures due to tariffs on the sales of our products in countries where our potential paying customers are located;
  3. 신규Failure to comply with laws and regulations applicable to our business could subject us to fines and penalties and could also cause us to lose customers or otherwise harm our business.
    •substantial changes to, or termination of, contracts;
  4. 신규Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.
    Laws and regulations regarding the development, use, and deployment of AI technologies in the EU, U.S., and elsewhere are increasing in complexity. For example, the EU AI Act has compliance deadlines throughout 2025 and into 2026, and a number of U.S. states have enacted AI governance and safety frameworks. Numerous jurisdictions have proposed legislation to regulate the development, use, and deployment of AI, in whole or in part. As we continue to see efforts to regulate this new technology, we have incurred and will continue to incur costs to address the impact, if any, of these laws and regulations regulating AI on our products and practices.
  5. 수정We have experienced rapid revenue growth, which may not be indicative of our future performance.
    We have experienced rapid revenue growth in recent periods, with revenue of $2,167.9 million, $1,669.6 million, and $1,296.7 million, and $975.2 million for the years ended December 31, 2025, 2024, and 2023, and 2022, respectively. However, our rate of revenue growth has periodically slowed in recent past periods and may continue to slow again in future periods. You should not consider our historical growth in revenue as indicative of our future performance. In particular, our revenue growth rates may continue to slow or decline in the future and may not be sufficient to achieve and sustain profitability, as we also expect our costs to increase in future periods. We believe that historical comparisons of our revenue may not be meaningful and should not be relied upon as an indication of future performance. Accordingly, you should not rely on our revenue and other growth for any prior quarter or year as an indication of our future revenue or revenue growth.
  6. 수정Adverse economic conditions, including reduced spending on products and solutions for network security, performance, and reliability, may adversely impact our revenue and profitability.
    The conflicts in the Middle East Conflicts and Ukraine and other areas of geopolitical tension around the world or any worsening or expansion of those conflicts or tensions, other geopolitical events such as elections and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate may materially adversely affect our customers, vendors, and partners, and the duration and extent to which these factors may impact our future business and operations, results of operations, financial condition, and cash flows remain uncertain.
  7. 수정Adverse economic conditions, including reduced spending on products and solutions for network security, performance, and reliability, may adversely impact our revenue and profitability.
    The conflicts in the Middle East Conflicts and Ukraine and other areas of geopolitical tension around the world or any worsening or expansion of those conflicts or geopolitical tensions, other geopolitical events such as elections and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate, could decrease the spending of our existing and potential new customers, adversely affect demand for our products, cause one or more of our customers, vendors, and partners to file for bankruptcy protection or go out of business, cause one or more of our customers to fail to renew, terminate, or seek to renegotiate their contracts with us, cause one or more of our suppliers to increase prices as a result of current or potential future tariffs or other factors, affect the ability of our sales team to travel to potential customers, impact expected spending from existing and potential new customers, and negatively impact collections of accounts receivable, all of which could adversely affect our business, results of operations, and financial condition.
  8. 수정Adverse economic conditions, including reduced spending on products and solutions for network security, performance, and reliability, may adversely impact our revenue and profitability.
    Any of the negative impacts of the conflicts in the Middle East and Ukraine and other areas of geopolitical tension around the world or any worsening or expansion of those conflicts or geopolitical tensions, other geopolitical events such as elections and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate, may have a material adverse effect on our business and operations, results of operations, financial condition, and cash flows. Any of these negative impacts, alone or in combination with others, also could exacerbate many of the other risk factors discussed in this Part I, Item 1A “Risk Factors” of this Annual Report on Form 10-K, including volatility in the trading prices of our Class A common stock. The full extent to which these factors will negatively affect our business and operations, results of operations, financial condition, and cash flows will depend on future developments that are highly uncertain and cannot be predicted, including the scope, severity, and duration of the conflicts in the Middle East and Ukraine, other areas of geopolitical tension around the world, and any economic downturns and the actions taken by governmental authorities and other third parties in response.
  9. 수정If we are unable to attract new paying and free customers, our future results of operations could be harmed.
    •impacts of the conflicts in the Middle East and Ukraine and other areas of geopolitical tension around the world or any worsening or expansion of those conflicts or geopolitical tensions and impacts of geopolitical events such as elections and other governmental changes.
  10. 수정Our business depends on our ability to retain and upgrade paying customers, expand the number of products we sell to paying customers and, for certain of our products, expand our paying customers' usage of such products, and, to a lesser extent, convert free customers to paying customers, and any decline in renewals, upgrades, expansions, usage, or conversions could adversely affect our future results of operations.
    Our business depends on our ability to retain and upgrade paying customers, expand the number of products we sell to paying customers, customers and, for certain of our products, expand our paying customers' usage of such products, and, to a lesser extent, convert free customers to paying customers, and any decline in renewals, upgrades, expansions, usage, or conversions could adversely affect our future results of operations.
  11. 수정Our business depends on our ability to retain and upgrade paying customers, expand the number of products we sell to paying customers and, for certain of our products, expand our paying customers' usage of such products, and, to a lesser extent, convert free customers to paying customers, and any decline in renewals, upgrades, expansions, usage, or conversions could adversely affect our future results of operations.
    Our business is subscription-based and it is important for our business and financial results that our paying customers renew their subscriptions for our products when existing contract terms expire. Our contracted customers, which consist of customers that sign up for our Enterprise plan, enter into longer term agreements with us having terms typically ranging from one to three years, and they generally have no obligation to renew their subscriptions for our products after the expiration of their contractual period and are allowed to cancel their subscriptions in the case of our uncured material breach of the agreement. Some contracted customers also have agreements that allow them to terminate the agreement without cause upon little or no advance written notice, or upon our failure to meet certain service level commitments, or to obtain and maintain industry security certifications within a specified time frame. Should certain of our contracted customers, especially our large customers, terminate their agreements, or reduce their expenditures, with us, our financial condition and results of operations may materially suffer. In addition, as As we continue to increase our number of large customers, and the amount of revenue we receive from large customers, this risk may increase. Our In addition, our pay-as-you-go customers pay with a credit card on a monthly or annual basis and can terminate their subscriptions, or switch to less expensive subscription plans, at will with little advance notice. Because pay-as-you-go customers that subscribe to our basic subscription plans are an important source of revenue, this ease of termination could cause our results of operations to fluctuate significantly from quarter to quarter.
  12. 수정Our business depends on our ability to retain and upgrade paying customers, expand the number of products we sell to paying customers and, for certain of our products, expand our paying customers' usage of such products, and, to a lesser extent, convert free customers to paying customers, and any decline in renewals, upgrades, expansions, usage, or conversions could adversely affect our future results of operations.
    Our future financial performance also depends in part on our ability to continue to upgrade paying customers to higher-tier subscriptions, expand the number of products we sell to paying customers, customers and, for certain of our products, expand our paying customers' usage of such products, and, to a lesser extent, to convert free customers into paying customers. Conversely, our paying customers may convert to lower-cost or free plans or reduce the number of products they purchase from us or the amount they use our products if they do not see the marginal value in paying for our higher-cost plans or for our specific products, or due to challenging macroeconomic conditions and/or reduced operating budgets, thereby impacting our ability to increase revenue. For example, we periodically have experienced a higher level of churn in our paying customer base (which is when any of our paying customers cease to be a paying customer for any reason, including any pay-as-you-go customer converting to a free subscription plan). Moreover, our free customers have no obligation to transition to paying customers at any point. In order to expand our commercial relationship with our customers, existing paying and free customers must decide that the incremental cost associated with such an upgrade in their subscription plans, the purchase of additional, or the expanded use of their currently used, products is justified by the additional functionality they would gain. For example, some of our paying customers may decide that our Enterprise plan offerings do not provide sufficient incremental value to upgrade from our pay-as-you-go offering or to continue any such previously chosen upgrade. In addition, for certain of our products, such as many of our developer platform products, the costs of the subscription are based on the contracted customers’ amount of usage of the product and there is no obligation to continue to use the product or increase usage. Our customers’ decisions whether to upgrade their subscription, purchase additional, or expand current usage, of our products or to continue any such previously chosen upgrade or purchased products are driven by a number of factors, including customer satisfaction with the security, performance, and reliability of our network and products, customer security and networking issues and requirements, general economic conditions, the potential future applicability of tariffs or retaliatory measures due to tariffs on our products in certain countries, and customer reaction to the price for additional products. If our efforts to expand our relationship with our existing paying and free customers are not successful, our financial condition and results of operations may materially suffer.
  13. 수정If we are unable to effectively attract, expand, and retain sales to large customers, or we fail to mitigate the additional risks associated with serving large customers, our business, results of operation, and financial condition may suffer.
    Historically, the implementation period to start using, or expanding the use of, our products has been short, with most customers under our pay-as-you-go plans implementing usage of our products within a short period of time and our sales cycle for customers under our Enterprise plan lasted less than one quarter. Since the first half of 2022, however, we have experienced periodic occasional lengthening of our average sales cycle for our new and existing large customers, and the lengthening of our sales cycle to our large customers could continue reoccur in the future. In addition, as our sales force continues to target an increasing number of large customers for new and expanded product sales, these larger enterprises often undertake a more significant evaluation and negotiation processes than we have experienced in the past, which could further lengthen our sales cycle materially.
  14. 수정If we do not effectively attract, train, and retain our sales force to be able to sell our existing and new products and product features, we may be unable to add new contracted customers, or increase sales to our existing customers and our business would be adversely affected.
    A substantial majority of our revenue in the year ended December 31, 2024 2025 was from contracted customers that were acquired through our inside and field sales teams, and we expect our sales teams to continue generating the majority of our revenue for the foreseeable future. As a result, our financial condition and results of operations are dependent to a significant degree on our ability to effectively attract, train, and retain qualified sales personnel, including senior sales leaders, and the ability of our dedicated sales personnel to acquire new contracted customers and expand our relationships with our existing contracted customers. Our sales representatives typically engage in direct interaction with our prospective contracted customers. Increasing our customer base and achieving broader market acceptance of our network and products will depend, to a significant extent, on our ability to expand and further invest in our sales and marketing operations and activities. There is significant competition for sales personnel with the advanced sales skills and technical knowledge we need. We believe that selling subscriptions to our products requires particularly talented sales personnel that understand a very wide array of highly technical topics, including significant portions of global networking, Internet, enterprise and identity security, and application development for both on-premises and cloud requirements. Changes in the senior leadership of our sales team could negatively impact our ability to retain current members of our sales team or attract new talent. In addition, as we continue to develop and sell newer types of products and product features, such as our suite of Zero Trust and network services solutions and our developer suite of products, we will need our sales personnel to be proficient in selling both these newer products and features and our overall broader suite of products to our existing and potential customers. If we are unable to effectively attract, train, and retain qualified sales personnel, particularly as our lines of products and product features expand, our business, results of operations, and financial condition will be adversely impacted.
  15. 수정If we do not effectively attract, train, and retain our sales force to be able to sell our existing and new products and product features, we may be unable to add new contracted customers, or increase sales to our existing customers and our business would be adversely affected.
    New sales hires require significant training and may take significant time before they achieve full productivity. As a result, our new sales hires and planned sales hires may not become as productive as we would like or as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals. In addition, due to our rapid growth, a large percentage of our sales team is new to our company and inexperienced in selling subscriptions to our products, and therefore these personnel may be less effective than our more seasoned employees. For example, since late 2022, we periodically have experienced a reduction reductions in average productivity among our sales personnel, which we believe was were due in part to new sales hires not becoming as productive as we expected and exacerbated by worsening or uncertain macroeconomic conditions. While we continue to address productivity and focus on hiring, training, and retaining successful sales personnel, these efforts may take longer than anticipated, which may negatively impact our ability to achieve our targeted revenue growth.
  16. 수정Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business.
    •our ability to retain and upgrade paying customers and expand the number and usage of our products sold to paying customers, especially our large customers;
  17. 수정Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business.
    •general political, regulatory, economic, market, and social conditions, including inflation, rising interest rates, actual or threatened tariffs and related economic retaliatory acts, actual or perceived failure or financial difficulties of financial institutions, other adverse changes in global and regional macroeconomic conditions, and other impacts of the conflicts in the Middle East and Ukraine, or other areas of geopolitical tension around the world, or any worsening or expansion of those conflicts or geopolitical tensions.
  18. 수정We rely on our co-founders and other key technical, sales, and management personnel to grow our business, and the loss of one or more key employees or the inability to successfully attract, integrate, and retain qualified senior management and other personnel, or the failure of new members of our management team to successfully lead and scale our business, could harm our business.
    From time to time, there may be changes in our management team as a result of the hiring, departure or realignment of our senior management and other key personnel, and such changes may impact our business. Additionally, as our business grows in scale and complexity, other changes to our management team may be necessary. For example, we have hired several new members of our senior management team in the past year, including recent years, such as our President of Revenue, our Chief Strategy Officer, our Chief People Officer, and our President of Product and Engineering. Chief Marketing Officer. In addition, our President of Product and Engineering recently departed to become chief executive officer of another public company. Any significant leadership change or senior management transition, such as these, involves inherent risks and any failure to ensure timely and suitable replacements and smooth transitions could hinder our strategic planning, business execution, and future performance. In particular, these or any future leadership transitions may result in, and in some cases have resulted in, a loss of personnel with deep institutional or technical knowledge and changes in business strategy or objectives and disruptions in our operations and relationships with existing employees and customers due to added costs, operational inefficiencies, changes in strategy, decreased employee morale and productivity, and increased turnover. We must successfully integrate our new leadership team members within our organization to achieve our operating objectives. If we lose one or more of our senior management or other key employees and are unable to find adequate replacements, or if we fail to successfully attract, integrate, retain and motivate members of our senior management team and key employees, our business could be harmed.
  19. 수정Our business depends, in part, on sales to the United States and foreign government organizations, which are subject to a number of challenges and risks.
    •government demand, payment for, and continued usage of, our products may be impacted by public sector budgetary cycles, funding authorizations, government shutdowns, reductions in government headcount and functions, or government shutdowns; contract consolidation and reductions in spending;
  20. 수정Our business depends, in part, on sales to the United States and foreign government organizations, which are subject to a number of challenges and risks.
    •governments often require contract terms that differ from our standard customer arrangements, including terms that can lead to those customers obtaining broader rights in our products than would be expected under a standard commercial contract and terms that can allow for early termination or subject us to more onerous obligations and requirements than our standard customer arrangements, such as supply chain restrictions, restrictions on employees' ability to manage their accounts, and additional reporting obligations; governments may limit public sector contracts to companies headquartered in the governments' respective jurisdictions or require partnerships with companies based in the governments’ respective jurisdictions in order for us to sell any of our products to those governments, which could result in a loss of revenue we otherwise would receive for such sales;
  21. 수정Our business depends, in part, on sales to the United States and foreign government organizations, which are subject to a number of challenges and risks.
    In addition, we must comply with laws and regulations relating to the formation, administration, and performance of contracts with the public sector, including U.S. federal, state, and local governmental organizations, as well as foreign governmental organizations, which affect how we and our channel partners do business with governmental agencies. Selling our products to the U.S. government, whether directly or through channel partners, also subjects us to certain regulatory and contractual requirements, including expanded compliance obligations under the Federal Acquisition Regulations (FARs). Regulations. Failure to comply with these laws, regulations, and requirements by either us or our channel partners could subject us to investigations, fines, and other penalties, which could have an adverse effect on our business, results of operations, and financial condition. For example, the U.S. Department of Justice (DOJ) and the General Services Administration (GSA) have in the past pursued claims against and financial settlements with vendors under the False Claims Act and other statutes related to misrepresenting cybersecurity practices or protocols, pricing and discount practices and compliance with certain provisions of GSA contracts. The DOJ and GSA continue to actively pursue such claims. Violations of certain regulatory and contractual requirements could also result in us being suspended or debarred from future government contracting. Any of these outcomes could have a material adverse effect on our revenue, results of operations, and financial condition. Any inability to address these risks and challenges could reduce the commercial benefit to us or otherwise preclude us from selling subscriptions to our products to government organizations.
  22. 수정Our business is exposed to risks associated with credit card and other online payment processing methods.
    Many of our customers pay for our service using a variety of different payment methods, including credit and debit cards, prepaid cards, direct debit, and online payment applications and wallets. We rely on internal systems as well as those of third parties to process payments. Acceptance and processing of these payment methods are subject to certain rules and regulations and require payment of interchange and other fees. To the extent there are increases in payment processing fees, material changes in the payment ecosystem, such as large re-issuances of payment cards, delays in receiving payments from payment processors, changes to rules or regulations concerning payment processing, loss of payment partners, and/or disruptions or failures in our payment processing systems or payment products, including products we use to update payment information, our revenue, operating expenses, and results of operation could be adversely impacted. In addition, from time to time, we encounter fraudulent use of payment methods, which could impact our results of operations and if not adequately controlled and managed could create negative consumer perceptions of our service. If we are unable to maintain our chargeback rate at acceptable levels, card networks may impose fines and our card approval rate may be impacted. If we fail to comply with the rules or requirements applicable to processing payments, or if our data security systems are breached, compromised, or otherwise unable to detect or prevent fraudulent activity, we may be liable for card issuing banks’ costs, subject to fines and higher transaction fees, and lose our ability to accept certain payments from our customers. The termination of our ability to process payments using any major payment method could harm our business, results of operations, and financial condition could be harmed. condition.
  23. 수정Because we recognize revenue from subscriptions for our products over the term of the subscription, downturns or upturns in new business may not be immediately reflected in our results of operations and may be difficult to discern.
    We generally recognize revenue from customers ratably over the term of their subscription, which in the case of our contracted customers typically range from one to three years and in the case of our pay-as-you-go customers is typically monthly. In addition, our subscription agreements with certain of our largest customers are structured on a "pool of funds" model in which the customer commits to spend at least a specified amount on our products during the subscription period. These “pool of funds” arrangements do not require the customer to subscribe for specific products or spend any specific amounts during any month, quarter or, if applicable, year of the subscription period, but the funds must be utilized during the subscription period under the terms of these subscription agreements. Additionally, for certain of our products, such as many of our developer platform products, the costs are based on the contracted customers’ amount of usage of the product and there is no obligation to continue to use the product or increase usage. Consequently, any increase or decline in new sales or renewals to these our customers in any one period may not be immediately reflected in our revenue for that period. Any such change, however, may affect our revenue in future periods. Accordingly, the effect of downturns or upturns in new sales and potential changes in our rate of renewals may not be fully reflected in our results of operations until future periods. We may also be unable to reduce our cost structure in line with a significant deterioration in sales or renewals. renewals or usage of our products that are subject to usage-based pricing. Our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as it is difficult to predict when revenue from new customers will be recognized over the applicable subscription term.
  24. 수정If our estimates, assumptions, or judgments relating to our critical accounting policies prove to be incorrect or financial reporting standards or interpretations change, our results of operations could be adversely affected.
    The preparation of financial statements in conformity with generally accepted accounting principles in the United States (U.S. GAAP) requires our management to make estimates, assumptions, and judgments that affect the amounts reported and disclosed in our consolidated financial statements and accompanying notes. We base our estimates and assumptions on historical experience and on various other assumptions that we believe to be reasonable under the circumstances. The results of these estimates and assumptions form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant estimates, assumptions, and judgments used in preparing our consolidated financial statements include those related to allowance for doubtful accounts, deferred contract acquisitions costs, the period of benefit generated from our deferred contract acquisition costs, the capitalization and estimated useful life of internal-use software, valuation of acquired intangible assets, the assessment of recoverability of intangible assets and their estimated useful lives, useful lives of property and equipment, the determination of the incremental borrowing rate used for operating lease liabilities, the valuation and recognition of stock-based compensation expense, uncertain tax positions, and the recognition and measurement of current and deferred income tax assets and liabilities. Due to geopolitical and macroeconomic uncertainties, including but not limited to the ongoing conflicts in the Middle East and Ukraine, and other areas of geopolitical tension around the world, inflationary pressures, threats of tariffs and other impediments to cross-border trade, and changes in interest rates, there is ongoing uncertainty in the global economy and financial markets. We are not aware of any specific event or circumstance that would require an update to our estimates or assumptions or a revision of the carrying value of assets or liabilities as of February 20, 2025, the date of issuance of this Annual Report on Form 10-K. These estimates and assumptions may change in the future, however, as new events occur and additional information is obtained. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of industry or financial analysts and investors, resulting in a decline in the trading price of our Class A common stock.
  25. 수정Future acquisitions, strategic investments, partnerships, or alliances could be difficult to identify and integrate, divert the attention of key management personnel, disrupt our business, dilute stockholder value, and adversely affect our results of operations, financial condition, and prospects.
    In addition, we may not be able to find suitable acquisition candidates and we may not be able to complete acquisitions on favorable terms, if at all. If we identify companies that we would like to buy, we may also face antitrust, competition, and other regulatory scrutiny that may limit our ability to complete such acquisitions. If we do complete acquisitions, we may not ultimately strengthen our competitive position or achieve our goals, and any acquisitions we complete could be viewed negatively by customers, developers, or investors. In addition, we may not be able to integrate acquired businesses successfully or effectively manage the combined company following an acquisition. If we fail to successfully integrate our acquisitions, or integrate and retain the people, technologies technologies, business partners, or customers associated with those acquisitions, into our company, the results of operations of the combined company could be adversely affected. Any integration process in connection with an acquisition will require significant time and resources, require significant attention from management, and disrupt the ordinary functioning of our business, and we may not be able to manage the process successfully, which could adversely affect our business, results of operations, and financial condition. We also frequently provide significant incentives for key employees of acquired companies to remain as our employees after the completion of the acquisition in order to facilitate integration and allow us to achieve the benefits we expect from the acquisition, but these incentives may not prove to be successful in retaining those new key employees. In addition, we may not successfully evaluate or utilize the acquired technology and accurately forecast the financial impact of an acquisition transaction, including accounting charges.
  26. 수정We may need additional capital, and we cannot be certain that additional financing will be available on favorable terms, or at all.
    Historically, we have financed our operations primarily through the sale of our equity and equity-linked securities as well as payments received from customers using our global cloud network and products. For example, we received substantial proceeds from the issuance and sales of our 0% Convertible Senior Notes due 2026 (the 2026 Notes) and 0% Convertible Senior Notes due 2030 (the 2030 Notes, and together with the 2026 Notes, the Notes). We also entered into a senior secured credit agreement in May 2024 that includes a $400 million revolving credit facility (the Revolving Credit Facility). Although we currently anticipate that our existing cash, cash equivalents, available-for-sale securities, available borrowing under the Revolving Credit Facility, and cash flow from operations will be sufficient to meet our working capital and capital expenditure needs for at least the next 12 months, we may require additional financing. We evaluate financing opportunities from time to time, and our ability to obtain financing will depend, among other things, on our development efforts, business plans, and operating performance, and the condition of the capital markets at the time we seek financing. We cannot assure you that additional financing will be available to us on favorable terms when required, or at all. For example, volatility in equity capital markets has adversely affected and may continue to adversely affect market prices of our shares of Class A common stock. This may materially and adversely affect our ability to fund our business through the sale of our equity and equity-linked securities if such funding were to become necessary. If we raise additional funds through the issuance of equity, equity-linked or debt securities, those securities may have rights, preferences or privileges senior to the rights of our Class A common stock, and, in the case of equity or equity-linked securities, our stockholders may experience dilution.
  27. 수정We may not be able to respond to rapid technological changes or develop new products and product features that are attractive to, and that contain all of the capabilities required by, our current and prospective future customers, especially large customers.
    Our ability to attract new customers and retain, and increase, revenue from existing customers will depend in significant part on our ability to anticipate and respond effectively to these forces on a timely basis and continue to introduce enhancements to our network and existing products and develop new products that have the features, and that function with the security, performance, and reliability capabilities, demanded by our customers, especially our large customers. If new technologies or advancements in technologies emerge that deliver competitive products and services at lower prices, more efficiently, more conveniently, more securely or reliably, or are higher performing, these technologies or advancements could render our network and existing products less attractive to our current and prospective future customers, or obsolete. For example, artificial intelligence AI and machine learning may change the way our industry identifies and responds to cyber threats, and businesses that are slow to adopt or fail to adopt these new technologies may face a competitive disadvantage. The development of novel attacks or exploits by criminal or malicious elements or hostile state actors also could render our network and existing products less effective or obsolete. If we are unable to develop new products and enhance our existing products so that they have the features and capabilities required by existing and potential new customers, especially large customers, our business, results of operations, and financial condition will be materially and adversely affected.
  28. 수정Problems with our internal systems, networks, or data, including actual or perceived breaches or failures, could cause our network or products to be perceived as insecure, underperforming, or unreliable, our customers to lose trust in our network and products, our reputation to be damaged, and our financial results to be negatively impacted.
    We face security threats from malicious third parties that could obtain unauthorized access to our internal systems, networks, and data, including the equipment at our network and core co-location facilities. It is virtually impossible for us to entirely mitigate the risk of these security threats and the security, performance, and reliability of our network and products has been in the past, and may be in the future, disrupted by third parties, including nation-states, competitors, hackers, disgruntled employees, former employees, or contractors. For example, in November 2023, we detected that a likely nation-state threat actor had gained unauthorized access to one of our internal systems. While we immediately began investigating the intrusion and believe we cut off the threat actor’s access prior to significant impact on our customer data or systems, we expect we will continue to be subject to similar threats of unauthorized access in the future and we may not be as successful in quickly identifying such intrusions and mitigating the impacts of such intrusions. We also face the possibility of security threats from other sources, such as employee or contractor errors (such as errors in utilizing artificial intelligence AI or machine learning in our products or in the operation of our business) or malfeasance. For example, hostile third parties, including nation-states and their agents, in the past have sought direct or indirect employment at Cloudflare, or attempted to bribe, extort, or otherwise manipulate our employees or contractors to compromise our network and products and in the future other hostile third parties may take similar actions. In addition, as As our business grows and we employ more employees and engage more contractors in more countries around the world, our ability to supervise the actions of our employees and contractors will decrease and the risk of an employee or contractor error or act of malfeasance will increase. These security threats from third parties are also likely to increase as the numbers, sizes, and types of customers using our network and products increases, particularly our customers that are involved in particularly sensitive industries or activities, such as banking and finance companies and governmental entities or in relation to elections in the United States or elsewhere. Additionally, artificial intelligence AI and machine learning may increase cybersecurity risks we face through, for example, being used to increase the prevalence or intensity of cyber attacks.
  29. 수정Problems with our internal systems, networks, or data, including actual or perceived breaches or failures, could cause our network or products to be perceived as insecure, underperforming, or unreliable, our customers to lose trust in our network and products, our reputation to be damaged, and our financial results to be negatively impacted.
    While we have implemented security measures internally and have integrated security measures into our network and products, these measures have not always functioned as expected and have not always detected or prevented all unauthorized activity, prevented all security breaches or incidents, mitigated all security breaches or incidents, or protected against all attacks or incidents and these types of security failures could occur again in the future. For example, we have experienced multiple social engineering attacks where third parties have attempted, and in limited cases succeeded, in breaching our network perimeter security. While these attacks did not effectively get beyond our network perimeter security and we have not suffered any material consequences as a result of these breaches, we cannot be certain that future breaches will be avoided or, if future breaches are successful, that we will not experience material detrimental impacts, particularly if those breaches involve third party access to decrypted or other sensitive data. In addition, there is risk that the vendors we use may be attacked and the controls we have in place are bypassed and our data accessed as a result. For example, one of the IT tools our employees used internally until the first quarter of 2023 was the subject of a large security incident in December 2022, which resulted in unauthorized parties stealing large amounts of the IT tools' customers’ data, including our data. We are not aware of any of our systems having been compromised as a result of this security incident due to additional required authorization and authentication events we have in place, particularly when accessing sensitive systems and resources, and we have since changed to using a new IT tool internally. In addition, in March 2022 and October
  30. 수정Problems with our internal systems, networks, or data, including actual or perceived breaches or failures, could cause our network or products to be perceived as insecure, underperforming, or unreliable, our customers to lose trust in our network and products, our reputation to be damaged, and our financial results to be negatively impacted.
    In addition, in March 2022 and October 2023, breaches of the systems of our former identity access management vendor resulted in attacks on our systems. While we quickly discovered these resulting attacks on our systems and believed we had fully contained their impact on our systems and data, the October 2023 breach of our systems contributed to the November 2023 intrusion of our systems by a likely nation-state threat actor. Further, in August 2025, a breach of a third-party chat agent integrated with our customer relationship management system allowed threat actors to gain unauthorized access to some of our customer contact and support information. While none of these incidents had a material impact on our business, results of operations or financial condition, we cannot be certain that compromises of our systems will not happen in the future as a result of these incidents or other similar incidents with third party vendors that we use to help secure our internal systems and that such incidents will not have a material impact on our results of operations or financial condition. Such incidents, whether or not successful, could result in our incurring significant costs related to, among other things, changes to our internal systems, remediating or replacing equipment within our global network, implementing additional threat protection measures, making modifications to our products and our global network, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with credits under our agreements with them or other incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Because these threats are constantly evolving, we believe successfully defending against them or implementing adequate preventative measures will become increasingly challenging.
  31. 수정Problems with our internal systems, networks, or data, including actual or perceived breaches or failures, could cause our network or products to be perceived as insecure, underperforming, or unreliable, our customers to lose trust in our network and products, our reputation to be damaged, and our financial results to be negatively impacted.
    The global network that we use to provide our products to our customers is made up of equipment at co-location facilities located in more than 335 330 cities and over 125 countries worldwide and we expect to continue to increase the size of our network in the future. As we grow the size and scope of our network, the number of our employees and third party contractors that have access to our equipment at these facilities will continue to increase, which will also increase the risk of potential errors or malfeasance such as potential equipment theft or potential attempts to interfere with, or intercept, network and customer data that is held in, or flows through, this equipment. In addition, local government officials may attempt to, or successfully take control of, our equipment in an attempt to interfere with our services or intercept data. Because the equipment in our network co-location facilities is designed to run all of our products, any insertion of ransomware or other malicious code on, unauthorized access to, or other security breach or incident with respect to, any of this equipment at any of these locations around the world could potentially impact all of our products running on this equipment around the world. We may also experience security breaches and other incidents that may remain undetected for an extended period and, therefore, may have a greater impact on our products and the networks and systems used in our business, the proprietary and other confidential data contained on our network or otherwise stored or processed in our operations, and ultimately our business. We expect to incur significant costs in our efforts to detect and prevent security breaches and other security-related incidents, and we have in the past faced, including in connection with the November 2023 intrusion of our systems, and may in the future face, increased costs in the event of actual or perceived security breaches or other security-related incidents. Our internal systems are exposed to the same cybersecurity risks and consequences of a breach as the systems of our customers and other enterprises, any of which could have an adverse effect on our business or reputation. These cybersecurity risks pose a particularly significant risk to a business like ours that is focused on providing highly secure products to customers. With the increase in remote work during recent years, we and our customers face increased risks to the security of infrastructure and data, and geopolitical tensions or events such as the and conflicts in the Middle East and Ukraine also may increase these risks. We cannot guarantee that our security measures will prevent security breaches or incidents. We also may face increased costs relating to maintaining and securing our infrastructure and data that we maintain and otherwise process.
  32. 수정Problems with our internal systems, networks, or data, including actual or perceived breaches or failures, could cause our network or products to be perceived as insecure, underperforming, or unreliable, our customers to lose trust in our network and products, our reputation to be damaged, and our financial results to be negatively impacted.
    Additionally, even in the absence of malicious actions, our network and products may experience errors, failures, vulnerabilities, or bugs that cause our products not to perform as intended and the likelihood of these problems may increase as we continue to expand the number and complexity of our products and related features, through artificial intelligence AI or otherwise, that we offer to our customers through our global network. For example, from time to time we are subject to “route leaks” that involve the accidental or, less commonly, illegitimate advertisement of prefixes, or blocks of IP addresses, which propagate across networks such as ours and can lead to incorrect routing of traffic across our network, taking traffic offline, or in extreme cases, potential interception of customers’ traffic by attackers. For example, in June 2019, a route leak spread by a major telecommunications services provider caused significant disruption to our traffic and that of many other providers. Although events like this are outside our control, they could materially harm our reputation and diminish the confidence of our current and potential customers in our network and products. Deployment of our network and products into other computing environments may expose these errors, failures, vulnerabilities, or bugs in our products. In addition, any such errors, failures, vulnerabilities, or bugs may not be found until after they are deployed to our customers and may create the perception that our network and products are insecure, underperforming, or unreliable. For example, deployments of software updates to our global network resulted in widespread service unavailability on our network in November and December 2025 and we also have experienced a limited number of other network outages over the past five years due to a variety of causes.
  33. 수정Problems with our internal systems, networks, or data, including actual or perceived breaches or failures, could cause our network or products to be perceived as insecure, underperforming, or unreliable, our customers to lose trust in our network and products, our reputation to be damaged, and our financial results to be negatively impacted.
    Actual or perceived problems with our network or systems, or those of our vendors, contractors, or those with which we have strategic relationships, could result in actual or perceived breaches of of, or incidents affecting, our or our customers’ networks and systems or data and/or subject us to reputational or financial harm. We are also required to comply with complex and evolving laws, regulations, and standards in many jurisdictions, including regarding our notifications to government agencies or public disclosures with respect to actual or perceived cybersecurity or personal data breaches, or other cybersecurity incidents, which could subject us to additional liability and reputational harm or lead to claims and litigation, indemnity obligations, regulatory reporting and/or audits, proceedings, and investigations and significant legal fees, significant costs for remediation, the expenditure of significant financial resources in efforts to analyze, correct, eliminate, remediate, or work around errors or defects, to address and eliminate vulnerabilities, and to address any applicable legal or contractual obligations relating to any actual or perceived security breach or incident. Our compliance efforts are complicated by the fact that these requirements and obligations may be subject to uncertain or inconsistent interpretations and enforcement, and may conflict among various jurisdictions.
  34. 수정If our customers’ or partners’ access to our network and products is interrupted or delayed for any reason, our business could suffer.
    While we do not consider them to have been material, we have experienced a limited number of network outages over the past five years, and we may in the future experience network disruptions and other performance problems, in each case due to a variety of factors. For example, deployments of software updates to our global network resulted in widespread service unavailability on our network in November and December 2025. The following factors, many of which are beyond our control, can affect the delivery, performance, and availability of our network and products:
  35. 수정If our customers’ or partners’ access to our network and products is interrupted or delayed for any reason, our business could suffer.
    •the occurrence of earthquakes, floods, weather events, fires, power loss, system failures, physical or electronic break-ins, acts of war or terrorism (including the ongoing conflicts in the Middle East and Ukraine or potential consequence of geopolitical tensions in other areas of around the world), human error or interference (including by disgruntled employees, former employees, or contractors), and other catastrophic events;
  36. 수정We rely on a limited number of suppliers for certain components of the equipment we use to operate our network and any disruption in the availability, or price, of these components could delay our ability to expand or increase the capacity of our global network, replace defective equipment, or identify alternative supply sources favorable to us.
    We rely on a limited number of suppliers for several components of the equipment we use to operate our network and provide products to our customers. Our reliance on these suppliers exposes us to risks, including reduced control over production costs, increased prices due to tariffs, tariffs (such as the tariffs the United States and other countries recently implemented or threatened to implement), increased prices and constraints based on the then-current availability, availability with an increased demand, terms, and pricing of these components. For example, we generally rely on a limited number of suppliers for the servers that we use in our network and we ordinarily purchase these components on a purchase-order basis, without any long-term contracts guaranteeing supply. We may also be subject to price increases from these suppliers should they be negatively impacted by tariffs or other regulations. regulations, such as the tariffs the United States and other countries recently implemented or threatened to implement. While the network equipment and servers we purchase generally are commodity equipment and we believe an alternative supply source or location for servers on substantially similar terms could be identified quickly, our business could be adversely affected until those efforts are completed.
  37. 수정We rely on a limited number of suppliers for certain components of the equipment we use to operate our network and any disruption in the availability, or price, of these components could delay our ability to expand or increase the capacity of our global network, replace defective equipment, or identify alternative supply sources favorable to us.
    In addition, the technology equipment industry has experienced component shortages and delivery delays in the past, and we may experience shortages or delays, including as a result of natural disasters, increased demand in the industry, military conflicts and geopolitical tensions, labor strikes, or other related conditions, or our suppliers lacking sufficient rights to supply the components in all jurisdictions in which we have co-location facilities that support our global network. For example, we expect significant component shortages that may impact our server supply chain during the current year, particularly in memory products such as Dual In-line Memory Modules (DIMMs), as well as enterprise Solid State Drives (SSDs), Central Processing Units (CPUs), and high-capacity Hard Disk Drives (HDDs). These anticipated shortages, driven by factors such as the reallocation of manufacturing capacity to support artificial intelligence infrastructure and increased demand from hyperscale data center operators, and other shortages or similar supply constraints in the future may disrupt and increase the cost of our expected purchases of network equipment and servers.
  38. 수정We rely on a limited number of suppliers for certain components of the equipment we use to operate our network and any disruption in the availability, or price, of these components could delay our ability to expand or increase the capacity of our global network, replace defective equipment, or identify alternative supply sources favorable to us.
    If our supply of certain components is disrupted or delayed or becomes more expensive, there can be no assurance that additional supplies or components can serve as adequate replacements for the existing components or that supplies will be available on terms that are favorable to us, if at all. Any disruption or delay or additional costs in the supply of our hardware components may delay the opening of new co-location facilities, limit capacity expansion or replacement of defective or obsolete equipment at existing co-location facilities, equipment, cause other constraints on our operations that could damage our customer relationships, or otherwise adversely impact our business, financial condition, or results of operations.
  39. 수정The actual or perceived failure of our products to block malware or prevent a security breach or incident could harm our reputation and adversely impact our business, results of operations, and financial condition.
    Companies are increasingly subject to a wide variety of attacks on their networks and systems, including traditional computer hackers; malicious code, such as viruses and worms; DDoS attacks; sophisticated attacks conducted or sponsored by nation-states; advanced persistent threat intrusions; ransomware; phishing attacks and other forms of social engineering; employee, vendor, or contractor errors or malfeasance; and theft or misuse of intellectual property or business or personal data, including by disgruntled employees, former employees, or contractors. External events, like the ongoing conflicts in the Middle East and Ukraine and other areas of geopolitical tension around the world and elections in the United States and elsewhere, can increase the likelihood of attacks. No security solution, including our products, can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security incident. Accordingly, our security products may be unable to detect or prevent a threat until after our customers are impacted. As our products are adopted by an increasing number of enterprises and by increasingly larger enterprises, it is possible that the individuals and organizations behind cyber threats will focus on identifying ways to circumvent or defeat our security products. If our network is targeted by attacks specifically designed to disrupt it, it could create the perception that our security products are not capable of providing adequate security. As a provider of security products, any perceived lack of security to our network or any of our products could erode our customers’ and potential customers’ trust in our network and products. Moreover, a high-profile security breach of, or security incident impacting, another cloud services provider could cause our customers and potential customers to lose trust in cloud solutions generally, and cloud-based products like ours in particular. Any such loss of trust could materially and adversely impact our ability to retain existing customers or attract new customers.
  40. 수정We provide service level commitments under our Enterprise subscription plan customer contracts and our Business subscription plan terms of service. If we fail to meet these contractual commitments, we could be obligated to provide credits for future service or allow customers to terminate their subscriptions and our business could suffer.
    Our Enterprise subscription plan agreements and our Business subscription plan terms of service typically provide for service level commitments, which contain specifications regarding the availability and performance of our network. In particular, our Enterprise subscription plan and our Business subscription plan terms of service include up to a 100% uptime guarantee. Any failure of or disruption to our infrastructure could adversely impact the security, performance, and reliability of our network and products for our customers. If we are unable to meet our stated service level commitments or if we suffer extended periods of poor performance or unavailability of our network and products, these customers could seek to bring claims against us or terminate their agreements with us and, in the case of our contracted customers, we may be contractually obligated to provide affected customers with service credits that they may apply against future subscription fees otherwise owed to us, and, in certain cases, refunds of pre-paid and other fees. For example, a route leak and a limited number of network outages during the past five years triggered certain of these types of obligations. obligations, including the deployments of software updates to our global network that resulted in widespread service unavailability on our network in November and December 2025. Although the impact of the route leak and these outages did not have a material impact on our results of operations or financial condition, other future events like these may materially and adversely impact our results of operations or financial condition. Our revenue, other results of operations, and financial condition could be harmed if we suffer performance issues or downtime that exceeds the service level commitments under our agreements and terms of service with our paying customers.
  41. 수정If our products do not obtain and maintain market acceptance, our ability to grow our business and our results of operations may be adversely affected.
    Our products are still evolving and it is difficult to predict customer demand and adoption rates for our product offerings. We believe that our network and cloud-based products represent a major shift from traditional solutions. Many of our potential customers, particularly large enterprises and government entities, face barriers to adopting our offerings because of their prior investment in, and the familiarity of their IT personnel with, on-premises, appliance-based solutions or other providers of cloud-based solutions. As a result, our sales process often involves extensive efforts to educate our customers about our products, particularly as we continue to pursue customer relationships with large organizations. Our customers also expect us to meet voluntary validations or adhere to industry standards and require our policies and practices to be evaluated by an independent third-party assessor. Although we currently have certain certifications and reports such as SOC2 Type 2, PCI DSS, ISO 27001, ISO 27701, and ISO 27018, C5, EU Code of Conduct, Global CBPR, Global PRP, UK Cyber Essentials, ENS ENS, ISMAP, FedRAMP Moderate authorization and FedRAMP moderate authorization, IRAP Protected Level, we may not be successful in continuing to maintain those certifications or in obtaining other certifications. In addition, sales to government entities and other large enterprises may in particular be conditioned upon adherence to PSPC, ISMAP, IRAP, PBMM or DoD IL4 compliance in Canada, Japan, Australia, Canada and the United States, and we do not currently have these certifications. The costs of obtaining and maintaining certification pursuant to any of these standards are significant, and any failure to obtain and maintain such certifications for our network and products could reduce demand for them, which would harm our business, results of operations, and financial condition. To the extent our competitors have, and we do not have, these certifications, we may lose the opportunity to obtain subscriptions from certain potential paying customers.
  42. 수정We expect to hold periodically certain types of cryptocurrency and similar types of digital assets that may be subject to unique regulatory risks, volatile market prices, and risks of loss, which could harm our business and reputation.
    In connection with our Web3 suite of products and our potential future participation in various Web3 protocol governance activities, we We expect to hold periodically certain types of cryptocurrency and similar types of digital assets that may be subject to unique regulatory risks, volatile market prices, and risks of loss, which could harm our business and reputation.
  43. 수정We expect to hold periodically certain types of cryptocurrency and similar types of digital assets that may be subject to unique regulatory risks, volatile market prices, and risks of loss, which could harm our business and reputation.
    The prices of digital assets have been and may continue to be highly volatile, including as a result of various associated risks, uncertainties and events. events, and the long-term adoption of digital assets by investors, consumers, and businesses remains uncertain. Moreover, digital assets' lack of a physical form, their reliance on technology for their creation, existence, and transactional validation, and their decentralization may subject their integrity to the threat of malicious attacks and technological obsolescence. In addition, if the market value of the digital assets we hold increases significantly relative to the purchase prices, we could be deemed an "investment company" for purposes of the Investment Company Act of 1940, as amended, and may be required to institute burdensome compliance requirements, restricting our activities in a way that could adversely affect our business, financial condition, and results of operations.
  44. 수정Activities of our paying and free customers or the content of their websites and other Internet properties may violate applicable laws and/or our terms of service and could subject us to lawsuits, regulatory enforcement actions, and/or liability in various jurisdictions.
    Through our network, we provide a wide variety of products that enable our customers and our customers' users to exchange information, conduct business, and engage in various online activities both domestically and internationally. Our customers and our customers' users may use our network and products in violation of applicable law or in violation of our terms of service or the customer’s own policies. The existing laws relating to the liability of providers of online products and services for activities of their users are highly unsettled and in flux both within the United States and internationally. We are currently, and in the future may be, subject to lawsuits and/or liability arising from the conduct of our customers and our customers' users. Additionally, the conduct of our customers and our customers' users may subject us to regulatory enforcement actions and/or liability. We are a defendant in lawsuits, both in the United States and abroad, seeking injunctive relief and/or damages against us based on content that is made available through our customers’ websites and other Internet properties. A number of these lawsuits involve copyright infringement claims, and courts in some countries have found that we may be held liable in certain circumstances for damages arising from infringement on a customer’s website or directed us to take action by removing access to content of certain websites and other Internet properties on our network. For example, in October 2025, a court in Japan held us liable for damages in a case alleging infringing content on websites using our services, which decision we have appealed. There can be no assurance that we will not face similar litigation in the future or that we will prevail in any litigation we are facing or may face. An adverse decision in one or more of these lawsuits could materially and adversely affect our business, results of operations, and financial condition.
  45. 수정Activities of our paying and free customers or the content of their websites and other Internet properties may violate applicable laws and/or our terms of service and could subject us to lawsuits, regulatory enforcement actions, and/or liability in various jurisdictions.
    Policies and laws in this area remain highly dynamic, and we may face additional theories of intermediary liability in various jurisdictions. Many policymakers in the United States have called for a re-examination of CDA section 230 and copyright law. The Digital Services Act and Digital Markets Act have gone into effect in the European Union (EU), updating the rules governing digital services like ours and imposing additional legal requirements on certain service providers. In addition, in 2019, the EU approved a Copyright Directive that will impose imposes additional obligations on service providers and failure to comply could give rise to significant liability. More recently, some countries in the EU have adopted or are considering adopting regulatory schemes that impose significant obligations on service providers related to online content and may give rise to fines for alleged noncompliance. For example, in December 2025, an Italian regulator issued an administrative fine of approximately €14.2 million against Cloudflare for alleged failure to comply with its regulatory scheme. Cloudflare is challenging both the fine and the underlying regulation. Other laws and pending legislation at the EU level (terrorist content, child sexual abuse materials) and in the United Kingdom (online harms), Australia (online harms), and India (Digital India Act), as well as other new laws like them, may also expose Internet companies like us to significant liability. We may incur additional costs to comply with these new laws, which may have an adverse effect on our business, results of operations, and financial condition.
  46. 수정Our policies regarding user privacy could cause us to experience adverse business and reputational consequences with customers, employees, suppliers, government entities, and other third parties.
    As a company, we strive to protect our customers’ privacy consistent with applicable law. Consequently, we generally do not provide personal information about our customers or their users without legal process. In accordance with our contractual commitments to our customers, we may need to challenge legal process requesting disclosure of personal information where such requests are inconsistent with applicable data protection laws. In addition, from time to time, government entities may seek or demand our assistance with obtaining information about our customers or their users or could request that we modify our network and products in a manner to permit access or monitoring. In light of our privacy commitments, we may legally challenge certain law enforcement requests, such as requests to provide a feed of content transiting our network, to obtain encryption keys, or to modify or weaken encryption. Despite the policies we have in place to protect consumer information, we also may face complaints from individuals who assert we have provided their information improperly to law enforcement or in response to third-party abuse complaints, or who disagree with our understanding of our legal obligations. To the extent that we do not provide assistance to, or comply with requests from, government entities or challenge those requests publicly or in court, we may experience adverse political, business, and reputational consequences. We may also face such adverse political, business, and reputational consequences to the extent that we provide, or are perceived as providing, assistance to government entities that exceeds our legal obligations. For example, we periodically receive requests for information purportedly originating from law enforcement agencies or pursuant to legal process, but which are fraudulent or improper attempts to cause us to reveal customer information. Any such disclosure could significantly and adversely impact our business and reputation.
  47. 수정Our policies regarding user privacy could cause us to experience adverse business and reputational consequences with customers, employees, suppliers, government entities, and other third parties.
    We publish a transparency report on a semi-annual basis to provide details of law enforcement and government requests we receive. receive, as well as abuse reports that we process. Laws such as the EU’s Digital Services Act include new transparency reporting legal requirements, some of which may not apply in a straightforward manner to certain of our services and abuse processes. Any determination that our transparency report does not meet the transparency reporting requirements could raise both regulatory and brand concerns. Our transparency report also includes a list of certain actions we have not taken in response to law enforcement requests. If we are ever required by law enforcement to take one or more of the actions covered by those disclosures, then we would have to remove the applicable disclosures from our transparency report. Both the publishing of our transparency report and, conversely, the potential narrowing of the list of actions we have not taken in response to law enforcement requests could damage our business and reputation.
  48. 수정Failure to comply with laws and regulations applicable to our business could subject us to fines and penalties and could also cause us to lose customers or otherwise harm our business.
    Our business is subject to regulation by various federal, state, local, and non-U.S. governmental agencies, including agencies responsible for monitoring and enforcing compliance with various legal obligations, such as privacy, data protection, and information security laws and regulations, intellectual property laws, telecommunications laws and regulations, employment and labor laws, workplace safety, environmental laws, consumer protection laws, anti-bribery laws, governmental trade sanctions laws, import and export controls, anti-corruption and anti-bribery laws, federal securities laws, and tax laws and regulations. In addition, emerging tools and technologies we may utilize in providing our products and solutions, like artificial intelligence AI and machine learning, have, and may also in the future, become subject to regulation under new laws or new applications of existing laws. For example, the EU AI Act has gone into effect and several U.S. states are also enacting laws governing the use of AI. In certain jurisdictions, some or all of these regulatory requirements may be more stringent than in the United States.
  49. 수정Failure to comply with laws and regulations applicable to our business could subject us to fines and penalties and could also cause us to lose customers or otherwise harm our business.
    In addition, the United States States, the EU, and other countries jurisdictions are considering expanding or have expanded regulatory requirements for services such as ours, with potential requirements such as collection and verification of customer data, limitations on the use of non-personal data, limitations on the transfer of certain types of data to named countries or entities, service switching obligations, requirements to block online content in response to regulatory notices or judicial orders, cybersecurity incident reporting obligations, expanded registration requirements, or requirements to have personnel in the country. The rapid expansion of proposed regulations, as well as possible conflicting requirements, may make it challenging for us to identify and comply with all new global regulations that may apply to our services. For example, the EU Data Act imposes service switching obligations, requires us to assist with data portability to facilitate switching, and imposes requirements related to the cross-border data transfer of non-personal data. We may incur substantial costs to comply with the EU Data Act, as well as become subject to substantial fines or civil litigation in the case of noncompliance.
  50. 수정Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.
    We receive, store, use, and otherwise process personal information and other information relating to individuals. There are numerous federal, state, local, and international laws and regulations regarding privacy, data protection, information security, and the storing, sharing, protection use, processing, transfer, disclosure, and protection other processing of personal information and other content, the scope of which are changing, subject to differing interpretations, and may be inconsistent among jurisdictions, or conflict with other rules. Not only is the number of data protection laws rising globally and within the United States, but existing laws and regulations are evolving. Together, this legislative framework may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, the EU’s General Data Protection Regulation (GDPR) imposes stringent data protection requirements and provides for penalties for noncompliance of up to the greater of €20 million or four percent of worldwide annual revenues. In addition, the GDPR and the data protection laws of numerous other jurisdictions such as Japan, China, South Korea, and the United Kingdom prohibit cross-border data transfers unless certain contractual and other conditions are met. This requires us to incur substantial costs and engage in additional contract negotiations with some of our customers and vendors to ensure the conditions established by these data protection regulations are met.
  51. 수정Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.
    In addition, the interpretation of existing laws and regulations regarding privacy, data protection, information security, and the processing of personal information security laws and regulations other content by governmental entities and the courts may change significantly over time in a manner that can have a significantly adverse impact on both our business and our customers’ businesses.
  52. 수정Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.
    This is especially true regarding the cross-border transfer of personal data. For example, in July 2023, the European Commission adopted an adequacy decision for the new EU-U.S. Data Privacy Framework, which generally allows the free flow of EU personal data to the United States for participating entities. While this framework currently serves as a means for cloud service providers like our company to freely transfer EU personal data to the United States, it may be subject to future legal challenges, suspension, amendment, repeal, or limitations to its scope by the European Commission, and some customers and vendors may be unwilling to rely on this framework due to these and other uncertainties.
  53. 수정Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.
    European Commission. In addition, some customers and vendors may be unwilling to rely on this framework due to these and other uncertainties, including perceived uncertainty about the U.S. stance on the existing legal framework. In addition, in January 2023, the European Data Protection Board issued its 2022 Coordinated Enforcement Action on the use of cloud-based services by the public sector, in which it expressed concerns that EU public sector entities may not be able to use U.S.-based cloud service providers consistently with GDPR due to their concerns about the ability of U.S. government agencies to access EU personal data. More recently, Following that, the European Data Protection Supervisor’s finding Supervisor found in March 2024 that the European Commission’s use of Microsoft 365 violates violated the GDPR in part due to EU personal data being transferred to countries that have had not been determined by the EU to provide adequate level of protection suggests that EU regulators are continuing to subject data transfers outside the EU to careful scrutiny.
  54. 수정Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.
    In addition, the United States has enacted the Protecting Americans' Data from Foreign Adversaries Act (PADFA), and the U.S. Department of Justice recently released a final rule rule, effective on April 8, 2025, implementing President Biden’s February 2024 Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern”, both of which restrict the transfer of certain types of data to named jurisdictions or covered entities. We have incurred additional costs and invested resources in addressing these new regulations, and as we continue to monitor the impact these new regulations have on our and our customers’ business, we may incur additional costs and may need to invest additional resources in order to make changes to our practices as may be required under these regulations.
  55. 수정Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.
    We also expect that there will continue to be new, and amendments to existing, laws, regulations, and industry standards concerning privacy, data protection, information security, and the processing of personal information security and other content proposed and enacted in the United States and various individual U.S. states. In the United States, various federal laws and regulations already apply to the collection, processing, disclosure and security of certain types of data, including the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act of 1996, and the Gramm-Leach-Bliley Act. In addition, there are also a number of recently enacted or proposed U.S. federal and state privacy and data protection bills in Congress and state legislatures across the country.
  56. 수정Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.
    Obligations relating to privacy, data protection, information security, and the processing of personal information security and other content also are increasing in complexity outside the U.S. For example, the EU has revised its Cybersecurity Directive (NIS2), which, among other things, obligates companies to adopt or update policies and procedures on issues such as incident handling and supply chain security, implementing certain administrative measures, and requires top management’s involvement in cybersecurity risk-management measures, with top management potentially held liable for non-compliance. NIS2 provides for significant penalties for noncompliance, requiring EU member states to provide for a maximum fine level of at least €10,000,000 or 2% of annual turnover, whichever is greater. In addition, the EU’s Digital Operational Resiliency Act became effective in January 2025. This law aims to establish a universal framework for managing and mitigating information and communication technology risk that will apply to entities in the financial sector and their third-party cloud service providers.
  57. 수정Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.
    More generally, as obligations regarding privacy, AI, data protection, information security, and the processing of personal information security and other content increase in complexity, we may be required to incur substantial costs to adapt our policies and business practices as well as engage in additional contractual negotiations. Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to customers or other third parties, applicable laws or regulations, or any of our other legal obligations relating to privacy, AI, data protection, information security, or the processing of personal information security and other content may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us by consumer advocacy groups or others and could result in significant liability or cause our customers to lose trust in us, which could cause them to cease or reduce use of our products and otherwise have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our products.
  58. 수정Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.
    Additionally, if third parties we work with, such as sub-processors, vendors, or developers, violate applicable laws or regulations, contractual obligations, or our policies—or if it is perceived that such violations have occurred—such actual or perceived violations may also have an adverse effect on our business. Further, any significant change to applicable laws, regulations, or industry practices regarding privacy, AI, data protection, information security, and the collection, use, retention, security, disclosure, or other processing of users’ content, or regarding the manner in which the express or implied consent of users for the collection, use, retention, disclosure, or other processing of such content is obtained, could increase our costs and require us to modify our network, products, and features, possibly in a material manner, which we may be unable to complete, and may limit our ability to store and process customer data or develop new products and features.
  59. 수정We are subject to anti-corruption, anti-bribery, and similar laws, and noncompliance with such laws can subject us to criminal penalties or significant fines and harm our business and reputation.
    We are subject to the U.S. Foreign Corrupt Practices Act of 1977, 1977 (FCPA), the UK Bribery Act 2010, and other anti-corruption, anti-bribery, anti-money laundering, and similar laws in the United States and other countries in which we conduct activities. Anti-corruption and anti-bribery laws, which have in the past been enforced aggressively and are interpreted broadly, prohibit companies and their employees and agents from promising, authorizing, making, or offering improper payments or other benefits to government officials and others in the public sector.
  60. 수정We may have exposure to greater than anticipated income tax liabilities in the United States and in foreign jurisdictions, requiring us to exercise judgment in determining the applicability of certain tax laws, and this could subject us to potentially adverse tax consequences and adversely impact our results of operations.
    Changes in accounting principles, changes in global tax laws, regulations or rates, or changes in taxing jurisdictions’ administrative interpretations, decisions, policies, and positions could also impact our provision for income taxes. For example, the United States signed into law the One Big Beautiful Bill Act on July 4, 2025, which permanently extends many of the expiring provisions from the Tax Cuts and Jobs Act and modifies a number of provisions. Additionally, the Organization for Economic Cooperation and Development (OECD) published model rules within the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting (the Inclusive Framework) to address the challenges arising from the digitalization of the global economy. impacting international operations. The Inclusive Framework includes provisions related to the taxation of the digital economy and the establishment of a 15% global minimum tax under Pillar Two. A number of foreign countries have enacted, or intend to enact, legislation adopting parts of the Inclusive Framework. On January 5, 2026, the OECD announced a “side-by-side” elective safe harbor that exempts U.S.-parented multinational entities from certain provisions of Pillar Two for fiscal years beginning on or after January 1, 2026. Any of the foregoing changes changes, if and to the extent implemented, could have an adverse impact on our results of operations, cash flows, and financial condition.
  61. 수정Our ability to use our net operating loss carryforwards and certain other tax attributes may be limited.
    Net operating loss carryforwards and other tax assets could expire before utilization and could be subject to limitations, which could harm our business and financial results. It is also possible that federal, state, U.S. federal and state and non-U.S. tax authorities will enact additional legislation limiting our ability to use our carryforwards, some of which may adversely impact our business.
  62. 수정Our international operations expose us to significant risks, and failure to manage those risks could materially and adversely impact our business and results of operations.
    •geopolitical, economic, and social uncertainties, including the potential implementation of tariffs or other costs or restrictions on the conduct of business, potential nationalization of key peering partners by foreign governments or political unrest that affects our ability to continue to work with particular peering partners, potential terrorist activities, military conflict or war, trade policies and sanctions, and the unknown impact of regional or global health crises, or epidemic or pandemic diseases;
  63. 수정Our international operations expose us to significant risks, and failure to manage those risks could materially and adversely impact our business and results of operations.
    •greater risk of unexpected changes in regulatory practices, increased costs due to tariffs, and tax laws and treaties;
  64. 수정Our international operations expose us to significant risks, and failure to manage those risks could materially and adversely impact our business and results of operations.
    •heightened security risks associated with our co-location facilities and related equipment in high-risk countries and the software code and systems access shared with our service providers located in such countries, including in the Hong Kong region as a result of the National Security Law passed in June 2020; countries;
  65. 수정Our international operations expose us to significant risks, and failure to manage those risks could materially and adversely impact our business and results of operations.
    Geopolitical events, including the ongoing conflicts in the Middle East and Ukraine or other areas of geopolitical tension around the world, or any worsening or expansion of those conflicts or geopolitical tensions, may increase the likelihood of certain of these risks materializing or heighten their impact on us in affected regions. In addition, heightened use of trade restrictions and sanctions, including tariffs or prohibitions on technology transfers to achieve diplomatic ends could impact our ability to conduct our business as planned.
  66. 수정Our international operations expose us to significant risks, and failure to manage those risks could materially and adversely impact our business and results of operations.
    As discussed in greater detail above in our risk factor titled “Our "Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business,” recent changes in business," the continued evolution of privacy and data protection laws and their application in a number of countries and supranational organizations have created uncertainty around the requirements related to transfers of personal data between jurisdictions, including transfers to the United States. As a result of this uncertainty, our current and potential customers in certain regions may be concerned about whether they are able to transfer personal data to the United States in connection with the usage of our global network and products. If these concerns result in our current and potential customers in those regions reducing their usage of our products, then our results of operations could be adversely impacted. Further, In addition, we anticipate needing to identify different transfer mechanisms and/or change our use of certain standard contractual clauses in order to lawfully transfer certain personal data from those regions to the United States. Further, customer demands that we avoid transferring data to specific regions, including the United States, might require us to adapt our products and services or make it difficult to sell to customers in certain industries. This could result in substantial costs, require changes to our policies and business practices, require us to engage in additional contractual obligations, limit our ability to provide certain products in certain jurisdictions, or materially adversely affect our business and operating results.
  67. 수정We are exposed to fluctuations in currency exchange rates, which could negatively affect our results of operations.
    Substantially all of our sales contracts are denominated in U.S. dollars and, therefore, substantially all of our revenue is not subject to foreign currency risk. However, a any strengthening of the U.S. dollar has increased and may continue to increase the real cost of our products to our customers outside of the United States, which could reduce demand for our products or cause us to discount our products, which could adversely affect our financial condition and results of operations.
  68. 수정Our business could be adversely impacted by the decision of foreign governments, Internet service providers, or others, to block transmission from Cloudflare IP addresses or domains in order to enforce certain Internet content blocking efforts.
    Some of our security products involve making origin IP addresses and other operational assets of our customers more difficult for cyber attackers to target. The evolving design of our network and products may create challenges for various organizations, including governments, that seek to block certain content based on IP address “block lists” or other mechanisms. This problem is exacerbated by the fact that a single Cloudflare IP address may be used for a number of Internet properties, and the Cloudflare IP address used for any one Internet property may change over time. This means that efforts by ISPs to block a single domain name may end up blocking a number of other domains or content. We have seen certain organizations react by deciding to block content that is using a Cloudflare IP address in an overly broad manner. It is also possible that organizations could react by choosing to block completely websites and other Internet properties that are using our network and/or transmitted using known Cloudflare IP addresses. Some of these blocking efforts would may be out of our control once they have been put in place and may limit our ability to provide our products on a fully global basis, which could reduce demand for our products among current or potential customers that are focused on the impacted regions or could otherwise adversely impact our business, results of operations, and financial condition.
  69. 수정We are subject to governmental trade sanctions laws, and export and import controls, that could impair our ability to compete in international markets and subject us to liability if we are not in full compliance with applicable laws.
    On September 29, 2025, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) released an interim final rule that expanded export control restrictions and licensing requirements under the EAR Entity List and Military End-User List to foreign entities that are 50% or more owned by one or more parties on those lists, which BIS has labeled the “Affiliates rule.” Although the Affiliates rule was suspended for a period of one year on November 10, 2025, the Affiliates rule, if implemented, would significantly raise the bar for compliance with EAR by imposing an affirmative responsibility to know the ownership of the foreign companies that are parties to any transactions. Even though we take precautions and have implemented policies and practices to assist in compliance, there is a risk that we may not be in full compliance with these laws.
  70. 수정We are subject to governmental trade sanctions laws, and export and import controls, that could impair our ability to compete in international markets and subject us to liability if we are not in full compliance with applicable laws.
    In 2019, we learned that we may have failed to comply with certain U.S. export-related filing and reporting requirements and may have submitted incorrect information to the U.S. government in connection with certain hardware exports. Upon learning of these potential violations and associated export control requirements, we promptly initiated a voluntary internal review and are taking remedial measures to prevent similar export control anomalies from occurring in the future. In May 2019, we submitted an initial voluntary self-disclosure to the Bureau of Industry and Security BIS regarding potential violations of EAR and a voluntary self-disclosure to the Census Bureau regarding potential violations of the Foreign Trade Regulations. In July 2019, we filed the full and complete voluntary self-disclosures. The voluntary self-disclosure to the Census Bureau was completed with no penalties in November 2019. The voluntary self-disclosure to the Bureau of Industry and Security BIS was completed with no penalties in June 2020.
  71. 수정We are subject to governmental trade sanctions laws, and export and import controls, that could impair our ability to compete in international markets and subject us to liability if we are not in full compliance with applicable laws.
    In May 2019, we submitted an initial voluntary self-disclosure to OFAC related to our non-compliance with certain economic and trade sanctions programs, and we filed the full and complete voluntary self-disclosure to OFAC in July 2019. Specifically, we identified that our products were used by, or for the benefit of, certain individuals and entities included in OFAC’s Specially Designated Nationals and Blocked Persons List, including entities identified in OFAC’s counter-terrorism and counter-narcotics trafficking sanctions programs and individuals or entities affiliated with governments currently subject to comprehensive U.S. sanctions or located in regions subject to comprehensive sanctions.
  72. 수정We are subject to governmental trade sanctions laws, and export and import controls, that could impair our ability to compete in international markets and subject us to liability if we are not in full compliance with applicable laws.
    OFAC’s counter-terrorism and counter-narcotics trafficking sanctions programs and individuals or entities affiliated with governments currently subject to comprehensive U.S. sanctions or located in regions subject to comprehensive sanctions. A small number of these parties made payments to us in connection with their use of our products. The voluntary self-disclosure, which we may supplement as appropriate, remains under an ongoing review by OFAC.
  73. 수정Our failure to protect our intellectual property rights and proprietary information could diminish our brand and other intangible assets.
    We rely and expect to continue to rely on a combination of patent, patent licenses, trade secret, domain name protection, trademarks, copyrights, and confidentiality and license agreements with our employees, consultants, and third parties in order to protect our intellectual property rights and proprietary information. As of December 31, 2024, 2025, we had 334 381 issued patents and 72 58 pending patent applications in the United States and abroad. However, third parties may knowingly or unknowingly infringe our intellectual property rights. Third parties may challenge our intellectual property rights, pending and future patent, trademark, and copyright applications may not be approved, and we may not be able to prevent infringement, misappropriation, or violations of our intellectual property rights without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes, and we provide access to these technologies and processes to certain of our vendors and partners, including JD Cloud with respect to the facilities included within our network in China. We must protect this proprietary information in order to realize commercial benefit from our investment.
  74. 수정Our failure to protect our intellectual property rights and proprietary information could diminish our brand and other intangible assets.
    In order to protect our proprietary technologies and processes, we rely in part on trade secret laws and confidentiality agreements with our employees, contractors, consultants, and third parties. These agreements may not effectively prevent disclosure of confidential information and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. Further, errors made by our employees or contractors in utilizing artificial intelligence AI or machine learning in our products or in the operation of our business could result in proprietary or other confidential information being exposed externally. In addition, others may independently discover our trade secrets or develop similar technologies and processes, in which case we would not be able to assert trade secret rights against them. Laws in certain jurisdictions may afford little or no trade secret protection, and any changes in, or unexpected interpretations of, the intellectual property laws in any country in which we operate may compromise our ability to enforce our intellectual property rights. We may not be effective in policing unauthorized use of our intellectual property rights, and even if we do detect violations, costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights, and any such litigation could be unsuccessful, lead to the invalidation of our proprietary rights, or lead to counterclaims by other parties against us. If the protection of our proprietary rights is inadequate to prevent use or appropriation by third parties, the value of our network and products, brand, and other intangible assets may be diminished and competitors may be able to more effectively replicate our network and products and their features. Any of these events could materially and adversely affect our business, results of operations, and financial condition.
  75. 수정We depend and rely upon software and technologies licensed from third parties to operate our business, and interruptions or the unavailability of these technologies may adversely affect our products, network, business, and results of operations.
    We rely on software, services, and other technology from third parties that we incorporate into, or integrate with, our network and products. We also rely on software, services, and other technology from third parties in order to operate critical functions of our business, including enterprise resource planning and customer relationship management services. If the software, services, or other technology we rely on become unavailable due to extended outages, the third-party provider disabling our access, expiration or termination of licenses, or because they are otherwise no longer available on commercially reasonable terms, our expenses could increase, we could incur reputational harm, and our ability to operate our network, provide our products, and our results of operations could be impaired until equivalent software, technology, or services are obtained or replacements are developed, all of which could adversely affect our business. For example, in June 2025, the underlying third party storage infrastructure used by our Workers KV service failed and caused us to experience a service outage for several hours that impacted a portion of our services and the customers using such services. While this incident did not have a material impact on our business, results of operations or financial condition, we cannot be certain that other similar incidents with third party vendors that we use will not have a material impact on our results of operations or financial condition.
  76. 수정The trading price of our Class A common stock may be volatile, and you could lose all or part of your investment.
    •general economic conditions and slow or negative growth of our markets, including inflation and related changes in monetary policy, rising changing interest rates, volatile energy prices, and other impacts of the conflicts in the Middle East and Ukraine, or other areas of geopolitical tension around the world, or any worsening or expansion of those conflicts or geopolitical tensions.
  77. 수정The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our initial public offering, and it may depress the trading price of our Class A common stock.
    In July 2017, FTSE Russell announced that it would cease to include most newly public companies utilizing dual or multi-class capital structures in its indices, including the Russell 1000, Russell 2000, and Russell 3000. Under the announced policies, our multi-class capital structure in some cases may make us ineligible for inclusion in some or all of these indices, and as a result, mutual funds, exchange-traded funds, and other investment vehicles that attempt to passively track these indices may not invest in our stock if we are not included. It is unclear what effect, if any, these policies have on the valuations of publicly traded companies excluded from the indices, but it is possible that they may depress these valuations compared to those of other similar companies that are included. Previously, Standard & Poor’s also excluded companies utilizing dual or multi-class capital structures from its indices, but reversed this policy in 2023, and companies with dual or multi-class capital structures have been eligible for inclusion on its indices since then. We cannot be sure that such policy, or the policies of other indices, will not change further and make us ineligible for inclusion on the S&P Composite 1500, or other indices, in the future.
  78. 수정We have broad discretion over the use of the net proceeds from our financing activities, and we may not use them effectively.
    We cannot specify with any certainty the particular uses of the net proceeds that we received from our prior financing activities, including from the issuances of the 2025 Notes and the 2026 Notes, and our management has broad discretion in the application of the net proceeds. The failure by our management to apply these proceeds effectively could adversely affect our business, results of operations, and financial condition. Pending their use, we may invest our proceeds in a manner that does not produce income or that loses value. Our investments may not yield a favorable return to our investors and may negatively impact the price of our Class A common stock.
  79. 수정Repaying and servicing our existing and future debt, including our Notes and our Revolving Credit Facility, may require a significant amount of cash, and we may not have sufficient cash flow from our business to pay our indebtedness.
    As of December 31, 2025, $1,293.8 million in aggregate principal amount of the 2026 Notes were outstanding and $2,000.0 million in aggregate principal amount of the 2030 Notes were outstanding. In addition, in May 2024, we entered into a senior secured credit agreement with a $400 million Revolving Credit Facility. Our ability to make scheduled payments of the principal of, or to refinance our indebtedness, including the 2026 Notes Notes, and any borrowings under our Revolving Credit Facility, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control. Our business may not generate cash flow from operations in the future sufficient to service our debt and make necessary capital expenditures. If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt, or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive. Our ability to refinance any future indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations. In addition, the credit agreement for our Revolving Credit Facility contains restrictive covenants that limit us, and any of our future debt agreements may contain restrictive covenants that may limit or prohibit us, in each case from adopting any of these alternatives. Our failure to comply with these covenants could result in an event of default which, if not cured or waived, could result in the acceleration of our debt.
  80. 수정We may not have the ability to raise the funds necessary for cash settlement upon conversion of the Notes or to repurchase the Notes for cash upon a fundamental change, and our future debt may contain limitations on our ability to pay cash upon conversion of the Notes or to repurchase the Notes.
    We may not have the ability to raise the funds necessary for cash settlement upon conversion of the 2026 Notes or to repurchase the 2026 Notes for cash upon a fundamental change, and our future debt may contain limitations on our ability to pay cash upon conversion of the 2026 Notes or to repurchase the 2026 Notes.
  81. 수정We may not have the ability to raise the funds necessary for cash settlement upon conversion of the Notes or to repurchase the Notes for cash upon a fundamental change, and our future debt may contain limitations on our ability to pay cash upon conversion of the Notes or to repurchase the Notes.
    Holders of the 2026 Notes have the right to require us to repurchase their 2026 Notes upon the occurrence of a fundamental change (which is defined in the 2026 Indenture) applicable indenture governing the applicable series of Notes) at a repurchase price equal to 100% of the principal amount of such 2026 Notes to be repurchased, plus accrued and unpaid interest, if any, to, but excluding, the applicable fundamental change repurchase date for such series of 2026 Notes. date. In addition, upon conversion of the 2026 Notes, unless we elect to deliver solely shares of our Class A common stock to settle such conversion (other than paying cash in lieu of delivering any fractional share), we will be required to make cash payments in respect of the 2026 Notes being converted. However, we may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of the 2026 Notes surrendered or 2026 Notes being converted. In addition, our ability to repurchase the 2026 Notes or to pay cash upon conversions of the 2026 such Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness. Our failure to repurchase the 2026 Notes at a time when the repurchase is required by the 2026 Indenture applicable indenture or to pay any cash payable on future conversions of the 2026 Notes as required by the 2026 Indenture applicable indenture would constitute a default. A default under the 2026 Indenture either indenture or the occurrence of a fundamental change under either series of the 2026 Notes could also lead to a default under agreements governing our future indebtedness. If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the 2026 Notes or make cash payments upon conversions thereof in accordance with the terms of the 2026 Indenture. applicable indenture. Any failure by us to repay the indebtedness and repurchase the 2026 Notes or make cash payments upon conversions thereof, in each case, when required to do so pursuant to the terms of the 2026 Indenture applicable indenture could harm our business, results of operations, and financial condition.
  82. 수정The conditional conversion feature of the Notes, when triggered, may adversely affect our financial condition and operating results.
    If the conditional conversion feature of either series of the 2026 Notes is triggered, holders of the 2026 applicable series of Notes are entitled to convert their 2026 Notes at any time during specified periods at their option. If one or more holders elect to convert their 2026 Notes, unless we elect to satisfy our conversion obligation by delivering solely shares of our Class A common stock (other than paying cash in lieu of delivering any fractional share), we would be required to settle a portion or all of our conversion obligation through the payment of cash, which could adversely affect our liquidity. In addition, we could be required under applicable accounting rules to reclassify all or a portion of the outstanding principal of the 2026 Notes as a current rather than long-term liability, which would result in a material reduction of our net working capital.
  83. 수정Transactions relating to the Notes may affect the value of our Class A common stock.
    Transactions relating to the 2026 Notes may affect the value of our Class A common stock.
  84. 수정Transactions relating to the Notes may affect the value of our Class A common stock.
    The conversion of some or all of the 2026 Notes would dilute the ownership interests of our existing stockholders to the extent we satisfy our conversion obligation by delivering shares of our Class A common stock upon any conversion of the 2026 Notes. The 2026 Notes of either series may become convertible at the option of their holders under certain circumstances set forth in the 2026 applicable Indenture. If holders of the 2026 Notes elect to convert their 2026 Notes, we may settle our conversion obligation by delivering to them a significant number of shares of our Class A common stock, which would cause dilution to our existing stockholders. In addition, from time to time, we may enter into certain exchange transactions with respect to the 2026 Notes which may also cause dilution to our existing stockholders. For example, in August 2021, we entered into privately-negotiated exchange agreements with certain holders of the our previously outstanding 0.75% Convertible Senior Notes due 2025 Notes (the 2025 Notes) for the exchange of approximately $400.7 million in cash and approximately 7.6 million shares of our Class A common stock for $400.0 million in aggregate principal amount of the 2025 Notes. In addition, during the year ended December 31, 2023, we settled conversions of approximately $35.4 million aggregate principal amount of the 2025 Notes for approximately 0.5 million shares of our Class A common stock. These conversions were exercised by the holders of the 2025 Notes in connection with our issuance of a redemption notice.
  85. 수정Transactions relating to the Notes may affect the value of our Class A common stock.
    In connection with the pricing of the 2026 both series of Notes, we entered into privately negotiated capped call transactions with the applicable option counterparties. The capped call transactions are expected generally to reduce the potential dilution upon conversion of the 2026 Notes of the applicable series and/or offset any cash payments we are required to make in excess of the principal amount of such converted 2026 Notes, as the case may be, with such reduction and/or offset subject to a cap.
  86. 수정Transactions relating to the Notes may affect the value of our Class A common stock.
    In connection with establishing their initial hedges of the capped call transactions, the applicable option counterparties or their respective affiliates entered into various derivative transactions with respect to our Class A common stock and/or purchased shares of our Class A common stock concurrently with or shortly after the pricing of the 2026 applicable series of Notes. From time to time, the option counterparties or their respective affiliates may modify their hedge positions by entering into or unwinding various derivatives with respect to our Class A common stock and/or purchasing or selling our Class A common stock or other securities of ours in secondary market transactions prior to the maturity of the 2026 Notes (and are likely to do so following any early conversion, repurchase, or redemption of the 2026 Notes, to the extent we exercise the relevant election under unwind a corresponding portion of the applicable capped call transactions). transactions, or if we otherwise unwind all or a portion of the capped call transactions, and during the applicable final observation period for the conversion of the Notes). This activity could also cause a decrease and/or increased volatility in the market price of our Class A common stock.
  87. 수정We are subject to counterparty risk with respect to the capped call transactions.
    The option counterparties are financial institutions, and we will be subject to the risk that any or all of them might default under the capped call transactions. Our exposure to the credit risk of the option counterparties will not be secured by any collateral. Past macroeconomic conditions have resulted in the actual or perceived failure or financial difficulties of many financial institutions, including the failures of Silicon Valley Bank and Signature Bank, and the UBS takeover of Credit Suisse. institutions. If an option counterparty becomes subject to insolvency proceedings, we will become an unsecured creditor in those proceedings with a claim equal to our exposure at that time under the capped call transactions with such option counterparty. Our exposure will depend on many factors but, generally, an increase in our exposure will be correlated to an increase in the market price and in the volatility of our Class A common stock. In addition, upon a default by an option counterparty, we may suffer adverse tax consequences and more dilution than we currently anticipate with respect to our Class A common stock. We can provide no assurance as to the financial stability or viability of the option counterparties.
  88. 삭제Adverse economic conditions, including reduced spending on products and solutions for network security, performance, and reliability, may adversely impact our revenue and profitability.
    The United States, Europe, and the United Kingdom have recently experienced historically high levels of inflation. Although inflation levels have decreased from such high levels in the United States, the United Kingdom, and Eurozone, the U.S. Federal Reserve, the European Central Bank, and the Bank of England have in the past raised, and may in the future raise or maintain, high interest rates and may implement fiscal policy interventions. Even if these interventions lower inflation, they may also reduce economic growth rates, create a recession, and result in other similar or unexpected effects.
  89. 문장 삭제If we do not effectively attract, train, and retain our sales force to be able to sell our existing and new products and product features, we may be unable to add new contracted customers, or increase sales to our existing customers and our business would be adversely affected.
    Changes in the senior leadership of our sales team, such as the departure of our former President of Revenue and the hiring of our new President of Revenue in February 2024 and subsequent changes to a number of the other senior leadership positions within our sales team, could negatively impact our ability to retain current members of our sales team.
  90. 문장 삭제Our ability to maintain customer satisfaction depends in part on the quality of our customer support. Failure to maintain high-quality customer support could have an adverse effect on our business, results of operation, and financial condition.
    In addition, we provide professional services to assist some of our large customers in their migration from existing vendors and otherwise with the configuration and use of our products. We do not have significant experience in providing professional services or determining the pricing for such services, and our failure to provide such services effectively or at pricing that appropriately reflects our costs of providing such services could negatively impact our customer satisfaction and retention and our results of operations.
  91. 삭제Our business depends, in part, on sales to the United States and foreign government organizations, which are subject to a number of challenges and risks.
    •governments may require us to partner with companies based in the governments’ jurisdictions in order for us to sell any of our products to those governments, which could result in a loss of revenue we otherwise would receive for such sales;
  92. 문장 삭제We may need additional capital, and we cannot be certain that additional financing will be available on favorable terms, or at all.
    For example, we received substantial proceeds from the issuance and sale of our Class A common stock in our initial public offering and in the issuances and sales of our 0.75% Convertible Senior Notes due 2025 (the 2025 Notes) and 0% Convertible Senior Notes due 2026 (the 2026 Notes).
  93. 문장 삭제Problems with our internal systems, networks, or data, including actual or perceived breaches or failures, could cause our network or products to be perceived as insecure, underperforming, or unreliable, our customers to lose trust in our network and products, our reputation to be damaged, and our financial results to be negatively impacted.
    For example, hostile third parties, including nation-states, may seek to bribe, extort, or otherwise manipulate our employees or contractors to compromise our network and products.
  94. 문장 삭제We rely on a limited number of suppliers for certain components of the equipment we use to operate our network and any disruption in the availability, or price, of these components could delay our ability to expand or increase the capacity of our global network, replace defective equipment, or identify alternative supply sources favorable to us.
    For example, during 2021 and continuing through the first quarter of 2022, a global shortage of CPUs, RAM, SSDs, and other electronics resulted in supply constraints for a number of electronics firms, including manufacturers of servers. This global shortage disrupted and increased the cost, and other shortages or similar supply constraints in the future may disrupt or increase the cost, of some of our expected purchases of network equipment and servers.
  95. 문장 삭제In connection with our Web3 suite of products and our potential future participation in various Web3 protocol governance activities, we expect to hold certain types of cryptocurrency and similar types of digital assets that may be subject to unique regulatory risks, volatile market prices, and risks of loss, which could harm our business and reputation.
    The prevalence of such assets is a relatively recent trend, and their long-term adoption by investors, consumers, and businesses remains uncertain.
  96. 문장 삭제Our policies regarding user privacy could cause us to experience adverse business and reputational consequences with customers, employees, suppliers, government entities, and other third parties.
    We also may face complaints from individuals who assert we have provided their information improperly to law enforcement or in response to third-party abuse complaints, despite policies we have in place to protect that information.
  97. 삭제Failure to comply with laws and regulations applicable to our business could subject us to fines and penalties and could also cause us to lose customers or otherwise harm our business.
    •termination of contracts;
  98. 문장 삭제Our actual or perceived failure to comply with privacy, data protection, information security, and other applicable laws, regulations, and obligations could harm our business.
    The shift to the new Trump administration, however, may result in uncertainty around the implementation of such regulations. We may incur substantial costs and an investment of resources to further understand the impact these new regulations will have on our and our customers’ business.
  99. 문장 삭제We may have exposure to greater than anticipated income tax liabilities in the United States and in foreign jurisdictions, requiring us to exercise judgment in determining the applicability of certain tax laws, and this could subject us to potentially adverse tax consequences and adversely impact our results of operations.
    For example, the United States enacted the Inflation Reduction Act in August 2022, which, among other provisions, implements a 15% corporate alternative minimum tax on adjusted financial statement income, effective in taxable years beginning after December 31, 2022, and a 1% excise tax on share repurchases, effective for repurchases made after December 31, 2022, which could include capped call transactions such as those we entered into in 2020 and 2021.
  100. 문장 삭제Our business could be adversely impacted by the decision of foreign governments, Internet service providers, or others, to block transmission from Cloudflare IP addresses or domains in order to enforce certain Internet content blocking efforts.
    If these challenges become too difficult for those organizations to overcome, they could make the decision to block content in an overbroad manner or block completely websites and other Internet properties that are using our network and/or transmitted using known Cloudflare IP addresses.
  101. 문장 삭제The dual class structure of our common stock has the effect of concentrating voting control with those stockholders who held our capital stock prior to the completion of our initial public offering, and it may depress the trading price of our Class A common stock.
    Previously, Standard & Poor’s also excluded companies utilizing dual or multi-class capital structures from its indices, including the S&P 500, the S&P MidCap 400, and the S&P SmallCap 600, which S&P indices together make up the S&P Composite 1500. However, in April 2023, it reversed this policy and announced that companies with dual or multi-class capital structures will again be eligible for inclusion on its indices.
  102. 문장 삭제Repaying and servicing our existing and future debt, including our 2026 Notes and our Revolving Credit Facility, may require a significant amount of cash, and we may not have sufficient cash flow from our business to pay our indebtedness.
    In August 2021, we issued $1,293.8 million in aggregate principal amount of the 2026 Notes and, as of December 31, 2024, the remaining aggregate principal amount was $1,293.8 million.