이번 보고서
2025.09 분기보고서
10-Q · 기간 말 2025. 9. 30. · 제출 2025. 10. 30.
비교 기준
2025.06 분기보고서
10-Q · 기간 말 2025. 6. 30.
0
새 리스크 항목
2
신규 문단
23
수정 문단
5
삭제
+1%
분량 변화
AI 한국어 요약
이 보고서의 한국어 요약은 준비 중입니다. 아래 원문 비교를 먼저 확인하세요.
원문 비교
- •substantial changes to our termination of contracts;
- Laws and regulations regarding the development, use, and deployment of AI technologies in the EU, U.S., and elsewhere are increasing in complexity. For example, the EU AI Act has compliance deadlines throughout 2025 and into 2026, and U.S. states such as Texas and Colorado are enacting laws governing the development, use, and deployment of AI. Numerous jurisdictions have proposed legislation to regulate the development, use, and deployment of AI, in whole or in part. As we continue to see efforts to regulate this new technology, we have incurred and will continue to incur costs to address the impact, if any, of these laws and regulations regulating AI on our products and practices.
- We have incurred net losses in all periods since we began operations and we may not achieve or maintain profitability in the future. We experienced net losses of
$50.4$1.3 million and$15.1$15.3 million for the three months endedJuneSeptember 30, 2025 and 2024, respectively, and$88.9$90.2 million and$50.6$66.0 million for thesixnine months endedJuneSeptember 30, 2025 and 2024, respectively, and as ofJuneSeptember 30, 2025, we had an accumulated deficit of$1,191.5$1,192.8 million. Because the markets for our products are rapidly evolving, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase over the next several years as we continue to hire additional personnel, expand our operations and infrastructure both domestically and internationally, and continue to develop our products. If we fail to increase our revenue to offset the increases in our operating expenses, we may not achieve or sustain profitability in the future. - We have experienced rapid revenue growth in recent periods, with revenue of
$512.3$562.0 million and$401.0$430.1 million for the three months endedJuneSeptember 30, 2025 and 2024, respectively, and$991.4$1,553.4 million and$779.6$1,209.7 million for thesixnine months endedJuneSeptember 30, 2025 and 2024, respectively. However, our rate of revenue growth has slowed in recent periods and may continue to slow in future periods. You should not consider our historical growth in revenue as indicative of our future performance. In particular, our revenue growth rates may continue to slow or decline in the future and may not be sufficient to achieve and sustain profitability, as we also expect our costs to increase in future periods. We believe that historical comparisons of our revenue may not be meaningful and should not be relied upon as an indication of future performance. Accordingly, you should not rely on our revenue and other growth for any prior quarter or year as an indication of our future revenue or revenue growth. - A substantial majority of our revenue in the
sixnine months endedJuneSeptember 30, 2025 was from contracted customers that were acquired through our inside and field sales teams, and we expect our sales teams to continue generating the majority of our revenue for the foreseeable future. As a result, our financial condition and results of operations are dependent to a significant degree on our ability to effectively attract, train, and retain qualified sales personnel, including senior sales leaders, and the ability of our dedicated sales personnel to acquire new contracted customers and expand our relationships with our existing contracted customers. Our sales representatives typically engage in direct interaction with our prospective contracted customers. Increasing our customer base and achieving broader market acceptance of our network and products will depend, to a significant extent, on our ability to expand and further invest in our sales and marketing operations and activities. There is significant competition for sales personnel with the advanced sales skills and technical knowledge we need. We believe that selling subscriptions to our products requires particularly talented sales personnel that understand a very wide array of highly technical topics, including significant portions of global networking, Internet, enterprise and identity security, and application development for both on-premises and cloud requirements. Changes in the senior leadership of our sales team could negatively impact our ability to retain current members of our sales team or attract new talent. In addition, as we continue to develop and sell newer types of products and product features, such as our suite of Zero Trust and network services solutions and our Cloudflare Developer Platform products, we will need our sales personnel to be proficient in selling both these newer products and features and our overall broader suite of products to our existing and potential customers. If we are unable to effectively attract, train, and retain qualified sales personnel, particularly as our lines of products and product features expand, our business, results of operations, and financial condition will be adversely impacted. - We have experienced, and may in the future experience, periods of rapid growth. For example, our headcount grew from
3,9024,160 employees as ofJuneSeptember 30, 2024 to4,6164,838 employees as ofJuneSeptember 30, 2025. We also have expanded the locations where we have employees to a number of new locations around the world during the past several years. The number of customers, users, and requests on our network also has increased rapidly in recent years. While we expect to continue to expand our operations, network, and products significantly in the future, both domestically and internationally, our growth may not be sustainable. Our growth has placed, and future growth will continue to place, a significant strain on our management and our administrative, operational, and financial infrastructure. Our success will depend in part on our ability to manage this growth effectively, which will require that we continue to improve our administrative, operational, financial, and management systems and controls by, among other things: - Our ability to attract new customers and retain, and increase, revenue from existing customers will depend in significant part on our ability to anticipate and respond effectively to these forces on a timely basis and continue to introduce enhancements to our network and existing products and develop new products that have the features, and that function with the security, performance, and reliability capabilities, demanded by our customers, especially our large customers. If new technologies or advancements in technologies emerge that deliver competitive products and services at lower prices, more efficiently, more conveniently, more securely or reliably, or are higher performing, these technologies or advancements could render our network and existing products less attractive to our current and prospective future customers, or obsolete. For example,
artificial intelligenceAI and machine learning may change the way our industry identifies and responds to cyber threats, and businesses that are slow to adopt or fail to adopt these new technologies may face a competitive disadvantage. The development of novel attacks or exploits by criminal or malicious elements or hostile state actors also could render our network and existing products less effective or obsolete. If we are unable to develop new products and enhance our existing products so that they have the features and capabilities required by existing and potential new customers, especially large customers, our business, results of operations, and financial condition will be materially and adversely affected. - We face security threats from malicious third parties that could obtain unauthorized access to our internal systems, networks, and data, including the equipment at our network and core co-location facilities. It is virtually impossible for us to entirely mitigate the risk of these security threats and the security, performance, and reliability of our network and products has been in the past, and may be in the future, disrupted by third parties, including
nation-states,nation- states, competitors, hackers, disgruntled employees, former employees, or contractors. For example, in November 2023, we detected that a likely nation-state threat actor had gained unauthorized access to one of our internal systems. While we immediately began investigating the intrusion and believe we cut off the threat actor’s access prior to significant impact on our customer data or systems, we expect we will continue to be subject to similar threats of unauthorized access in the future and we may not be as successful in quickly identifying such intrusions and mitigating the impacts of such intrusions. We also face the possibility of security threats from other sources, such as employee or contractor errors (such as errors in utilizingartificial intelligenceAI or machine learning in our products or in the operation of our business) or malfeasance. For example, hostile third parties, including nation-states and their agents, in the past have sought direct or indirect employment at Cloudflare, or attempted to bribe, extort, or otherwise manipulate our employees or contractors to compromise our network and products and in the future other hostile third parties may take similar actions.In addition, asAs our business grows and we employ more employees and engage more contractors in more countries around the world, our ability to supervise the actions of our employees and contractors will decrease and the risk of an employee or contractor error or act of malfeasance will increase. These security threats from third parties are also likely to increase as the numbers, sizes, and types of customers using our network and products increases, particularly our customers that are involved in particularly sensitive industries or activities, such as banking and finance companies and governmental entities or in relation to elections in the United States or elsewhere. Additionally,artificial intelligenceAI and machine learning may increase cybersecurity risks we face through, for example, being used to increase the prevalence or intensity of cyber attacks. - While we have implemented security measures internally and have integrated security measures into our network and products, these measures have not always functioned as expected and have not always detected or prevented all unauthorized activity, prevented all security breaches or incidents, mitigated all security breaches or incidents, or protected against all attacks or incidents and these types of security failures could occur again in the future. For example, we have experienced multiple social engineering attacks where third parties have attempted, and in limited cases succeeded, in breaching our network perimeter security. While these attacks did not effectively get beyond our network perimeter security and we have not suffered any material consequences as a result of these breaches, we cannot be certain that future breaches will be avoided or, if future breaches are successful, that we will not experience material detrimental impacts, particularly if those breaches involve third party access to decrypted or other sensitive data. In addition, there is risk that the vendors we use may be attacked and the controls we have in place are bypassed and our data accessed as a result. For example, one of the IT tools our employees used internally until the first quarter of 2023 was the subject of a large security incident in December 2022, which resulted in unauthorized parties stealing large amounts of the IT tools' customers’ data, including our data. We are not aware of any of our systems having been compromised as a result of this security incident due to additional required authorization and authentication events we have in place, particularly when accessing sensitive systems and resources, and we have since changed to using a new IT tool internally. In addition, in March 2022 and October 2023, breaches of the systems of our former identity access management vendor resulted in attacks on our systems. While we quickly discovered these resulting attacks on our systems and believed we had fully contained their impact on our systems and data, the October 2023 breach of our systems contributed to the November 2023 intrusion of our systems by a likely nation-state threat actor. Further, in August 2025, a breach of a third-party chat agent integrated with our customer relationship management system allowed threat actors to gain unauthorized access to some of our customer contact and support information. While none of these incidents had a material impact on our business, results of operations or financial condition, we cannot be certain that compromises of our systems will not happen in the future as a result of these incidents or other similar incidents with third party vendors that we use to help secure our internal systems and that such incidents will not have a material impact on our results of operations or financial condition. Such incidents, whether or not successful, could result in our incurring significant costs related to, among other things, changes to our internal systems, remediating or replacing equipment within our global network, implementing additional threat protection measures, making modifications to our products and our global network, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with credits under our agreements with them or other incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Because these threats are constantly evolving, we believe successfully defending against them or implementing adequate preventative measures will become increasingly challenging.
- As of
JuneSeptember 30, 2025, we hosted our global network and served our customers from co-location and Internet Service Provider (ISP) partner facilities located in more than 330 cities and over 125 countries worldwide. In addition to these global facilities, much of the infrastructure for our global network and for our business and operations is maintained through a core co-location facility located in the greater Portland, Oregon area, a second core co-location facility located in Amsterdam that provides certain redundancy to the U.S. core facility, and through a limited number of other U.S. co-location facilities that provide limited subsets of our network support. While we have electronic and, to a lesser extent, physical access to the components and infrastructure of our network andco-locationco- location facilities that are hosted by third parties — including ISP-partner facilities — we do not control the operation of these third-party facilities. Consequently, we may be subject to service disruptions as well as failures to provide adequate support for reasons that are outside of our direct control. All of our co-location and ISP-partner facilities and network infrastructure are vulnerable to damage or interruption from a variety of sources including earthquakes; weather events; floods; fires; power loss; system failures; computer viruses; physical or electronic break-ins; human error; malfeasance; or interference, including by disgruntled employees, former employees, or contractors; military conflicts; terrorism; and other catastrophic events. For example, in November 2023, our control plane and analytics services experienced an outage triggered by a power failure at one of our core data centers in the greater Portland, Oregon area, which impacted certain customers' access to some of our products and services for several days and the loss of certain customer logs. In March 2024, a subsequent power failure occurred at the same core data center in the greater Portland, Oregon area, which impacted certain customers’ access to some of our products for minutes and to our analytics services for several hours. In addition, we have experienced a route leak and a limited number of network outages involving our core and network co-location facilities over the past five years due to a variety of causes. Co-location facilities housing our network infrastructure may also be subject to local governmental or other administrative actions, changes to legal or permitting requirements, labor disputes, and litigation to stop, limit, or delay operations. Despite precautions taken at these facilities, such as disaster recovery and business continuity arrangements, the occurrence of a natural disaster or an act of war or terrorism, a decision to close the co-location facilities without adequate notice, interference with, or sabotage of, our equipment at these facilities, or other unanticipated problems at these facilities could result in interruptions or delays in the availability of our network and products, impede our ability to scale our operations, or have other adverse impacts upon our business, results of operations, and financial condition. In addition, errors or defects in our customers’ software can result in unexpected and unintentional upward spikes in their usage of our products and network, and those spikes can cause strains on, and adversely affect the availability and functioning of, our co-location facilities and our network. - We rely on a limited number of suppliers for several components of the equipment we use to operate our network and provide products to our customers. Our reliance on these suppliers exposes us to risks, including reduced control over production costs, increased prices due to tariffs (such as the tariffs the United States and other countries recently implemented or threatened to implement), increased prices and constraints based on the then-current
availability,availability with an increased demand, terms, and pricing of these components. For example, we generally rely on a limited number of suppliers for the servers that we use in our network and we ordinarily purchase these components on a purchase-order basis, without any long-term contracts guaranteeing supply. We may also be subject to price increases from these suppliers should they be negatively impacted by tariffs or other regulations, such as the tariffs the United States and other countries recently implemented or threatened to implement. While the network equipment and servers we purchase generally are commodity equipment and we believe an alternative supply source or location for servers on substantially similar terms could be identified quickly, our business could be adversely affected until those efforts are completed. In addition, the technology equipment industry has experienced component shortages and delivery delays in the past, and we may experience shortages or delays, including as a result of natural disasters, increased demand in the industry, military conflicts and geopolitical tensions, labor strikes, or other related conditions, or our suppliers lacking sufficient rights to supply the components in all jurisdictions in which we have co-location facilities that support our global network. For example, during 2021 and continuing through the first quarter of 2022, a global shortage of CPUs, RAM, SSDs, and other electronics resulted in supply constraints for a number of electronics firms, including manufacturers of servers. This global shortage disrupted and increased the cost, and other shortages or similar supply constraints in the future may disrupt or increase the cost, of some of our expected purchases of network equipment and servers. If our supply of certain components is disrupted or delayed or becomes more expensive, there can be no assurance that additional supplies or components can serve as adequate replacements for the existing components or that supplies will be available on terms that are favorable to us, if at all. Any disruption or delay or additional costs in the supply of our hardware components may delay the opening of new co-location facilities, limit capacity expansion or replacement of defective or obsolete equipment at existing co-location facilities, cause other constraints on our operations that could damage our customer relationships, or otherwise adversely impact our business, financial condition, or results of operations. - Our business is subject to regulation by various federal, state, local, and non-U.S. governmental agencies, including agencies responsible for monitoring and enforcing compliance with various legal obligations, such as privacy, data protection, and information security laws and regulations, intellectual property laws, telecommunications laws and regulations, employment and labor laws, workplace safety, environmental laws, consumer protection laws, anti-bribery laws, governmental trade sanctions laws, import and export controls, anti-corruption and anti-bribery laws, federal securities laws, and tax laws and regulations. In addition, emerging tools and technologies we may utilize in providing our products and solutions, like
artificial intelligenceAI and machine learning, have, and mayalsoin the future, become subject to regulation under new laws or new applications of existing laws. For example, the EU AI Act has gone into effect and several U.S. states are also enacting laws governing the use of AI. In certain jurisdictions, some or all of these regulatory requirements may be more stringent than in the United States. - In addition, the United
StatesStates, the EU, and othercountriesjurisdictions are considering expanding or have expanded regulatory requirements for services such as ours, with potential requirements such as collection and verification of customer data, limitations on the use of non-personal data, limitations on the transfer of certain types of data to named countries or entities, data switching obligations, requirements to block online content in response to regulatory notices or judicial orders, cybersecurity incident reporting obligations, expanded registration requirements, or requirements to have personnel in the country. The rapid expansion of proposed regulations, as well as possible conflicting requirements, may make it challenging for us to identify and comply with all new global regulations that may apply to our services. For example, the new EU Data Act imposes service switching obligations designed to remove commercial and technical obstacles for customers by phasing out switching charges and requiring us to assist with data portability. It also imposes requirements related to the cross-border data transfer of non-personal data. We may be required to provide more flexible termination rights to customers and incur substantial costs to comply with the EU Data Act, as well as become subject to substantial fines or civil litigation for noncompliance. - This is especially true regarding the cross-border transfer of personal data. For example, in July 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework, which generally allows the free flow of EU personal data to the United States for participating entities. While this framework currently serves as a means for cloud service providers like our company to freely transfer EU personal data to the United States, it may be subject to future legal challenges, suspension, amendment, repeal, or limitations to its scope by the European Commission. In addition, some customers and vendors may be unwilling to rely on this framework due to these and other uncertainties, including perceived uncertainty about the U.S. stance on the existing legal framework. In addition, in January 2023, the European Data Protection Board issued its 2022 Coordinated Enforcement Action on the use of cloud-based services by the public sector, in which it expressed concerns that EU public sector entities may not be able to use U.S.-based cloud service providers consistently with GDPR due to their concerns about the ability of U.S. government agencies to access EU personal data. Following that, the European Data Protection Supervisor found in March 2024 that the European Commission’s use of Microsoft 365 violated the GDPR in part due to EU personal data being transferred to countries that had not been determined by the EU to provide adequate level of protection suggests that EU regulators are continuing to subject data transfers outside the EU to careful scrutiny.
- In addition, the United States has enacted the Protecting Americans' Data from Foreign Adversaries Act (PADFA), and the U.S. Department of Justice
recentlyreleased a final rule,which becameeffective on April 8, 2025, implementing President Biden’s February 2024 Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern”, both of which restrict the transfer of certain types of data to named jurisdictions or covered entities. We have incurred additional costs andhaveinvested resources in addressing these new regulations, and as we continue to monitor the impact these new regulations have on our and our customers’businessbusiness, we may incur additional costs andimplementmay need to invest additional resources in order to make changes to our practices as may be required under these regulations. - Changes in accounting principles, changes in global tax laws, regulations or rates, or changes in taxing jurisdictions’ administrative interpretations, decisions, policies, and positions could also impact our provision for income taxes. For example, the United States
passedsigned into law the One Big Beautiful Bill Act(OBBBA)on July 4, 2025, which permanently extends many of the expiring provisions from the Tax Cuts and Jobs Act(TCJA)and modifies a number of international provisions. Additionally, the Organization for Economic Cooperation and Development (OECD) published model rules within the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting (the Inclusive Framework) to address the challenges arising from the digitalization of the global economy. The Inclusive Framework includes provisions related to the taxation of the digital economy and the establishment of a 15% global minimum tax under Pillar Two. A number of foreign countries have enacted, or intend to enact, legislation adopting parts of the Inclusive Framework. Any of the foregoing changes, if and to the extent implemented, could have an adverse impact on our results of operations, cash flows, and financial condition. - Historically, we have derived a significant portion of our revenue from outside the United States. We derived 50% and 50% of our revenue from our international customers for the three months ended September 30, 2025 and 2024, respectively, and 51% and 49% of our revenue from our international customers for the nine months ended September 30, 2025 and 2024, respectively. We are continuing to adapt to and develop strategies to address international markets and our growth strategy includes expansion into geographies around the world, but there is no guarantee that such efforts will be successful. In addition, our global network includes co-location facilities located in more than 330 cities and over 125 countries worldwide as of
JuneSeptember 30, 2025. We expect that our international sales and network activities will continue to grow in the future, as we continue to pursue opportunities in international markets and further grow our network around the world. These international operations will require significant management attention and financial resources and are subject to substantial risks, including: - Substantially all of our sales contracts are denominated in U.S. dollars and, therefore, substantially all of our revenue is not subject to foreign currency risk. However, a strengthening of the U.S. dollar
has increased andmaycontinue toincrease the real cost of our products to our customers outside of the United States, which could reduce demand for our products or cause us to discount our products, which could adversely affect our financial condition and results of operations. - Our business activities are subject to various economic and trade sanctions regulations administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) and U.S. export control and similar foreign laws and regulations, including the U.S. Department of Commerce’s Export Administration Regulations (EAR). We incorporate encryption technology into certain of our products, and the encryption products and the underlying technology may be exported outside the United States only with the required export authorizations, including by license, a license exception, or other appropriate government authorizations, including the filing of classification requests or self-classification reports. Further, the U.S. economic sanctions laws and export control laws include restrictions or prohibitions on the sale or supply of most products and services to U.S. embargoed or sanctioned countries, governments, persons, and entities. On September 29, 2025, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) released an interim final rule that expands export control restrictions and licensing requirements under the EAR Entity List and Military End-User List to foreign entities that are 50% or more owned by one or more listed parties, which BIS has labeled the “Affiliates rule.” The Affiliates rule significantly raises the bar for compliance with EAR by imposing an affirmative responsibility to know the ownership of the foreign companies that are parties to any transactions. Even though we take precautions and have implemented policies and practices to assist in compliance, there is a risk that we may not be in full compliance with these laws.
- In 2019, we learned that we may have failed to comply with certain U.S. export-related filing and reporting requirements and may have submitted incorrect information to the U.S. government in connection with certain hardware exports. Upon learning of these potential violations and associated export control requirements, we promptly initiated a voluntary internal review and are taking remedial measures to prevent similar export control anomalies from occurring in the future. In May 2019, we submitted an initial voluntary self-disclosure to
the Bureau of Industry and SecurityBIS regarding potential violations of EAR and a voluntary self-disclosure to the Census Bureau regarding potential violations of the Foreign Trade Regulations. In July 2019, we filed the full and complete voluntary self-disclosures. The voluntary self-disclosure to the Census Bureau was completed with no penalties in November 2019. The voluntary self-disclosure tothe Bureau of Industry and SecurityBIS was completed with no penalties in June 2020. - We rely and expect to continue to rely on a combination of patent, patent licenses, trade secret, domain name protection, trademarks, copyrights, and confidentiality and license agreements with our employees, consultants, and third parties in order to protect our intellectual property rights and proprietary information. As of
JuneSeptember 30, 2025, we had354368 issued patents and4555 pending patent applications in the United States and abroad. However, third parties may knowingly or unknowingly infringe our intellectual property rights. Third parties may challenge our intellectual property rights, pending and future patent, trademark, and copyright applications may not be approved, and we may not be able to prevent infringement, misappropriation, or violations of our intellectual property rights without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes, and we provide access to these technologies and processes to certain of our vendors and partners, including JD Cloud with respect to the facilities included withinour network inChina. We must protect this proprietary information in order to realize commercial benefit from our investment. - In order to protect our proprietary technologies and processes, we rely in part on trade secret laws and confidentiality agreements with our employees, contractors, consultants, and third parties. These agreements may not effectively prevent disclosure of confidential information and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. Further, errors made by our employees or contractors in utilizing
artificial intelligenceAI or machine learning in our products or in the operation of our business could result in proprietary or other confidential information being exposed externally. In addition, others may independently discover our trade secrets or develop similar technologies and processes, in which case we would not be able to assert trade secret rights against them. Laws in certain jurisdictions may afford little or no trade secret protection, and any changes in, or unexpected interpretations of, the intellectual property laws in any country in which we operate may compromise our ability to enforce our intellectual property rights. We may not be effective in policing unauthorized use of our intellectual property rights, and even if we do detect violations, costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights, and any such litigation could be unsuccessful, lead to the invalidation of our proprietary rights, or lead to counterclaims by other parties against us. If the protection of our proprietary rights is inadequate to prevent use or appropriation by third parties, the value of our network and products, brand, and other intangible assets may be diminished and competitors may be able to more effectively replicate our network and products and their features. Any of these events could materially and adversely affect our business, results of operations, and financial condition. - Our Class B common stock has 10 votes per share and our Class A common stock has one vote per share. As of
JuneSeptember 30, 2025, our directors, executive officers, and holders of more than 5% of our common stock, and their respective affiliates, held in the aggregate72.1%72.8% of the voting power of our capital stock, with our co-founders together holding approximately51.9%51.6% of the voting power of our capital stock. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively continue to control a majority of the combined voting power of our common stock and therefore are able to control all matters submitted to our stockholders for approval. This concentrated control will limit or preclude the ability of holders of Class A common stock to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that you may feel are in your best interest as one of our stockholders. - As of
JuneSeptember 30, 2025, $1,293.8 million in aggregate principal amount of the 2026 Notes were outstanding and $2,000.0 million in aggregate principal amount of the 2030 Notes were outstanding. In addition, in May 2024, we entered into a senior secured credit agreement with a $400 million Revolving Credit Facility. Our ability to make scheduled payments of the principal of the Notes, and any borrowings under our Revolving Credit Facility, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control. Our business may not generate cash flow from operations in the future sufficient to service our debt and make necessary capital expenditures. If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt, or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive. Our ability to refinance any future indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations. In addition, the credit agreement for our Revolving Credit Facility contains restrictive covenants that limit us, and any of our future debt agreements may contain restrictive covenants that may limit or prohibit us, in each case from adopting any of these alternatives. Our failure to comply with these covenants could result in an event of default which, if not cured or waived, could result in the acceleration of our debt. - Holders of the Notes have the right to require us to repurchase their Notes upon the occurrence of a fundamental change (which is defined in the applicable Indenture governing the applicable series of
Notes (each, an Indenture))Notes) at a repurchase price equal to 100% of the principal amount of such Notes to be repurchased, plus accrued and unpaid interest, if any, to, but excluding, the fundamental change repurchase date for such series of Notes. In addition, upon conversion of the Notes, unless we elect to deliver solely shares of our Class A common stock to settle such conversion (other than paying cash in lieu of delivering any fractional share), we will be required to make cash payments in respect of the Notes being converted. However, we may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of the Notes surrendered or Notes being converted. In addition, our ability to repurchase the Notes or to pay cash upon conversions of the Notes may be limited by law, by regulatory authority or by agreements governing our future indebtedness. Our failure to repurchase the Notes at a time when the repurchase is required by the applicable Indenture or to pay any cash payable on future conversions of the Notes as required by the applicable Indenture would constitute a default. A default under either Indenture or the occurrence of a fundamental change under either series of the Notes could also lead to a default under agreements governing our future indebtedness. If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Notes or make cash payments upon conversions thereof in accordance with the terms of the Indentures. Any failure by us to repay the indebtedness and repurchase the Notes or make cash payments upon conversions thereof, in each case, when required to do so pursuant to the terms of the applicable Indenture could harm our business, results of operations, and financial condition. - For example, hostile third parties, including nation-states, may seek to bribe, extort, or otherwise manipulate our employees or contractors to compromise our network and products.
- •termination of contracts;
- However, in February 2025, President Trump signed an Executive Order directing the U.S. Attorney General to pause enforcement of the FCPA by the United States Department of Justice for 180 days. Despite this Executive Order, bribery remains illegal under the FCPA, the SEC’s FCPA enforcement continues, and anti-corruption enforcement by global regulators outside of the United States has strengthened in recent years. Additionally, the FCPA has a five-year statute of limitations, meaning violations committed during this pause could be prosecuted by a new administration.
- We are currently evaluating the full impact of the OBBBA on our operations.
- We derived 51% and 49% of our revenue from our international customers for the three months ended June 30, 2025 and 2024, respectively, and 51% and 48% of our revenue from our international customers for the six months ended June 30, 2025 and 2024, respectively.
- Our competitors provide both on-premises, appliance-based solutions, and cloud-based services that have functionality similar to our network and products. We expect competition to increase as other established and emerging companies and start-ups enter the markets for products and solutions for security, performance, and reliability, in particular with respect to cloud-based solutions, as customer requirements evolve and as new products, services, and technologies, including those that leverage artificial intelligence (AI) and machine learning, are introduced. If we are unable to anticipate or effectively react to these competitive challenges, our competitive position could weaken, and we could experience a decline in revenue or our growth rate that could materially and adversely affect our business and results of operations.
- Additionally, even in the absence of malicious actions, our network and products may experience errors, failures, vulnerabilities, or bugs that cause our products not to perform as intended and the likelihood of these problems may increase as we continue to expand the number and complexity of our products and related features, through
artificial intelligenceAI or otherwise, that we offer to our customers through our global network. For example, from time to time we are subject to “route leaks” that involve the accidental or, less commonly, illegitimate advertisement of prefixes, or blocks of IP addresses, which propagate across networks such as ours and can lead to incorrect routing of traffic across our network, taking traffic offline, or in extreme cases, potential interception of customers’ traffic by attackers. For example, in June 2019, a route leak spread by a major telecommunications services provider caused significant disruption to our traffic and that of many other providers. Although events like this are outside our control, they could materially harm our reputation and diminish the confidence of our current and potential customers in our network and products. Deployment of our network and products into other computing environments may expose these errors, failures, vulnerabilities, or bugs in our products. In addition, any such errors, failures, vulnerabilities, or bugs may not be found until after they are deployed to our customers and may create the perception that our network and products are insecure, underperforming, or unreliable. For example, we have experienced a limited number of network outages over the past five years due to a variety of causes. - Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business.
- We also expect that there will continue to be new, and amendments to existing, laws, regulations, and industry standards concerning privacy, data protection, and information security proposed and enacted in the United States and various individual U.S. states. In the United States, various federal laws and regulations
alreadyapply to the collection, processing, disclosure and security of certain types of data, including the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Health Insurance Portability and Accountability Act of 1996, and the Gramm-Leach-Bliley Act. In addition, there are also a number of recently enacted or proposed U.S. federal and state privacy and data protection bills in Congress and state legislatures across the country. - More generally, as obligations regarding privacy, AI, data protection, and information security increase in complexity, we may be required to incur substantial costs to adapt our policies and business practices as well as engage in additional contractual negotiations. Any failure or perceived failure by us to comply with our privacy policies, our privacy-related obligations to customers or other third parties, applicable laws or regulations, or any of our other legal obligations relating to privacy, AI, data protection, or information security may result in governmental investigations or enforcement actions, litigation, claims, or public statements against us by consumer advocacy groups or others and could result in significant liability or cause our customers to lose trust in us, which could cause them to cease or reduce use of our products and otherwise have an adverse effect on our reputation and business. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the adoption and use of, and reduce the overall demand for, our products.
- •laws and regulations related to privacy, AI, data protection, security requirements, data localization, or content restriction that could pose risks to our intellectual property, increase the cost of doing business in a country, subject us to greater risks of claims and enforcement actions by regulators or others, subject us and our current and potential customers to burdensome requirements, increase the chance that current and potential customers may be unable to use our products or may be required to lessen or alter how they use our products, or create other disadvantages to our business or negative impacts on our results of operations;
- •general economic conditions and slow or negative growth of our markets, including inflation and related changes in monetary policy,
risingchanging interest rates, volatile energy prices, and other impacts of the conflicts in the Middle East and Ukraine, or other areas of geopolitical tension around the world, or any worsening or expansion of those conflicts or geopolitical tensions.