이번 보고서
2026.03 분기보고서
10-Q · 기간 말 2026. 3. 31. · 제출 2026. 5. 8.
비교 기준
2025 연차보고서
10-K · 기간 말 2025. 12. 31.
1
새 리스크 항목
8
신규 문단
31
수정 문단
8
삭제
+2%
분량 변화
AI 한국어 요약
한 줄 요약
Cloudflare는 "에이전틱 AI 우선" 운영 모델로의 전환과 2026년 5월 발표한 인력 감축을 새 리스크로 추가하고, AI가 고객 수요와 경쟁 구도를 흔들 수 있다는 경고를 여러 곳에서 강화했습니다. 반면 OFAC 제재 조사 종결과 중국 JD Cloud 계약 연장으로 기존 리스크 두 가지는 줄었습니다.
주목할 변화
- 신규AI 우선 운영 모델 전환과 인력 감축2026년 5월 인력 감축을 발표하고 AI·자동화 도구로 생산성을 유지하겠다고 밝혔지만, 기대한 효율이나 비용 절감이 기한 내에 나오지 않을 수 있다고 경고했습니다("may not achieve the benefits we expect in the time we expect, if at all"). 퇴직금 등 구조조정 비용, 직원 사기 저하와 노하우 유출, AI에 의존하는 법무·컴플라이언스 기능의 감독 공백("introduce additional oversight risks")도 함께 위험으로 적었습니다.
- 신규AI 챗봇에 따른 웹사이트 트래픽 감소소비자가 웹사이트를 방문하지 않고 AI 챗봇에서 정보를 얻으면서 트래픽이 줄고 있습니다. 그 결과 웹사이트 운영자가 사이트를 빠르고 안전하게 만드는 Cloudflare 제품을 덜 필요로 할 수 있다는 내용이 신규 고객 확보 리스크에 추가됐습니다("consumers' increasing reliance on AI chatbots for information in lieu of visiting websites").
- 강화AI가 고객사 사업에 타격을 줄 가능성기존 고객의 업그레이드·추가 구매를 좌우하는 요인에 AI가 새로 들어갔습니다. 특히 소프트웨어 기업 고객의 사업이 AI로 타격을 받으면 구매 여력이 줄 수 있다고 명시했습니다("adverse impact of AI on the businesses of our customers that are software companies"). 문구도 "확대"에서 "유지 및 확대(retain and expand)"로 바뀌었습니다.
- 강화AI 기업이 경쟁자로 부상잠재 경쟁자 목록에 AI 기업과 서버·프로세서·메모리 공급사가 추가됐습니다. 이들이 자사 AI 제품을 Cloudflare 인프라에서 쓰지 못하게 제한할 수 있다는 우려도 새로 들어갔습니다("limit or prevent use of such AI products on our infrastructure"). 단일 솔루션 경쟁사에는 엣지 컴퓨팅, 개발자 솔루션, AI 추론(AI inference) 업체가 추가됐습니다.
- 강화AI를 활용한 공격자의 취약점 탐지공격자가 AI로 Cloudflare와 고객 시스템의 취약점을 찾아내 악용할 수 있고, 이 때문에 보안 제품이 공격을 막지 못할 위험이 커질 수 있다는 문장이 내부 보안과 제품 보안 리스크 양쪽에 추가됐습니다("threat actors use AI to detect, and take advantage of, potential vulnerabilities").
- 완화OFAC 제재 위반 자진신고 건 종결2026년 4월 9일 OFAC로부터 No Action Letter를 받았습니다. OFAC가 벌금이나 추가 조치 없이 검토를 종결했다는 뜻입니다("closing its review without penalties or further action"). 이에 따라 "검토 진행 중"이라는 문장은 삭제됐습니다.
- 완화중국 JD Cloud 계약 연장2026년 3월 만료 예정이던 계약에 대해 "원래 계약보다 경제 조건이 불리하다"고 적었던 문장이 삭제됐습니다. 대신 네트워크 서비스 계약은 2032년 3월까지, 재판매 계약은 2029년 3월까지 연장됐다는 내용이 들어갔습니다("extends the framework agreement for network services to March 2032").
- 신규새 ERP 시스템 도입 리스크새 전사적자원관리(ERP) 시스템을 도입하는 중이며, 도입이나 이전 과정에서 문제가 생기면 재무계획·보고·컴플라이언스에 지장이 생길 수 있다고 추가했습니다("any unforeseen problems with our new ERP ... could harm our ability to manage our business").
읽는 법
이번 분기 변화의 중심에는 AI가 있습니다. AI는 회사 내부 운영(인력 감축과 자동화), 고객 수요(웹 트래픽 감소와 소프트웨어 고객의 타격), 경쟁 구도(AI 기업의 인프라 진입) 세 방향에서 동시에 리스크 요인으로 새로 들어왔습니다. 앞으로 공시에서는 구조조정 비용 규모, 인력 감축 이후의 운영 안정성, 고객 유지 관련 지표가 어떻게 공개되는지 확인해 볼 필요가 있습니다. 반대로 OFAC 조사 종결과 JD Cloud 계약 장기 연장은 기존의 규제·지정학 관련 불확실성이 일부 해소됐다는 신호로 볼 수 있습니다.
원문 비교
- The ongoing evolution of our business to an agentic AI-first operating model, including our use of artificial intelligence (AI) and other automation tools and resources and our related recently announced workforce reduction, may not achieve the benefits we expect in the time we expect, if at all, and could adversely affect our business, financial condition, and results of operations.
- We are in the process of evolving how we operate our business to an agentic AI-first operating model. As part of this evolution in our operating model, in May 2026 we announced a workforce reduction designed to better align our organizational structure to this operating model. We expect to incorporate AI tools and automation to increase productivity and maintain operational efficiency as we continue this evolution in our operating model. However, we may not realize the expected operating efficiencies, cost savings, or other expected benefits of these changes within the expected timeframe, if at all.
- Our ability to successfully operate our business after our announced workforce reduction will depend in part on our use of AI and other automation tools and resources and the effectiveness and reliability of these tools and resources. These technologies may be more costly than we currently anticipate, may not perform as expected, may require more time or expense to implement effectively than anticipated, may introduce operational or cybersecurity risks, or may fail to enhance productivity and maintain operational efficiency as expected. Increased use of AI and other automation tools and technologies also could increase the risk of operational disruptions and errors, network interruptions, control failures or other significant events, particularly during transition periods, as internal responsibilities are reassigned and processes are adjusted. Any failure to successfully implement these actions, or any unintended consequences resulting from them, could result in reputational harm, loss of customers, reduction in sales, delays in product development or strategic initiatives, and could materially and adversely affect our business, financial condition and results of operations.
- Our recently announced workforce reduction will result in severance and other restructuring charges. We may also incur unexpected additional costs in connection with these announced departures, including as a result of potential claims by employees, organizations that represent employees such as works councils, and governmental or regulatory bodies. In addition, the workforce reduction may disrupt our operations, adversely affect employee morale and productivity, and result in increased employee turnover. The departure of employees, including experienced personnel, may result in the loss of institutional knowledge and expertise, and remaining employees may experience increased workloads, which could lead to increased error rates, reduced innovation, and further attrition of key talent. Although we expect to continue to invest in the employees not impacted by the workforce reduction and those we may hire in the future, the workforce reduction could harm our reputation, make the future retention and hiring of employees more difficult, and require payment of increased compensation.
- We may also suffer other indirect harms to our business as a result of reputational harm or concerns that our customers and applicable governmental and regulatory bodies have regarding the use of AI. Evolving legal and regulatory requirements and public scrutiny relating to AI technologies could increase our compliance costs or limit our ability to deploy AI and automation tools as intended. In addition, any reassignment of responsibilities, together with potentially increased reliance on automation and AI tools to support certain of our legal, regulatory compliance and risk management functions, may limit our capacity and introduce additional oversight risks. If our AI and automation tools do not perform as anticipated or are not effectively implemented and monitored, our ability to maintain effective governance, compliance, and risk processes could be impaired, which could increase the risk of regulatory inquiries, investigations, litigation, enforcement actions, control deficiencies and penalties.
- •the increasing reduction in traffic to websites as a result of consumers’ increasing reliance on AI chatbots for information in lieu of visiting websites, and the resulting negative impact on website operators’ need for our products to make their websites faster, more secure, and more reliable;
- •governments may limit public sector contracts to companies headquartered in the governments' respective jurisdictions or require partnerships with companies based in the governments’ respective jurisdictions in order for us to sell any of our products to those governments, which could result in a loss of revenue we otherwise would receive for such sales;
- We regularly upgrade or replace our various software systems and processes. If the implementations of these new applications are delayed, or if we encounter unforeseen problems with our new systems and processes or in migrating away from our existing systems and processes, our operations and our ability to manage our business could be negatively impacted. For example, we are in the process of implementing a new enterprise resource planning system (ERP). Our ERP is a critical element of our financial planning, reporting, and compliance programs, and any unforeseen problems with our new ERP or in migrating away from previous systems and processes could harm our ability to manage our business.
- Our business involves significant risks, some of which are described below. You should carefully consider the risks and uncertainties described below, together with all of the other information in this
AnnualQuarterly Report on Form10-K,10-Q, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our condensed consolidated financial statements and related notes. Any of the following risks could have an adverse effect on our business, results of operations, financial condition, or prospects, and could cause the trading price of our Class A common stock to decline. Our business, results of operations, financial condition, or prospects could also be harmed by risks and uncertainties that are not presently known to us or that we currently believe are not material. In that event, the market price of our Class A common stock could decline, and you could lose part or all of your investment. Our Risk Factors are not guarantees that no such conditions exist as of the date of this report and should not be interpreted as an affirmative statement that such risks or conditions have not materialized, in whole or in part. - We have incurred net losses in all periods since we began operations and we may not achieve or maintain profitability in the future. We experienced net losses of
$102.3 million, $78.8 million,$22.9 million and$183.9$38.5 million for theyearsthree months endedDecemberMarch 31, 2026 and 2025,2024, and 2023,respectively, and as ofDecemberMarch 31,2025,2026, we had an accumulated deficit of$1,204.9$1,227.8 million. Because the markets for our products are rapidly evolving, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase over the next several years as we continue to hire additional personnel, expand our operations and infrastructure both domestically and internationally, and continue to develop our products. If we fail to increase our revenue to offset the increases in our operating expenses, we may not achieve or sustain profitability in the future. - We have experienced rapid revenue growth in recent periods, with revenue of
$2,167.9 million, $1,669.6 million,$639.8 million and$1,296.7$479.1 million for theyearsthree months endedDecemberMarch 31, 2026 and 2025,2024, and 2023,respectively. However, our rate of revenue growth has periodically slowed in past periods and may slow again in future periods. You should not consider our historical growth in revenue as indicative of our future performance. In particular, our revenue growth rates may slow or decline in the future and may not be sufficient to achieve and sustain profitability, as we also expect our costs to increase in future periods. We believe that historical comparisons of our revenue may not be meaningful and should not be relied upon as an indication of future performance. Accordingly, you should not rely on our revenue and other growth for any prior quarter or year as an indication of our future revenue or revenue growth. - Any of the negative impacts of conflicts and geopolitical tension around the world or any worsening or expansion of those conflicts or tensions, other geopolitical events such as elections and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate, may have a material adverse effect on our business and operations, results of operations, financial condition, and cash flows. Any of these negative impacts, alone or in combination with others, also could exacerbate many of the other risk factors discussed in this Part
I,II, Item 1A “Risk Factors” of thisAnnualQuarterly Report on Form10-K,10-Q, including volatility in the trading prices of our Class A common stock. The full extent to which these factors will negatively affect our business and operations, results of operations, financial condition, and cash flows will depend on future developments that are highly uncertain and cannot be predicted, including the scope, severity, and duration of conflicts and geopolitical tension around the world, and any economic downturns and the actions taken by governmental authorities and other third parties in response. - Our future financial performance also depends in part on our ability to continue to upgrade paying customers to higher-tier subscriptions, expand the number of products we sell to paying customers and, for certain of our products, expand our paying customers' usage of such products, and, to a lesser extent, convert free customers into paying customers. Conversely, our paying customers may convert to lower-cost or free plans or reduce the number of products they purchase from us or the amount they use our products if they do not see the marginal value in paying for our higher-cost plans or for our specific products, or due to challenging macroeconomic conditions and/or reduced operating budgets, thereby impacting our ability to increase revenue. For example, we periodically have experienced a higher level of churn in our paying customer base (which is when any of our paying customers cease to be a paying customer for any reason, including any pay-as-you-go customer converting to a free subscription plan). Moreover, our free customers have no obligation to transition to paying customers at any point. In order to expand our commercial relationship with our customers, existing paying and free customers must decide that the incremental cost associated with such an upgrade in their subscription plans, the purchase of additional, or the expanded use of their currently used, products is justified by the additional functionality they would gain. For example, some of our paying customers may decide that our Enterprise plan offerings do not provide sufficient incremental value to upgrade from our pay-as-you-go offering or to continue any such previously chosen upgrade. In addition, for certain of our products, such as many of our developer platform products, the costs of the subscription are based on the contracted customers’ amount of usage of the product and there is no obligation to continue to use the product or increase usage. Our customers’ decisions whether to upgrade their subscription, purchase additional, or expand current usage, of our products or to continue any such previously chosen upgrade or purchased products are driven by a number of factors, including customer satisfaction with the security, performance, and reliability of our network and products, customer security and networking issues and requirements, general economic conditions, the potential future applicability of tariffs or retaliatory measures due to tariffs on our products in certain countries, the ongoing development of AI technologies and products that adversely impact the businesses of our customers and, as a result, could potentially diminish their ability to purchase our products (such as the adverse impact of AI on the businesses of our customers that are software companies), and customer reaction to the price for additional products. If our efforts to retain and expand our relationship with our existing paying and free customers are not successful, our financial condition and results of operations may materially suffer.
- Our growth strategy is dependent, in large part, upon attracting, expanding, and retaining sales to large customers. For our definition of “large customers,” see Part
II,I, Item7.2. Management’s Discussion and Analysis of Financial Condition and Results of Operations. Attracting, expanding, and retaining sales to large customers involve risks that may not be present, or that are present to a lesser extent, with sales to smaller customers, including: - Further, our ability to improve our sales of products to large customers is dependent on us continuing to attract and retain sales personnel with experience in selling to larger enterprises. Also, because security breaches or a network outage with respect to larger, high-profile enterprises are likely to be heavily publicized, there is increased liability and reputational risks associated with serving these customers if we
experienceexperience, or are perceived to have experienced, a security breach or network outage. We also believe that large customers may be more likely than our smaller customers to terminate or reduce their usage of our products in such circumstances. - Our potential competitors include large companies with substantial infrastructure, such as global telecommunications services provider partners and public cloud providers, as well as other large companies that are developing or may develop substantial infrastructure, including AI providers and companies that sell technology for AI providers, such as providers of servers, processors, and memory products. These companies could choose to enter the markets for products and solutions for security, performance, and reliability, including by acquiring existing companies, developing their own internal solutions, or establishing cooperative relationships with businesses that may allow them to offer more comprehensive solutions or to offer solutions for lower prices or to adapt more quickly than us to new technologies and customer needs. AI providers and their suppliers also could choose to limit their customers’ use of their products to infrastructure provided by the AI provider or our competitors, such as public cloud providers, and limit or prevent use of such AI products on our infrastructure. As our business continues to grow and we increase our market share for various products and services, these larger companies may increase their focus on us as a competitor and the actions they undertake to compete with our business and products. Additionally, if an increasing portion of web content is housed on another company’s network or portions of the Internet are otherwise
privatized,privatized (whether on the infrastructure of public cloud providers, AI providers, or otherwise), it could reduce the demand for our products and increase competitive pressure on us. These competitive pressures in our markets or our failure to compete effectively may result in price reductions, fewer subscriptions, reduced revenue and gross margin, increased net losses, and loss of market share. - •point solution vendors, which provide cloud-based products and services to address a single use case or challenge, in various categories
includingsuch as cloud security vendors, content delivery network (CDN) and edge computing vendors, domain name system (DNS) services vendors, email security vendors,andcloud SD-WAN vendors, developer solutions vendors, and AI inference vendors; and - A substantial majority of our revenue in the
yearthree months endedDecemberMarch 31,20252026 was from contracted customers that were acquired through our inside and field sales teams, and we expect our sales teams to continue generating the majority of our revenue for the foreseeable future. As a result, our financial condition and results of operations are dependent to a significant degree on our ability to effectively attract, train, and retain qualified sales personnel, including senior sales leaders, and the ability of our dedicated sales personnel to acquire new contracted customers and expand our relationships with our existing contracted customers. Our sales representatives typically engage in direct interaction with our prospective contracted customers. Increasing our customer base and achieving broader market acceptance of our network and products will depend, to a significant extent, on our ability to expand and further invest in our sales and marketing operations and activities. There is significant competition for sales personnel with the advanced sales skills and technical knowledge we need. We believe that selling subscriptions to our products requires particularly talented sales personnel that understand a very wide array of highly technical topics, including significant portions of global networking, Internet, enterprise and identity security, and application development for both on-premises and cloud requirements. Changes in the senior leadership of our sales team could negatively impact our ability to retain current members of our sales team or attract new talent. In addition, as we continue to develop and sell newer types of products and product features, we will need our sales personnel to be proficient in selling both these newer products and features and our overall broader suite of products to our existing and potential customers. If we are unable to effectively attract, train, and retain qualified sales personnel, particularly as our lines of products and product features expand, our business, results of operations, and financial condition will be adversely impacted. - We have experienced, and may in the future experience, periods of rapid growth. For example, our headcount grew from
3,6824,400 employees as ofDecemberMarch 31,2023,2025 to4,2635,483 employees as ofDecemberMarch 31,2024, to 5,156 employees as of December 31, 2025.2026. We also have expanded the locations where we have employees to a number of new locations around the world during the past several years. The number of customers, users, and requests on our network also has increased rapidly in recent years. While we expect to continue to expand our operations, network, and products significantly in the future, both domestically and internationally, our growth may not be sustainable. Our growth has placed, and future growth will continue to place, a significant strain on our management and our administrative, operational, and financial infrastructure. Our success will depend in part on our ability to manage this growth effectively, which will require that we continue to improve our administrative, operational, financial, and management systems and controls by, among other things: - •governments often require contract terms that differ from our standard customer arrangements, including terms that can lead to those customers obtaining broader rights in our products than would be expected under a standard commercial contract and terms that can allow for early termination or subject us to more onerous obligations and requirements than our standard customer arrangements, such as supply chain restrictions, restrictions on employees' ability to manage their accounts, and additional reporting obligations;
governments may limit public sector contracts to companies headquartered in the governments' respective jurisdictions or require partnerships with companies based in the governments’ respective jurisdictions in order for us to sell any of our products to those governments, which could result in a loss of revenue we otherwise would receive for such sales; - The preparation of financial statements in conformity with generally accepted accounting principles in the United States (U.S. GAAP) requires our management to make estimates, assumptions, and judgments that affect the amounts reported and disclosed in our condensed consolidated financial statements and accompanying notes. We base our estimates and assumptions on historical experience and on various other assumptions that we believe to be reasonable under the circumstances. The results of these estimates and assumptions form the basis for making judgments about the carrying values of assets, liabilities, and equity, and the amount of revenue and expenses that are not readily apparent from other sources. Significant estimates, assumptions, and judgments used in preparing our condensed consolidated financial statements include those related to allowance for doubtful accounts, deferred contract acquisitions costs, the period of benefit generated from our deferred contract acquisition costs, the capitalization and estimated useful life of internal-use software, valuation of acquired intangible assets, the assessment of recoverability of intangible assets and their estimated useful lives, useful lives of property and equipment, the determination of the incremental borrowing rate used for operating lease liabilities, the valuation and recognition of stock-based compensation expense, uncertain tax positions, and the recognition and measurement of current and deferred income tax assets and liabilities. Due to geopolitical and macroeconomic uncertainties, including conflicts and geopolitical tension around the world, inflationary pressures, threats of tariffs and other impediments to cross-border trade, and changes in interest rates, there is ongoing uncertainty in the global economy and financial markets. We are not aware of any specific event or circumstance that would require an update to our estimates or assumptions or a revision of the carrying value of assets or liabilities as of the date of issuance of this
AnnualQuarterly Report on Form10-K.10-Q. These estimates and assumptions may change in the future, however, as new events occur and additional information is obtained. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of industry or financial analysts and investors, resulting in a decline in the trading price of our Class A common stock. - We face security threats from malicious third parties that could obtain unauthorized access to our internal systems, networks, and data, including the equipment at our network and core co-location facilities. It is virtually impossible for us to entirely mitigate the risk of these security threats and the security, performance, and reliability of our network and products has been in the past, and may be in the future, disrupted by third parties, including nation-states, competitors, hackers, disgruntled employees, former employees, or contractors. For example, in November 2023, we detected that a likely nation-state threat actor had gained unauthorized access to one of our internal systems. While we immediately began investigating the intrusion and believe we cut off the threat actor’s access prior to significant impact on our customer data or systems, we expect we will continue to be subject to similar threats of unauthorized access in the future and we may not be as successful in quickly identifying such intrusions and mitigating the impacts of such intrusions. We also face the possibility of security threats from other sources, such as employee or contractor errors (such as errors in utilizing AI or machine learning in our products or in the operation of our business) or malfeasance. For example, hostile third parties, including nation-states and their agents, in the past have sought direct or indirect employment at Cloudflare, or attempted to bribe, extort, or otherwise manipulate our employees or contractors to compromise our network and products and in the future other hostile third parties may take similar actions. As our business grows and we employ more employees and engage more contractors in more countries around the world, our ability to supervise the actions of our employees and contractors will decrease and the risk of an employee or contractor error or act of malfeasance will increase. These security threats from third parties are also likely to increase as the numbers, sizes, and types of customers using our network and products increases, particularly our customers that are involved in particularly sensitive industries or activities, such as banking and finance companies and governmental entities or in relation to elections in the United States or elsewhere. Additionally, AI and machine learning may increase cybersecurity risks we face through, for example, being used to increase the prevalence or intensity of cyber
attacks.attacks or to detect, and take advantage of, potential vulnerabilities in our internal systems, networks, and data. - While we have implemented security measures internally and have integrated security measures into our network and products, these measures have not always functioned as expected and have not always detected or prevented all unauthorized activity, prevented all security breaches or incidents, mitigated all security breaches or incidents, or protected against all attacks or incidents and these types of security failures could occur again in the future. For example, we have experienced multiple social engineering attacks where third parties have attempted, and in limited cases succeeded, in breaching our network perimeter security. While these attacks did not effectively get beyond our network perimeter security and we have not suffered any material consequences as a result of these breaches, we cannot be certain that future breaches will be avoided or, if future breaches are successful, that we will not experience material detrimental impacts, particularly if those breaches involve third party access to decrypted or other sensitive data. In addition, there is risk that the vendors we use may be attacked and the controls we have in place are bypassed and our data accessed as a result. For example, one of the IT tools our employees used internally until the first quarter of 2023 was the subject of a large security incident in December 2022, which resulted in unauthorized parties stealing large amounts of the IT tools' customers’ data, including our data. We are not aware of any of our systems having been compromised as a result of this security incident due to additional required authorization and authentication events we have in place, particularly when accessing sensitive systems and resources, and we have since changed to using a new IT tool internally. In addition, in March 2022 and October 2023, breaches of the systems of our former identity access management vendor resulted in attacks on our systems. While we quickly discovered these resulting attacks on our systems and believed we had fully contained their impact on our systems and data, the October 2023 breach of our systems contributed to the November 2023 intrusion of our systems by a likely nation-state threat actor. Further, in August 2025, a breach of a third-party chat agent integrated with our customer relationship management system allowed threat actors to gain unauthorized access to some of our customer contact and support information. While none of these incidents had a material impact on our business, results of operations or financial condition, we cannot be certain that compromises of our systems will not happen in the future as a result of these incidents or other similar incidents with third party vendors that we use to help secure our internal systems and that such incidents will not have a material impact on our results of operations or financial condition. Such incidents, whether or not successful, could result in our incurring significant costs related to, among other things, changes to our internal systems, remediating or replacing equipment within our global network, implementing additional threat protection measures, making modifications to our products and our global network, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with credits under our agreements with them or other incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Because these threats are constantly evolving, we believe successfully defending against them or implementing adequate preventative measures will become increasingly challenging.
- As of
DecemberMarch 31,2025,2026, we hosted our global network and served our customers from co-location and Internet Service Provider (ISP) partner facilities located in more than330335 cities and over 125 countries worldwide. In addition to these global facilities, much of the infrastructure for our global network and for our business and operations is maintained through a core co-location facility located in the greater Portland, Oregon area, a second core co-location facility located in Amsterdam that provides certain redundancy to the U.S. core facility, and through a limited number of other U.S. co-location facilities that provide limited subsets of our network support. While we have electronic and, to a lesser extent, physical access to the components and infrastructure of our network and co-location facilities that are hosted by third parties — including ISP-partner facilities — we do not control the operation of these third-party facilities. Consequently, we may be subject to service disruptions as well as failures to provide adequate support for reasons that are outside of our direct control. All of our co-location and ISP-partner facilities and network infrastructure are vulnerable to damage or interruption from a variety of sources including earthquakes; weather events; floods; fires; power loss; system failures; computer viruses; physical or electronic break-ins; human error; malfeasance; or interference, including by disgruntled employees, former employees, or contractors; military conflicts; terrorism; and other catastrophic events. For example, in November 2023, our control plane and analytics services experienced an outage triggered by a power failure at one of our core data centers in the greater Portland, Oregon area, which impacted certain customers' access to some of our products and services for several days and the loss of certain customer logs. In March 2024, a subsequent power failure occurred at the same core data center in the greater Portland, Oregon area, which impacted certain customers’ access to some of our products for minutes and to our analytics services for several hours. In addition, we have experienced a route leak and a limited number of network outages involving our core and network co-location facilities over the past five years due to a variety of causes. Co-location facilities housing our network infrastructure may also be subject to local governmental or other administrative actions, changes to legal or permitting requirements, labor disputes, and litigation to stop, limit, or delay operations. Despite precautions taken at these facilities, such as disaster recovery and business continuity arrangements, the occurrence of a natural disaster or an act of war or terrorism, a decision to close the co-location facilities without adequate notice, interference with, or sabotage of, our equipment at these facilities, or other unanticipated problems at these facilities could result in interruptions or delays in the availability of our network and products, impede our ability to scale our operations, or have other adverse impacts upon our business, results of operations, and financial condition. In addition, errors or defects in our customers’ software can result in unexpected and unintentional upward spikes in their usage of our products and network, and those spikes can cause strains on, and adversely affect the availability and functioning of, our co-location facilities and our network. - We rely on a limited number of suppliers for several components of the equipment we use to operate our network and provide products to our customers. Our reliance on these suppliers exposes us to risks, including reduced control over production costs, increased prices due to tariffs (such as the tariffs the United States and other countries recently implemented or threatened to
implement), increased pricesimplement) and constraints on pricing and other terms based on the then-current availabilitywith an increased demand, terms, and pricingof these components. For example, we generally rely on a limited number of suppliers for the servers that we use in our network and we ordinarily purchase these components on a purchase-order basis, without any long-term contracts guaranteeing supply. We may also be subject to price increases from these suppliers should they be negatively impacted by tariffs or other regulations, such as the tariffs the United States and other countries recently implemented or threatened toimplement.implement, or other increases in their production costs. While the network equipment and servers we purchase generally are commodity equipment and we believe an alternative supply source or location for servers on substantially similar terms could be identified quickly, our business could be adversely affected until those efforts are completed. - Our security products are designed to reduce the threat to our customers posed by malware and other Internet security threats. Our security products may fail to detect or prevent malware or security breaches or incidents for any number of reasons and the risks of such failures may increase in the future as threat actors use AI to detect, and take advantage of, potential vulnerabilities within our and our customers’ internal systems, networks, and data. Even where our security products perform as intended, the performance of our security products can be negatively impacted by our failure to enhance, expand, or update our network and products; improper classification of websites by our employees, automated systems, and partners which identify and track malicious websites; improper deployment or configuration of our products; the development, maintenance, and functioning of the infrastructure of the Internet as a whole; and many other factors. For example, during August and September of 2023, an unknown threat actor exploited a vulnerability in the standard HTTP/2 protocol critical to the function of the Internet and websites. This threat actor worked to generate a series of the largest-scale DDoS attacks against our network that we have recorded prior to that time. While our systems were able to mitigate the overwhelming majority of incoming attacks, the volume overloaded some components in our network and impacted several customers’ performance, all of which were quickly resolved. During the process of mitigating these attacks, our team developed new technology to stop these types of attacks and further improve our own mitigations for this and other future attacks. Although the impact of the attacks did not have a material impact on our reputation or results of operations or financial condition, other future attacks like these may materially and adversely impact our reputation, results of operations or financial condition if we cannot effectively stop or mitigate the attacks and otherwise suffer performance issues or downtime that exceeds the service level commitments under our agreements and terms of service with our paying customers.
- Through our network, we provide a wide variety of products that enable our customers and our customers’ users to exchange information, conduct business, and engage in various online activities both domestically and internationally. Our customers and our customers’ users may use our network and products in violation of applicable law or in violation of our terms of service or the customer’s own policies. The existing laws relating to the liability of providers of online products and services for activities of their users are highly unsettled and in flux both within the United States and internationally. We are currently, and in the future may be, subject to lawsuits and/or liability arising from the conduct of our customers and our customers’ users. Additionally, the conduct of our customers and our customers’ users may subject us to regulatory enforcement actions and/or liability. We are a defendant in lawsuits, both in the United States and abroad, seeking injunctive relief and/or damages against us based on content that is made available through our customers’ websites and other Internet properties. A number of these lawsuits involve copyright infringement claims, and courts in some countries have found that we may be held liable in certain circumstances for damages arising from infringement on a customer’s website or directed us to take action by removing access to content of certain websites and other Internet properties on our network. For example, in October 2025, a court in Japan held us liable for damages in a case alleging infringing content on websites using our services,
whicha decision we have appealed. There can be no assurance that we will not face similar litigation in the future or that we will prevail in any litigation we are facing or may face. An adverse decision in one or more of these lawsuits could materially and adversely affect our business, results of operations, and financial condition. - Our business is subject to regulation by various federal, state, local, and non-U.S. governmental agencies, including agencies responsible for monitoring and enforcing compliance with various legal obligations, such as privacy, data protection, and information security laws and regulations, intellectual property laws, telecommunications laws and regulations, employment and labor laws, workplace safety, environmental laws, consumer protection laws, anti-bribery laws, governmental trade sanctions laws, import and export controls, anti-corruption and anti-bribery laws, federal securities laws, and tax laws and regulations. In addition, emerging tools and technologies we may utilize in providing our products and solutions, like AI and machine learning, have, and may in the future, become subject to regulation under new laws or new applications of existing laws. For example, the EU AI Act has gone into effect and several U.S. states have enacted or are
also enactingconsidering laws governing theusedevelopment, use, or deployment of AI. In certain jurisdictions, some or all of these regulatory requirements may be more stringent than in the United States. - Laws and regulations regarding the development, use, and deployment of AI technologies in the EU, U.S., and elsewhere are increasing in complexity. For example, the EU AI Act
hasprovides for compliance deadlinesthroughoutin 2025 andinto2026, and a number of U.S. states have enacted AI governance and safety frameworks. Numerous jurisdictions have proposed legislation to regulate the development, use, and deployment of AI, in whole or in part. As we continue to see efforts to regulate this new technology, we have incurred and will continue to incur costs to address the impact, if any, of these laws and regulations regulating AI on our products and practices. WeThough we have established internal education policies for our employees regarding compliance with anti-corruption and other applicable laws, we cannot assure you that all of our employees and agents, including our channel partners, have complied with, or in the future will comply with, our policies and applicable law. As we continue to increase our international sales and business and expand our network globally, our risks under these laws may increase. The investigation of possible violations of these laws, including internal investigations and compliance reviews that we may conduct from time to time, could have a material adverse effect on our business. Actual or perceived noncompliance with these laws could subject us to investigations, severe criminal or civil sanctions, settlements, prosecution, loss of export privileges, suspension or debarment from U.S. government contracts and other contracts, other enforcement actions, the appointment of a monitor, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, whistleblower complaints, adverse media coverage and other consequences. Other internal and government investigations, regulatory proceedings, or litigation, including private litigation filed by our stockholders, may also follow as a consequence. Any investigations, actions, or sanctions could materially harm our reputation, business, results of operations, and financial condition. Further, the promulgation of new anti-corruption and anti-bribery laws, rules or regulations or new interpretations of current anti-corruption and anti-bribery laws, rules or regulations could impact the way we do business in other countries, including requiring us to change certain aspects of our business to ensure compliance, which could reduce revenue, increase costs, or subject us to additional liabilities.- Under certain circumstances, our income tax obligations may be reduced as a result of our net operating loss carryforwards and other tax attributes. As of December 31, 2025, we had net operating loss carryforwards for U.S.
As of December 31, 2025, we had net operating loss carryforwards for U.S.federal and state income tax purposes of $1,859.1 million and $988.3 million, which will begin to expire in 2029 and 2027, respectively. We had net operating loss carryforwards for U.K. income tax purposes of $269.8 million that can be carried forward indefinitely. Also as of December 31, 2025, we had U.S. federal and state research and development tax credit carryforwards of $91.6 million and $42.2 million that will begin to expire in 2029 and 2039, respectively.- Historically, we have derived a significant portion of our revenue from outside the United States. We derived
51%, 49%,51% and48%51% of our revenue from our international customers for theyearsthree months endedDecemberMarch 31, 2026 and 2025,2024, and 2023,respectively. We are continuing to adapt to and develop strategies to address international markets and our growth strategy includes expansion into geographies around the world, but there is no guarantee that such efforts will be successful. In addition, our global network includes co-location facilities located in more than330335 cities and over 125 countries worldwide as ofDecemberMarch 31,2025.2026. We expect that our international sales and network activities will continue to grow in the future, as we continue to pursue opportunities in international markets and further grow our network around the world. These international operations will require significant management attention and financial resources and are subject to substantial risks, including: - We believe our offering of an integrated global network that includes facilities in China is important to our existing and potential future customers. Our ability to continue to offer an integrated network presence that includes China currently is dependent on our commercial relationship with JD Cloud. Regulation of Internet infrastructure and traffic by the Chinese government creates challenges to the peering of Chinese and non-Chinese networks. We have a strategic agreement with JD Cloud to provide solutions that accommodate the requirements imposed by Chinese regulations through JD Cloud's development and operation of facilities in China that are included as part of our network. Our current agreement with JD Cloud extends the framework agreement for network services to March 2032 and extends our resale agreement to March 2029. Consistent with the
originalprior agreement, our current agreement with JD Cloud is subject to earlier termination by either party under certain circumstances such as the other party’s material breach and can be terminated by JD Cloud under certain circumstances if necessary Chinese governmental approvals are revoked or become limited or impaired or if public law or regulatory action by the Chinese or U.S. government expressly prohibits or materially restricts the collaboration contemplated by the agreement. The risk of such an early termination event may have increased during the current environment of economic trade negotiations and tensions between the Chinese and U.S. governments. - In May 2019, we submitted an initial voluntary self-disclosure to OFAC related to our non-compliance with certain economic and trade sanctions programs, and we filed the full and complete voluntary self-disclosure to OFAC in July 2019. Specifically, we identified that our products were used by, or for the benefit of, certain individuals and entities included in OFAC’s Specially Designated Nationals and Blocked Persons List, including entities identified in OFAC’s counter-terrorism and counter-narcotics trafficking sanctions programs and individuals or entities affiliated with governments currently subject to comprehensive U.S. sanctions or located in regions subject to comprehensive sanctions. On April 9, 2026, we received a No Action Letter from OFAC, stating that OFAC was closing its review without penalties or further action.
- We rely and expect to continue to rely on a combination of patent, patent licenses, trade secret, domain name protection, trademarks, copyrights, and confidentiality and license agreements with our employees, consultants, and third parties in order to protect our intellectual property rights and proprietary information. As of
DecemberMarch 31,2025,2026, we had381383 issued patents and5862 pending patent applications in the United States and abroad. However, third parties may knowingly or unknowingly infringe our intellectual property rights. Third parties may challenge our intellectual property rights, pending and future patent, trademark, and copyright applications may not be approved, and we may not be able to prevent infringement, misappropriation, or violations of our intellectual property rights without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes, and we provide access to these technologies and processes to certain of our vendors and partners, including JD Cloud with respect to the facilities included within China. We must protect this proprietary information in order to realize commercial benefit from our investment. - Our Class B common stock has 10 votes per share and our Class A common stock has one vote per share. As of
DecemberMarch 31,2025,2026, our directors, executive officers, and holders of more than 5% of our common stock, and their respective affiliates, held in the aggregate71.0%63.8% of the voting power of our capital stock, with our co-founders together holding approximately50.5%49.9% of the voting power of our capital stock. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively continue to control a majority of the combined voting power of our common stock and therefore are able to control all matters submitted to our stockholders for approval. This concentrated control will limit or preclude the ability of holders of Class A common stock to influence corporate matters for the foreseeable future, including the election of directors, amendments of our organizational documents, and any merger, consolidation, sale of all or substantially all of our assets, or other major corporate transaction requiring stockholder approval. In addition, this may prevent or discourage unsolicited acquisition proposals or offers for our capital stock that you may feel are in your best interest as one of our stockholders. Under the announced policies,Additionally, ourmulti-classdual-class capital structure in some cases may make us ineligible for inclusion insome or all of thesecertain indices, and as a result, mutual funds, exchange-traded funds, and other investment vehicles that attempt to passively track these indices may not invest in our stock if we are not included.Previously,For example, Standard & Poor’salsopreviously excluded companies utilizing dual or multi-class capital structures from its indices, but reversed this policy in 2023, and companies with dual or multi-class capital structures have been eligible for inclusion on its indices since then. We cannot be sure that such policy, or the policies of other indices, will not change further and make us ineligible for inclusion on the S&P Composite 1500, or other indices, in thefuture.future, which could depress our valuations compared to those of other similar companies that do not have dual or multi-class capital structures.- As of
DecemberMarch 31,2025,2026, $1,293.8 million in aggregate principal amount of the 2026 Notes were outstanding and $2,000.0 million in aggregate principal amount of the 2030 Notes were outstanding. In addition, in May 2024, we entered into a senior secured credit agreement with a $400 million Revolving Credit Facility. Our ability to make scheduled payments of the principal of, or to refinance our indebtedness, including the Notes, and any borrowings under our Revolving Credit Facility, depends on our future performance, which is subject to economic, financial, competitive, and other factors beyond our control. Our business may not generate cash flow from operations in the future sufficient to service our debt and make necessary capital expenditures. If we are unable to generate such cash flow, we may be required to adopt one or more alternatives, such as selling assets, restructuring debt, or obtaining additional debt financing or equity capital on terms that may be onerous or highly dilutive. Our ability to refinance any future indebtedness will depend on the capital markets and our financial condition at such time. We may not be able to engage in any of these activities or engage in these activities on desirable terms, which could result in a default on our debt obligations. In addition, the credit agreement for our Revolving Credit Facility contains restrictive covenants that limit us, and any of our future debt agreements may contain restrictive covenants that may limit or prohibit us, in each case from adopting any of these alternatives. Our failure to comply with these covenants could result in an event of default which, if not cured or waived, could result in the acceleration of our debt. - Our potential competitors include large companies with substantial infrastructure, such as global telecommunications services provider partners and public cloud providers.
- In addition, in March 2022 and October
- Our security products may fail to detect or prevent malware or security breaches or incidents for any number of reasons.
- European Commission. In addition, in January 2023, the European Data Protection Board issued its 2022 Coordinated Enforcement Action on the use of cloud-based services by the public sector, in which it expressed concerns that EU public sector entities may not be able to use U.S.-based cloud service providers consistently with GDPR due to their concerns about the ability of U.S. government agencies to access EU personal data. Following that, the European Data Protection Supervisor found in March 2024 that the European Commission’s use of Microsoft 365 violated the GDPR in part due to EU personal data being transferred to countries that had not been determined by the EU to provide adequate level of protection suggests that EU regulators are continuing to subject data transfers outside the EU to careful scrutiny.
- On January 5, 2026, the OECD announced a “side-by-side” elective safe harbor that exempts U.S.-parented multinational entities from certain provisions of Pillar Two for fiscal years beginning on or after January 1, 2026.
- Our current agreement with JD Cloud, which is set to expire in March 2026, contains economic terms that are less favorable to us than the terms of the original agreement with JD Cloud that expired in 2023.
- OFAC’s counter-terrorism and counter-narcotics trafficking sanctions programs and individuals or entities affiliated with governments currently subject to comprehensive U.S. sanctions or located in regions subject to comprehensive sanctions. A small number of these parties made payments to us in connection with their use of our products. The voluntary self-disclosure, which we may supplement as appropriate, remains under an ongoing review by OFAC.
- In July 2017, FTSE Russell announced that it would cease to include most newly public companies utilizing dual or multi-class capital structures in its indices, including the Russell 1000, Russell 2000, and Russell 3000. It is unclear what effect, if any, these policies have on the valuations of publicly traded companies excluded from the indices, but it is possible that they may depress these valuations compared to those of other similar companies that are included.
- Conflicts and geopolitical tension around the world or any worsening or expansion of those conflicts or tensions, other geopolitical events such as elections and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate, could decrease the spending of our existing and potential new customers, adversely affect demand for our products, cause one or more of our customers, vendors, and partners to file for bankruptcy protection or go out of business, cause one or more of our customers to fail to renew, terminate, or seek to renegotiate their contracts with us, cause one or more of our suppliers to increase prices as a result of current or potential future
tariffstariffs, inflation, or other factors, affect the ability of our sales team to travel to potential customers, impact expected spending from existing and potential new customers, and negatively impact collections of accounts receivable, all of which could adversely affect our business, results of operations, and financial condition. - Our competitors provide both on-premises, appliance-based solutions, and cloud-based services that have functionality similar to our network and products. We expect competition to increase as other established and emerging companies and start-ups enter the markets for products and solutions for security, performance, and reliability, in particular with respect to cloud-based solutions, as customer requirements evolve and as new products, services, and technologies, including those that leverage
artificial intelligence(AI) and machine learning, are introduced. If we are unable to anticipate or effectively react to these competitive challenges, our competitive position could weaken, and we could experience a decline in revenue or our growth rate that could materially and adversely affect our business and results of operations. - The global network that we use to provide our products to our customers is made up of equipment at co-location facilities located in more than
330335 cities and over 125 countries worldwide and we expect to continue to increase the size of our network in the future. As we grow the size and scope of our network, the number of our employees and third party contractors that have access to our equipment at these facilities will continue to increase, which will also increase the risk of potential errors or malfeasance such as potential equipment theft or potential attempts to interfere with, or intercept, network and customer data that is held in, or flows through, this equipment. In addition, local government officials may attempt to, or successfully take control of, our equipment in an attempt to interfere with our services or intercept data. Because the equipment in our network co-location facilities is designed to run all of our products, any insertion of ransomware or other malicious code on, unauthorized access to, or other security breach or incident with respect to, any of this equipment at any of these locations around the world could potentially impact all of our products running on this equipment around the world. We may also experience security breaches and other incidents that may remain undetected for an extended period and, therefore, may have a greater impact on our products and the networks and systems used in our business, the proprietary and other confidential data contained on our network or otherwise stored or processed in our operations, and ultimately our business. We expect to incur significant costs in our efforts to detect and prevent security breaches and other security-related incidents, and we have in the past faced, including in connection with the November 2023 intrusion of our systems, and may in the future face, increased costs in the event of actual or perceived security breaches or other security-related incidents. Our internal systems are exposed to the same cybersecurity risks and consequences of a breach as the systems of our customers and other enterprises, any of which could have an adverse effect on our business or reputation. These cybersecurity risks pose a particularly significant risk to a business like ours that is focused on providing highly secure products to customers. With the increase in remote work during recent years, we and our customers face increased risks to the security of infrastructure and data, and geopolitical tensions and conflicts may increase these risks. We cannot guarantee that our security measures will prevent security breaches or incidents. We also may face increased costs relating to maintaining and securing our infrastructure and data that we maintain and otherwise process. - In addition, the technology equipment industry has experienced component shortages and delivery delays in the past, and we may experience shortages or delays, including as a result of natural disasters, increased demand in the industry, military conflicts and geopolitical tensions, fuel shortages, labor strikes, or other related conditions, or our suppliers lacking sufficient rights to supply the components in all jurisdictions in which we have co-location facilities that support our global network. For example, we expect significant component shortages that may impact our server supply chain during the current year, particularly in memory products such as Dual In-line Memory Modules (DIMMs), as well as enterprise Solid State Drives (SSDs), Central Processing Units (CPUs), and high-capacity Hard Disk Drives (HDDs). These anticipated shortages, driven by factors such as the reallocation of manufacturing capacity to support artificial intelligence infrastructure and increased demand from hyperscale data center operators, and other shortages or similar supply constraints in the future may disrupt and increase the cost of our expected purchases of network equipment and servers.
- This is especially true regarding the cross-border transfer of personal data. For example, in July 2023, the European Commission adopted an adequacy decision for the EU-U.S. Data Privacy Framework, which generally allows the free flow of EU personal data to the United States for participating entities. While this framework currently serves as a means for cloud service providers like our company to freely transfer EU personal data to the United States, it may be subject to future legal challenges, suspension, amendment, repeal, or limitations to its scope by the European Commission. In addition, some customers and vendors may be unwilling to rely on this framework due to these and other uncertainties, including perceived uncertainty about the U.S. stance on the existing legal framework.
- Changes in accounting principles, changes in global tax laws, regulations or rates, or changes in taxing jurisdictions’ administrative interpretations, decisions, policies, and positions could also impact our provision for income taxes. For example, the United States signed into law the One Big Beautiful Bill Act on July 4, 2025, which permanently extends many of the expiring provisions from the Tax Cuts and Jobs Act and modifies a number of international provisions. Additionally, the Organization for Economic Cooperation and Development (OECD) published model rules within the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting (the Inclusive Framework) to address the challenges impacting international operations. The Inclusive Framework includes provisions related to the taxation of the digital economy and the establishment of a 15% global minimum tax under Pillar Two. A number of foreign countries have enacted, or intend to enact, legislation adopting parts of the Inclusive Framework. Any of the foregoing changes, if and to the extent implemented, could have an adverse impact on our results of operations, cash flows, and financial condition.