Cloudflare, Inc. (NET) Business

Item 1. Business

Overview

Cloudflare’s mission is to help build a better Internet.

Over the past decade, the technology industry has been undergoing a massive transition from on-premises hardware and software that customers buy, to services in the cloud that they rent. Organizations find themselves at different points in this transition to the cloud. Regardless of where organizations are in their transition, they all face a common set of challenges: they exist in a complex, heterogeneous infrastructure environment which exacerbates the fundamental problems of the Internet more than ever, and the on-premises hardware boxes that they once relied upon to solve these problems were never designed to work in such an environment. As more workloads move to the cloud and workforces become increasingly distributed globally, there is no point in installing additional hardware boxes on premise. An on-premises box will not solve the problems organizations now face. Nor can a business ship a hardware box to a cloud vendor. Even if they wanted to, there is literally no place to install such a box in the cloud.

The result is that a major architectural shift at the network layer is underway. Previously, enterprises would often string together a diverse set of on-premises hardware boxes from different vendors to solve their network challenges. As these solutions move to the cloud, the network latency, support complexity, and cost of overhead makes stringing together multiple point-cloud solutions that only address specific network needs also untenable. Customers are therefore looking to consolidate behind a single, global provider that operates in the cloud — what has been described as a “Connectivity Cloud".

Cloudflare is a leader in this Connectivity Cloud category. We deliver a broad range of services to businesses of all sizes and in all geographies — making them more secure, enhancing the performance of their business-critical applications, and eliminating the cost and complexity of managing individual network hardware. Our network serves as a scalable, easy-to-use, unified control plane to deliver security, performance, and reliability across on-premises, hybrid, cloud, and software-as-a-service (SaaS) applications. We serve comprehensive customer needs across security and connectivity, and increasingly, the distributed and programmable nature of our network is resulting in customers building their applications on top of our network, too — including both traditional applications and those that are enhanced with artificial intelligence (AI).

Our Network

We have built an efficient, scalable, programmable network that allows us to rapidly develop and deploy our products for our customers and that is architected to be flexible, scalable, and get more and more efficient as it expands. Our network is built to run every service on every server in every city. This design enables us to grow capacity quickly and inexpensively and to allow us to shift customers and traffic across our network efficiently. We refer to this architecture as “serverless” because it means we can deploy standard, commodity hardware, and our product developers and customers do not need to worry about the underlying servers.

We are also expanding the capabilities of our network servers to enable AI workloads that are suited to take into account the widely distributed nature of our network. Additionally, our software is designed to manage the deployment and execution of our product developers’ code and our customers’ code across our network. Because we manage the execution and prioritization of code running across our network, it means that we are both able to improve the performance of our highest paying customers, and also effectively leverage idle capacity across our network. We have chosen to utilize this idle capacity to create a free tier of service which has generated substantial global scale for us. In turn, this scale makes us attractive partners for Internet Service Providers (ISPs) globally, which reduces our co-location and bandwidth costs. As our network grows, these dynamics become even more powerful. Today, our network spans more than 330 cities in over 125 countries worldwide and interconnects with over 13,000 networks globally, including major ISPs, cloud services, and enterprises.

9

Table of contents

Increasingly, we are finding that our customers are also using our network to build their applications too. We believe this programmable feature of our network is attractive to our customers for a number of reasons, including:

•the global reach of our network and how it puts our customers’ applications closer to the world's Internet-connected population;

•the nature of our serverless offering, meaning that rather than having to worry about regions, or the deployment and scaling of containers as applications grow in popularity, we do it automatically for them; and

•our ongoing deployment of graphics processing units (GPUs) across our global network of servers, which will help our customers build performant AI into their applications natively.

Growth Strategy

Key elements of our growth strategy include:

•Acquire New Customers: We believe that anyone that relies on the Internet to deliver products, services, or content or to operate a business can be a Cloudflare customer. We plan to continue to grow our customer base across all of our offerings—contracted, pay-as-you-go, and free.

◦Contracted and Pay-As-You-Go: We are focused on the continued growth of our paying customer base, particularly contracted customers (our customers on an Enterprise plan) and large customers. We also are continuing to focus on growth in our pay-as-you-go customers (those on paid Pro and/or Business plans) that is predominantly used by our small and medium customers.

◦Free: In addition to our focus on paying customers, we will continue to invest in awareness and functionality of our products to drive overall customer growth beyond the millions of Internet properties (e.g., domains, websites, application programming interfaces (APIs), and mobile applications) using Cloudflare today.

•Expand Our Relationships with Existing Customers: We continue to focus on improving our customers’ experience through our product offerings and customer support in order to strengthen and expand existing customer relationships. Customers expand their relationships with us by upgrading to premium plans, increasing their usage of our products, or adding products from our different suites of products or across the same product suite.

•Develop New Products and Solutions: We continue to invest in new product development and building new solutions for our existing customers and potential new customers, and as we onboard more customers and more traffic on our network, our ability to identify promising new avenues for innovation improves.

•Extend Our Developer Solutions Strategy: We have seen a growing number of customers that have chosen to bring applications to market using our developer-based solutions, including Cloudflare Workers. This has opened up an entirely new market for us: storage and compute. Our developer offerings are attractive in the market because of our architecture and the power of our network, and we believe adoption of these offerings will continue to grow as we further invest in them.

Our Products

We deliver a suite of deeply integrated products that serve as a unified control plane for our customers, allowing them to build, connect, and secure applications and corporate infrastructure. Customers can quickly and easily join Cloudflare by using just one of our products and then expand their usage of Cloudflare over time by adding additional products. Our full suite of products consists of (1) our application services that help deliver security, performance, and reliability for any organization's applications connected to the Internet, including websites and application programming interfaces (APIs), and that also form the foundation of our newly announced efforts to allow content creators to monetize their work by controlling how bots, crawlers, and agents access their work; (2) our secure access service edge (SASE) platform, which contains our suite of Zero Trust and workplace security services and network services solutions to help ensure traffic in and out of an organization’s network and devices is verified and authorized and data is protected and secured, as well as to securely connect data centers, cloud services, and branch offices to an organization with our Connectivity Cloud; (3) our developer-based solutions to

10

Table of contents

build and deploy serverless and AI applications with scale, performance, security and reliability: and (4) our consumer offerings.

Application Services

Cloudflare offers a suite of application services products (i) to help ensure that Internet properties such as websites, applications, and APIs that are exposed to the Internet are safe from attacks, and are fast and reliable; (ii) to provide customers with the ability to build customized analytics for insights and intelligence to further optimize and secure their applications, such as monitoring for threats, understanding search engine crawler behavior and domain name system (DNS) query traffic, and analyzing any other real time data traffic; and (iii) to easily identify, block and control access from AI crawlers and AI agents and operators, a growing concern for content creators and website operators.

Application Security

We provide an integrated cloud-based security solution designed to secure any combination of platforms, including public cloud, private cloud, on-premises, SaaS applications, and “Internet of things” devices. Our primary application security product offerings include:

•Web Application Firewall (WAF): Protects a customer’s Internet properties from common vulnerabilities like SQL injection attacks, cross-site scripting, and cross-site forgery requests, with no changes to the customer’s existing infrastructure, and also provides the ability to configure thresholds, define responses, and apply throttling rules across web applications and API endpoints.

•Bot Management: Detects and manages undesired or malicious Internet traffic generated by malicious software programs called bots, while still allowing useful bots to access Internet properties through machine learning and behavioral analytics, and also includes Turnstile, our client side no-captcha alternative that can be deployed on any applications, including those that are not actively using our global network.

•Distributed Denial of Service (DDoS) Mitigation: Protects a customer’s website applications, TCP/UDP applications, and networks and data centers alike, across network systems layers 3, 4, and 7 from DDoS attacks, which are malicious attempts to disrupt the normal operations of an application, targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.

•API Security (API Shield): Keeps customer APIs secure and productive with API discovery, integrated API management and analytics, and layered API defenses.

•SSL / TLS Encryption: Manages encrypted secure socket layer (SSL) and transport layer security (TLS) web traffic to prevent data theft and tampering to improve security, as well as application and website productivity, and also provides with our Advanced Certificate Manager a consolidated certificate management experience with greater configuration for managing multiple certificates.

•Client-Side Security (Page Shield): Protects website visitors from customer-side attacks that target vulnerabilities directly in the browser environment.

•Security Center: An actionable dashboard that provides insights into threats, risks, and configuration suggestions, acting as a security practitioner’s home page and summarizing insights from the all of our Application Security suite of products.

Application Performance

Our application performance solutions improve conversions, reduce churn, and improve visitor experiences by accelerating web and mobile performance, while keeping applications available and allowing our customers to run their digital operations much more efficiently. Our primary application performance product offerings include:

•Content Delivery: Accelerates content delivery time by automatically serving our customers' most popular content from our network locations close to our customers’ users.

•Load Balancing: Enhances performance and reliability for single, hybrid-cloud, and multi-cloud environments using local and global load balancing to reduce latency by distributing traffic across multiple servers or by routing traffic to the closest geolocation region to the user.

•DNS: Authoritative DNS keeps customer Internet properties online and available around the world, and DNS resolver returns the Internet Protocol (IP) addresses of servers when a user enters a domain name.

11

Table of contents

•Smart Shield: Improves Internet performance by combining intelligent routing over the Internet using our network, connection reuse, cache reserves, and dedicated egress IP addresses.

•Video Stream Delivery: Caches and delivers HTTP(S) video content on websites, saving the customer on origin server bandwidth costs.

•Web Optimization: Adjusts automatically the way content is delivered based on the particular device accessing the site to improve speed without affecting the customer’s Internet property look or features.

•Cloudflare Waiting Room: Allows organizations to route large volumes of users to a custom-branded virtual waiting room, helping preserve customer experience and protect origin servers from being overwhelmed with requests.

•Cloudflare Data Localization Suite: Sets rules and controls at the network edge about where data is stored and protected, while taking advantage of our global network.

SASE Platform

Our SASE platform combines network services and Zero Trust and workplace security products to provide a comprehensive, cloud-based network and security-as-a-service solution that is designed to be secure, fast, reliable, and define the future of the corporate network. Whereas some large companies had built their own proprietary networks to control and protect their employees working in virtual space, that model had significant limitations, including a price tag that was prohibitive for most companies and an inability to adapt well to increased use of mobile devices and remote work. By leveraging the public Internet, our SASE platform brings together in a single pane of glass how employees connect, on-ramps for branch offices, secure connectivity for applications, and controlled access to SaaS applications while safeguarding the adoption of AI at scale.

Network Services

These products help our customers connect, secure, and accelerate their corporate networks, without the cost and complexity of legacy network hardware. This effectively enables Cloudflare to act as a secure wide area network (WAN) for all entities on a corporate network regardless of what device they use or where they are located.

•Magic WAN: Connects and routes traffic between different networks within an enterprise, which are often broadly geographically dispersed, across Cloudflare's global network.

•Magic Transit: Extends the benefits of our network to customers' on-premises and data center networks. Magic Transit is deployed in front of an enterprise network and protects it at the IP layer from DDoS attacks and enables provisioning of a full suite of virtual network functions, including IP packet filtering and firewalling, load balancing, and traffic management tools.

•Magic Firewall: Cloud-based firewall enables administrators to set policies for all traffic entering and leaving the network.

•Cloudflare Network Interconnect: Direct Internet connectivity between Cloudflare’s global network and on-premises networks wherever they are, whether over a private network interconnect or over an Internet exchange.

•Spectrum: Extends Cloudflare’s speed, security, and reliability functionality to TCP/UDP applications at the transport layer of the Internet, such as gaming applications and voice over Internet protocol (VoIP) applications.

Zero Trust and Workplace Security Services

These products shield users of a corporate network from attacks, inspect traffic for threats, apply privilege rules to grant access to the customer's data and applications, and help organizations connect, secure, and accelerate their corporate networks without the cost and complexity of legacy hardware.

•Cloudflare Zero Trust Network Access: Enforces Zero Trust application access based on identity, including authenticating users accessing applications, seamlessly onboarding third-party users, and logging every event and request.

•Cloudflare Secure Web Gateway: Filters all traffic crossing to customer employee devices to prevent malicious traffic reaching end-user devices, including inspecting and filtering DNS, network, HTTP, and

12

Table of contents

egress traffic to enforce acceptable use policies, blocking risky web sites with custom block lists and threat intelligence, and enhancing visibility and protection across SaaS applications.

•Cloudflare One Client (WARP): Protects corporate devices by privately sending traffic from those devices to our global network, builds device posture rules, and enforces security policies anywhere.

•Remote Browser Isolation: Runs a customer's browsers in the cloud as opposed to on-device, mitigating the impact of attacks.

•Cloud Access Security Broker: Provides visibility and control over SaaS applications to help prevent data leaks and compliance violations.

•Cloud Email Security: Protects users of a corporate network from phishing, business email compromise, and email supply chain attacks.

•Digital Experience Monitoring: Provides administrators with comprehensive, real-time visibility into the performance and connectivity of end-user devices, applications, and networks

•Data Loss Prevention: Inspects web traffic and SaaS applications for sensitive data like personally identifiable information (PII) and prevents exfiltration of this data with allow or block policies.

Developer-based Solutions

By leveraging our serverless platform, developers can build serverless applications on our network that scale without needing to spend time and effort on infrastructure or operations. This enables developers to deliver more performant applications that have global scale, all while improving their productivity. Our primary developer-based solutions include products categorized for AI, compute, storage & databases, and media.

AI

•Workers AI: Enables developers to run machine learning models, powered by serverless GPUs, on our global network.

•Vectorize: Allows developers to easily store and query embeddings, representations of values or objects commonly consumed by machine learning models.

•AI Gateway: Provides observability, caching, security, and routing features for AI applications.

Compute

•Cloudflare Workers: Allows developers to augment existing applications or create entirely new ones through a lightweight execution environment without configuring or maintaining infrastructure and to identify changes that impact end-user experience with first-party telemetry.

•Cloudflare Workers for Platforms: Provides a managed execution environment for our multi-tenant platform customers where their customers can deploy and run their own code on our global network.

•Cloudflare Pages: Allows front-end developers to quickly and easily build, collaborate on, and deploy websites.

Storage & Databases

•R2 Object Storage: Provides global object storage without egress frees.

•D1: Enables developers to create serverless SQL databases.

•Workers KV: Helps developers manage states for their applications with a globally distributed key-value storage.

•Durable Objects: Enables a customer to build and run collaborative applications, such as chat rooms, games, and whiteboards, on our global network.

•Hyperdrive: Accelerates queries to databases by caching frequent query responses, maintaining primed connection pools, and optimizing routing.

13

Table of contents

•Queues: Adds reliable message queues to process tasks asynchronously and improve reliability and performance.

Media

•Cloudflare Stream: Enables live and on-demand video streaming from our global network.

•Cloudflare Images: Provides an end-to-end solution to cost-effectively build and maintain image infrastructure.

•Cloudflare Realtime: Enables developers to build real-time audio and video applications.

Consumer Offerings

Our consumer products make it easy for individuals to have a performant and secure Internet experience. Adoption of our consumer offerings makes our business offerings more powerful and adoption of our business offerings improves our consumer offerings. Our consumer offerings also have been an effective and differentiated marketing channel to increase the awareness of our brand. Our primary consumer product offerings include:

•1.1.1.1 DNS: A consumer DNS resolver app that provides a fast and private way to browse the Internet. 1.1.1.1 is a public DNS resolver, but unlike most DNS resolvers, we do not sell user data to advertisers. Our implementation of 1.1.1.1 makes it among the fastest resolvers available, and we support DNS over HTTPS (DoH) which encrypts and secures consumers’ DNS requests. An additional version of our consumer DNS resolver known as 1.1.1.1 for Families adds a layer of protection to consumer home networks and protects them from malware and adult content.

•1.1.1.1 with WARP: A virtual private network (VPN) app for consumers designed to secure and accelerate traffic on mobile devices. The basic version of WARP is included as an option with the 1.1.1.1 app for free, and WARP+, a premium version that accelerates a user's Internet access is available for purchase.

•Cloudflare Registrar: Offers secure registration and management of domain names.

Our Customers

We view our millions of free and paying customers, which manage millions of Internet properties on our network, as part of a broad, global community.

As of December 31, 2025, we had approximately 332,000 paying customers across more than 190 countries. Our paying customer base is highly diversified across organizations of all sizes in every major industry vertical including technology, healthcare, financial services, consumer and retail, industrial, non-profit, and government. Our large customer count has increased from 2,756 as of December 31, 2023 to 3,497 as of December 31, 2024 to 4,298 as of December 31, 2025. Refer to Part II, Item 7, Management's Discussion and Analysis of Financial Condition and Results of Operations for additional information regarding the definitions of our "paying customers" and "large customers."

No single customer accounted for more than 10% of our revenue in the years ended December 31, 2023, 2024, or 2025.

Cloudflare Impact

Cloudflare Impact — the platform for our corporate responsibility and sustainability — was launched in 2021 and is organized around three core beliefs:

•a better Internet is principled;

•a better Internet is for everyone; and

•a better Internet is sustainable.

As a signatory to the United Nations Global Compact, we are committed to the United Nations Ten Principles and supporting the United Nations Sustainable Development Goals, with annual tracking of our progress. To that end, we publish our company-wide emissions consistent with the Greenhouse Gas Protocol, and climate-related financial

14

Table of contents

risks. We also are committed to powering our operations with 100% renewable energy based on methodology developed by RE100, a global corporate renewable energy initiative, and setting near-term company-wide emissions reductions in line with climate science with the Science Based Targets initiative.

We respect human rights under the United Nations Guiding Principles on Business and Human Rights, and advance and protect freedom of expression and privacy consistent with the Global Network Initiative (GNI) Principles. As part of those commitments, we continue to develop our internal human rights practice, including human rights training, due diligence, and engagement. We also participate in independent GNI Assessments, which include comprehensive review of our human rights related policies, processes, and impacts by leading academic and civil society experts.

Our Board of Directors, through its nominating and corporate governance committee, oversees Cloudflare Impact and its related programs. Additional information regarding our sustainability initiatives and programs can be found in the latest Cloudflare Impact Report, which is located on our website at https://www.cloudflare.com/impact/. The Cloudflare Impact Report, as well as the sustainability resources and Emissions Inventory, are updated annually. This website address is intended to be an inactive textual reference only. None of the information on, or accessible through, our website is part of this Form 10-K or is incorporated by reference herein.

Initiatives We Support

We also have launched various impact initiatives as part of our mission to help build a better Internet, including:

•Project Galileo: Since 2014, we have provided free services to at-risk journalists, human rights defenders, and civil society organizations, at no cost. The program now includes more than 3,000 domains operated by organizations in more than 120 countries.

•Athenian Project: We created the Athenian Project in 2017 to provide U.S. state and local governments’ election websites with our highest level of security and reliability services for free. We currently protect more than 440 state and local election websites in 33 U.S. states, as well as election entities in six additional countries.

•Cloudflare for Campaigns: Since 2020, the Cloudflare for Campaigns program has provided free security services to help candidates for public office and political parties in the United States defend against cyber attacks and election interference.

•Project Cybersafe Schools: We launched Project Cybersafe Schools in 2023 as part of the U.S. government's Back to School Safely: K-12 Cybersecurity Summit. Through the program, we provide eligible public school districts with Zero Trust and workplace security solutions that help minimize exposure to harmful online content and common cyber threats, such as phishing and credential harvesting, for free. Currently, more than 230 school districts in 30 U.S. states receive free services through the program.

Our Technology

Our distributed and proprietary network is the core of our technology and enables us to move data seamlessly from nearly any point on earth in a fast, efficient, and reliable manner. Our network has been built from the ground up as a single software stack we developed that runs our products in more than 330 cities and over 125 countries worldwide. This allows us to scale quickly while offering a wide range of products and simultaneously lowering operating expenses.

Efficient Serverless Network Design

We have developed a single software stack that is responsible for all of our products. We have been able to efficiently scale our network by building it with commodity hardware components that are powered by our proprietary software. This integrated stack has made scaling, debugging, optimizing, and operating our network and products easier and cheaper. It also allows us to deploy changes across our entire worldwide network in a matter of seconds. In addition, we embed encryption chips into the motherboards of our servers that are designed to preclude anyone else from running unauthorized software on our equipment. This allows us to securely and quickly expand our infrastructure far and wide in order to offer the best service and drive down operating costs.

Our serverless network design allows each individual machine in our global network to run our software suite and provide our products. We have built coordination software that ties together these thousands of machines into a

15

Table of contents

single global network that allows us to efficiently route traffic to different physical locations and to individual machines. This enables us to maximize utilization of our commodity hardware and provide different service levels to different customers. It also allows our network to get more efficient and powerful as we add each incremental server, regardless of where it is located. Every time we add a server or add a new city, our entire network improves.

Network Flexibility

Our network and products are API-driven and designed for developers. We have an API-first mentality, which means anything a customer can do via our web interface can also be performed by our API. This allows our customers to easily embed our service in their own workflows. For example, a customer can use our web interface or API to change its custom configuration and that will be rolled out globally by our configuration software in seconds. This contrasts with many other vendors’ solutions where configuration changes can take hours and require professional services.

Our software is designed to spread loads dynamically across our entire distributed network depending on current network conditions and traffic priority. This enables us to deliver different quality of service depending on what customers pay us, ensuring our highest paying customers get the best performance and permitting us to serve our lower paying and free customers from excess capacity.

Given the distributed and highly efficient nature of our network, we can easily develop new features and products on our platform and deploy them without significant incremental costs. The flexibility of our serverless platform allows us to open it to third parties to write code directly on our network through our Cloudflare Workers product.

Research and Development

Our research and development organization is responsible for the design, development, testing, and delivery of our global network and products. Our R&D team's structure allows us to build a broad swath of products while continuing to innovate. One group works closely with our product management organization to improve, refine, and expand our existing products. A second independent group builds greenfield opportunities that aim to expand our market and reach new markets. In addition, our research team is focused on ensuring that our network, products, and customers are secured with the latest cryptography.

We prioritize investment in research and development. Those investments have continued to result in the launch of new products that have helped us attract new customers and sell more products to our existing customers.

Sales

We have a multi-pronged go to market approach that allows us to efficiently serve the needs of very small to very large customers. By using a combination of direct sales, indirect sales, and web self-service, we are able to serve customers across a wide range of sizes, geographies, and vertical markets.

We sell our products under our Enterprise plans directly to customers through our global, technically-oriented inside and field sales teams, and indirectly through our ecosystem of channel partners that includes managed service providers, resellers, distributors, and global system integrators. We refer to our customers on an Enterprise plan as “contracted” customers. For large contracted customers, our relationships often start with a portion of the customer’s overall network, security and application needs and expand over time as they consolidate other vendors’ services and increase their adoption of our products and services.

We also offer self-service access to certain of our products through our website and hosting partners where customers can either start on a free or paid plan and, as we demonstrate value, upgrade over time. Those customers on paid Pro and/or Business plans, which we refer to as “pay-as-you-go” customers, are able to sign up for plans of bundled products as well as individual offerings that are payable monthly or annually. Pay-as-you-go customers are able to onboard and customize our products through our console and pay for their subscription using a credit card. Our automated and easy to use process enables us to efficiently onboard new customers or existing customers to new products without requiring any interaction with our sales team. As pay-as-you-go customers evolve their usage of our products, some upgrade to an Enterprise plan for greater control, higher service levels and

16

Table of contents

terms, or productivity-related tools while existing contracted customers can add their increased usage or expanded products to their bills.

Marketing

Our marketing aims to clearly communicate the value of our offerings to a large and diverse set of global customers at scale. We drive organic awareness and adoption of our products by providing a free offering that enables millions of users to experience the benefits of our global network before they adopt our pay-as-you-go offerings or contract for our Enterprise plan. We engage with developers across blogs, social media, and other channels to help build our brand and visibility among technical communities. In addition, our consumer products, including 1.1.1.1 and WARP, provide an effective and differentiated marketing channel to expand the awareness of our brand.

We invest in a variety of targeted digital and non-digital marketing activities and programs to build awareness, engage with prospects, and build pipeline for our global sales teams. We also share stories of how large customers are rapidly adopting our services across use cases, industry verticals, and geographies, to communicate customer trust and our market momentum.

Competition

We compete in the market for network services primarily across three categories:

•On-premises network hardware vendors. We compete with companies in this category to provide security, performance, and reliability services. We believe we are positioned favorably against these vendors with our cloud-based, multitenant approach that is better suited to an increasingly cloud-based world and that allows customers to treat our services as operational as opposed to capital costs.

•Point solution vendors, which provide cloud-based products and services to address a single use case or challenge, in various categories including application and network security vendors, content delivery network (CDN) vendors, domain name system (DNS) services vendors, email security vendors, and SD-WAN vendors. Providers in these categories are all focused on delivering cloud-based point solutions. However, customers are increasingly looking for an integrated infrastructure platform offering security, performance, and reliability through a single vendor.

•A subset of services provided by traditional public cloud vendors. We believe customers want the ability to manage a consistent policy across their on-premises, cloud, hybrid, and SaaS vendors, and be able to enforce that policy through an independent and integrated services provider. Customers are concerned about being locked in to any one public cloud provider. Our ability to efficiently and inexpensively move data between multiple clouds allows our customers to pick and choose the best from any cloud provider without fearing lock-in. Furthermore, unlike some public cloud providers, our business model aligns fully with the interests of our customers. We do not sell user data. We do not aim to compete with our customers.

In addition, we believe we are increasingly competing with public cloud vendors for storage and compute workloads as more third-party developers utilize our serverless platform. Because of the efficiency of our Cloudflare Workers product, we are able to offer it at prices that are highly competitive with public cloud vendors, and because it is distributed across our entire network, it enables the development of applications that were not previously possible on the traditional public cloud.

The principal competitive factors in the markets in which we operate include:

•breadth of network and product features and continued innovation;

•integrated solutions across security, performance, and reliability;

•unified control plane across on-premises, cloud, hybrid, and SaaS infrastructure;

•performance, availability, and effectiveness;

•network scalability;

•total cost of ownership;

17

Table of contents

•ease of adoption and use;

•global network coverage;

•quality of customer support;

•programmability and extensibility of platform; and

•independence, reputation, and trust.

We believe that we are positioned favorably against our competitors based on these principal competitive factors.

Human Capital Resources

As of December 31, 2025, we had 5,156 full-time employees, including 2,452 employees located outside of the United States. We also engage contractors and consultants. None of our employees in the United States are represented by a labor union, but some of our employees outside of the United States are represented by works councils. We have not experienced any work stoppages, and we believe that our employee relations are strong.

Our Culture

A healthy company culture has been a critical part of our success. In order to preserve our culture, we define performance by both results and behaviors. These behaviors — which we call Cloudflare capabilities — are clearly defined, and we use them as part of our hiring, performance, and promotion decisions:

•Be curious to learn and grow

•Communicate clearly, directly and transparently

•Do the right thing

•Embrace diversity to make Cloudflare better

•Get your work across the finish line

•Lead with empathy and assume good intentions

We want everyone at Cloudflare to have rewarding careers, so we invest in development opportunities, aligned with both behaviors and results, to build leadership skills across the company at all levels. In 2023, 2024, and 2025, Cloudflare has been recognized as one of the Top 100 Most Loved Workplaces by Newsweek and the Best Practice Institute.

Compensation and Benefits

We believe that attracting, motivating, and retaining talent at all levels is vital to our success. Our total rewards programs are built to engage employees, provide support, and encourage career best performance. Through programs that drive employee retention and engagement, we also improve our ability to support customers and protect the long-term interests of our stockholders. We provide our employees with competitive salaries, opportunities for equity ownership, and a comprehensive benefits package that promotes well-being across all aspects of their lives, including health care, life and disability insurance, financial savings, family forming and caregiving benefits, and flexible vacation time. We allow flexibility in how teams work, while also supporting the benefits of intentional togetherness. This allows us to draw from a much larger talent pool and provides potential and current employees with additional opportunities to grow their careers at Cloudflare, while also providing environmental and other benefits.

Diversity, Equity, and Inclusion

We believe that much of our innovation and success is rooted in the diversity of our teams and our commitment to inclusion. We have fostered an inclusive culture through the development of employee-led communities, educational offerings, incorporating behaviors into performance, and reviews of our processes and policies for fairness and inclusion. We remain committed to extending our diversity and inclusion initiatives across our global workforce.

18

Table of contents

We value diversity at all levels and are committed to promoting the advancement of leaders from different backgrounds. We work with our managers to develop strategies for increasing the diversity of their teams and ensuring inclusion, equity, and fairness. An important component of our diversity, equity, and inclusion strategy is to grow a diverse talent pool, and we have established recruiting partnership programs with various organizations to reach underrepresented groups. We are focused on understanding our diversity and inclusion strengths and opportunities in order to execute a strategy to support further progress.

Intellectual Property

Our success depends in part upon our ability to protect and use our core technology and intellectual property rights. We rely on a combination of patents, copyrights, trademarks, trade secrets, know-how, contractual provisions, and confidentiality procedures to protect our intellectual property rights. As of December 31, 2025, we had 381 issued patents and 58 pending patent applications in the United States and abroad. These patents and patent applications seek to protect our proprietary inventions relevant to our business. Our issued patents are scheduled to expire between 2030 and 2045, and cover various aspects of our network and products. In addition, we have registered “Cloudflare” as a trademark in the United States and other jurisdictions, and we have filed other trademark applications in the United States. We are also the registered holder of a variety of domestic and international domain names that include “Cloudflare” (including “Cloudflare.com”).

In addition to the protection provided by our intellectual property rights, we enter into proprietary information and invention assignment agreements or similar agreements with our employees, consultants, and contractors. We further seek to control the use of our proprietary technology and intellectual property rights through provisions in our subscription agreements.

Corporate Information

Cloudflare, Inc. was incorporated in the state of Delaware in July 2009. Our principal executive offices are located at 101 Townsend Street, San Francisco, California 94107, and our telephone number is (888) 993-5273.

Additional Information

Our website is located at https://www.cloudflare.com and our investor relations website is located at https://cloudflare.NET. Copies of our Annual Reports on Form 10-K, our Quarterly Reports on Form 10-Q, our Current Reports on Form 8-K, our Proxy Statements for our annual meetings of stockholders and amendments to these reports filed or furnished pursuant to Section 13(a) or 15(d) of the Exchange Act, as amended, are available free of charge on our investor relations website as soon as reasonably practicable after we file such material electronically with or furnish it to the Securities and Exchange Commission (the SEC). The SEC also maintains a website that contains these filings at www.sec.gov.

We have used, and intend to continue to use, our website, investor relations website, news website (https://www.cloudflare.com/press), blog (https://blog.cloudflare.com), and social media accounts, including our X account (@Cloudflare), our Facebook account (@Cloudflare), and our Instagram account (@cloudflare), as a means of disclosing material non-public information and for complying with our disclosure obligations under Regulation FD.

The contents of the websites provided above are not intended to be incorporated by reference into this Annual Report on Form 10-K or in any other report or document we file with the SEC. Further, our references to the URLs for these websites are intended to be inactive textual references only.