Cloudflare
"I woke up this morning in a bad mood and decided to kick them off the Internet."
Original Business Case Weekly articleA case study in the contradictions of building a utility for the open internet.
Most cybersecurity companies sell fear. Cloudflare gave away its core product for free and became the infrastructure layer for over 20% of the internet. The company was born from a spam-tracking hobby project, survived existential content moderation crises that forced its CEO to make decisions he publicly called arbitrary and dangerous, and emerged as one of the few cloud companies growing revenue past $2 billion while consistently expanding its product surface area.
This case study traces how three co-founders turned a Harvard Business School class project into a company that processes requests from over one billion unique IP addresses daily, and why every major strategic decision revolved around a single philosophical bet: that making the internet’s plumbing free and fast would eventually become the most defensible business model in technology.
Honey Pots and Hotel Lobbies, 2004–2010
In 2004, Matthew Prince was not thinking about building a company. He was a law professor and part-time entrepreneur who had created Project Honey Pot with a programmer named Lee Holloway. The open-source tool tracked email spammers and online threats using a network of decoy addresses spread across the web. It was a side project. It generated no revenue.
Then the U.S. Department of Homeland Security called. They wanted to know if Prince understood what he was sitting on. The question stuck with him. Project Honey Pot could see who was doing bad things on the internet, but it could not stop them. That gap between observation and action would become Cloudflare’s founding thesis.
Four years later, Prince enrolled at Harvard Business School. His motivation for attending was, by his own account, avoidance.
My dad called me up and said, “Son, I’ve taken care of you a lot of your life and it’s time for you to come run the family business,” and I couldn’t imagine anything worse than running my dad’s Hooters.
Matthew Prince, Inc. Magazine Podcast
In January 2009, during a class on technology ventures, Prince met Michelle Zatlyn. Zatlyn had a chemistry degree from McGill, had interned at Google, and had co-founded a rewards startup that would later be acquired. On a class trip to Silicon Valley, Prince described Project Honey Pot over dinner. Zatlyn saw the opportunity he had missed. The question was not how to track threats better. It was how to stop them at the network level before they reached a website.
That same evening, they sketched a business model on a napkin and cornered their professor, Tom Eisenmann, in the hotel lobby to recruit him as an advisor. They submitted the idea to the HBS business plan competition and won the Dubilier Prize, collecting $50,000. The prize validated something, but what mattered more was the clarity of the insight: every website on the internet needed security and performance, but only large enterprises could afford it. If someone could build those capabilities into the network itself and offer them for free at the base tier, adoption would be enormous.
By summer 2009, Prince, Zatlyn, and Holloway moved to Palo Alto. Their office sat above a nail salon, not far from Steve Jobs’ house. They rejected the name “WebWall” in favor of “Cloudflare,” short for firewall in the cloud. Ray Rothrock at Venrock and Carl Ledbetter at Pelion Venture Partners led the Series A that November.
On September 27, 2010, Cloudflare launched at TechCrunch Disrupt. They took second place. But what happened after the conference mattered more than the trophy. Thousands of websites signed up in the first week. The product was a reverse proxy, which means Cloudflare sat between a website and its visitors, filtering malicious traffic and caching content to speed up delivery. What made it unusual was that it worked with a single DNS change. No hardware. No software installation. No technical expertise required.
Your call
If you were an early Cloudflare investor in 2010, the product was clearly useful but the business model was unproven. How would you evaluate whether a company giving away security for free could ever generate meaningful revenue? What signals would you look for in the first 12 months?