Cloudflare Q4 2025 Earnings Review
Photo by NASA / Unsplash

Cloudflare Q4 2025 Earnings Review

12 min read

Table of Contents

Reviews and deep dives already published this season:

a. Cloudflare 101

Basic Niche:

Cloudflare makes the internet fast, reliable and secure. They have a massive global Content Delivery Network (CDN) to move traffic closer to the end user, which cuts web latency. They actively assist clients in optimizing traffic, speed and consistency as well. NET doesn’t sell physical firewall hardware, but instead a virtual, cloud-native “Magic Firewall” to supplant these hardware needs.

  • Web application firewalls (WAFs) are for app-level security.
  • Magic Firewall is for network-level security.
  • Magic Wide Area Network (WAN) is Magic Firewall’s partner in crime; it connects networks while Magic Firewall protects them.

Workers Platform & AI Tools:

Workers Platform is its serverless (so fully managed by Cloudflare) product suite for millions of developers to build, maintain, secure and deploy applications. This enables caching of content and apps across Cloudflare’s global network for faster delivery. It also allows developers to access models and GenAI tools (like sentiment analysis) to build and customize apps hosted by Cloudflare’s network.

  • Workers AI pairs seamlessly with its “Vectorize.” Vectorize offers a style of data querying that allows for visualization of patterns.

Another key example of Cloudflare’s GenAI tools is its R2 product. This allows cloud workloads and data to freely move among public clouds with no tax. This is key in a multi-cloud world where very few want to rely on a single vendor anymore. Simply put, models are voracious users of data and that data is routinely hosted in many clouds. That's where R2 comes in handy.

  • Cloudflare AI is its overarching suite of AI tools, which includes the developer AI tools in Workers, among others.
  • Hyperdrive is a notable product within the Workers Platform. This allows any legacy database to plug into NET’s global CDN. It makes NET an easier migration partner as it helps customers embrace next-gen databases, cloud migrations and GenAI.
  • AI Crawl Control helps companies safeguard their proprietary data from impermissible AI chatbot access and set permission rules.
  • Browser Isolation is Net’s managed service for providing users with a purely secluded environment to search and scrape the web. This will be an increasingly important tool for its GenAI inference products that are now building steam. Inference is where Cloudflare expects to realize the bulk of GenAI’s financial value. Models are trained once and periodically updated with new data. After that, the value of those models lies in their ability to connect dots and drive insights (or inference). That’s where Cloudflare thrives.

Zero Trust & More on Network Security:

Cloudflare also offers its Zero Trust Network Access (ZTNA) program. This directly competes with Zscaler. Zero trust means that a user or device must be constantly verified (or never trusted). Cloudflare does this in a seamless manner that minimizes user friction by only creating that friction when necessary. It considers device type, location, usage patterns (or signatures) and other contextual clues to better authorize permission requests. This way, it knows when to block those requests or when to require more information. It then deploys a minimal privilege approach to ensure only the necessary permissions are granted to workers. Nothing more, nothing less. Zero Trust ensures an adversary can’t breach the most vulnerable part of a tech stack and move freely throughout it thereafter.

Cloud Access Security Broker (CASB) is a security tool to provide firms with a bird's-eye view of application usage. This has both security and performance optimization implications. It hosts and secures client data and uncovers suspicious activity or deviations in typical usage patterns to flag threats. It plugs into NET’s Secure Web Gateway (SWG), which is essentially a digital security guard ensuring protection of a firm’s secure network and assets from the open internet. It ties closely to NET’s data loss prevention (DLP) and URL filtering tools.

Secure Access Service Edge (SASE) is a term for how Cloudflare conjoins web performance like SWG, Magic WAN with security use cases like DLP, Magic Firewall, email security and broad threat intelligence capabilities. This drives vendor consolidation, controls costs and augments performance. Cloudflare One is its overarching product bundle subscription combining this suite.

It offers Distributed Denial of Service (DDoS) attack protection to augment its security capabilities. This form of hacking aims to inundate and overwhelm networks with traffic. NET prevents this activity through a product called Magic Transit and boasts higher success rates, scalability and cost efficiency with it vs. alternatives. They think they’re one of one in terms of handling massive traffic spikes without ballooning costs or issues. While alternatives route separate networks for DDOS-specific functions, sacrificing interoperability, Cloudflare provides non-siloed service.

b. Key Points

  • AI is accelerating virtually every facet of this business.
  • Signed its largest annual contract value deal ever.
  • The Workers Platform is up to 4.5M developers, growing 50% Y/Y.

c. Demand

Cloudflare beat revenue estimates by 3.9% & beat guidance by 4.3%. NET’s 30.2% 2-year revenue compounded annual growth rate (CAGR) compares to 29.4% Q/Q & 28.9% 2 quarters ago.

d. Profits & Margins

  • Beat 75.6% GPM estimates by 20 basis points (bps; 1 basis point = 0.01%).
  • Beat EBIT estimates by 6.9% & beat guidance by 7.3%.
    • OpEx as a percent of revenue was 60% vs. 63% Y/Y. Leverage came from R&D as well as sales & marketing.
    • Operating income rose by 33% Y/Y.
    • Headcount rose by 21% Y/Y.
  • Beat $0.27 estimates & identical guidance by $0.01 each.
  • Beat FCF estimates by 3.5%. Network CapEx was 13% of revenue during Q4 and will be around 13.5% of revenue for 2026.

The same harmless trend impacting GPM in recent quarters hit that margin during Q4. Paid traffic increased as a percentage of total traffic, which means more overall expenses allocated in cost of goods sold rather than sales and marketing. There is no material impact on EBIT or net income, as it’s just reshuffling where expenses are realized.

e. Balance Sheet

  • $4.1B in cash & equivalents.
  • $3.3B in convertible notes.
  • No traditional debt.
  • 2.1% Y/Y share dilution.

f. Guidance & Valuation