CloudFlare, the Startup That Thwarts Hackers
Matthew Prince is a restless guy. After earning a law degree and starting a company to track spammers, he enrolled in Harvard Business School in 2007. During the winter of his second year, he found himself on a class trip to Silicon Valley, listening to a presentation from a not-very-smart-sounding entrepreneur. A classmate, Michelle Zatlyn, turned to him. “If this guy can get funding, so can we,” she told him.
Their idea—a Web security service that watches over clients’ sites and can protect all when one is attacked—became CloudFlare, which won HBS’s 2009 Business Plan Contest and went on to raise $20 million from venture capital firms, including New Enterprise Associates. CloudFlare is far from a household name, but its services—which have expanded to include speed enhancements, analytics, and other tools for Web administrators—are used by hundreds of thousands of sites, from food blogs to Metallica’s fan page. About 25 percent of global Web visitors pass through CloudFlare’s servers each month, according to the company, and revenues are increasing 40 percent each month as the startup prepares to expand from its niche servicing smaller sites to wooing bigger commercial customers that are also pursued by large companies including Akamai and Symantec. The markets for Web security and so-called website optimization, which include a variety of services meant to make sites run more efficiently and safely, have “exploded,” says Paul A. Palumbo, founder of Accu-Stream Research. “There’s an opportunity for a startup to carve out a meaningful business, of between $20 million and $100 million, in the next few years.”
Cloudflare’s initial appeal was as a kind of risk-pooling service for website administrators. If a hacker or some malicious code targeted a CloudFlare-protected site, its software could prevent the attacker from targeting the rest of its network. That idea wasn’t entirely new, but the cost was right: free for most sites and a starting price of $20 a month for extra features. The startup began attracting small clients reluctant to pay for pricey alternatives from companies like Akamai.
CloudFlare has continually added more tools for its target market of website owners. To reduce the time it takes a Web page to load, CloudFlare runs a so-called content distribution network, the service that Akamai specializes in. CloudFlare rents space in 14 data centers around the world (and hopes to be in 30 by year-end); when a Metallica fan in Japan wants to gain access to the band’s site, for instance, his request goes to CloudFlare’s Tokyo servers instead of ones in the U.S., making the response time faster. CloudFlare also predicts which page a fan might jump to next and starts loading it ahead of time, and bundles together some of the files that make up a website so that servers don’t have to ship information as frequently. The result, according to the company, is that sites using CloudFlare’s services load twice as fast and use 60 percent less bandwidth than average. And the global distribution means CloudFlare can keep a website running even if the site’s servers fail or are brought down by a hacker.
“We were being quoted between $10,000 monthly to hundreds of thousands of dollars to get what CloudFlare is offering,” says Igor Soshkin, chief executive officer of Staten Island startup Shopping Cart Elite, which uses CloudFlare. CloudFlare says it signs up 1,000 new sites every day.
CloudFlare will start going after bigger fish in February, when it plans to launch a $200-a-month service that offers protection against large denial of service attacks, which hacker groups like Anonymous have used to bring down many sites, including MasterCard’s. The startup is testing a feature-rich service for Fortune 500 companies that would cost an average of $2,000 a month, and give site administrators greater customization options and access to a support representative. “They’ll certainly take a part of the business Akamai could be pursuing,” says Carl Brooks, an analyst at Tier1 Research. Akamai declined to comment. Michael Osterman, president of Osterman Research, expects a major security company like McAfee or Trend Micro to acquire the startup “in the very near future.” McAfee and Trend Micro declined to comment.
Prince says he isn’t looking to sell, and wants to lead CloudFlare to an IPO. “We don’t have a single salesperson on our staff,” says Prince, who says that word-of-mouth is CloudFlare’s best marketing. When he tweeted about being on vacation in Costa Rica recently, two local bloggers drove to Tamarindo to chat him up. “The interest comes to us,” he says.