NET Cloudflare 10-Q 2026-09-30 section summaries

Cloudflare (NET) — Q3 and nine months ended September 30, 2026

Cloudflare’s revenue grew strongly, while higher delivery costs, operating expenses and restructuring charges widened its losses. The company continued investing in network infrastructure and developer-focused products, and its financing activity materially changed its convertible-debt position.

Consolidated results

Q3 revenue increased 39.2%; 9M revenue increased 36.4%. Gross margin fell to 71.2% from 74.0% in Q3 and to 71.4% from 74.9% for 9M, as quarterly cost of revenue grew 54.0%. Operating expenses included $11.018M of Q3 restructuring and other charges and $161.711M for 9M. Cloudflare operates as one segment; its segment measure was a Q3 net loss of $34.065M, versus $1.290M.

Revenue by geography and channel

For the U.S., 9M revenue was $1.078B, versus $769.385M; for Other, it was $165.441M, versus $120.250M. Channel-partner revenue for 9M was $658.055M, versus $392.829M, while direct revenue was $1.460B, versus $1.161B, reflecting a larger channel contribution.

Cash flow and balance sheet

Operating cash flow increased despite the larger net loss. Investing cash outflow narrowed to $357.186M from $1.515B, while financing cash inflow was $893.230M versus $2.008B. Cash, cash equivalents and restricted cash increased $1.027B during 9M.

Equity less goodwill and acquired intangible assets was approximately $1.041B. Cash, cash equivalents, restricted cash and available-for-sale securities at recurring fair value totaled $5.140853B, versus $4.112072B at year-end 2025. The investment portfolio was investment grade (average AA-); its net unrealized position shifted from a $7.049M gain to a $26.151M loss, which management considered temporary.

Shares outstanding rose from 351.887M at December 31, 2025, to 358.240M at September 30, 2026. Shares reserved for future issuance increased to 156.497M from 142.306M.

Financing, investment and business developments

In August, Cloudflare issued $2.500B principal of 0% convertible senior notes due 2031, receiving $2.4625B net proceeds. Their net carrying amount was $2.463444B at quarter-end; disclosed fair value was $3.1531B. The $2.000B principal 0% notes due 2030 had a $1.978456B net carrying amount and $2.5557B disclosed fair value. The notes are carried at face value less unamortized issuance costs; the company intends to settle principal in cash upon conversion. It paid $259.5M for 2031 capped calls covering approximately 5.0M shares, intended to mitigate dilution or cash settlement up to $854.12 per share. The $1.2938B principal 2026 notes matured in August: approximately $1.2934B was converted and repaid in cash, with about 2.2M Class A shares issued for conversion value above principal; the remaining $0.3M was repaid. The $400M revolving facility, expandable by $150M subject to conditions and maturing in May 2029, had no borrowings.

Net property and equipment growth included network servers increasing to $896.601M from $726.763M and construction in progress to $168.744M from $58.372M. In October, after quarter-end, the company entered compute and colocation agreements with estimated undiscounted payments of $461.1M over 3–10 years.

The May restructuring plan, intended to accelerate an “agentic AI-first” operating model, reduced the workforce by approximately 20%. Charges through September totaled $161.711M, including $122.556M severance and benefits, $36.104M stock compensation and $3.051M other costs; cash payments were $122.992M. Stock-based compensation was $167.629M in Q3 versus $109.917M and $441.742M for 9M versus $327.829M. Unrecognized expense for unvested RSUs and PSUs was $1.1223B, expected to be recognized over 2.9 years.

VoidZero was acquired in June for $164.2M, including $98.7M in Class A shares and $65.5M of cash payments, net of cash acquired. It added $143.021M of goodwill and $26.5M of acquired intangible assets. A separate October acquisition of Deno Land cost approximately $26.5M cash; purchase accounting was in progress.

Contracted revenue and risks

Remaining performance obligations were $2.8768B at September 30, with 65% expected to be recognized in the next 12 months. Deferred contract acquisition costs were $266.545M, up from $194.035M a year earlier.

Cloudflare voluntarily disclosed potential export-control and sanctions violations to OFAC and BIS. OFAC closed its review without penalty or further action in April 2026, and no loss was recognized. Management cited uncertainty from geopolitical tensions, potential conflict escalation, tariffs and other trade impediments.

Cloudflare (NET) — Q3 and nine months ended September 30, 2026

Cloudflare’s revenue grew strongly, driven by larger enterprise customer wins and expansion within existing customers. Higher network and technology costs, along with continued investment and restructuring, weighed on gross margin and widened GAAP operating and net losses.

Consolidated results

Q3 cost of revenue rose 54%, faster than revenue, reflecting higher spending on third-party technology services (+$43.0M), colocation/network/bandwidth (+$19.4M), and server depreciation (+$10.1M). Nine-month increases also included employee costs and capitalized software amortization. Management expects usage and network expansion to keep raising these costs, while anticipating long-term scale benefits and broadly stable gross margins.

Q3 operating expenses were $337.987M in sales and marketing ($236.309M prior year), $168.204M in R&D ($120.956M), and $107.951M in G&A ($95.906M); restructuring charges were $11.018M versus none. Nine-month expenses were $885.709M in sales and marketing ($669.679M), $478.662M in R&D ($370.602M), $321.882M in G&A ($280.551M), and $161.711M in restructuring versus none. Employee costs—especially stock-based compensation—and higher professional-services costs drove much of the increase; reduced G&A headcount and lower free-customer network costs partly offset it. Non-GAAP operating income excludes items including stock compensation and related payroll taxes, acquired-intangible amortization, restructuring, and certain legal and acquisition costs; some exclusions are cash expenses.

Revenue by geography

For the nine months, U.S. revenue was $1.078189B versus $769.385M, and Other revenue was $165.441M versus $120.250M. Their growth rates—40.1% and 37.6%—were slower than Q3’s 44.3% and 46.4%, respectively. International markets contributed 48% of Q3 revenue, compared with 50% a year earlier.

Customer and cash-flow metrics

Operating cash flow increased, but its margin declined to 28% in Q3 from 30% and to 23% for nine months from 27%. Nine-month cash generation included $441.7M of stock-based compensation and $190.5M of depreciation and amortization; working-capital outflows included higher contract-acquisition costs, prepaid assets, and receivables, partly offset by a $190.9M increase in deferred revenue. Investing cash outflow was $806.554M in Q3 versus $629.518M, and $357.186M for nine months versus $1.515B. Financing cash flow was an inflow of $896.913M in Q3 versus a $3.569M outflow, and $893.230M for nine months versus $2.008B.

Restructuring, liquidity, and outlook

A May 7, 2026 plan to shift toward an “agentic AI-first” operating model reduced the workforce by approximately 20% and was substantially completed by September 30. Estimated charges were up to $165M: $125M cash severance and benefits, $35M stock-based compensation, and $5M other costs. Management expects significant operating-expense growth over the next several years and says the timing of profitability remains uncertain.

At September 30, cash and cash equivalents were $1.9695B, including $45.7M at foreign subsidiaries; available-for-sale securities were $3.1592B, comprising investment-grade securities with an average AA- rating. Outstanding debt included $2.5B principal of 2031 Notes and $2.0B principal of 2030 Notes. In Q3, Cloudflare repaid $1.2938B principal of 2026 Notes in cash, issued approximately 2.2M Class A shares for conversion value above principal, and received 1.4M shares through settlement of related capped calls. The nine-month financing inflow included $2.5B gross proceeds from 2031 Notes and a $259.5M purchase of 2031 Capped Calls. No borrowings were outstanding under the $400M revolver, which may be increased by up to $150M subject to conditions. Management believes available resources and the revolver cover working capital and capital expenditures for at least 12 months, but notes that further financing may be needed depending on growth, investment, acquisitions, and other conditions. The accumulated deficit was $1.4319B.

Cloudflare is investing in network capacity—including storage-enabled servers and GPUs for AI products—as well as product development, sales, channels, and international expansion. Its network spans more than 340 cities and 130-plus countries. Risks include tariffs and retaliatory measures, macroeconomic uncertainty that could lengthen sales cycles or increase payment delays and churn, and currency movements that could make dollar-priced services more costly abroad. The company cautions that uncertainty may persist through 2026.

There were no changes to significant accounting policies. Management identified no specific event requiring an estimate update or carrying-value revision as of issuance. It is evaluating two not-yet-effective FASB standards: ASU 2024-03 on more disaggregated expense disclosures and ASU 2025-06 on internal-use software costs; the impact of both remains under evaluation.

Market risk and liquidity

As of September 30, 2026, Cloudflare had $2.500B principal outstanding on its 2031 Notes and $2.000B principal outstanding on its 2030 Notes. The Notes have no regularly scheduled interest payments and therefore create no economic interest-rate exposure from such payments. Their fair value generally moves inversely with interest rates and also fluctuates with the Class A share price. They are carried at face value less unamortized issuance costs.

No borrowings were outstanding under the Revolving Credit Facility. Any borrowings would bear a floating alternate base rate or adjusted term SOFR rate plus a margin of 1.75%–2.50%; the applicable margin may change with total net leverage. Letters of credit were immaterial.

At September 30, 2026, cash and cash equivalents were $1.9695B and available-for-sale securities were $3.1592B. The investment portfolio is held for capital preservation and liquidity, rather than trading or speculation. A hypothetical 1% increase in interest rates was estimated to increase the portfolio’s market value by $32.4M; a 1% decrease was estimated to reduce it by $32.1M. Interest-rate-driven fair-value changes in available-for-sale securities are not recognized unless securities are sold before maturity or a fair-value decline is deemed other-than-temporary. Lower investment yields could reduce future investment income, while selling securities after a market-value decline could result in principal losses.

Foreign currency and inflation

Because most revenue is denominated in U.S. dollars while operating expenses are generally denominated in local currencies—particularly British pounds, euros, and Singapore dollars—currency movements create exposure. For the nine months ended September 30, 2026 and 2025, a hypothetical 10% strengthening or weakening of the U.S. dollar would not have materially affected the consolidated financial statements. Cloudflare hedges certain foreign-currency cash flows with derivatives that mature within 12 months and does not use them speculatively. It uses multiple counterparties and master netting agreements, reports no significant counterparty credit exposure, and neither posts nor receives collateral.

Inflation had not materially affected the business, results, or financial condition. However, Cloudflare cautioned that it may be unable to fully offset substantial future cost inflation through price increases.

Disclosure controls and internal control over financial reporting

For Q2 2026, management, including the CEO and CFO, concluded that disclosure controls and procedures were effective at a reasonable-assurance level.

Cloudflare implemented a new ERP system and continued a phased upgrade of its core financial systems, modifying controls related to accumulating, recording, and reporting financial-statement information. Management evaluated the control environment, procedures, data, and controls, and concluded that controls continued to operate effectively during implementation. No other changes materially affected, or were reasonably likely to materially affect, internal control over financial reporting.

The company cautioned that controls provide reasonable, not absolute, assurance, and that implementation and future changes may create control risks. It will continue monitoring and upgrading its controls.

Principal risks and business developments

Cloudflare’s results remain exposed to the challenge of sustaining rapid growth while scaling sales, infrastructure and product development. The company has incurred losses in every period since operations began and expects expenses to rise as it hires, expands globally and invests in its network and products. It prioritizes long-term growth and reinvestment over near-term profitability; continued spending may not generate sufficient growth or improve profitability.

The accumulated deficit was $1.4319B at September 30, 2026. Growth has slowed in some prior periods and could slow further; profitability depends on revenue growing faster than costs.

Growth, sales and customer retention

Growth depends on winning new customers, converting free users to paid plans, renewals, upgrades and greater product usage. Most customers do not pay, and historically a substantial majority of free users have not converted. Pay-as-you-go customers can cancel or downgrade with little notice, while some enterprise contracts allow termination without cause or for service-level or certification failures. Customer budgets, satisfaction, reliability, pricing, competition, regulation and economic conditions can all affect retention and expansion.

Cloudflare’s large-customer strategy brings longer and more resource-intensive sales processes, more customer support and infrastructure demands, greater pricing leverage for buyers, and possible lower-margin terms. “Pool of funds” contracts commit customers to minimum spending over a contract period but do not specify when or on which products it will be spent, making revenue timing less predictable. Sales growth also depends on recruiting and training technically skilled salespeople; new hires have sometimes ramped more slowly and average sales productivity has periodically declined. The President of Revenue is expected to depart at year-end 2026, with a successor starting in November.

Competition spans network security, performance, developer platforms and AI inference. Larger providers may bundle or heavily discount products, while new technology and AI-enabled changes could reduce demand for some services. AI chatbots replacing website visits may also weaken demand for website performance and security products. Cloudflare is shifting toward an “agentic AI-first” operating model and substantially completed a workforce reduction announced in May 2026. Expected productivity and savings may not materialize; restructuring costs, lost expertise, lower morale, higher workloads and increased reliance on automation could disrupt operations, oversight, product development or customer service.

Network, security and supply-chain resilience

Cloudflare’s network spans facilities in more than 340 cities across over 130 countries, but core infrastructure is concentrated in the greater Portland, Oregon area and Amsterdam, with limited redundancy particularly at the U.S. core site. A failure, cyberattack, power outage or other disruption could affect services globally. Past events include Portland-area facility outages in November 2023 and March 2024, widespread service unavailability after software updates in November and December 2025, and a several-hour Workers KV outage in June 2025 caused by third-party storage infrastructure. The company said these events did not materially affect results, but future incidents could cause customer losses, service credits, litigation or substantial costs. Enterprise and Business plans include uptime commitments of up to 100%.

Cyber risks include sophisticated and AI-enabled attacks, vulnerabilities, employee or vendor errors, and misuse of privileged access. Disclosed incidents include a November 2023 intrusion attributed to a likely nation-state actor and an August 2025 third-party chat-agent breach; the company reported no material business or financial impact from these incidents. Security failures could nevertheless expose data, trigger remediation, indemnity and regulatory costs, and damage trust. Insurance may be unavailable or insufficient, including for certain nation-state events.

Cloudflare depends on a limited number of suppliers for network components and has warned of significant current-year shortages of memory products, enterprise SSDs, CPUs and high-capacity HDDs, partly as capacity shifts toward AI infrastructure. Tariffs, price increases and delays could constrain network expansion, raise capital expenditures and pressure gross margins if costs cannot be passed through. Dependence on co-location providers, ISP partners, peering arrangements and third-party technology also creates risks of higher costs, service disruption or less favorable terms.

Regulation, litigation and international exposure

Cloudflare faces changing requirements for privacy, data transfers, cybersecurity, AI, online content, telecommunications, trade and government contracting. Data-localization rules or limits on cross-border transfers may require new infrastructure, product changes or restrictions on services. The company is challenging an approximately €14.2M Italian regulatory fine imposed in December 2025. GDPR penalties can reach the greater of €20M or 4% of worldwide annual revenue; EU NIS2 provides for maximum penalties of at least €10M or 2% of annual turnover, whichever is greater. AI and cybersecurity rules may add compliance costs and operational obligations.

Courts in some countries have found potential intermediary liability or ordered content access restrictions. A Japanese court found Cloudflare liable for damages in October 2025 over allegedly infringing content; Cloudflare appealed. Claims involving customer content, intellectual property and AI-related interactions with third-party models could lead to damages, licensing costs or product changes. In China, network services depend substantially on JD Cloud; losing the relationship could impair service utility and results.

International expansion brings exposure to currency movements, sanctions and export controls, local regulation, taxes, geopolitical disruption and higher compliance costs. A stronger U.S. dollar may weaken demand, while foreign-currency operating expenses are increasing. Cloudflare began an FX hedging program in Q2 2024, but hedges may be incomplete or ineffective.

Financing, ownership and governance

At September 30, 2026, Cloudflare had $2.000B principal of 2030 Notes and $2.500B principal of 2031 Notes outstanding, plus a $400M senior secured revolving credit facility. Covenants restrict certain debt, liens, asset sales, investments and other actions and impose leverage and interest-coverage requirements. Debt service or refinancing depends on cash generation and capital-market access; conversion or repurchase obligations could pressure liquidity or dilute shareholders. At the August 2026 maturity of the 0% Notes due 2026, the company settled remaining conversion and principal obligations with $1,293.4M in cash and approximately 2.2M Class A shares.

A proposed capitalization change involving nonvoting Class C shares and Series FF preferred stock is subject to litigation. On October 16, 2026, the Delaware Court of Chancery preliminarily enjoined implementation; appeal and litigation outcomes remain uncertain. Directors, executives, large holders and affiliates held 65.4% of voting power at September 30, 2026; co-founders Matthew Prince and Michelle Zatlyn together held approximately 48.9%. Class B shares carry ten votes per share versus one for Class A. Cloudflare warns that the proposed structure, future share issuance and convertible-note conversions could affect trading, financing flexibility and dilution. It has never paid cash dividends and expects to retain earnings for operations and expansion.

During Q3 2026, Cloudflare directors John Graham-Cumming and Katrin Suder each adopted a Rule 10b5-1 trading arrangement on August 17, 2026. The plans provide for potential sales of up to 91,818 and 5,210 shares of Cloudflare Class A common stock, respectively, and are intended to qualify for the affirmative defense under Rule 10b5-1(c). Graham-Cumming’s plan runs through December 31, 2027, and Suder’s through August 17, 2027, unless completed earlier. No other officers or directors adopted or terminated a Rule 10b5-1 or non-Rule 10b5-1 trading arrangement during the quarter.