Cloudflare, Inc.

Previous wording

We have incurred net losses in all periods since we began operations and we may not achieve or maintain profitability in the future. We experienced net losses of $170.0 million and $50.4 million for the three months ended June 30, 2026 and 2025, respectively, and $192.9 million and $88.9 million for the six months ended June 30, 2026 and 2025, respectively, and as of June 30, 2026, we had an accumulated deficit of $1,397.8 million. Because the markets for our products are rapidly evolving, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase over the next several years as we continue to hire additional personnel, expand our operations and infrastructure both domestically and internationally, and continue to develop our products. If we fail to increase our revenue to offset the increases in our operating expenses, we may not achieve or sustain profitability in the future.

Current wording

We have incurred net losses in all periods since we began operations and we may not achieve or maintain profitability in the future. We experienced net losses of $34.1 million and $1.3 million for the three months ended September 30, 2026 and 2025, respectively, and $227.0 million and $90.2 million for the nine months ended September 30, 2026 and 2025, respectively, and as of September 30, 2026, we had an accumulated deficit of $1,431.9 million. Because the markets for our products are rapidly evolving, it is difficult for us to predict our future results of operations. We expect our operating expenses to increase over the next several years as we continue to hire additional personnel, expand our operations and infrastructure both domestically and internationally, and continue to develop our products. If we fail to increase our revenue to offset the increases in our operating expenses, we may not achieve or sustain profitability in the future.

Previous wording

We have experienced rapid revenue growth in recent periods, with revenue of $696.1 million and $512.3 million for the three months ended June 30, 2026 and 2025, respectively, and $1,335.8 million and $991.4 million for the six months ended June 30, 2026 and 2025, respectively. However, our rate of revenue growth has periodically slowed in past periods and may slow again in future periods. You should not consider our historical growth in revenue as indicative of our future performance. In particular, our revenue growth rates may slow or decline in the future and may not be sufficient to achieve and sustain profitability, as we also expect our costs to increase in future periods. We believe that historical comparisons of our revenue may not be meaningful and should not be relied upon as an indication of future performance. Accordingly, you should not rely on our revenue and other growth for any prior quarter or year as an indication of our future revenue or revenue growth.

Current wording

We have experienced rapid revenue growth in recent periods, with revenue of $782.5 million and $562.0 million for the three months ended September 30, 2026 and 2025, respectively, and $2,118.3 million and $1,553.4 million for the nine months ended September 30, 2026 and 2025, respectively. However, our rate of revenue growth has periodically slowed in past periods and may slow again in future periods. You should not consider our historical growth in revenue as indicative of our future performance. In particular, our revenue growth rates may slow or decline in the future and may not be sufficient to achieve and sustain profitability, as we also expect our costs to increase in future periods. We believe that historical comparisons of our revenue may not be meaningful and should not be relied upon as an indication of future performance. Accordingly, you should not rely on our revenue and other growth for any prior quarter or year as an indication of our future revenue or revenue growth.

Previous wording

Our ability to successfully operate our business after our recent workforce reduction will depend in part on our use of AI and other automation tools and resources and the effectiveness and reliability of these tools and resources. These technologies may be more costly than we currently anticipate, may not perform as expected, may require more time or expense to implement effectively than anticipated, may introduce operational or cybersecurity risks, or may fail to enhance productivity and maintain operational efficiency as expected. Increased use of AI and other automation tools and technologies also could increase the risk of operational disruptions and errors, network interruptions, control failures or other significant events, particularly during transition periods, as internal responsibilities are reassigned and processes are adjusted. Any failure to successfully implement these actions, or any unintended consequences resulting from them, could result in reputational harm, loss of customers, reduction in sales, delays in product development or strategic initiatives, and could materially and adversely affect our business, financial condition and results of operations.

Current wording

Our ability to successfully operate our business will depend in part on our use of AI and other automation tools and resources and the effectiveness and reliability of these tools and resources. These technologies may be more costly than we currently anticipate, may not perform as expected, may require more time or expense to implement effectively than anticipated, may introduce operational or cybersecurity risks, or may fail to enhance productivity and maintain operational efficiency as expected. Increased use of AI and other automation tools and technologies also could increase the risk of operational disruptions and errors, network interruptions, control failures or other significant events, particularly during transition periods, as internal responsibilities are reassigned and processes are adjusted. Any failure to successfully implement these actions, or any unintended consequences resulting from them, could result in reputational harm, loss of customers, reduction in sales, delays in product development or strategic initiatives, and could materially and adversely affect our business, financial condition and results of operations.

Previous wording

Our recent workforce reduction has resulted in severance and other restructuring charges. We may also incur unexpected additional costs in connection with these departures, including as a result of potential claims by employees, organizations that represent employees such as works councils, and governmental or regulatory bodies. In addition, the workforce reduction may disrupt our operations, adversely affect employee morale and productivity, and result in increased employee turnover. The departure of employees, including experienced personnel, may result in the loss of institutional knowledge and expertise, and remaining employees may experience increased workloads, which could lead to increased error rates, reduced innovation, and further attrition of key talent. Although we expect to continue to invest in the employees not impacted by the workforce reduction and those we may hire in the future, the workforce reduction could harm our reputation, make the future retention and hiring of employees more difficult, and require payment of increased compensation.

Current wording

Our recent workforce reduction has resulted in severance and other restructuring charges. We may also incur unexpected additional costs in connection with these departures, including as a result of potential claims by employees, organizations that represent employees such as works councils, and governmental or regulatory bodies. In addition, the workforce reduction may disrupt our operations, adversely affect employee morale and productivity, and result in increased employee turnover. The departure of employees, including experienced personnel, may have resulted in the loss of institutional knowledge and expertise, and remaining employees may experience increased workloads, which could lead to increased error rates, reduced innovation, and further attrition of key talent. Although we expect to continue to invest in the employees not impacted by the workforce reduction and those we may hire in the future, the workforce reduction could harm our reputation, make the future retention and hiring of employees more difficult, and require payment of increased compensation.

Previous wording

Conflicts and geopolitical tension around the world or any worsening or expansion of those conflicts or tensions, other geopolitical events such as elections and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate may materially adversely affect our customers, vendors, and partners, and the duration and extent to which these factors may impact our future business and operations, results of operations, financial condition, and cash flows remain uncertain.

Current wording

Conflicts and geopolitical tension around the world or any worsening or expansion of those conflicts or tensions, other geopolitical events such as elections, including the recent U.S. midterm elections, and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate may materially adversely affect our customers, vendors, and partners, and the duration and extent to which these factors may impact our future business and operations, results of operations, financial condition, and cash flows remain uncertain.

Previous wording

Conflicts and geopolitical tension around the world or any worsening or expansion of those conflicts or tensions, other geopolitical events such as elections and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate, could decrease the spending of our existing and potential new customers, adversely affect demand for our products, cause one or more of our customers, vendors, and partners to file for bankruptcy protection or go out of business, cause one or more of our customers to fail to renew, terminate, or seek to renegotiate their contracts with us, cause one or more of our suppliers to increase prices as a result of current or potential future tariffs, inflation, or other factors, affect the ability of our sales team to travel to potential customers, impact expected spending from existing and potential new customers, and negatively impact collections of accounts receivable, all of which could adversely affect our business, results of operations, and financial condition.

Current wording

Conflicts and geopolitical tension around the world or any worsening or expansion of those conflicts or tensions, other geopolitical events such as elections, including the recent U.S. midterm elections, and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate, could decrease the spending of our existing and potential new customers, adversely affect demand for our products, cause one or more of our customers, vendors, and partners to file for bankruptcy protection or go out of business, cause one or more of our customers to fail to renew, terminate, or seek to renegotiate their contracts with us, cause one or more of our suppliers to increase prices as a result of current or potential future tariffs, inflation, or other factors, affect the ability of our sales team to travel to potential customers, impact expected spending from existing and potential new customers, and negatively impact collections of accounts receivable, all of which could adversely affect our business, results of operations, and financial condition.

Previous wording

Any of the negative impacts of conflicts and geopolitical tension around the world or any worsening or expansion of those conflicts or tensions, other geopolitical events such as elections and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate, may have a material adverse effect on our business and operations, results of operations, financial condition, and cash flows. Any of these negative impacts, alone or in combination with others, also could exacerbate many of the other risk factors discussed in this Part II, Item 1A “Risk Factors” of this Quarterly Report on Form 10-Q, including volatility in the trading prices of our Class A common stock. The full extent to which these factors will negatively affect our business and operations, results of operations, financial condition, and cash flows will depend on future developments that are highly uncertain and cannot be predicted, including the scope, severity, and duration of conflicts and geopolitical tension around the world, and any economic downturns and the actions taken by governmental authorities and other third parties in response.

Current wording

Any of the negative impacts of conflicts and geopolitical tension around the world or any worsening or expansion of those conflicts or tensions, other geopolitical events such as elections, including the recent U.S. midterm elections, and other governmental changes, and any related challenging macroeconomic conditions globally and in various countries in which we and our customers operate, may have a material adverse effect on our business and operations, results of operations, financial condition, and cash flows. Any of these negative impacts, alone or in combination with others, also could exacerbate many of the other risk factors discussed in this Part II, Item 1A “Risk Factors” of this Quarterly Report on Form 10-Q, including volatility in the trading prices of our Class A common stock. The full extent to which these factors will negatively affect our business and operations, results of operations, financial condition, and cash flows will depend on future developments that are highly uncertain and cannot be predicted, including the scope, severity, and duration of conflicts and geopolitical tension around the world, and any economic downturns and the actions taken by governmental authorities and other third parties in response.

Previous wording

•our failure to obtain additional, or maintain existing, government or industry security certifications for our network and products, such as Federal Risk and Authorization Management Program (FedRAMP) Moderate authorization that we achieved in 2022;

Current wording

•our failure to obtain additional, or maintain existing, government or industry security certifications for our network and products, such as Federal Risk and Authorization Management Program (FedRAMP) High authorization that we achieved in August 2026;

Previous wording

•impacts of conflicts and geopolitical tension around the world or any worsening or expansion of those conflicts or tensions and impacts of geopolitical events such as elections and other governmental changes.

Current wording

•impacts of conflicts and geopolitical tension around the world or any worsening or expansion of those conflicts or tensions and impacts of geopolitical events such as elections, including the recent U.S. midterm elections, and other governmental changes.

Previous wording

If we are unable to effectively attract, expand, and retain sales to large customers, or we fail to mitigate the additional risks associated with serving large customers, our business, results of operation, and financial condition may suffer.

Current wording

If we are unable to effectively attract, expand, and retain sales to large customers, or we fail to mitigate the additional risks associated with serving large customers, our business, results of operations, and financial condition may suffer.

Previous wording

The markets for our network and products are intensely competitive and characterized by rapid changes in technology, customer requirements, industry standards, and frequent introductions of new, and improvements of, existing products. Our broad portfolio of products exposes us to competition from a large number of competitors in a number of different markets, including companies and their product and services offerings in, among others, virtual private networks, internal and external firewalls, web security (including web application firewalls and content filtering), distributed denial-of-service (DDoS) prevention, intrusion detection and prevention, application delivery controls, content delivery networks, domain name systems, email security vendors, advanced threat prevention, wide area network (WAN) technology, and developer platforms.

Current wording

The markets for our network and products are intensely competitive and characterized by rapid changes in technology, customer requirements, industry standards, and frequent introductions of new, and improvements of, existing products. Our broad portfolio of products exposes us to competition from a large number of competitors in a number of different markets, including companies and their product and services offerings in, among others, virtual private networks, internal and external firewalls, web security (including web application firewalls and content filtering), distributed denial-of-service (DDoS) prevention, intrusion detection and prevention, application delivery controls, content delivery networks, domain name systems, email security vendors, advanced threat prevention, wide area network (WAN) technology, developer platforms, and AI inference.

Previous wording

In addition, some of our larger competitors have substantially broader and more diverse product and services offerings, which may allow them to leverage existing commercial relationships, incorporate functionality into existing products, sell products and services with which we compete at zero or negative margins, offer fee waivers and reductions or other economic and non-economic concessions, bundle products and solutions, maintain closed technology platforms, or render our products unable to interoperate with such platforms. If they were to engage in predatory competitive practices, it could harm our existing product offerings or prevent us from creating viable products in other segments of the markets in which we participate. If our competitors are able to exploit their advantages or are able to persuade our customers or potential customers that their products are superior to ours, we may not be able to compete effectively and our business, financial condition, and results of operations may be materially affected.

Current wording

In addition, some of our larger current and potential future competitors have substantially broader and more diverse product and services offerings, which may allow them to leverage existing commercial relationships, incorporate functionality into existing products, sell products and services with which we compete at zero or negative margins, offer fee waivers and reductions or other economic and non-economic concessions, bundle products and solutions, maintain closed technology platforms, or render our products unable to interoperate with such platforms. If they were to engage in predatory competitive practices, it could harm our existing product offerings or prevent us from creating viable products in other segments of the markets in which we participate. If our competitors are able to exploit their advantages or are able to persuade our customers or potential customers that their products are superior to ours, we may not be able to compete effectively and our business, financial condition, and results of operations may be materially affected.

Previous wording

A substantial majority of our revenue in the six months ended June 30, 2026 was from contracted customers that were acquired through our inside and field sales teams, and we expect our sales teams to continue generating the majority of our revenue for the foreseeable future. As a result, our financial condition and results of operations are dependent to a significant degree on our ability to effectively attract, train, and retain qualified sales personnel, including senior sales leaders, and the ability of our dedicated sales personnel to acquire new contracted customers and expand our relationships with our existing contracted customers. Our sales representatives typically engage in direct interaction with our prospective contracted customers. Increasing our customer base and achieving broader market acceptance of our network and products will depend, to a significant extent, on our ability to expand and further invest in our sales and marketing operations and activities. There is significant competition for sales personnel with the advanced sales skills and technical knowledge we need. We believe that selling subscriptions to our products requires particularly talented sales personnel that understand a very wide array of highly technical topics, including significant portions of global networking, Internet, enterprise and identity security, and application development for both on-premises and cloud requirements. Changes in the senior leadership of our sales team (including the previously announced departure of our current President of Revenue at the end of 2026) could negatively impact our ability to retain current members of our sales team or attract new talent. In addition, as we continue to develop and sell newer types of products and product features, we will need our sales personnel to be proficient in selling both these newer products and features and our overall broader suite of products to our existing and potential customers. If we are unable to effectively attract, train, and retain qualified sales personnel, particularly as our lines of products and product features expand, our business, results of operations, and financial condition will be adversely impacted.

Current wording

A substantial majority of our revenue in the nine months ended September 30, 2026 was from contracted customers that were acquired through our inside and field sales teams, and we expect our sales teams to continue generating the majority of our revenue for the foreseeable future. As a result, our financial condition and results of operations are dependent to a significant degree on our ability to effectively attract, train, and retain qualified sales personnel, including senior sales leaders, and the ability of our dedicated sales personnel to acquire new contracted customers and expand our relationships with our existing contracted customers. Our sales representatives typically engage in direct interaction with our prospective contracted customers. Increasing our customer base and achieving broader market acceptance of our network and products will depend, to a significant extent, on our ability to expand and further invest in our sales and marketing operations and activities. There is significant competition for sales personnel with the advanced sales skills and technical knowledge we need. We believe that selling subscriptions to our products requires particularly talented sales personnel that understand a very wide array of highly technical topics, including significant portions of global networking, Internet, enterprise and identity security, and application development for both on-premises and cloud requirements. Changes in the senior leadership of our sales team (including the previously announced departure of our current President of Revenue at the end of 2026 and the start of our new President of Revenue in November 2026) could negatively impact our ability to retain current members of our sales team or attract new talent. In addition, as we continue to develop and sell newer types of products and product features, many of which are significantly different than our historical products, we will need our sales personnel to be proficient in selling both these newer products and features and our suite of other products to our existing and potential customers. If we are unable to effectively attract, train, and retain qualified sales personnel, particularly as our lines of products and product features expand, our business, results of operations, and financial condition will be adversely impacted.

Previous wording

As we continue to focus on revenue growth, we are seeking to increase our rate of hiring sales personnel and any delays in making these incremental sales hires could have an adverse impact on our ability to increase revenue, particularly with respect to our sales to contracted customers. In addition, if we fail to effectively train and integrate new hires, it could negatively impact the existing sales and marketing personnel and their productivity, relationships with our customers, our ability to generate a pipeline of new customers, and our ability to increase revenue.

Current wording

As we continue to focus on revenue growth, we are seeking to increase our rate of hiring sales personnel and any delays in making these incremental sales hires or decrease in the quality of our sales personnel could have an adverse impact on our ability to increase revenue, particularly with respect to our sales to contracted customers. In addition, if we fail to effectively train and integrate new hires, it could negatively impact the existing sales and marketing personnel and their productivity, relationships with our customers, our ability to generate a pipeline of new customers, and our ability to increase revenue.

Previous wording

New sales hires require significant training and may take significant time before they achieve full productivity. As a result, our new sales hires and planned sales hires may not become as productive as we would like or as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals. In addition, due to our rapid growth, a large percentage of our sales team is new to our company and inexperienced in selling subscriptions to our products, and therefore these personnel may be less effective than our more seasoned employees. For example, since late 2022, we periodically have experienced reductions in average productivity among our sales personnel, which we believe were due in part to new sales hires not becoming as productive as we expected and exacerbated by worsening or uncertain macroeconomic conditions. While we continue to address productivity and focus on hiring, training, and retaining successful sales personnel, these efforts may take longer than anticipated, which may negatively impact our ability to achieve our targeted revenue growth.

Current wording

New sales hires require significant training and may take significant time before they achieve full productivity. As a result, our new sales hires and planned sales hires may not become as productive as we would like or as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals. In addition, due to our rapid growth, a large percentage of our sales team is new to our company and inexperienced in selling subscriptions to our products, and therefore these personnel may be less effective than our more seasoned employees. For example, since late 2022, we periodically experienced reductions in average productivity among our sales personnel, which we believe were due in part to new sales hires not becoming as productive as we expected and exacerbated by worsening or uncertain macroeconomic conditions. While we continue to address productivity and focus on hiring, training, and retaining successful sales personnel, these efforts may take longer than anticipated, which may negatively impact our ability to achieve our targeted revenue growth.

Previous wording

•further improving our key business applications, processes, and IT infrastructure, including our network co-location facilities, to support our current and anticipated business needs;

Current wording

•further improving our key business applications, processes, and IT infrastructure, including our network co-location facilities and our enterprise resource planning (ERP) system, to support our current and anticipated business needs;

Previous wording

•appropriately documenting and testing our IT systems and business processes.

Current wording

•appropriately documenting and testing our ERP and other IT systems and business processes.

Previous wording

Our future success is substantially dependent on our ability to attract, integrate, retain, and motivate the members of our management team and other key employees throughout our organization. In particular, we are highly dependent on the services of our co-founders, Matthew Prince, our Chief Executive Officer, and Michelle Zatlyn, our President. We rely on our leadership team in the areas of operations, security, marketing, sales, support, research and development, and general and administrative functions, and on individual contributors on our research and development team. Although we have entered into employment offer letters with our key personnel, these agreements have no specific duration and constitute at-will employment. We also do not maintain key person life insurance policies on any of our employees.

Current wording

We rely on our leadership team in the areas of operations, security, marketing, sales, support, research and development, and general and administrative functions, and on individual contributors on our research and development team. Although we have entered into employment offer letters with our key personnel, these agreements have no specific duration and constitute at-will employment. We also do not maintain key person life insurance policies on any of our employees.

Previous wording

From time to time, there may be changes in our management team as a result of the hiring, departure or realignment of our senior management and other key personnel, and such changes may impact our business. Additionally, as our business grows in scale and complexity, other changes to our management team may be necessary. For example, we have hired or promoted several new members of our senior management team in recent years, such as our Chief Strategy Officer, our Chief People Officer, our Chief Marketing Officer, our Chief Legal Officer, and our Chief Engineering Officer. In addition, our President of Product and Engineering departed during 2025 to become chief executive officer of another public company, our prior Chief Legal Officer resigned from that position during the first quarter of 2026, and our President of Revenue announced that he is departing at the end of 2026. Any significant leadership change or senior management transition, such as these, involves inherent risks and any failure to ensure timely and suitable replacements and smooth transitions could hinder our strategic planning, business execution, and future performance. In particular, these or any future leadership transitions may result in, and in some cases have resulted in, a loss of personnel with deep institutional or technical knowledge and changes in business strategy or objectives and disruptions in our operations and relationships with existing employees and customers due to added costs, operational inefficiencies, changes in strategy, decreased employee morale and productivity, and increased turnover. We must successfully integrate our new leadership team members within our organization to achieve our operating objectives. If we lose one or more of our senior management or other key employees and are unable to find adequate replacements, or if we fail to successfully attract, integrate, retain and motivate members of our senior management team and key employees, our business could be harmed.

Current wording

From time to time, there may be changes in our management team as a result of the hiring, departure or realignment of our senior management and other key personnel, and such changes may impact our business. Additionally, as our business grows in scale and complexity, other changes to our management team may be necessary. For example, we have hired or promoted several new members of our senior management team in recent years, such as our Chief Strategy Officer, our Chief People Officer, our Chief Marketing Officer, our Chief Legal Officer, our Chief Engineering Officer, and our new President of Revenue. In addition, our President of Product and Engineering departed during 2025 to become chief executive officer of another public company, our prior Chief Legal Officer resigned from that position during the first quarter of 2026, and our President of Revenue announced that he is departing at the end of 2026. Any significant leadership change or senior management transition, such as these, involves inherent risks and any failure to ensure timely and suitable replacements and smooth transitions could hinder our strategic planning, business execution, and future performance. In particular, these or any future leadership transitions may result in, and in some cases have resulted in, a loss of personnel with deep institutional or technical knowledge and changes in business strategy or objectives and disruptions in our operations and relationships with existing employees and customers due to added costs, operational inefficiencies, changes in strategy, decreased employee morale and productivity, and increased turnover. We must successfully integrate our new leadership team members within our organization to achieve our operating objectives. If we lose one or more of our senior management or other key employees and are unable to find adequate replacements, or if we fail to successfully attract, integrate, retain and motivate members of our senior management team and key employees, our business could be harmed.

Previous wording

To execute our growth plan, we must also attract and retain large numbers of highly qualified personnel in a number of job markets globally. In particular, it is critical for us to attract and retain sales and engineering talent in our fast growing industry. Competition for these personnel in the San Francisco Bay Area, where our headquarters is located, and in Lisbon, London, Singapore, and Austin, Texas, as well as other locations where we employ personnel, is intense, especially for experienced sales professionals and for engineers experienced in designing and developing cloud applications. We have from time to time experienced, and we may continue to experience, difficulty in hiring and retaining employees with appropriate qualifications or level of experience. For example, we have experienced, and may continue to experience, difficulty recruiting, hiring, and retaining sales personnel with the appropriate level of experience and knowledge necessary to effectively sell our products to large customers. Additionally, in recent years, recruiting, hiring, and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of high-profile cybersecurity attacks on global corporations and governments. Many of the companies with which we compete for experienced personnel have greater resources than we have and may provide higher levels of compensation or more attractive benefits. We may need to increase our existing compensation levels in response to competition, rising inflation, or labor shortages, which may increase our operating costs and reduce our margins. In addition, job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment. Volatility or lack of performance in our stock price has in the past, and may in the future, affect our ability to attract and retain our key employees or require us to increase the number of shares that we include in employee equity awards, which has and may continue to affect our outstanding share count, cause dilution to existing shareholders, and increase our stock-based compensation expense. In addition, upon vesting of equity awards, many of our employees have acquired or may soon acquire a substantial amount of personal wealth. This may make it more difficult for us to retain and motivate these employees, and this wealth could affect their decision about whether or not they continue to work for us. Any failure to successfully attract, integrate, or retain qualified personnel to fulfill our current or future needs could materially and adversely affect our business, results of operations, and financial condition.

Current wording

To execute our growth plan, we must also attract and retain large numbers of highly qualified personnel in a number of job markets globally. In particular, it is critical for us to attract and retain sales and engineering talent in our fast growing industry. Competition for these personnel in the San Francisco Bay Area, where our headquarters is located, and in Lisbon, London, Singapore, and Austin, Texas, as well as other locations where we employ personnel, is intense, especially for experienced sales professionals and for engineers experienced in designing and developing cloud and AI applications. We have from time to time experienced, and we may continue to experience, difficulty in hiring and retaining employees with appropriate qualifications or level of experience. For example, we have experienced, and may continue to experience, difficulty recruiting, hiring, and retaining sales personnel with the appropriate level of experience and knowledge necessary to effectively sell our products to large customers and engineers with experience designing and developing cloud and AI applications. Additionally, in recent years, recruiting, hiring, and retaining employees with expertise in the cybersecurity industry has become increasingly difficult as the demand for cybersecurity professionals has increased as a result of high-profile cybersecurity attacks on global corporations and governments. Many of the companies with which we compete for experienced personnel (in particular, public cloud companies and frontier AI model companies) have greater resources than we have and may provide higher levels of compensation or more attractive benefits. We periodically have needed to, and in the future we may need to further increase our existing compensation levels for various types of employees in response to competition, rising inflation, or labor shortages, which may increase our operating costs and reduce our margins. In addition, job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment. Volatility or lack of performance in our stock price has in the past, and may in the future, affect our ability to attract and retain our key employees or require us to increase the number of shares that we include in employee equity awards, which has and may continue to affect our outstanding share count, cause dilution to existing shareholders, and increase our stock-based compensation expense. In addition, upon vesting of equity awards, many of our employees have acquired or may soon acquire a substantial amount of personal wealth. This may make it more difficult for us to retain and motivate these employees, and this wealth could affect their decision about whether or not they continue to work for us. Any failure to successfully attract, integrate, or retain qualified personnel to fulfill our current or future needs could materially and adversely affect our business, results of operations, and f…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

In addition, we must comply with laws and regulations relating to the formation, administration, and performance of contracts with the public sector, including U.S. federal, state, and local governmental organizations, as well as foreign governmental organizations, which affect how we and our channel partners do business with governmental agencies. Selling our products to the U.S. government, whether directly or through channel partners, also subjects us to certain regulatory and contractual requirements, including expanded compliance obligations under the Federal Acquisition Regulations. Failure to comply with these laws, regulations, and requirements by either us or our channel partners could subject us to investigations, fines, and other penalties, which could have an adverse effect on our business, results of operations, and financial condition. For example, the U.S. Department of Justice (DOJ) and the General Services Administration (GSA) have in the past pursued claims against and financial settlements with vendors under the False Claims Act and other statutes related to misrepresenting cybersecurity practices or protocols, pricing and discount practices and compliance with certain provisions of GSA contracts. The DOJ and GSA continue to actively pursue such claims. Violations of certain regulatory and contractual requirements could also result in us being suspended or debarred from future government contracting. Any of these outcomes could have a material adverse effect on our revenue, results of operations, and financial condition. Any inability to address these risks and challenges could reduce the commercial benefit to us or otherwise preclude us from selling subscriptions to our products to government organizations.

Current wording

In addition, we must comply with laws and regulations relating to the formation, administration, and performance of contracts with the public sector, including U.S. federal, state, and local governmental organizations, as well as foreign governmental organizations, which affect how we and our channel partners do business with governmental agencies. Selling our products to the U.S. government, whether directly or through channel partners, also subjects us to certain regulatory and contractual requirements, including expanded compliance obligations under the Federal Acquisition Regulations. Failure to comply with these laws, regulations, and requirements by either us or our channel partners could subject us to investigations, fines, and other penalties, which could have an adverse effect on our business, results of operations, and financial condition. For example, the U.S. Department of Justice (DOJ) and the General Services Administration (GSA) have in the past pursued claims against and financial settlements with vendors under the False Claims Act and other statutes related to misrepresenting cybersecurity practices or protocols, pricing and discount practices and compliance with certain provisions of GSA contracts. The DOJ and GSA continue to actively pursue such claims. Violations of certain regulatory and contractual requirements could also result in us being suspended or debarred from future government contracting. Any of these outcomes could have a material adverse effect on our revenue, results of operations, and financial condition. Any inability to address these risks and challenges could reduce the commercial benefit to us or otherwise preclude us from selling our products to government organizations.

Previous wording

We generally recognize revenue from customers ratably over the term of their subscription, which in the case of our contracted customers typically range from one to three years and in the case of our pay-as-you-go customers is typically monthly. In addition, our subscription agreements with certain of our largest customers are structured on a "pool of funds" model in which the customer commits to spend at least a specified amount on our products during the subscription period. These “pool of funds” arrangements do not require the customer to subscribe for specific products or spend any specific amounts during any month, quarter or, if applicable, year of the subscription period, but the funds must be utilized during the subscription period under the terms of these subscription agreements. Additionally, for certain of our products, such as many of our developer platform products, the costs are based on the contracted customers’ amount of usage of the product and there is no obligation to continue to use the product or increase usage. Consequently, any increase or decline in new sales or renewals to our customers in any one period may not be immediately reflected in our revenue for that period. Any such change, however, may affect our revenue in future periods. Accordingly, the effect of downturns or upturns in new sales and potential changes in our rate of renewals may not be fully reflected in our results of operations until future periods. We may also be unable to reduce our cost structure in line with a significant deterioration in sales or renewals or usage of our products that are subject to usage-based pricing. Our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as it is difficult to predict when revenue from new customers will be recognized over the applicable subscription term.

Current wording

We generally recognize revenue from customers ratably over the term of their subscription, which in the case of our contracted customers typically range from one to three years and in the case of our pay-as-you-go customers is typically monthly. In addition, our subscription agreements with certain of our largest customers are structured on a "pool of funds" model in which the customer commits to spend at least a specified amount on our products during the subscription period. These “pool of funds” arrangements do not require the customer to subscribe for specific products or spend any specific amounts during any month, quarter or, if applicable, year of the subscription period, but the funds must be utilized during the subscription period under the terms of these subscription agreements. Additionally, for certain of our products, such as many of our developer platform products, the costs are based on the contracted customers’ amount of usage of the product and there is no obligation to continue to use the product or increase usage. Consequently, any increase or decline in new sales or renewals to our customers in any one period may not be immediately reflected in our revenue for that period. Any such change, however, may affect our revenue in future periods. Accordingly, the effect of downturns or upturns in new sales and potential changes in our rate of renewals may not be fully reflected in our results of operations until future periods and it may be difficult for us to predict the amounts that will be reflected in our results of operations in those future periods. We may also be unable to reduce our cost structure in line with a significant deterioration in sales or renewals or usage of our products that are subject to usage-based pricing. Our subscription model also makes it difficult for us to rapidly increase our revenue through additional sales in any period, as it is difficult to predict when revenue from new customers will be recognized over the applicable subscription term.

Previous wording

Historically, we have financed our operations primarily through the sale of our equity and equity-linked securities as well as payments received from customers using our global cloud network and products. For example, we received substantial proceeds from the issuance and sales of our 0% Convertible Senior Notes due 2026 (the 2026 Notes) and 0% Convertible Senior Notes due 2030 (the 2030 Notes, and together with the 2026 Notes, the Notes). We also entered into a senior secured credit agreement in May 2024 that includes a $400 million revolving credit facility (the Revolving Credit Facility). Although we currently anticipate that our existing cash, cash equivalents, available-for-sale securities, available borrowing under the Revolving Credit Facility, and cash flow from operations will be sufficient to meet our working capital and capital expenditure needs for at least the next 12 months, we may require additional financing. We evaluate financing opportunities from time to time, and our ability to obtain financing will depend, among other things, on our development efforts, business plans, and operating performance, and the condition of the capital markets at the time we seek financing. We cannot assure you that additional financing will be available to us on favorable terms when required, or at all. For example, volatility in equity capital markets has adversely affected and may continue to adversely affect market prices of our shares of Class A common stock. This may materially and adversely affect our ability to fund our business through the sale of our equity and equity-linked securities if such funding were to become necessary. If we raise additional funds through the issuance of equity, equity-linked or debt securities, those securities may have rights, preferences or privileges senior to the rights of our Class A common stock, and, in the case of equity or equity-linked securities, our stockholders may experience dilution.

Current wording

Historically, we have financed our operations primarily through the sale of our equity and equity-linked securities as well as payments received from our customers. For example, we received substantial proceeds from the issuance and sales of our 0% Convertible Senior Notes due 2030 (the 2030 Notes) and 0% Convertible Senior Notes due 2031 (the 2031 Notes, and together with the 2030 Notes, the Notes). We also entered into a senior secured credit agreement in May 2024 that includes a $400 million revolving credit facility (the Revolving Credit Facility). Although we currently anticipate that our existing cash, cash equivalents, available-for-sale securities, available borrowing under the Revolving Credit Facility, and cash flow from operations will be sufficient to meet our working capital and capital expenditure needs for at least the next 12 months, we may require additional financing. We evaluate financing opportunities from time to time, and our ability to obtain financing will depend, among other things, on our development efforts, business plans, and operating performance, and the condition of the capital markets at the time we seek financing. We cannot assure you that additional financing will be available to us on favorable terms when required, or at all. For example, volatility in equity capital markets has adversely affected and may continue to adversely affect market prices of our shares of Class A common stock. This may materially and adversely affect our ability to fund our business through the sale of our equity and equity-linked securities if such funding were to become necessary. If we raise additional funds through the issuance of equity, equity-linked or debt securities, those securities may have rights, preferences or privileges senior to the rights of our Class A common stock, and, in the case of equity or equity-linked securities, our stockholders may experience dilution.

Previous wording

The industry in which we compete is characterized by rapid technological change, including frequent introductions of new products and services, evolving industry standards, changing regulations, and the development of novel cyber attacks by hostile parties, as well as changing customer needs, requirements, and preferences. Our need for continuous innovation is driven not only by competitive forces within our industry but also by our need to out-innovate the highly motivated third parties seeking to breach or compromise our network and those of our customers for economic, political, military, or other purposes.

Current wording

The industry in which we compete is characterized by rapid, AI-enabled technological change, including frequent introductions of new products and services, evolving industry standards, changing regulations, and the development of novel cyber attacks by hostile parties, as well as changing customer needs, requirements, and preferences. Our need for continuous innovation is driven not only by competitive forces within our industry but also by our need to out-innovate the highly motivated, AI-enabled third parties seeking to breach or compromise our network and those of our customers for economic, political, military, or other purposes.

Previous wording

Our ability to attract new customers and retain, and increase, revenue from existing customers will depend in significant part on our ability to anticipate and respond effectively to these forces on a timely basis and continue to introduce enhancements to our network and existing products and develop new products that have the features, and that function with the security, performance, and reliability capabilities, demanded by our customers, especially our large customers. If new technologies or advancements in technologies emerge that deliver competitive products and services at lower prices, more efficiently, more conveniently, more securely or reliably, or are higher performing, these technologies or advancements could render our network and existing products less attractive to our current and prospective future customers, or obsolete. For example, AI and machine learning may change the way our industry identifies and responds to cyber threats, and businesses that are slow to adopt or fail to adopt these new technologies may face a competitive disadvantage. The development of novel attacks or exploits by criminal or malicious elements or hostile state actors also could render our network and existing products less effective or obsolete. If we are unable to develop new products and enhance our existing products so that they have the features and capabilities required by existing and potential new customers, especially large customers, our business, results of operations, and financial condition will be materially and adversely affected.

Current wording

Our ability to attract new customers and retain, and increase, revenue from existing customers will depend in significant part on our ability to anticipate and respond effectively to these forces on a timely basis and continue to introduce enhancements to our network and existing products and develop new products that have the features, and that function with the security, performance, and reliability capabilities, demanded by our customers, especially our large customers. If new technologies or advancements in technologies emerge that deliver competitive products and services at lower prices, more efficiently, more conveniently, more securely or reliably, or are higher performing, these technologies or advancements could render our network and existing products less attractive to our current and prospective future customers, or obsolete. For example, AI and machine learning is changing the speed and frequency of cyber threats and also changing the way our industry identifies and responds to cyber threats, and businesses that are slow to adopt or fail to adopt these new technologies will face a competitive disadvantage. The development of novel attacks or exploits by criminal or malicious elements or hostile state actors also could render our network and existing products less effective or obsolete. If we are unable to develop new products and enhance our existing products so that they have the features and capabilities required by existing and potential new customers, especially large customers, our business, results of operations, and financial condition will be materially and adversely affected.

Previous wording

We face security threats from malicious third parties that could obtain unauthorized access to our internal systems, networks, and data, including the equipment at our network and core co-location facilities. It is virtually impossible for us to entirely mitigate the risk of these security threats and the security, performance, and reliability of our network and products has been in the past, and may be in the future, disrupted by third parties, including nation-states, competitors, hackers, disgruntled employees, former employees, or contractors. For example, in November 2023, we detected that a likely nation-state threat actor had gained unauthorized access to one of our internal systems. While we immediately began investigating the intrusion and believe we cut off the threat actor’s access prior to significant impact on our customer data or systems, we expect we will continue to be subject to similar threats of unauthorized access in the future and we may not be as successful in quickly identifying such intrusions and mitigating the impacts of such intrusions. We also face the possibility of security threats from other sources, such as employee or contractor errors (such as errors in utilizing AI or machine learning in our products or in the operation of our business) or malfeasance. For example, hostile third parties, including nation-states and their agents, in the past have sought direct or indirect employment at Cloudflare, or attempted to bribe, extort, or otherwise manipulate our employees or contractors to compromise our network and products and in the future other hostile third parties may take similar actions. As our business grows and we employ more employees and engage more contractors in more countries around the world, our ability to supervise the actions of our employees and contractors will decrease and the risk of an employee or contractor error or act of malfeasance will increase. These security threats from third parties are also likely to increase as the numbers, sizes, and types of customers using our network and products increases, particularly our customers that are involved in particularly sensitive industries or activities, such as banking and finance companies and governmental entities or in relation to elections in the United States or elsewhere. Additionally, AI and machine learning may increase cybersecurity risks we face through, for example, being used to increase the prevalence or intensity of cyber attacks or to detect, and take advantage of, potential vulnerabilities in our internal systems, networks, and data.

Current wording

We face security threats from malicious third parties that could obtain unauthorized access to our internal systems, networks, and data, including the equipment at our network and core co-location facilities. It is virtually impossible for us to entirely mitigate the risk of these security threats and the security, performance, and reliability of our network and products has been in the past, and may be in the future, disrupted by third parties, including nation-states, competitors, hackers, disgruntled employees, former employees, or contractors. For example, in November 2023, we detected that a likely nation-state threat actor had gained unauthorized access to one of our internal systems. While we immediately began investigating the intrusion and believe we cut off the threat actor’s access prior to significant impact on our customer data or systems, we expect we will continue to be subject to similar threats of unauthorized access in the future and we may not be as successful in quickly identifying such intrusions and mitigating the impacts of such intrusions. We also face the possibility of security threats from other sources, such as employee or contractor errors (including errors in utilizing AI or machine learning in our products or in the operation of our business that could compromise our network and products or our internal systems, networks, and data, or result in the unintentional public disclosure of our or our customers’ confidential data) or malfeasance. For example, hostile third parties, including nation-states and their agents, in the past have sought direct or indirect employment at Cloudflare, or attempted to bribe, extort, or otherwise manipulate our employees or contractors to compromise our network and products and in the future other hostile third parties may take similar actions. As our business grows and we employ more employees and engage more contractors in more countries around the world, our ability to supervise the actions of our employees and contractors will decrease and the risk of an employee or contractor error or act of malfeasance will increase. These security threats from third parties are also likely to increase as the numbers, sizes, and types of customers using our network and products increases, particularly our customers that are involved in particularly sensitive industries or activities, such as banking and finance companies and governmental entities or in relation to elections in the United States or elsewhere. Additionally, AI and machine learning may increase cybersecurity risks we face as they are used to increase the prevalence, intensity, or speed of cyber attacks or to detect, and take advantage of, potential vulnerabilities in our or our customers' internal systems, networks, and data. For example, in October 2026, we implemented mitigations in our web application firewall to address vulnerabilities known as “php2shell” that had been identified in PHP, a widely-used open-source scripting langu…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

The global network that we use to provide our products to our customers is made up of equipment at co-location facilities located in more than 335 cities and over 125 countries worldwide and we expect to continue to increase the size of our network in the future. As we grow the size and scope of our network, the number of our employees and third party contractors that have access to our equipment at these facilities will continue to increase, which will also increase the risk of potential errors or malfeasance such as potential equipment theft or potential attempts to interfere with, or intercept, network and customer data that is held in, or flows through, this equipment. In addition, local government officials may attempt to, or successfully take control of, our equipment in an attempt to interfere with our services or intercept data. Because the equipment in our network co-location facilities is designed to run all of our products, any insertion of ransomware or other malicious code on, unauthorized access to, or other security breach or incident with respect to, any of this equipment at any of these locations around the world could potentially impact all of our products running on this equipment around the world. We may also experience security breaches and other incidents that may remain undetected for an extended period and, therefore, may have a greater impact on our products and the networks and systems used in our business, the proprietary and other confidential data contained on our network or otherwise stored or processed in our operations, and ultimately our business. We expect to incur significant costs in our efforts to detect and prevent security breaches and other security-related incidents, and we have in the past faced, including in connection with the November 2023 intrusion of our systems, and may in the future face, increased costs in the event of actual or perceived security breaches or other security-related incidents. Our internal systems are exposed to the same cybersecurity risks and consequences of a breach as the systems of our customers and other enterprises, any of which could have an adverse effect on our business or reputation. These cybersecurity risks pose a particularly significant risk to a business like ours that is focused on providing highly secure products to customers. With the increase in remote work during recent years, we and our customers face increased risks to the security of infrastructure and data, and geopolitical tensions and conflicts may increase these risks. We cannot guarantee that our security measures will prevent security breaches or incidents. We also may face increased costs relating to maintaining and securing our infrastructure and data that we maintain and otherwise process.

Current wording

The global network that we use to provide our products to our customers is made up of equipment at co-location facilities located in more than 340 cities and over 130 countries worldwide and we expect to continue to increase the size of our network in the future. As we grow the size and scope of our network, the number of our employees and third party contractors that have access to our equipment at these facilities will continue to increase, which will also increase the risk of potential errors or malfeasance such as potential equipment theft or potential attempts to interfere with, or intercept, network and customer data that is held in, or flows through, this equipment. In addition, local government officials may attempt to, or successfully take control of, our equipment in an attempt to interfere with our services or intercept data. Because the equipment in our network co-location facilities is designed to run all of our products, any insertion of ransomware or other malicious code on, unauthorized access to, or other security breach or incident with respect to, any of this equipment at any of these locations around the world could potentially impact all of our products running on this equipment around the world. We may also experience security breaches and other incidents that may remain undetected for an extended period and, therefore, may have a greater impact on our products and the networks and systems used in our business, the proprietary and other confidential data contained on our network or otherwise stored or processed in our operations, and ultimately our business. We expect to incur significant costs in our efforts to detect and prevent security breaches and other security-related incidents, and we have in the past faced, including in connection with the November 2023 intrusion of our systems, and may in the future face, increased costs in the event of actual or perceived security breaches or other security-related incidents. Our internal systems are exposed to the same cybersecurity risks and consequences of a breach as the systems of our customers and other enterprises, any of which could have an adverse effect on our business or reputation. These cybersecurity risks pose a particularly significant risk to a business like ours that is focused on providing highly secure products to customers. With the increase in remote work during recent years, we and our customers face increased risks to the security of infrastructure and data, and geopolitical tensions and conflicts may increase these risks. We cannot guarantee that our security measures will prevent security breaches or incidents. We also may face increased costs relating to maintaining and securing our infrastructure and data that we maintain and otherwise process.

Previous wording

As of June 30, 2026, we hosted our global network and served our customers from co-location and Internet Service Provider (ISP) partner facilities located in more than 335 cities and over 125 countries worldwide. In addition to these global facilities, much of the infrastructure for our global network and for our business and operations is maintained through a core co-location facility located in the greater Portland, Oregon area, a second core co-location facility located in Amsterdam that provides certain redundancy to the U.S. core facility, and through a limited number of other U.S. co-location facilities that provide limited subsets of our network support. While we have electronic and, to a lesser extent, physical access to the components and infrastructure of our network and co-location facilities that are hosted by third parties — including ISP-partner facilities — we do not control the operation of these third-party facilities. Consequently, we may be subject to service disruptions as well as failures to provide adequate support for reasons that are outside of our direct control. All of our co-location and ISP-partner facilities and network infrastructure are vulnerable to damage or interruption from a variety of sources including earthquakes; weather events; floods; fires; power loss; system failures; computer viruses; physical or electronic break-ins; human error; malfeasance; or interference, including by disgruntled employees, former employees, or contractors; military conflicts; terrorism; and other catastrophic events. For example, in November 2023, our control plane and analytics services experienced an outage triggered by a power failure at one of our core data centers in the greater Portland, Oregon area, which impacted certain customers' access to some of our products and services for several days and the loss of certain customer logs. In March 2024, a subsequent power failure occurred at the same core data center in the greater Portland, Oregon area, which impacted certain customers’ access to some of our products for minutes and to our analytics services for several hours. In addition, we have experienced a route leak and a limited number of network outages involving our core and network co-location facilities over the past five years due to a variety of causes. Co-location facilities housing our network infrastructure may also be subject to local governmental or other administrative actions, changes to legal or permitting requirements, labor disputes, and litigation to stop, limit, or delay operations. Despite precautions taken at these facilities, such as disaster recovery and business continuity arrangements, the occurrence of a natural disaster or an act of war or terrorism, a decision to close the co-location facilities without adequate notice, interference with, or sabotage of, our equipment at these facilities, or other unanticipated problems at these facilities could result in interruptions or delays in the availabilit…

Excerpt shortened here; the source contains the full paragraph.

Current wording

As of September 30, 2026, we hosted our global network and served our customers from co-location and Internet Service Provider (ISP) partner facilities located in more than 340 cities and over 130 countries worldwide. In addition to these global facilities, much of the infrastructure for our global network and for our business and operations is maintained through a core co-location facility located in the greater Portland, Oregon area, a second core co-location facility located in Amsterdam that provides certain redundancy to the U.S. core facility, and through a limited number of other U.S. co-location facilities that provide limited subsets of our network support. While we have electronic and, to a lesser extent, physical access to the components and infrastructure of our network and co-location facilities that are hosted by third parties — including ISP-partner facilities — we do not control the operation of these third-party facilities. Consequently, we may be subject to service disruptions as well as failures to provide adequate support for reasons that are outside of our direct control. All of our co-location and ISP-partner facilities and network infrastructure are vulnerable to damage or interruption from a variety of sources including earthquakes; weather events; floods; fires; power loss; system failures; computer viruses; physical or electronic break-ins; human error; malfeasance; or interference, including by disgruntled employees, former employees, or contractors; military conflicts; terrorism; and other catastrophic events. For example, in November 2023, our control plane and analytics services experienced an outage triggered by a power failure at one of our core data centers in the greater Portland, Oregon area, which impacted certain customers' access to some of our products and services for several days and the loss of certain customer logs. In March 2024, a subsequent power failure occurred at the same core data center in the greater Portland, Oregon area, which impacted certain customers’ access to some of our products for minutes and to our analytics services for several hours. In addition, we have experienced a route leak and a limited number of network outages involving our core and network co-location facilities over the past five years due to a variety of causes. Co-location facilities housing our network infrastructure may also be subject to local governmental or other administrative actions, changes to legal or permitting requirements, labor disputes, and litigation to stop, limit, or delay operations. Despite precautions taken at these facilities, such as disaster recovery and business continuity arrangements, the occurrence of a natural disaster or an act of war or terrorism, a decision to close the co-location facilities without adequate notice, interference with, or sabotage of, our equipment at these facilities, or other unanticipated problems at these facilities could result in interruptions or delays in the availa…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Any interruption or delay in our customers’ or partners’ access to our network and products will negatively impact our customers. Our customers depend on the continuous availability of our network for the delivery and use of our products, and our products are designed to operate without interruption, including up to 100% uptime guarantee for our Business and Enterprise plans. If all or a portion of our network were to fail, our customers and partners could lose access to their internal network and/or the Internet as a whole until such disruption is resolved or they deploy disaster recovery options that allow them to bypass our network. The adverse effects of any network interruptions on our reputation and financial condition may be heightened due to the nature of our business and our customers’

Current wording

Any interruption or delay in our customers’ or partners’ access to our network and products will negatively impact our customers. Our customers depend on the continuous availability of our network for the delivery and use of our products, and our products are designed to operate without interruption, including up to 100% uptime guarantee for our Business and Enterprise plans. If all or a portion of our network were to fail, our customers and partners could lose access to their internal network and/or the Internet as a whole until such disruption is resolved or they deploy disaster recovery options that allow them to bypass our network. The adverse effects of any network interruptions on our reputation and financial condition may be heightened due to the nature of our business and our customers’ expectation of continuous and uninterrupted Internet access and low tolerance for interruptions of any duration. In addition, because some of our customers’ most critical applications are protected by our products and network and these customers may not be using other providers for similar services, the adverse effect of network disruptions to these customers could be particularly severe. The impact of an interruption in access to our network and products could also impact the ability to run our own business because we use a number of our products in the operation of our business.

Previous wording

Our products are still evolving and it is difficult to predict customer demand and adoption rates for our product offerings. We believe that our network and cloud-based products represent a major shift from traditional solutions. Many of our potential customers, particularly large enterprises and government entities, face barriers to adopting our offerings because of their prior investment in, and the familiarity of their IT personnel with, on-premises, appliance-based solutions or other providers of cloud-based solutions. As a result, our sales process often involves extensive efforts to educate our customers about our products, particularly as we continue to pursue customer relationships with large organizations. Our customers also expect us to meet voluntary validations or adhere to industry standards and require our policies and practices to be evaluated by an independent third-party assessor. Although we currently have certain certifications and reports such as SOC2 Type 2, PCI DSS, ISO 27001, ISO 27701, and ISO 27018, C5, EU Code of Conduct, Global CBPR, Global PRP, UK Cyber Essentials, ENS, ISMAP, FedRAMP Moderate authorization and IRAP Protected Level, we may not be successful in continuing to maintain those certifications or in obtaining other certifications. In addition, sales to government entities and other large enterprises may in particular be conditioned upon adherence to PBMM or DoD IL4 compliance in Canada and the United States, and we do not currently have these certifications. The costs of obtaining and maintaining certification pursuant to any of these standards are significant, and any failure to obtain and maintain such certifications for our network and products could reduce demand for them, which would harm our business, results of operations, and financial condition. To the extent our competitors have, and we do not have, these certifications, we may lose the opportunity to obtain subscriptions from certain potential paying customers.

Current wording

Our products are still evolving and it is difficult to predict customer demand and adoption rates for our product offerings. We believe that our network and cloud-based products represent a major shift from traditional solutions. Many of our potential customers, particularly large enterprises and government entities, face barriers to adopting our offerings because of their prior investment in, and the familiarity of their IT personnel with, on-premises, appliance-based solutions or other providers of cloud-based solutions. As a result, our sales process often involves extensive efforts to educate our customers about our products, particularly as we continue to pursue customer relationships with large organizations. Our customers also expect us to meet voluntary validations or adhere to industry standards and require our policies and practices to be evaluated by an independent third-party assessor. Although we currently have certain certifications and reports such as SOC2 Type 2, PCI DSS, ISO 27001, ISO 27701, and ISO 27018, C5, EU Code of Conduct, Global CBPR, Global PRP, UK Cyber Essentials, ENS, ISMAP, K-ISMS, FedRAMP Moderate and High authorization and IRAP Protected Level, we may not be successful in continuing to maintain those certifications or in obtaining other certifications. In addition, sales to government entities and other large enterprises may in particular be conditioned upon adherence to PBMM or DoD IL4 compliance in Canada and the United States, and we do not currently have these certifications. The costs of obtaining and maintaining certification pursuant to any of these standards are significant, and any failure to obtain and maintain such certifications for our network and products could reduce demand for them, which would harm our business, results of operations, and financial condition. To the extent our competitors have, and we do not have, these certifications, we may lose the opportunity to obtain subscriptions from certain potential paying customers.

Previous wording

Policies and laws in this area remain highly dynamic, and we may face additional theories of intermediary liability in various jurisdictions. Many policymakers in the United States have called for a re-examination of CDA section 230 and copyright law. The Digital Services Act and Digital Markets Act have gone into effect in the European Union (EU), updating the rules governing digital services like ours and imposing additional legal requirements on certain service providers. In addition, in 2019, the EU approved a Copyright Directive that imposes additional obligations on service providers and failure to comply could give rise to significant liability. More recently, some countries in the EU have adopted or are considering adopting regulatory schemes that impose significant obligations on service providers related to online content and may give rise to fines for alleged noncompliance. For example, in December 2025, an Italian regulator issued an administrative fine of approximately €14.2 million against Cloudflare for alleged failure to comply with its regulatory scheme. Cloudflare is challenging both the fine and the underlying regulation. Other laws and pending legislation at the EU level (terrorist content, child sexual abuse materials) and in the United

Current wording

Policies and laws in this area remain highly dynamic, and we may face additional theories of intermediary liability in various jurisdictions. Many policymakers in the United States have called for a re-examination of CDA section 230 and copyright law. The Digital Services Act and Digital Markets Act have gone into effect in the European Union (EU), updating the rules governing digital services like ours and imposing additional legal requirements on certain service providers. In addition, in 2019, the EU approved a Copyright Directive that imposes additional obligations on service providers and failure to comply could give rise to significant liability. More recently, some countries in the EU have adopted or are considering adopting regulatory schemes that impose significant obligations on service providers related to online content and may give rise to fines for alleged noncompliance. For example, in December 2025, an Italian regulator issued an administrative fine of approximately €14.2 million against Cloudflare for alleged failure to comply with its regulatory scheme. Cloudflare is challenging both the fine and the underlying regulation. Other laws and pending legislation at the EU level (terrorist content, child sexual abuse materials) and in the United Kingdom (online harms), Australia (online harms), and India (Digital India Act), as well as other new laws like them, may also expose Internet companies like us to significant liability. We may incur additional costs to comply with these new laws, which may have an adverse effect on our business, results of operations, and financial condition.

Previous wording

In addition, the United States has enacted the Protecting Americans' Data from Foreign Adversaries Act (PADFA), and the U.S. Department of Justice released a final rule, effective on April 8, 2025, implementing President Biden’s February 2024 Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern”, both of which restrict the transfer of certain types of data to named jurisdictions or covered entities. We have incurred additional costs and invested resources in addressing these new regulations, and as we continue to monitor the impact these new regulations have on our and our customers’ business, we may incur additional costs and may need to invest additional resources in order to make changes to our practices as may be required under these regulations.

Current wording

In addition, the United States has enacted the Protecting Americans' Data from Foreign Adversaries Act (PADFA), and the U.S. Department of Justice released a final rule, effective on April 8, 2025, implementing President Biden’s February 2024 Executive Order 14117, “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern”, both of which restrict the transfer of certain types of data to named jurisdictions or covered entities. We have incurred additional costs and invested resources in addressing these new regulations, and as we continue to monitor the impact these new regulations have on our and our customers’ business, we may incur additional costs and may need to invest additional resources in order to make changes to how we conduct our business as may be required under these regulations.

Previous wording

Laws and regulations regarding the development, use, and deployment of AI technologies in the EU, U.S., and elsewhere are increasing in complexity. For example, the EU AI Act provides for compliance deadlines in 2025 and 2026, and a number of U.S. states have enacted AI governance and safety frameworks or laws or regulations imposing transparency or other obligations in connection with the development, use, or deployment of AI. Further, numerous jurisdictions have proposed legislation to regulate the development, use, and deployment of AI. As we continue to see efforts to regulate this new technology, we have incurred and will continue to incur costs to address the impact, if any, of these laws and regulations regulating AI on our products and practices.

Current wording

Laws and regulations regarding the development, use, and deployment of AI technologies in the EU, U.S., and elsewhere are increasing in complexity and uncertainty. For example, certain obligations under the EU AI Act now apply, with others deferred to 2027 and 2028, and a number of U.S. states have enacted AI governance and safety frameworks or laws or regulations imposing transparency or other obligations in connection with the development, use, or deployment of AI, while the U.S. federal government has sought to limit or preempt certain state AI laws. Further, numerous jurisdictions have proposed legislation to regulate the development, use, and deployment of AI. As we continue to see efforts to regulate this new technology, we have incurred and will continue to incur costs to address the impact, if any, of these laws and regulations regulating AI on our products and practices.

Previous wording

Changes in accounting principles, changes in global tax laws, regulations or rates, or changes in taxing jurisdictions’ administrative interpretations, decisions, policies, and positions could also impact our provision for income taxes. For example, the United States signed into law the One Big Beautiful Bill Act on July 4, 2025, which permanently extends many of the expiring provisions from the Tax Cuts and Jobs Act and modifies a number of international provisions. Additionally, the Organization for Economic Cooperation and Development (OECD) published model rules within the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting (the Inclusive Framework) to address the challenges impacting international operations. The Inclusive Framework includes provisions related to the taxation of the digital economy and the establishment of a 15% global minimum tax under Pillar Two. A number of foreign countries have enacted, or intend to enact, legislation adopting parts of the Inclusive Framework. Any of the foregoing changes, if and to the extent implemented, could have an adverse impact on our results of operations, cash flows, and financial condition.

Current wording

Changes in accounting principles, changes in global tax laws, regulations or rates, or changes in taxing jurisdictions’ administrative interpretations, decisions, policies, and positions could also impact our provision for income taxes. For example, the United States signed into law the One Big Beautiful Bill Act on July 4, 2025, which permanently extended many of the expiring provisions from the Tax Cuts and Jobs Act and modified a number of international provisions. Additionally, the Organization for Economic Cooperation and Development (OECD) published model rules within the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting (the Inclusive Framework) to address the challenges impacting international operations. The Inclusive Framework includes provisions related to the taxation of the digital economy and the establishment of a 15% global minimum tax under Pillar Two. A number of foreign countries have enacted, or intend to enact, legislation adopting parts of the Inclusive Framework. Any of the foregoing changes, if and to the extent implemented, could have an adverse impact on our results of operations, cash flows, and financial condition.

Previous wording

Historically, we have derived a significant portion of our revenue from outside the United States. We derived 49% and 51% of our revenue from our non-U.S. customers for the three months ended June 30, 2026 and 2025, respectively, and 50% and 51% of our revenue from our non-U.S. customers for the six months ended June 30, 2026 and 2025, respectively. We are continuing to adapt to and develop strategies to address international markets and our growth strategy includes expansion into geographies around the world, but there is no guarantee that such efforts will be successful. In addition, our global network includes co-location facilities located in more than 335 cities and over 125 countries worldwide as of June 30, 2026. We expect that our international sales and network activities will continue to grow in the future, as we continue to pursue opportunities in international markets and further grow our network around the world. These international operations will require significant management attention and financial resources and are subject to substantial risks, including:

Current wording

Historically, we have derived a significant portion of our revenue from outside the United States. We derived 48% and 50% of our revenue from our non-U.S. customers for the three months ended September 30, 2026 and 2025, respectively, and 49% and 51% of our revenue from our non-U.S. customers for the nine months ended September 30, 2026 and 2025, respectively. We are continuing to adapt to and develop strategies to address international markets and our growth strategy includes expansion into geographies around the world, but there is no guarantee that such efforts will be successful. In addition, our global network includes co-location facilities located in more than 340 cities and over 130 countries worldwide as of September 30, 2026. We expect that our international sales and network activities will continue to grow in the future, as we continue to pursue opportunities in international markets and further grow our network around the world. These international operations will require significant management attention and financial resources and are subject to substantial risks, including:

Previous wording

•changes in a specific country’s or region’s political or economic conditions, including the impact of elections and other changes in governments;

Current wording

•changes in a specific country’s or region’s political or economic conditions, including the impact of elections, including the recent U.S. midterm elections, and other changes in governments;

Previous wording

As discussed in greater detail above in our risk factor titled "Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business," the continued evolution of privacy and data protection laws and their application in a number of countries and supranational organizations have created uncertainty around the requirements related to transfers of personal data between jurisdictions, including transfers to the United States. As a result of this uncertainty, our current and potential customers in certain regions may be concerned about whether they are able to transfer personal data to the United States in connection with the usage of our global network and products. If these concerns result in our current and potential customers in those regions reducing their usage of our products, then our results of operations could be adversely impacted. In addition, we anticipate needing to identify different transfer mechanisms and/or change our use of certain standard contractual clauses in order to lawfully transfer certain personal data from those regions to the United States. Further, customer demands that we avoid transferring data to specific regions, including the United States, might require us to adapt our products and services or make it difficult to sell to customers in certain industries. This could result in substantial costs, require changes to our policies and business practices, require us to engage in additional contractual obligations, limit our ability to provide certain products in certain jurisdictions, or materially adversely affect our business and operating results.

Current wording

As discussed in greater detail above in our risk factor titled "Our actual or perceived failure to comply with privacy, data protection, information security, AI, and other applicable laws, regulations, and obligations could harm our business," the continued evolution of privacy and data protection laws and their application in a number of countries and supranational organizations have created uncertainty around the requirements related to transfers of personal data between jurisdictions, including transfers to the United States. As a result of this uncertainty, our current and potential customers in certain regions may be concerned about whether they are able to transfer personal data to a location outside their home regions, including but not limited to, the United States in connection with the usage of our global network and products. If these concerns result in our current and potential customers in those regions reducing their usage of our products, then our results of operations could be adversely impacted and/or we may be required to invest in changes to our infrastructure and network. In addition, we anticipate needing to identify different transfer mechanisms and/or change our use of certain standard contractual clauses in order to lawfully transfer certain personal data from those regions to the United States or other third countries. Further, customer demands that we avoid transferring data to specific regions, including the United States, might require us to adapt our products and services or make it difficult to sell to customers in certain industries. This could result in substantial costs, require changes to our policies and business practices, require us to engage in additional contractual obligations, limit our ability to provide certain products in certain jurisdictions, or materially adversely affect our business and operating results.

Previous wording

On September 29, 2025, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) released an interim final rule that expanded export control restrictions and licensing requirements under the EAR Entity List and Military End-User List to foreign entities that are 50% or more owned by one or more parties on those lists, which BIS has labeled the “Affiliates rule.” Although the Affiliates rule was suspended for a period of one year on November 10, 2025, the Affiliates rule, if implemented, would significantly raise the bar for compliance with EAR by imposing an affirmative responsibility to know the ownership of the foreign companies that are parties to any transactions. Even though we take precautions and have implemented policies and practices to assist in compliance, there is a risk that we may not be in full compliance with these laws.

Current wording

On September 29, 2025, the U.S. Department of Commerce’s Bureau of Industry and Security (BIS) released an interim final rule that expanded export control restrictions and licensing requirements under the EAR Entity List and Military End-User List to foreign entities that are 50% or more owned by one or more parties on those lists, which BIS has labeled the “Affiliates rule.” Although the Affiliates rule has been suspended until January 10, 2027, the Affiliates rule, if implemented, would significantly raise the bar for compliance with EAR by imposing an affirmative responsibility to know the ownership of the foreign companies that are parties to any transactions. Even though we take precautions and have implemented policies and practices to assist in compliance, there is a risk that we may not be in full compliance with these laws.

Previous wording

We own a large number of patents, copyrights, trademarks, domain names, and trade secrets and, from time to time, are subject to litigation based on allegations of infringement, misappropriation, or other violations of intellectual property or other rights. As we face increasing competition and gain an increasingly high profile, the possibility of intellectual property rights claims, commercial claims, and other assertions against us grows. In addition, a number of companies in our industry hold a large number of patents and also protect their copyright, trade secret, trademark, and other intellectual property rights, and companies in the networking and security industry frequently enter into litigation based on allegations of patent infringement or other violations of intellectual property rights. We have in the past been, are currently, and may from time to time in the future become, a party to litigation and disputes related to intellectual property, our business practices, and our products. For example, we are a defendant in lawsuits, both in the United States and abroad, seeking injunctive relief and/or damages against us based on claims of alleged patent infringement and claims of alleged copyright infringement through content on our customers’ websites. Courts in some countries have found that we may be held liable in certain circumstances for damages arising from infringement on a customer’s website or directed us to take action by removing access to content of certain websites and other Internet properties on our network. We may also be subject to governmental and other regulatory investigations from time to time. The costs of supporting litigation and dispute resolution proceedings are considerable, and there can be no assurances that a favorable outcome will be obtained. Disputes, whether or not favorably resolved, also may generate negative publicity and damage our reputation. We may need to settle litigation and disputes on terms that are unfavorable to us, or we may be subject to an unfavorable judgment that may not be reversible upon appeal. The terms of any settlement or judgment may require us to cease some or all of our operations or pay substantial amounts to the other party. With respect to any intellectual property rights claim, we may have to seek a license to continue practices found to be in violation of third-party rights, which may not be available on reasonable terms and may significantly increase our operating expenses. A license to continue such practices may not be available to us at all, and we may be required to develop alternative non-infringing technology or practices or discontinue the practices. The development of alternative, non-infringing technology or practices could require significant effort and expense. Our business, results of operations, and financial condition could be materially and adversely affected as a result.

Current wording

We own a large number of patents, copyrights, trademarks, domain names, and trade secrets and, from time to time, are subject to litigation based on allegations of infringement, misappropriation, or other violations of intellectual property or other rights. As we face increasing competition and gain an increasingly high profile, the possibility of intellectual property rights claims, commercial claims, and other assertions against us grows. In addition, a number of companies in our industry hold a large number of patents and also protect their copyright, trade secret, trademark, and other intellectual property rights, and companies in the networking and security industry frequently enter into litigation based on allegations of patent infringement or other violations of intellectual property rights. We have in the past been, are currently, and may from time to time in the future become, a party to litigation and disputes related to intellectual property, our business practices, and our products. For example, we are a defendant in lawsuits, both in the United States and abroad, seeking injunctive relief and/or damages against us based on claims of alleged patent infringement and claims of alleged copyright infringement through content on our customers’ websites. Courts in some countries have found that we may be held liable in certain circumstances for damages arising from infringement on a customer’s website or directed us to take action by removing access to content of certain websites and other Internet properties on our network. We may also be subject to governmental and other regulatory investigations from time to time.

Previous wording

We rely and expect to continue to rely on a combination of patent, patent licenses, trade secret, domain name protection, trademarks, copyrights, and confidentiality and license agreements with our employees, consultants, and third parties in order to protect our intellectual property rights and proprietary information. As of June 30, 2026, we had 390 issued patents and 75 pending patent applications in the United States and abroad. However, third parties may knowingly or unknowingly infringe our intellectual property rights. Third parties may challenge our intellectual property rights, pending and future patent, trademark, and copyright applications may not be approved, and we may not be able to prevent infringement, misappropriation, or violations of our intellectual property rights without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes, and we provide access to these technologies and processes to certain of our vendors and partners, including JD Cloud with respect to the facilities included within China. We must protect this proprietary information in order to realize commercial benefit from our investment.

Current wording

We rely and expect to continue to rely on a combination of patent, patent licenses, trade secret, domain name protection, trademarks, copyrights, and confidentiality and license agreements with our employees, consultants, and third parties in order to protect our intellectual property rights and proprietary information. As of September 30, 2026, we had 392 issued patents and 78 pending patent applications in the United States and abroad. However, third parties may knowingly or unknowingly infringe our intellectual property rights. Third parties may challenge our intellectual property rights, pending and future patent, trademark, and copyright applications may not be approved, and we may not be able to prevent infringement, misappropriation, or violations of our intellectual property rights without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes, and we provide access to these technologies and processes to certain of our vendors and partners, including JD Cloud with respect to the facilities included within China. We must protect this proprietary information in order to realize commercial benefit from our investment.