Cloudflare, Inc. — Q3 2023 Form 10-Q
Reporting period: Quarter and nine months ended September 30, 2023. Unaudited U.S. GAAP financial statements. Unless otherwise noted, amounts are USD millions.
Business context
Cloudflare provides cloud-based security, performance, and reliability services through a global network. Revenue is primarily subscription and support revenue. The company reports one operating segment; 48% of Q3 revenue came from outside the United States.
Financial performance
| Metric | Q3 2023 | Q3 2022 | Nine months 2023 | Nine months 2022 |
|---|---|---|---|---|
| Revenue | $335.6 | $253.9 | $934.3 | $700.5 |
| Gross profit | $257.5 | $191.9 | $710.6 | $535.7 |
| Gross margin | 77% | 76% | 76% | 76% |
| Operating loss | $(39.2) | $(45.9) | $(142.7) | $(150.5) |
| Net loss | $(23.5) | $(42.5) | $(156.1) | $(147.5) |
| Net loss per share | $(0.07) | $(0.13) | $(0.47) | $(0.45) |
Q3 revenue grew 32% year over year; nine-month revenue grew 33%. Q3 operating margin was negative 12%, versus negative 18% a year earlier. Non-GAAP operating margin was 13% versus 6% in Q3 2022; the company’s non-GAAP measure excludes stock-based compensation and related payroll taxes, acquired-intangible amortization, and certain acquisition-related expenses.
Interest income rose to $18.0 million in Q3 and $48.0 million year to date, primarily due to higher interest rates. Q3 net loss narrowed, while nine-month net loss increased, including a $50.3 million debt-extinguishment loss associated with repurchasing 2025 Notes.
Cash flow, liquidity and debt
- Q3 operating cash flow was $68.1 million and free cash flow was $34.9 million (10% margin). For the first nine months, operating cash flow was $169.0 million and free cash flow was $68.7 million (7% margin), compared with negative $73.4 million free cash flow in the prior-year period.
- At September 30, cash and cash equivalents were $94.1 million and available-for-sale securities were $1,480.2 million. Current assets were $1,858.0 million versus current liabilities of $477.8 million. The investment portfolio was investment grade, with an average AA+ rating.
- The 2026 zero-coupon convertible notes had $1,293.8 million principal outstanding and a $1,282.4 million net carrying amount; disclosed fair value was $1,101.5 million. The 2025 Notes were fully settled or repurchased, with none outstanding at quarter-end.
- Management said existing cash, cash equivalents, and securities should cover working capital and capital expenditure needs for at least 12 months. The company reported an accumulated deficit of $996.0 million and expects operating losses and cash flow to fluctuate as it invests for growth.
- Non-cancelable purchase and bandwidth/co-location commitments totaled $194.0 million; operating lease liabilities totaled $136.7 million. These commitments are in addition to the 2026 Notes.
Material changes and operating indicators
- Paying customers increased 17% year over year to 182,027; customers with annualized revenue above $100,000 rose to 2,558 from 1,908.
- Dollar-based net retention was 116%, down from 124% a year earlier, indicating slower expansion within the measured existing-customer cohort.
- Remaining performance obligations were $1,083.0 million; the company expected to recognize 75% within the next 12 months.
- Stock-based compensation was $73.8 million in Q3 and $199.6 million for the nine months, materially affecting GAAP operating results. Operating expenses increased 25% in Q3 and 24% year to date.
- Q3 gross margin remained broadly stable despite higher network, co-location, depreciation, technology-service, and employee costs. Management cited customer growth and expansion as revenue drivers.
Outlook, risks and unusual items
- The filing provides no numerical revenue or earnings guidance. Management expects continued investment in network infrastructure, product development, sales and marketing, and personnel; operating expenses are expected to rise in absolute dollars in the foreseeable future. Profitability timing remains uncertain.
- Management reported macroeconomic effects including longer sales cycles, slower pipeline conversion, higher days sales outstanding, customer churn, and delayed payments. It warned these trends could recur amid economic uncertainty and geopolitical conflicts.
- During August and September, a threat actor used an HTTP/2 vulnerability to launch unusually large DDoS attacks. Some network components were overloaded and several customers experienced performance impacts; Cloudflare said these were quickly resolved and had no material impact on reputation or financial results.
- A voluntary OFAC self-disclosure concerning potential sanctions violations remains under review. The company has recognized no loss because a loss was not considered probable and the possible range was not estimable. Other export-control disclosures were closed without penalties. Management said no pending or threatened legal proceeding was then likely to have a material adverse financial effect, while noting litigation outcomes are uncertain.
- Key risks include continued losses, slower growth, customer retention and large-customer concentration exposure, intense competition, security incidents or outages, reliance on network and ISP/co-location partners, privacy and regulatory obligations, international operations and the JD Cloud relationship in China, and repayment or conversion obligations on the 2026 Notes.
Important facts for investors to verify
- Whether revenue growth and customer expansion can hold up as net retention has declined to 116% and macroeconomic sales-cycle pressures persist.
- Whether operating cash flow and free cash flow remain positive after infrastructure investment, note-related payments, and working-capital changes.
- The scale and trajectory of stock-based compensation, its effect on GAAP losses, and potential shareholder dilution.
- The terms, potential conversion or cash-settlement exposure, and maturity obligations of the $1.294 billion 2026 Notes.
- Any developments in the open OFAC review, customer-content litigation, regulatory requirements, or network-security and availability incidents.