Over the coming weeks, we’ll publish a series of notes on the leaders we find most remarkable today. This first piece outlines the framework and mental models behind how we form those views.

Why leadership matters

A comment from Shopify’s Tobi Lütke in his recent Acquired interview stuck with me: “consensus is always the absence of leadership.” His point was that consensus-driven decisions tend to focus on avoiding downside rather than pursuing upside, which naturally leads to middling outcomes—often a six or seven out of ten.

Leaders, by contrast, step in and take the reins. They make the hard calls—the ones that may be unpopular in the moment but often prove to be the best long-term bets. The people who can do this well tend to combine control, alignment, and a clear sense of direction, all qualities we look for in the leaders of the businesses we invest in.

While founders often embody these qualities, we think “re-founders” can have an equivalent impact. These are leaders who steer a company in a fundamentally new direction—so much so that the organisation feels rebuilt from first principles. They secure genuine buy-in from both the board and the team, and they operate with the same clarity and authority as a founder. Satya Nadella is the clearest example in recent memory.

From left to right: Tobi Lütke (Shopify), Jensen Huang (Nvidia), Satya Nadella (Microsoft)

The 6 factors we view as critical to long-term value creation

Before diving into individual leaders, it’s helpful to outline the traits we consistently see in those who build durable, compounding value. We group them into six factors, starting with the most foundational: control.

1. Control

The ability to make unconventional decisions without being slowed or vetoed by boards, committees, or internal politics.

Category-defining companies are usually built by CEOs with unilateral decision rights — the room to try something that looks wrong in the moment and obvious in hindsight.

2. Vision

A coherent, durable, long-range mission that shapes everything: product priorities, hiring, culture, capital allocation, and how the company speaks to the world.

Long-term compounding works only when a CEO sees further than the market and acts on that view consistently.

3. Skin in the Game

Leaders who are economically and reputationally aligned with long-term value creation behave differently.

You want decision-makers who win when shareholders win — and who feel the downside alongside them when they miss.

4. Operator Depth

High-context leaders stay close to product, engineering, hiring, customer issues, and day-to-day execution.

Over time, they build an internal model of the business that enables faster, cleaner decisions. Low-context leaders outsource this understanding to layers of management — and mediocrity accumulates.

5. Intellectual Leadership

The ability to generate insight, articulate mental models, and shape a field’s direction.

Companies tend to absorb the CEO’s thinking style; the best CEOs end up out-innovating their competitors’ strategy teams.

6. Compounding Skill

The rate at which a CEO learns — ideally faster than the market, faster than the board, and faster than competitors.

Compounding leaders pivot quickly, integrate feedback without ego defensiveness, and expand their scope of competence over time.

These six factors form the backbone of how we think about exceptional leadership and long-term value creation. From here, we’ll use this framework to examine a range of leaders who bring these ideas to life in very different ways.

In the coming weeks, we’ll explore a handful of the leaders we admire most. Those examples will make the ideas here far more concrete — so it’s worth keeping an eye out.

While the path ahead is bumpier than the last decade, the company’s role in the open internet—neutral, data-rich, and increasingly infrastructural—still supports a constructive long-term outlook. This article unpacks the competitive dynamics behind today’s pessimism and why the current price may offer an attractive entry point for long-horizon investors.

Who is The Trade Desk?

Founded in 2009, The Trade Desk (TTD) grew out of Jeff Green’s belief that digital advertising should function more like a modern, rules-based market—transparent, automated, and driven by data rather than relationships. Green often framed the mission simply: build the “Goldman Sachs of advertising,” a platform where pricing is clear, decisions are made in real time, and buyers have granular control over how and where budgets are deployed.

Green spent his early career pushing against structural inefficiencies in the digital ad market. After selling AdECN—among the first electronic ad exchanges—to Microsoft in 2007, he saw up close how closed systems and opaque pricing limited advertiser control and muddied price discovery. That experience shaped his conviction that digital advertising would eventually resemble modern financial exchanges.

TTD was his attempt to build that marketplace—an independent demand‑side platform (DSP) where advertisers and agencies can plan, manage, optimise, and measure campaigns programmatically across channels such as CTV, mobile, audio, and display.

From day one, Green positioned TTD not as an agency competitor but as the infrastructure that supports them. That neutrality has long been both a strength and a limitation: TTD earns trust because it doesn’t own media or consumer relationships, but it also gives up the control that integrated platforms enjoy.

That trade-off worked when data and inventory were abundant, but the question now is whether neutrality has run its course—and whether investors should underwrite structurally lower share gains and a slower mix shift toward the highest-yielding inventory.

The market for advertising

The Ad Tech ecosystem

The ad-tech ecosystem is crowded and often confusing, with many intermediaries sitting between advertisers and publishers. TTD’s role is to simplify this path by giving buyers a single place to access inventory across channels and exchanges. The below visuals from the company’s Q2 2025 investor presentation highlight this structure, but the key point is straightforward: TTD acts as the connective layer that helps buyers navigate a fragmented landscape.

This matters because advertising is one of the largest markets globally, with nearly $1 trillion in annual spend. TTD sits inside the $135b open-internet portion of that market—a slice defined by its accessibility to independent platforms and its mix of video, retail media, and other digital formats. With TTD’s take rate sitting around c.20%, this translates to TAM of c.$26b.

With TTD’s revenue at $2.4b today, that equates to about 9% penetration of its current addressable market—forecast to grow 5–7% annually. While that offers a healthy runway, sustaining 15–20% growth implicitly requires continued market share gains over time.

Ecosystem overview

Source: The Trade Desk investor presentation Q2 2025

Video

Video—especially Connected TV (CTV)—is the largest and fastest‑growing part of the open internet. Analysts estimate CTV makes up roughly 50% of TTD’s $2.4b revenue base, and it remains the company’s main growth engine as budgets move from linear TV into streaming.

Linear still commands c.$140b in global ad spend, more than 3x the size of today’s CTV market, which shows how much runway remains. For TTD specifically, the ceiling is set less by total CTV growth and more by how much of that linear-to-streaming migration remains accessible via independent pipes rather than locked into vertically integrated sales channels.

Retail

Retail media is becoming a more important focus for TTD. Retailers use their first‑party shopping data to target ads with high intent, and this data can be activated in two main ways:

• Onsite: Ads shown on a retailer’s own websites (e.g. sponsored listings on Walmart.com).

• Offsite: Ads that use retailer data to reach consumers across the open internet (e.g. Walmart ads on YouTube) and direct them back to the retailer’s platform.

Other channels

Beyond video and retail, TTD supports other formats that round out its role as a unified programmatic platform:

• Audio: Ads on streaming music, podcasts, and internet radio.

• Digital Out‑of‑Home (DOOH): Ads on physical screens like billboards and transit hubs.

• Display & Native: Traditional digital units—from banner ads to in‑feed formats—that offer broad reach and brand‑safe placements.

Growth areas

TTD’s near-term focus remains CTV and retail media, especially in North America, where the company generates c.90% of its revenue. Those are also the highest-yielding parts of the mix, which means success here has an outsized impact on both growth and gross margin durability.

Beyond this, several other vectors can drive expansion:

• Expanding client base: TTD is using AI to widen its TAM. Its Koa AI copilot automates campaign setup and optimisation, helping smaller advertisers buy programmatically without agency support.

• Geography: North America accounts for c.90% of TTD’s revenue but only c.40% of global ad spend, leaving meaningful international headroom as programmatic adoption accelerates abroad.

• Channel expansion: More nascent formats—such as audio and DOOH—have room to grow, especially as cross-channel data improves targeting and measurement.

Magna 2024 Global Ad Spend Forecast

Source: The Trade Desk investor presentation Q2 2025

Competitive landscape

The industry is dominated by a few scale players

Programmatic advertising naturally rewards scale. Large advertisers often consolidate spend with a small number of DSPs to get cleaner cross-channel measurement, tighter frequency control, and better activation of their first- and third-party data. These feedback loops reinforce themselves—more demand leads to better optimisation, which attracts more demand. As a result, independent DSPs tend to drift toward winner-take-most dynamics, with the top one or two platforms capturing the bulk of scaled, multi-market agency relationships and the associated data exhaust.

This dynamic benefits TTD. It is the largest independent DSP in a field dominated by a few vertically integrated (“walled garden”) rivals, most notably Google’s DV360 and Amazon Advertising. While those platforms are anchored in their own ecosystems, TTD’s neutrality positions it as the scaled alternative across the open internet.

TTD positioned as the open market’s neutral alternative

TTD’s model is built around neutrality. Unlike walled gardens, it doesn’t own media or prioritise any publisher. Instead, it gives advertisers access to a wide mix of inventory through more than 100 integrated ad exchanges and SSPs. This independence lets TTD aggregate demand from agencies and brands and connect them to publishers across the open web. Walled gardens, by contrast, control both the inventory and the underlying user data.

Although walled gardens still capture the bulk of digital ad spend—roughly 50–70%—attention is fragmenting across streaming, audio, and retail media. As budgets follow that fragmentation, the case for an independent DSP that can unify reach, measurement, and identity across channels becomes stronger.

Recent issues and reasons for decline

In its Q4 FY24 earnings release (12 Feb 2025), TTD announced a major re‑organisation of its go‑to‑market teams—an implicit acknowledgement of rising competitive pressure in CTV and retail media.

Management also guided to slower growth, forecasting $575m of revenue for 1Q FY25, or +17% YoY — well below the 25–30% pace investors had grown accustomed to.

TTD share price

Source: Koyfin (10 Nov 2025)

Management pointed to temporary advertiser caution and uneven CTV ramp timing as the main drivers of slower growth. Investors read it differently, viewing the guidance as a sign of competitive pressure and possible share loss in premium CTV inventory. The market effectively reset the medium-term growth expectation from “compound in the high-20s” to “mid-teens with more uncertainty around CTV share.”

The stock fell c.30% after the release and continued to drift lower, with the multiple compressing from a “category winner” premium toward the low end of high-growth software peers.

A strong 1Q FY25 beat briefly lifted sentiment, but the rebound faded as management reiterated softer guidance in 2Q and 3Q. Shares now trade roughly 70% below the 52‑week high at c.7x LTM revenue — lower than nearly any other company with a similar growth trajectory and margin profile.

Has TTD lost its competitive edge?

Amazon’s competitive re-positioning

Amazon has been a competitor for years, but over the past 12–18 months its DSP has shifted from adjacent to directly competitive with TTD. Historically, Amazon’s ad business centred on retail media—monetising on‑site search and display inside its marketplace. Today, it has broadened into a full‑funnel ecosystem spanning retail, streaming, and third‑party inventory.

Amazon now blends its first‑party retail and streaming data with proprietary inventory and lower platform fees to create a closed, high‑performing DSP that appeals to performance‑oriented advertisers. This strategy accelerated in 2024–2025 as Amazon secured new CTV distribution and ad‑sales partnerships with Disney, Roku, and Netflix. Alongside its expanding Fire TV footprint and retail‑media network, these agreements give Amazon preferential access to high‑value CTV impressions that were once available through open‑internet exchanges.

For TTD, Amazon’s CTV push hits a core growth driver. As Amazon secures more premium CTV supply, the share available to independent DSPs shrinks—a dynamic that could constrain TTD’s long‑term growth if it continues.

The strategic risk extends beyond inventory access. For commerce‑heavy marketers, Amazon’s DSP can become the default performance rail: retail data, streaming inventory, and closed‑loop attribution all live in one place. Agencies will continue to multi‑home, but high‑intent, data‑rich campaigns may drift toward Amazon, leaving TTD with a mix that is more upper‑funnel and less defensible.

Threats from other ‘walled garden’ DSPs

Beyond Amazon, TTD also competes with integrated giants like Google DV360 and Meta Ads Manager. These platforms optimise for yield and data retention within their own ecosystems, trading neutrality for control. While they overlap with TTD across display, video, and CTV, their competitive positioning differs from Amazon’s in two important ways.

First, Google and Meta are inventory‑anchored. Their DSPs exist primarily to monetise owned media—YouTube and Search for Google; Instagram and Facebook for Meta—rather than to win share across the open internet. They have massive reach and unique data, but little incentive to push spend outside their walls.

Second, advertisers treat them as complements, not substitutes. Brands buy walled‑garden impressions through Google and Meta directly, then use TTD to manage everything else. Amazon, by contrast, is building a closed‑loop DSP explicitly designed to become the primary performance rail across both open and closed inventory. That makes Amazon’s threat more direct and strategically significant.

The shifting privacy landscape

Privacy changes remain a structural challenge for TTD—less so in CTV, which is already cookie‑less, but more so across mobile and display. The deprecation of third‑party cookies, Apple’s App Tracking Transparency rules, and tighter US and EU regulations have all reduced the signal density that independent platforms rely on. Because TTD’s mobile and display channels still depend on these signals, the shift puts it at a relative disadvantage and limits its ability to deliver higher‑value targeting.

Management is betting that Unified ID 2.0, retail‑media data partnerships, and AI‑driven contextual tools can help offset this signal loss (see discussion of these in the next section below). These are long‑term solutions, and adoption will take time, but they give TTD a credible path to maintaining performance without relying on the kind of vertically integrated identity stacks that regulators are increasingly scrutinising.

Looking ahead, regulators could be both headwind and tailwind—restricting cross‑site tracking while also increasing scrutiny of data concentration inside walled gardens. TTD’s neutrality and privacy‑forward posture position it as a potential part of the solution rather than part of the problem.

How is TTD responding?

Refreshing its senior bench

To address execution challenges and sharpen its go‑to‑market focus, TTD has refreshed several top leadership roles. The recent hires all bring deep experience scaling global ad and software businesses:

• Anders Mortensen — Chief Revenue Officer: 25 years of experience scaling large advertising organisations, most recently at Google, where he helped lead one of its fastest‑growing ad units.

• Vivek Kundra — Chief Operating Officer: Long track record operating high‑growth software businesses, including at Salesforce, where he helped revenue grow from $2b to more than $8b.

• Alex Kayyal — Chief Financial Officer: Two decades as an investor and operator across global tech companies, most recently as a Partner at Lightspeed and previously in senior roles at Salesforce Ventures.

• Omar Tawakol — Board Member: Deep background in AI, data, and advertising, with a history of building and scaling platforms in adjacent markets.

Taken together, these appointments signal a clear intent: strengthen execution, improve global reach, and prepare the organisation for its next phase of growth.

Strategic initiatives

To regain momentum, TTD is doubling down on two long‑term initiatives—OpenPath and Unified ID 2.0 (UID2). Both are designed to anchor TTD more deeply within the open‑internet infrastructure.

Each carries execution risk, but together they offer the clearest route to re‑accelerating growth: improving data visibility, expanding margin capture, and strengthening TTD’s role in identity and measurement, especially in CTV where fragmentation and walled‑garden competition are most acute.

OpenPath – Vertical integration on the demand side

OpenPath connects advertisers directly to publishers, reducing reliance on third‑party SSPs and improving transparency, pricing efficiency, and data feedback loops. As adoption grows, more spend can flow through TTD’s own pipes, lifting take‑rates and deepening performance data. Even a modest mix shift of total spend onto OpenPath-enabled supply can add incremental gross margin leverage, which matters in a model where operating expenses are largely fixed in the near term.

Openpath overview

Source: The Trade Desk investor day presentation October 2022

OpenPath does create tension with SSPs. Historically, SSPs aggregated supply while TTD aggregated demand; now, by offering a direct route, TTD competes for the same economics and data exhaust. Some SSPs may tilt toward rival DSPs, though the broader industry shift toward supply‑path optimisation helps mute this risk.

Early results are promising. OpenPath is live with dozens of publishers and more than 11,000 destinations across CTV, mobile, display, and audio. Freestar’s integration delivered a 3× improvement in inventory fill rates and a 27% lift in programmatic revenue within six months, and major partners like Disney and Warner Bros Discovery have responded positively.

If OpenPath reaches scale, its biggest impact will be less about fee capture and more about strengthening TTD’s underlying advantages: richer log‑level data, tighter optimisation loops, and more bespoke buyer–publisher connections.

UID2 – Identity in a privacy-frst world

UID2 is an open‑source identity framework designed for a privacy‑centric future. It allows advertisers to target and measure audiences without third‑party cookies, using encrypted, login‑based identifiers. If adoption reaches critical mass, UID2 could give the open internet a persistent identity layer that functions more like the first‑party systems of Amazon or Google and, importantly, would reduce the relative performance gap that currently justifies premium budgets flowing toward those closed ecosystems.

Together with OpenPath, UID2 aims to restore some of the closed‑loop precision of walled gardens while maintaining interoperability and neutrality. Adoption will depend on publishers, retailers, and regulators, and policy shifts could either accelerate or slow momentum.

Early signs are encouraging. Warner Bros Discovery has integrated UID2 across its entertainment, sports, news, and lifestyle brands (including Max and Discovery+), and Walmart Connect is actively testing the framework. In Europe, EUID—the regional counterpart—is gaining traction with partners such as DAZN, Bacardi, Kimberly‑Clark, Aller Media, Future, OneFootball, Prisma Media, and Tesco.

One nuance is that UID2’s biggest risk may be its own success. As an open protocol, it is designed for broad adoption rather than exclusivity. If it becomes the dominant standard, TTD’s role as steward could yield deeper integrations and advantaged data flows—but it could also flatten into shared infrastructure that competitors can access on similar terms. The open question is whether UID2 becomes a differentiator for TTD or simply the mechanism that keeps the open web competitive.

Competitive analysis and outlook

One useful way to gauge TTD’s long-term resilience is through Hamilton Helmer’s 7 Powers framework. While TTD doesn’t enjoy the overpowering moats that protect platforms like Google or Amazon, it has assembled a mix of moderate, mutually reinforcing advantages — scale-driven optimisation, increasing switching costs, and a founder-led operating culture that keeps the organisation fast and focused. These strengths don’t produce winner-take-all dominance, but they have kept customer retention above 95% for more than a decade, which is its own quiet mark of resilience.

The landscape around TTD, however, is changing. Amazon keeps widening its edge in CTV by locking down premium inventory and blending it with rich retail and streaming data, creating performance levels that TTD can’t always match. Even so, a meaningful set of publishers remain wary of handing too much data or leverage to Amazon. For them, TTD’s neutrality, interoperability, and steady role in the open internet make it a comfortable and credible counterweight. That positioning may not eliminate the competitive pressure, but it does preserve TTD’s relevance as the market rebalances.

7 Powers analysis

1. Counter Positioning – Weak but durable

TTD’s independence is its most visible point of differentiation: while Google and Amazon design their DSPs to reinforce the value of their own media properties, TTD positions itself as the neutral broker in the middle. That distinction matters, but it doesn’t rise to the level of true counter positioning. For a company to hold that Power, incumbents must experience real economic pain if they try to imitate the entrant’s model. Here, the opposite is true. Google and Amazon remain integrated because it is more profitable for them, not because TTD’s approach would undermine their economics.

That leaves TTD with a form of differentiation that is weak but durable. Its neutrality builds trust, encourages publishers to share data, and positions the company as a stabilising force in the open internet. These benefits reinforce other moats, but they do not compound on their own — making this a steady, rather than transformative, source of advantage.

2. Scale Economies – Moderate and increasing

TTD’s scale advantage doesn’t stem from cheaper infrastructure; it shows up in the quality of outcomes. Each additional impression feeds richer log-level data into the system, refining bidding models and tightening identity resolution. Models trained on a decade of auction history simply make better decisions than those trained on a year’s worth — and that performance gap tends to compound over time.

Scale also unlocks more practical benefits: broader reach, better frequency management, and cleaner cross-channel measurement. As CTV and retail media add more signal into the system, these advantages strengthen. TTD will never approach Google or Amazon in absolute scale, but within the independent DSP universe, it is clearly pulling ahead — and the economics of that position look more like a structurally high-teens grower with stable margins than a commoditised software vendor competing on price.

3. Network Economies – Weak and increasing

TTD does benefit from network effects, but they manifest in quiet, incremental ways rather than the sharp flywheels seen in classic platform businesses. As more advertisers and publishers participate, the system accumulates denser auction data, broader identity graphs, and smoother optimisation. These improvements lift overall performance, though the effects tend to diffuse gradually rather than accelerate dramatically.

UID2 and OpenPath could strengthen these dynamics. If they gain broad adoption, TTD could evolve into more of a connective layer for the open internet — a shared standard that improves efficiency for both buyers and sellers. But adoption is shaped as much by politics as by technology. Large publishers and retailers must trust that these tools serve the ecosystem rather than tilt advantage toward TTD. If that trust holds, the network effects could become meaningfully stronger.

4. Switching Costs – Moderate and increasing

Switching away from TTD is technically possible, but the practical friction is high. Brands and agencies have years of audience definitions, creative assets, measurement frameworks, and model history embedded in the platform. Moving to a new DSP means walking away from that accumulated optimisation — and because bidding models learn from experience, any replacement starts from a weaker foundation.

Identity workflows make the transition even harder. Once a brand’s CRM feeds, conversion events, and household graphs are wired into TTD, rebuilding that architecture elsewhere is slow, lossy, and often comes with a hit to performance. Day-to-day habits add another layer: planning, trafficking, reporting, and creative rotation are deeply ingrained in TTD’s interface.

Agencies amplify this inertia. Retraining large teams, reworking operational processes, and re-establishing data and inventory integrations is expensive and disruptive, which makes full-scale switching rare outside of major failures. Most agencies standardise globally, and TTD is now one of the few independent DSPs embedded across their stacks. Even when a brand wants to test alternatives, staying put is usually the easier path.

All of this creates a durable moat. Switching can happen, but it is painful enough that TTD has held retention above 95% for more than a decade. As campaigns become more complex and identity frameworks more deeply integrated, these switching costs only continue to rise.

5. Branding – Weak and stable

TTD’s brand is built on trust more than on emotion or identity. Its independence, transparency, and long-standing support for the open internet aren’t traditional brand attributes, but they carry weight in a landscape dominated by vertically integrated platforms. Agencies tend to view TTD as the reliable, neutral option; publishers see it as a collaborator rather than a competitor; and regulators often treat it as a useful counterbalance to the largest walled gardens.

That said, this doesn’t translate into premium pricing or deep, irrational loyalty. Advertisers don’t choose TTD because of its name — they choose it because the platform delivers dependable performance without the conflicts of interest embedded in closed ecosystems. The brand amplifies other strengths, but it isn’t a moat on its own.

As a result, branding remains a weak but steady Power: consistent, reputation-based, and supportive of the broader narrative TTD has built, but not a structural advantage in isolation.

6. Cornered Resource – Weak but emerging

TTD doesn’t control the proprietary consumer data or premium inventory that anchor the deepest moats at Google and Amazon. Instead, its efforts around UID2 and OpenPath are attempts to build shared infrastructure that nudges the open internet toward common, interoperable standards. These tools are strategically important, but they are not cornered resources today.

UID2 is intentionally open, built to be adopted broadly rather than owned outright. OpenPath is more differentiated, but it still functions as an integration layer rather than a piece of exclusive supply. If both initiatives scale, TTD could settle into a soft infrastructural role — a trusted steward that partners rely on for identity, authentication, and efficient supply routing. That position would come with influence, deeper integrations, and a quieter form of defensibility.

For now, though, this Power remains early and uncertain. The potential is meaningful, but it only hardens if adoption reaches critical mass across major publishers, retailers, and agencies.

7. Process Power – Moderate and increasing

TTD’s operating rhythm increasingly reflects genuine Process Power — a collection of routines and decision patterns that competitors have found difficult to imitate. The company’s ability to iterate quickly, collaborate openly with partners, and run experiments in full view of the ecosystem shows up across its work, from onboarding publishers to testing identity frameworks to integrating new CTV supply.

Competitors have tried to match this pace and struggled. DV360 often contends with internal trade-offs that slow decision-making, and Amazon tends to move methodically outside its core retail and commerce engine. These gaps suggest that TTD’s speed and clarity aren’t just cultural preferences; they are embedded into the way the organisation is wired.

Founder leadership strengthens this advantage. Jeff Green’s transparent, ecosystem-first style shapes how teams prioritise, communicate, and ship product. Replicating that style would require rivals to rethink how decisions flow through their organisations — a costly and slow undertaking. Over time, these routines compound into a form of defensibility that is subtle but meaningful.

Process Power isn’t yet a dominant moat, but it is clearly strengthening and gives TTD a distinctive ability to adapt as the market evolves.

Power summary

Viewed together, TTD’s Powers form a set of moderate but reinforcing advantages. Its independence and reputation create the trust that underpins deep agency and publisher partnerships. Those relationships, in turn, strengthen scale economies and amplify switching costs. Layered on top is an operating culture that continuously absorbs ecosystem feedback and converts it into product improvements at a pace the larger platforms often struggle to match.

This collection of strengths doesn’t guarantee market leadership — Amazon and Google still sit atop the most valuable data and premium inventory — but it does point to a foundation of durable relevance. If UID2 and OpenPath continue to gain traction and mature into broadly adopted standards, these Powers could compound further, anchoring TTD more deeply in the infrastructure of the open internet.

Investment view

TTD’s original vision — a transparent, neutral, market-like platform for digital advertising — still holds, but the competitive backdrop has become more demanding. Growth has moderated, premium CTV supply is increasingly consolidated, privacy reforms continue to erode open-internet signal, and walled-garden pressure has intensified. Against that backdrop, the central question for investors is whether neutrality can still deliver performance that keeps pace with platforms built on proprietary data and closed ecosystems.

We view the outlook through three structural forces shaping the next phase of the open internet:

• Digital and CTV migration: Streaming continues to pull dollars from linear TV, but the extent to which independent DSPs retain access to premium CTV inventory will set the ceiling on TTD’s growth. The migration is real, but the distribution of supply remains the key variable because it determines whether TTD’s long-term growth converges toward overall digital ad growth or can sustain a structural premium through continued share gains.

• Identity rebuild in a privacy-centric world: With cookies and mobile IDs fading, UID2 and EUID sit at the center of whether the open internet can maintain addressable advertising at scale. Their adoption trajectory will shape both performance and long-term competitiveness.

• AI-driven automation: As machine learning reduces operational complexity, DSPs must prove they can deliver strong results without relying on privileged first-party data. The degree to which Koa/Solimar becomes the default workflow for agencies will be an important marker of TTD’s momentum.

Across these forces, owning TTD remains a bet on the durability of the open internet and the economic value of neutrality in a privacy-first world. The following section outlines the valuation framework and IRR sensitivities under each scenario.

Valuation benchmarking

To frame TTD’s valuation, we compared it against a set of 37 software peers expected to grow revenue between 10% and 30% a year over the next three years, all with gross margins above 75%. Within this group, TTD sits toward the lower end of the valuation range at 7.3x LTM revenue. Only a few companies with comparable or faster growth — including HubSpot at 6.3x, Monday.com at 6.3x, and Workiva at 5.9x — trade meaningfully lower.

From here, the near-term downside looks limited to another turn of multiple compression, which would take the stock down c.14% to roughly $37/sh. By contrast, a re-rating back to the peer trend line of around 12x would imply a move to c.$71/sh, or roughly 65% upside.

Put differently, the market is already pricing TTD as a “low-end of high-growth” asset; any evidence that it can defend mid-teens growth with stable margins forces a re-rating toward the centre of the peer set.

EV / revenue multiple and 3 year revenue CAGR

Source: Koyfin (10 Nov 2025)

Base Case — 20% IRR

In the base case, digital and CTV migration continue at a steady pace, but access to premium CTV inventory remains partly constrained by the major streaming platforms. Independent DSPs retain meaningful reach, but not full parity with the walled gardens. UID2/EUID see moderate, industry-standard adoption — enough to rebuild usable signal density across the open internet, though not enough to become the dominant identity layer. AI automation expands access for mid-market buyers but doesn’t materially compress take rates or close the performance gap with Amazon’s closed-loop data.

Against this backdrop, TTD sustains a c.15% revenue CAGR, driven by stable agency relationships, incremental share gains in open-internet video, and continued international expansion. If the company can prove that mid-teens growth is both durable and predictable, a re-rating toward c.10x revenue — still comfortably below historical highs — appears reasonable and assuming stable margins supports a c.20% equity IRR from today’s levels.

IRR sensitivity analysis

Note that our estimates assume no net dilution, with buybacks offsetting SBC (in-line with historical trends)

Bull Case — 40% IRR

In the bull case, the open internet retains real competitive relevance even as consolidation continues. Major publishers keep meaningful portions of their CTV inventory accessible through programmatic channels, and after a period of testing semi-walled approaches, the market leans back toward transparency and interoperability. UID2 and EUID see broad uptake across agencies, retailers, and premium publishers, restoring cross-site addressability to a level that meaningfully narrows the ROAS gap with the walled gardens.

AI becomes an accelerant rather than a commoditiser. Koa and Solimar evolve into the default workflow layer for many agency teams, embedding identity, planning, and creative optimisation in a single environment. As these capabilities integrate more tightly, switching costs deepen.

Under these conditions, TTD reaccelerates to 20%+ revenue growth, and investor confidence supports a return to c.15x revenue.

Bear Case — c.0% IRR

In the bear case, the open internet shrinks in scope and relevance. Major streaming platforms — including Disney, Amazon, and Netflix — reserve most premium CTV inventory for their direct-sold or vertically integrated channels, leaving independent DSPs with thinner supply and weaker signal density. At the same time, privacy reforms tighten, slowing UID2 adoption and constraining cross-site visibility. As signal quality erodes, the performance gap between programmatic and contextual advertising narrows.

AI also shifts from enabler to commoditiser. Optimisation becomes table stakes, and the platforms with proprietary data and closed-loop attribution — notably Amazon and the walled gardens — capture a larger share of spend. Agencies respond by funneling more budgets through those closed systems or through hybrid in-house stacks, reducing TTD’s footprint to upper-funnel or brand-oriented campaigns.

In this scenario, revenue growth decelerates toward a c.10% CAGR, and the multiple compresses toward c.5x revenue.

Final Takeaways

TTD’s growth has slowed and competition has intensified, but the company’s core strategic pillars remain solid—and in some areas, stronger than before. Its reputation for trust, neutrality, and transparency continues to matter in a market where those characteristics are increasingly rare.

Performance in the short-term is likely to remain choppy as the industry works through privacy changes, shifts in CTV supply, and volatile investor sentiment. The medium-term picture, however, is more constructive than recent volatility suggests. Holding c.15% revenue growth with even modest multiple expansion already supports a >20% IRR, and progress on identity and direct integrations provides meaningful upside—especially if OpenPath and UID2 move from valuable tools to the default rails for a larger share of open-internet spend.

Taken together, TTD offers a blend of durability and built-in optionality. Neutrality may limit how dominant the company can be in the short run, but it also underpins the trust and cross-platform access that strengthen its role as the ecosystem reshapes itself.

Jeff Green’s founding philosophy still resonates: build for the long term, operate transparently, and focus on the rails others rely on. In a landscape marked by rising opacity and consolidation, that orientation is becoming more—not less—strategic.

In this article we discuss the result, what it means for our investment case, and what you need to believe to buy Cloudflare at these levels.

Q3 FY25 result

The most important factor underpinning Cloudflare’s long-term success is its ability to win and grow Enterprise contracts — a muscle it has slowly been building; transitioning from product-led growth to an enterprise sales model.

Sales productivity has increased for seven consecutive quarters, and anecdotally the company has been closing the feature gap across multiple Acts. It’s pleasing to see this translate into continued momentum in both average customer spend and logo wins — driving revenue from large customers (>$100k ARR) up 13% QoQ and 42% YoY.

NRR and large customer revenues

RPO growth of 43% YoY, the highest since Dec 22, points to continued momentum into FY26, with contract mix shifting further toward multi-year commitments (now c.35% of total value). Management also noted that “Pool of Funds” contracts, where a large customer commits a pre-specified amount of spend (pre-paid, multi-year or multi-product) that they can draw against across multiple Cloudflare product lines, now represent low double digits of total ACV — a positive signal of ecosystem buy-in.

RPO growth and composition

Reinforcing this, the company highlighted several notable recent deals in the quarter. Recent wins span all three Acts — from core infrastructure to AI-driven workloads:

• $34.3m 5-year contract with a European tech company redesigning architecture on Workers and Durable Objects.

• $22.8m 3-year contract with a Global 2000 digital media platform emphasizing AI-driven web protection and Pay Per Crawl.

• $15m 3-year contract with a media platform to reduce egress fees and latency, lowering total cost of ownership by 30%.

• $16.1m 2-year contract with a Fortune 500 fintech company expanding across multiple Cloudflare products.

• $20m+ 2-year contract with a U.S. cabinet-level agency standardising on Cloudflare’s FedRAMP portfolio, displacing legacy solutions and saving $10m annually.

What does this mean for our investment case?

This result doesn’t change our thesis — it strengthens it. Cloudflare continues to prove it can win in the enterprise while maintaining its pace of product delivery.

In our previous article, we did a deep dive of Cloudflare, analysing the company in the context of Hamilton Helmer’s 7 Powers and examining its strategic positioning relative to other incumbents across each of its product lines.

We rated Scale Economies as the company’s greatest strength, leveraging its global anycast network to power multiple product types across its 3 Acts and amortising its cost base over a far bigger TAM than any direct competitor (ex Hyperscalers).

We identified the company’s biggest risk as being stuck between low-cost ‘good enough’ solutions (e.g. a Microsoft bundle) and best-in-class point solutions (e.g. Zscaler in Zero Trust). Recent results have continued to add weight to the argument that Cloudflare is a viable competitor at the top end, rapidly shipping new features and coming closer and closer to feature parity.

While this supports our investment thesis, the challenge we continue to have is Cloudflare’s extremely rich price (see further discussion below). At $253.3, there is little room for error and no margin of safety.

Our base case model prices Cloudflare at $208.9, and we plan to opportunistically add to our position when Mr Market has an off day. Cloudflare is a name to own for the long term, but for right now it’s a Hold.

Subscribe now

Valuation and forecast update

Cloudflare’s value lies in its long-duration growth curve — a fat tail that demands sustained reinvestment and depresses near-term cash flow. This means the factors that are most important from a valuation perspective are A) revenue growth and B) the terminal revenue multiple that is applied.

These are inherently linked; a slowdown in growth will compress the multiple — a double whammy to valuation. While the opposite is also true, it’s much harder to increase by 2x from here than to decrease. Increasing would imply a c.70x NTM revenue, moving to a realm shared by few others (such as Palantir), while decreasing 2x brings you in line with some still expensive, high quality names like Snowflake and Zscaler.

Growth forecasts

We derive an above consensus growth forecast of 28.7% (consensus c.25%) over the next 5 years, predicated on Cloudflare roughly doubling its market share of Acts 1 and 2, and successfully executing the growth strategy across Acts 3 and 4.

• Act 1: Implies revenue similar to Akamai today, going from c.3.6% to 7.2% market share.

• Act 2: Implies revenue similar to Zscaler today, going from c.1.3% to 2.4% market share.

• Acts 3 / 4: Management estimate Act 3 alone as having >$50b TAM. We believe a 50% CAGR is a fair base case, in-line with how Cloudflare grew earlier products over 2018-22. We could easily see this expanding well beyond this level, particularly given gravity from the rest of the ecosystem and massive tailwinds from AI uptake.

Indicative bottom up revenue forecasts by product Act

Multiple analysis

As discussed in our previous Cloudflare deep dive, Cloudflare has a structural cost advantage relative to peers and we also believe strong Process Power enables rapid product iteration and expansion at a superior pace. Both factors support above-market revenue growth and a higher than average multiple.

The below table highlights the relationship between growth and margins on the valuation multiple based on a DCF, assuming these differences hold for 15 years.

Valuation multiple sensitivities

• Margins: Today, Cloudflare has low FCF margins — a function of significant platform investment, tactically sharp price points, and heightened sales spend as it drives growth. Our long-term forecasts estimate Cloudflare’s margin grows to c.25% by 2035; however this remains behind the majority of leading cybersecurity firms.

• Growth: Revenue has a much bigger multiplier impact than margin because of its compounding effect. Recurring revenue growth impacts value into perpetuity, while margins are transient to any given year. Cloudflare will likely continue to grow above market, but the key questions are how far above and for how long.

Cloudflare’s revenue multiple of c.34x is significantly higher than all the peers we have listed, including direct competitors Palo Alto (+150%) and Zscaler (+120%). Using the above matrix, this implies the market is pricing in a persistent growth differential of >7.5%. This is certainly possible, but to outperform for the next 15 years is a tall order that leaves little room for error and no margin of safety.

At these levels, even small execution missteps could trigger multiple compression. It’s a business we want to own more of — just not at any price.

We hold Cloudflare as an optionality position, and plan to continue adding when the opportunity presents itself, but for now see better value in other names like Zscaler — click here to read our ZS investment thesis.

Subscribe now

In our previous article we examined Zscaler’s founding insight, the secular drivers behind Zero Trust adoption, and the evolving competitive landscape as hyperscalers and best-of-breed challengers fight for enterprise mindshare.

As explored in Part 1, Zscaler’s architecture is proven. The open question is whether the company can defend its role as the neutral control point for secure access—especially as Microsoft, Palo Alto, and Cloudflare push similar narratives and bundle adjacent capabilities.

This article evaluates Zscaler’s strategic durability using Hamilton Helmer’s “7 Powers” framework. We assess which advantages remain intact, which are weakening, and which are strengthening as adoption scales. We then turn to valuation—testing how much of Zscaler’s future is already priced in, and what assumptions are required to support an investment case.

Zscaler is a strong business. The question is whether its strategic advantages are sufficient to preserve relevance and pricing power in a market that is rapidly consolidating.

If you haven’t read part 1, you can read it here

At Pumice Capital, we publish free, in-depth fundamental research on high-quality companies built to compound over decades. Our focus is a concentrated portfolio of resilient, growth-driven businesses with a 10+ year horizon — backed by deep, differentiated analysis rarely found in mainstream coverage.

Recent reports: Cloudflare (NET) | Confluent (CFLT) | Snowflake (SNOW)

If you want early access to our latest research on the companies shaping the future, you can subscribe for free today.

Subscribe now

1 – Power analysis

Zscaler’s early advantage stemmed from counter positioning, but its current moat is built on process power, switching costs, and brand strength. The company’s integrated product suite supports significant expansion within existing accounts, and its founder-led culture has enabled consistent innovation—often ahead of larger incumbents.

While scale and network effects offer some protection against smaller challengers, they are largely neutralised when competing with legacy vendors and hyperscalers.

A) Scale economies

Definition: Marginal costs decline faster than rivals can match - producing an unreplicable cost structure.

Rating - Weak (stable): Zscaler’s scale provides an edge over smaller vendors such as Wiz, Illumio, Armis, and Netskope. However, it is on par—or behind—larger incumbents and platform players.

This makes scale a relative advantage, not an absolute one. Hyperscalers can subsidise SSE offerings as part of broader cloud bundles, eroding any cost-based differentiation.

• Palo Alto, Cisco, Fortinet: These legacy vendors operate at comparable or greater customer/device scale and can cross-subsidise SSE infrastructure from larger product portfolios. Fortinet’s hardware margins fund aggressive pricing; Cisco leverages its vast channel and global backbone; Palo Alto can bundle Prisma Access into multi-product deals.

• Cloudflare: Runs a larger global network (335+ cities) serving multiple workloads, giving it bandwidth-buying power Zscaler can’t match.

• Microsoft & Google: Hyperscalers have orders-of-magnitude more network and compute scale, owning undersea cables and data centres globally. They can absorb SSE workloads into existing cloud footprints at near-zero incremental network cost. Security modules inside Microsoft 365 E5 can be priced near zero for incremental customers, nullifying scale-based cost advantages.

B) Network effects

Definition: Each new user increases the value of the product for others, with the product continuing to become more valuable as the number of users grows.

Rating - Weak (Stable): Zscaler’s customers do not directly interact, so there is no classic network effect. The only network-like benefit is aggregated threat intelligence.

In theory, more Zscaler customers → more traffic analysed → faster detection of new threats → better protection for all. However, threat intel can be bought, shared via industry feeds, or collected by rivals with their own massive telemetry.

Beyond a certain threshold, incremental telemetry also yields diminishing returns. This limits the extent to which scale translates into differentiated security outcomes.

• Palo Alto & Cisco: See threat data from thousands of firewalls and endpoint agents.

• Microsoft: Collects telemetry from Windows, Office, Azure, and Defender (1.4b+ Windows devices).

• Cloudflare: Inspects global web traffic across >25 million domains.

C) Counter positioning

Definition: A superior business model that incumbents rationally avoid copying because it would damage their core business. It is only a lasting source of advantage if the incumbent’s inaction remains structurally rational - driven by cannibalisation risk, internal conflict, or strategic constraint.

Rating - Weak (Decreasing): Once a clear advantage versus appliance vendors, this power has now largely been erased as the market has gone all-in on cloud. It exists in remnants across legacy players, but we expect this will go to zero over time.

• In the 2010s, firewall and gateway vendors thrived on high-margin hardware. Zscaler’s cloud-native, multi-tenant SaaS model eliminated boxes, cut costs, and updated continuously — a direct threat to that profit model.

  • Palo Alto’s CEO (2017) stated they held back cloud rollout to avoid “collapsing” firewall revenue.

• Zscaler capitalised, cementing its lead, and incumbents only embraced cloud after Zscaler proved it out.

• Eventually (c.2020), Palo Alto, Cisco, and Fortinet accepted the inevitable shift, building or buying cloud/SASE platforms.

As counter-positioning fades, Zscaler loses one of its most asymmetric advantages, leaving it more exposed to direct product and pricing battles.

D) Switching costs

Definition: Customer lock-in created by the financial, operational, and risk burdens of replacing a vendor.

Rating - Strong (Increasing): Once deployed, Zscaler becomes deeply embedded in customer infrastructure, making replacement costly, risky, and slow. Lock-in is strongest with large, multi-module enterprises (85% of $1M+ customers use 2+ modules; 65% use 3+ as of FY24), increasing entanglement.

That said, high switching costs can cut both ways: they may slow churn, but also extend sales cycles and constrain Zscaler’s ability to win competitive displacements at scale.

Moving providers involves:

• Reconfiguring network routing and authentication (AD/SSO).

• Deploying new endpoint agents to thousands of devices.

• Rewriting security policies, retraining IT, and re-onboarding users.

• Running dual systems in parallel to avoid outages, doubling cost during transition.

While strong, lock-in could degrade if buyer preference shifts toward modular ‘best-of-suite’ rather than single-vendor entrenchment —mixing Zscaler with Microsoft Defender or Cloudflare. In such a scenario, Zscaler’s ability to dictate price or prevent churn would be meaningfully weaker.

E) Branding

Definition: The ability to win preference or pricing power because of brand trust or prestige, even when products are functionally similar.

Rating - Moderate (Stable): Zscaler has strong brand equity in cloud security and Zero Trust, and regularly appears as a front runner in Gartner’s Magic Quadrant for SSE.

A decade as the clear SSE/Zero Trust leader has given Zscaler a brand halo that can swing deals when technical and price differences are small. In risk-averse enterprise security buying, this is meaningful.

Gartner Magic Quadrant for Security Service Edge

• Consistent #1 positioning — 10+ years as a Gartner MQ Leader, top in Forrester Wave, and often the reference vendor for Zero Trust.

• Halo of trust — Zscaler is used by Fortune 500 banks, defence agencies, and governments, with public case studies in highly regulated industries.

• Thought leadership — Regularly shapes Zero Trust narratives in analyst research and media coverage.

• Partner validation — Deep integrations with Microsoft, CrowdStrike, and Okta reinforce credibility and reach.

Brand, however, does not close deals alone — technical fit, ROI, and integration remain important. Rivals like Palo Alto, Cisco, and Microsoft have broader brand reach across more of the IT stack.

F) Cornered resource

Definition: Exclusive control over a valuable asset (IP, data, talent, rights) that rivals cannot replicate or acquire.

Rating - None (Stable): Zscaler has no irreplaceable asset that competitors cannot access or build themselves.

Certifications and partnerships are replicable — FedRAMP High was achieved early, but Netskope and Palo Alto now match it; integrations with Okta, Microsoft, and SD-WAN vendors are non-exclusive.

Core capabilities are architectural rather than proprietary (see process power), and talent is mobile across the industry.

• No unassailable IP moat — core SSE capabilities are architectural choices, not patented choke points. Palo Alto, Netskope, and Cloudflare have built similar capabilities independently.

• Talent and leadership are exceptional but portable — several SSE competitors are led by ex-Zscaler or ex-Juniper staff.

G) Process power

Definition: Advantage gained from unique, opaque, and hard-to-replicate processes—rooted in tacit knowledge and sustained execution excellence—that competitors cannot match despite copying inputs, unlike superficial “good culture” or generic operational efficiency.

Rating - Strong (Stable): Zscaler’s 15+ years operating a massive security cloud have created unique technical and organisational muscle memory, underpinning its continuous delivery of new features without downtime.

Despite poaching talent, and with bigger budgets, competitors have faced scaling and performance issues.

• Founder-led culture — Chaudhry has embedded his deep technical expertise, long-term orientation, and willingness to prioritise architectural purity over short-term sales expedience into Zscaler’s DNA.

• Enterprise migration expertise — Repeatable Fortune 500 rollout playbooks integrating identity (AD/SSO), reconfiguring global routing, and retiring VPNs with minimal disruption.

• Cross-product synergy — Natively integrated ZIA, ZPA, ZDX enable unified policy application and monitoring across internet access, private apps, and user experience.

While processes and culture are hard to replicate, bureaucracy could erode agility if the founder-led culture diminishes over time.

2 – Valuation

While Zscaler’s technology leadership and enterprise penetration are undeniable, the stock trades at a premium that embeds strong assumptions about sustained growth and continued dominance in Zero Trust.

To assess whether today’s valuation is justified, we benchmark Zscaler against peers on trading multiples, test upside and downside scenarios through DCF modelling, and identify the operational and strategic milestones investors should monitor most closely.

Comparable company trading multiples

Zscaler currently trades 15% below its 52-week high at $269.6/sh (25 Aug 2025 close), implying a c.13x EV/NTM revenue multiple based on consensus forecasts. This premium valuation reflects much higher growth vs. legacy peers, but is still well below companies like CrowdStrike (20.0x) or Cloudflare (28.5x) who share a similar growth outlook.

This valuation implies an expected decline in revenue growth to the high-teens, and hence is justified as long as the company maintains its current market share (our forecast industry CAGR to 2035 is 19%—see our previous article here).

This appears achievable—but only if Zscaler maintains current execution discipline. A slip in innovation velocity or pricing pressure from hyperscaler bundling could quickly make these assumptions look optimistic.

Discounted cash flow modelling

To assess the reasonableness of Zscaler’s trading price, we run a DCF using three scenarios - one where continued execution enables further market share growth, one where current share is maintained, and one where growth declines materially.

Base Case

Implied value = $275.3sh - c.2% above current price.

Our base case assumes Zscaler defends its current competitive position and grows in-line with the market, growing revenue at 18% p.a through to FY35.

Investors are effectively underwriting continued persistence rather than material acceleration, assuming that switching costs and process power are sufficient to hold share, even if scale economies and network effects remain relatively weak.

Key assumptions:

• NRR moderates over time, falling by 0.5% p.a. to 110% by 2035.

• New customers grow at a declining rate - falling by 5% p.a. (in-line with FY24).

• Gross profit margin is maintained at c.80%.

• Opex compression from 62% of revenue in FY24 to 53% of revenue by FY35 (excluding SBC), and capex intensity steady at 14%.

• c.2% annual shareholder dilution.

• Terminal revenue multiple of 11.5x applied in FY35 (assumes valuation re-rates back in line with what top tier legacy players like PANW command today).

Bull Case

Implied value = $404.4/sh - c.50% above current price.

Under a bull case, Zscaler remains a dominant enterprise presence and continues to expand its share of wallet across the security stack. Overall, this implies 24% p.a. revenue growth through to FY35.

This scenario assumes switching costs and process power not only hold but strengthen, with customers consolidating spend around Zscaler as the default secure access control point. Such a path would allow Zscaler to trade closer to Cloudflare’s premium.

Relative to the base case, we have assumed:

• NRR is 5% higher in all years.

• New customer acquisition is 5% higher - maintaining growth at FY24’s level.

• All other assumptions are constant.

Bear Case

Implied value = $193.4/sh - c.(28%) below current price.

In our bear case, we assume much lower growth and margin compression amidst tough competition. Overall, this implies 14% p.a. revenue growth through to FY35.

The bear case effectively models an erosion of Power—where hyperscaler bundling blunts pricing, switching costs weaken as modular adoption rises, and brand halo proves insufficient to sustain premium positioning. In this world, Zscaler converges toward the economics of firewall vendors rather than sustaining platform-like multiples.

Relative to the base case, we have assumed:

• NRR is 2.5% lower in all years.

• New customer acquisition growth is reduced by 5% - falling by 10% p.a.

• Gross profit margin is reduced by 5%.

• Terminal revenue multiple is reduced by 2.0x to 9.5x, reflecting a lower growth outlook and less robust competitive positioning.

• Other assumptions unchanged.

Valuation takeaways

At c.13x NTM revenue, Zscaler’s valuation embeds meaningful growth moderation and provides some margin of safety relative to its faster-growing peers. The key investor question is whether switching costs and customer entrenchment offset the structural threat of hyperscaler bundling.

Relative to peers:

• CrowdStrike: Zscaler trades at a 34% discount on revenue multiples despite higher near-term growth and better margins, potentially reflecting weaker perceived optionality outside its core or a weaker competitive advantage.

• Cloudflare: The gap is wider still with a 54% discount, possibly due to a premium given to Cloudflare for its exposure to AI inference at the edge and the company’s platform capability.

• Palo Alto: Zscaler retains a 15% premium, justified by its higher growth and cleaner business model.

For long-term investors, this setup offers a reasonable risk/reward skew with asymmetric upside potential that could be unlocked if Zscaler extends its Exchange deeper into adjacent security functions and proves resilient against platform consolidation.

• The base case suggests the stock is broadly fairly priced if Zscaler simply maintains its position as a neutral Zero Trust control point.

• The bull case highlights that durable 20%+ growth and deeper product penetration could re-rate the stock by 40–50%, bringing multiples closer to CrowdStrike or Cloudflare.

• The bear case underscores the risk of commoditisation and margin compression, where Zscaler could trade closer to mature firewall vendors.

Conclusion

Zscaler’s addressable market is forecast to grow at 19% annually, increasing the company’s SAM to $277b by 2030, and as a market leader the company is well positioned to ride this wave.

The base investment case rests on conviction in Zscaler’s ability to maintain its execution discipline, leveraging the strong switching costs and brand trust that has been developed over the past 18 years to earn its fair share of growth. While these powers do not guarantee invulnerability, they do suggest resilience: customers face material friction in switching, and CIOs continue to view Zscaler as the archetype of cloud-native Zero Trust.

The bull case — switching costs are strengthening with multi-module adoption, a capable management team can further climb the adjacency ladder into an array of complementary products, and history points to a proven capability of out-innovating peers. Given FY24 revenue amounted to only 2% of the SAM, there is a credible growth runway and hitting mid-20s revenue growth is not impossible (or even unlikely).

The bear case — Zscaler innovates too slowly, and has its lunch eaten by agile product specialists (Wiz, Illumio, Armis, Dynatrace) or platform players seeking to commoditise Zscaler’s offerings within their broader ecosystems (Cloudflare, Microsoft).

Overall, the stock is not priced for perfection, it is priced for persistence. Investors must decide whether Zscaler’s process discipline and switching costs are enough to offset the gravitational pull of bundled platforms.

On balance, we believe they are. Our view is that there is sufficient power to maintain and grow the business at or above market levels, and as a result rate the business as a BUY in our portfolio at current levels.

Zscaler’s founding bet — that legacy VPN- and firewall-centric architectures would fail in a cloud-first world — has been vindicated, and its Zero Trust Exchange now brokers traffic for thousands of enterprises and tens of millions of users across a global footprint.

But the next decade will be harder.

Zscaler sits at the fault line between two market forces: platforms collapsing networking and security into bundled cloud stacks, and best-of-breed specialists carving out depth in high-value niches.

Microsoft can bundle “good enough” SSE into E5, Cloudflare can extend its global edge network into full Zero Trust, and cloud-security pure-plays like Wiz, Illumio and Armis can out-innovate in narrow domains.

The investor questions are twofold: can a neutral security control point defend pricing power and relevance as platform integration accelerates, and can Zscaler expand product depth fast enough to remain the system-of-record for secure access, rather than a pass-through policy layer? We aim to answer these questions over a 2-part series.

Part 1 examines Zscaler’s founding insight, the structural drivers shaping demand, and today’s competitive map. Part 2 tests the durability of its economics under Hamilton Helmer’s “7 Powers” lens and assesses valuation and risk-reward under multiple competitive and macro scenarios.

At Pumice Capital, we publish free, in-depth fundamental research on high-quality companies built to compound over decades. Our focus is a concentrated portfolio of resilient, growth-driven businesses with a 10+ year horizon — backed by deep, differentiated analysis rarely found in mainstream coverage.

Recent reports: Cloudflare (NET) | Confluent (CFLT) | Snowflake (SNOW)

If you want early access to our latest research on the companies shaping the future, you can subscribe for free today.

Subscribe now

1 – Why Zscaler exists

“Our mission is to empower organizations to realize the full potential of the cloud and mobility by securely connecting users to applications from any device, anywhere”

When Jay Chaudhry founded Zscaler in 2007, he was convinced “the castle-and-moat model of corporate security was crumbling.” SaaS, mobile devices, and direct-to-internet workflows were rendering hub-and-spoke networks “slow, costly, and fundamentally unsafe once the perimeter was breached.” His aim was to move security “out of the box in the data centre and into a utility for the internet age” — a multi-tenant, globally distributed service that could connect any user to any app, from any device, anywhere.

Even the name reflected the ambition: a portmanteau of “Zenith of Scalability,” signalling a vision of internet-wide security unconstrained by hardware limits or geography.

Instead of placing users on a network they could roam freely inside, his Zero Trust model would authenticate every session, connect it only to the specific app or service required, and inspect all traffic inline at cloud scale. In Chaudhry’s view, that was the only way enterprises could fully embrace the agility and reach of the cloud without importing the risks of the old perimeter.

The below chart highlights the differences in old vs. new security approaches:

Legacy vs. modern security approaches

Early product development

Zscaler Internet Access (ZIA): Solving real pain points in the early 2010s

Zscaler’s first commercial proof point was Zscaler Internet Access (ZIA), launched in the early 2010s to secure outbound internet traffic in the cloud. Chaudhry recalls, “Selling security without appliances was a radical idea — we had to show CIOs it could work better than the hardware they trusted.”

ZIA explained: ZIA is like a cloud-based security checkpoint for internet traffic. It applies your company’s security policies and scans for threats before anything reaches your device — no matter where you're working. This removes the need to route traffic through a central data centre, which boosts performance, simplifies IT management, and scales easily as your team grows.

From a competitive standpoint, ZIA's early traction served as proof that cloud-native performance and scalability could win against entrenched appliance incumbents. This was critical in convincing risk-averse enterprises to move core security functions off-premises.

As SaaS adoption surged in the mid-2010s, appliance-based tools became increasingly slow, complex, and costly. Although large enterprises required time and education to shift, ZIA’s benefits (faster performance, reduced IT overhead, and easier scalability) ultimately drove widespread adoption.

Enter ZPA (2015–2017): Extending cloud-native access to internal apps

With that initial foothold, Zscaler extended the Exchange into private application access with Zscaler Private Access (ZPA) between 2015 and 2017. Chaudhry argued, “Why put a user on the entire network when they only need one app?”. ZPA replaced VPNs with identity-based, app-specific connections, sharply reducing lateral-movement risk and containing breaches before they spread.

ZPA explained: Instead of placing users on the corporate network (where they could potentially access other systems), ZPA creates identity-verified, direct connections to specific applications. This approach significantly reduces lateral movement risk, which is the ability of attackers to move across systems within a network after gaining initial access. By eliminating broad network access, ZPA helped to contain threats and limit potential damage from compromised users.

Strategically, ZPA expanded Zscaler’s addressable market beyond internet-bound traffic, deepened integration into customer environments, and reduced reliance on a single revenue stream. While early deployments required tuning, customer feedback highlighted strong visibility and segmentation benefits, and independent studies later reported measurable ROI and breach-rate reductions (Forrester reported a 289% average ROI and a 55% drop in breaches among ZPA users in 2024.).

Pandemic acceleration and expanding use cases

The shift to remote work in 2020 exposed the latency and reliability limits of corporate VPN infrastructures. For enterprises already using ZIA, adding ZPA provided a direct path to extend secure internal application access without the performance penalties of backhaul. Chaudhry noted, “In weeks, customers went from ‘we’ll pilot ZPA’ to ‘we need it for the whole workforce by Monday’.”

This urgency accelerated multi-product adoption within the installed base and broadened ZPA’s role beyond employee access. Enterprises increasingly used it to connect contractors, partners, and third-party developers to specific applications without exposing the wider network, reinforcing Zscaler’s positioning as a universal access broker rather than a remote-work point solution.

Zscaler ZIA and ZPA

Platform expansion and IPO

With ZIA and ZPA established, Zscaler broadened the Zero Trust Exchange into adjacent security and networking functions to increase share of wallet and embed more deeply into customer environments. Major additions include:

• Workload Communications (Zscaler Cloud Protection – ZCP, 2020): Segments and secures east–west traffic between cloud workloads, reducing the attack surface inside public cloud environments. Strengthens Zscaler’s relevance to DevOps and cloud security teams.

• Digital Experience Monitoring (Zscaler Digital Experience – ZDX, 2020): Provides end-to-end visibility into user experience and application performance, enabling IT teams to troubleshoot without on-premises appliances. Improves retention by integrating performance management with security.

• B2B and OT/IoT extensions (IoT/OT Security, 2021–2022): Applies Zero Trust principles to partner access, industrial control systems, and IoT devices, addressing security gaps in manufacturing, energy, and critical infrastructure sectors. Expands TAM beyond the traditional corporate workforce.

• Security posture management and risk analytics (Risk360 and Zscaler Business Insights – BI, 2023): Combines cloud security posture management (from acquisitions) with analytics on policy gaps, risk scoring, and compliance tracking. Adds preventative and governance layers on top of inline enforcement, supporting executive and board-level reporting.

• Security workflow automation (ShiftRight acquisition, 2021): Integrates incident response, policy updates, and remediation into customer workflows, improving operational efficiency for SOC teams and driving platform stickiness.

These expansions positioned Zscaler to address a larger share of the Secure Service Edge (SSE) and Zero Trust markets, while creating more entry points for cross-sell within existing accounts. However, they also broadened the competitive set to include multi-product platforms like Microsoft, Palo Alto Networks, and Cloudflare, requiring continued investment to match their breadth and integration.

In March 2018, Zscaler completed its IPO, raising $192m at a c.$3.6bn valuation. The listing increased market visibility, provided capital for R&D and acquisitions, and enhanced credibility in pursuing large enterprise and government contracts. Since then, ARR has grown at a c.52% CAGR (2018-2024), with multi-product adoption steadily increasing as the platform strategy has matured.

Zscaler product development: 2016 to 2024

In Q1 FY25, Zscaler’s Zero Trust Exchange processed more than 500 billion daily transactions for approximately 8,600 customers and over 47 million users worldwide. Each transaction represents a real-time security or access decision — from inspecting web traffic and brokering application sessions, to scanning content for data loss prevention or enforcing microsegmentation across internal workloads.

This section has traced the evolution of Zscaler’s product suite — from ZIA and ZPA through to newer offerings like ZDX, IoT/OT Security, Risk360, and ZCP — and how these expansions have positioned the company across a broader swathe of the Secure Service Edge and Zero Trust markets. The next section looks forward, assessing how these capabilities are expected to develop and the structural trends likely to underpin growth over the next five to ten years.

Zscaler product recap

2 – Market growth drivers

Historical growth context

Since its IPO in 2018, Zscaler’s serviceable addressable market (SAM) has expanded from $17.7bn (IDC’s assessment of what customers spend on like-for-like products) to $96bn in FY24. This growth reflects both the modernisation of legacy security budgets and the creation of entirely new, cloud-native security categories rooted in Zero Trust.

Zscaler’s Serviceable Addressable Market: 2018 to 2024

A) Legacy modernisation (c.35% / c.$27b of SAM growth)

With more than 50% of enterprise workloads now hosted in Microsoft 365, Salesforce, AWS, and Azure, routing traffic through centralised firewalls has become impractical.

• Impact: Budgets tied to SWG and VPN appliances (Blue Coat, Cisco ASA) migrated to cloud-delivered SSE platforms (ZIA and ZPA).

B) Incumbent displacement (c.20% / c.$16b of SAM growth)

Hybrid work and growing SaaS adoption have made IT environments more complex and fragmented. As trust shifted to users and devices, many legacy CASB appliances became obsolete.

• Impact: Zscaler consolidated spend from standalone CASB/DLP (Skyhigh, Symantec) and firewall-based egress filtering (Palo Alto, Fortinet) by embedding these functions within its SSE platform.

C) Cloud-native category expansion (c.45% / c.$35b of SAM growth)

Decentralised IT and hybrid work created security gaps that legacy tools couldn’t address.

• Impact: New needs like securing internal workload traffic, monitoring user experience, protecting IoT/OT environments, and applying AI to risk policy, drove demand for cloud-native solutions. Zscaler extended beyond ZIA/ZPA into these areas, unlocking growth in markets that barely existed in 2018.

Growth outlook

Industry growth is forecast to continue at 19% annually, increasing the company’s SAM to $277b by 2030, underpinned by a continuation and evolution of the trends already at play today, namely:

• The transition of all workflows to the cloud

• Rising compliance and regulatory scrutiny

• The rise of ‘work anywhere’ on ‘any device’

• A proliferation in bad actors trying to take advantage of the rapidly evolving technological landscape

Zscaler’s Serviceable Addressable Market: 2024 to 2030

A) SSE: Ongoing cloud proliferation (c.43% / c.$80b of SAM growth)

SSE remains Zscaler’s largest and most important opportunity, accounting for roughly half of its total addressable market. Gartner’s SSE Market Forecast 2024 projects a 16–18% CAGR through 2030, underpinned by:

• Long-tail modernisation: Many large enterprises continue to decommission legacy appliances. For example, in 2024 BP retired over 60% of its firewall stack after migrating to Microsoft 365 and AWS, deploying ZIA and ZPA to c.80,000 employees and reducing VPN-related incidents by 70%.

• Rising compliance complexity: With over 50 countries enforcing data localisation, demand for sovereign cloud solutions is surging. Zscaler’s global cloud and in-line architecture (embedding security directly into the data path) enable real-time inspection, lower latency, and seamless compliance, unlike bolt-on or gateway-based approaches used by competitors.

B) Digital Experience Market: Structural movement to hybrid work (c.7% / c.$13b of SAM growth)

ZDX strengthens Zscaler’s platform differentiation by embedding real-time user experience insights alongside core SSE and workload protection - providing a natural upsell path and improving operational outcomes for IT teams. Mordor Intelligence forecasts the Digital Experience Monitoring (DEM) market to grow at a c.17% CAGR through 2030, driven by:

• Infrastructure fragmentation: Despite widespread SaaS adoption, most enterprises still operate across hybrid environments (mixing on-prem, cloud, and third-party services). This fragmentation makes it difficult to diagnose performance and connectivity issues across networks.

• Hybrid work persistence: Post-pandemic, hybrid work is the norm. As users operate outside managed networks, IT teams need tools to pinpoint device, app, or network issues without relying on legacy, on-prem monitoring systems.

• Tool consolidation: Enterprises are moving away from using separate point tools like ThousandEyes, Nexthink, or Riverbed for network and device monitoring. Instead, they’re adopting integrated platforms that combine these capabilities—simplifying operations and cutting costs

C) Workload Security: Increasing “east-west” traffic (c.36% / c.$65b of SAM growth)

Zscaler entered the workload security market in 2020, and it now represents its largest growth opportunity outside SSE. Gartner projects >25% CAGR through 2030 for Zero Trust workload security, driven by:

• Modern app architectures: As companies move from single, monolithic apps to smaller, distributed services, internal traffic between systems is expected to make up 70–80% of enterprise network flows. This increases the risk of threats spreading inside the network, and traditional security tools often can’t see or control this traffic—leaving blind spots.

• Microsegmentation: Key to limiting breach impact by isolating workloads. As internal environments grow more dynamic and distributed, segmentation becomes critical to enforcing Zero Trust and securing cloud-native workloads beyond the reach of traditional firewalls.

• Regulatory scrutiny: Sectors like finance and healthcare now face stricter rules around breach containment, segmentation, and auditability. This drives demand for security architectures that can enforce policy and provide clear visibility across environments.

D) IoT/OT security: bridging IT and industrial domains (c.11% / c.$20b of SAM growth)

Although more nascent, OT security is rapidly emerging as a strategic priority, particularly in critical infrastructure. IDC projects a c.18% CAGR through 2030. Zscaler is well positioned to capitalise via:

• Rising investment in critical sectors: Industries like energy, manufacturing, and transportation face increasing attacks on operational systems, prompting greater security spending to protect uptime, safety, and supply chains.

• Shift toward unified IT–OT security: Enterprises are moving away from siloed industrial tools in favour of cloud-native platforms that can enforce consistent Zero Trust policies across both corporate and operational networks.

• Regulatory pressure: Standards like NIS2 in Europe and sector-specific mandates in the US require better segmentation, monitoring, and incident response in OT environments.

E) Risk360/ BI SAM: AI-powered threats and AI-augmented security (c.2% / c.$4b of SAM growth)

Though Risk360/BI remains Zscaler’s smallest SAM, it is strategically significant as enterprises face a sharp rise in AI-driven threats - up fivefold since 2021. Gartner forecasts ~20% CAGR through 2030, driven by:

• AI-powered detection and telemetry: As threats become more sophisticated and evasive, enterprises are adopting AI to detect behavioural anomalies and assess risk in real-time - an area where Zscaler’s telemetry scale (500B+ daily events) provides a clear advantage.

• Automated threat correlation: Reducing mean-time-to-detect (MTTD) requires correlating signals across users, apps, and workloads. Zscaler’s unified architecture enables this cross-surface visibility and response automation.

• Embedded risk analytics in policy enforcement: Zscaler’s integration of AI into ZIA/ZPA enables dynamic access decisions based on real-time risk posture - deepening its value proposition as not just a secure access layer, but a smart, adaptive one.

These market drivers underpin Zscaler’s continued growth trajectory, albeit in a landscape marked by intensifying competitive pressures, especially from hyperscalers and security incumbents aggressively pivoting towards SSE offerings. The next section examines how robustly Zscaler’s competitive positioning can withstand these emerging challenges.

3 - Competitive landscape

Zscaler’s competitive set spans four distinct groups, each defined by its primary market identity and go-to-market positioning. Zscaler tends to win where its cloud-native, unified SSE architecture and track record of large-scale enterprise deployments translate into measurable operational and security gains.

• Full-stack SSE competitors – Compete on perceived simplicity and existing relationships, often leveraging networking refresh cycles.

• Product specialists – Win with deep, best-of-breed capabilities in discrete niches.

• Platform-embedded security – Offer “good enough” tools deeply integrated into broader productivity, identity, or cloud ecosystems.

• Mid-market price attackers – Target cost-sensitive buyers with lighter-weight, lower-priced SSE solutions.

To sustain leadership, Zscaler must:

1. Deepen SD-WAN integration and routing parity while positioning Zero Trust SD-WAN as a step-change architecture.

2. Match or exceed best-in-class depth in high-growth adjacencies (e.g., CSPM, microsegmentation).

3. Defend against hyperscaler bundling by demonstrating operational superiority, especially in multi-cloud and regulated sectors.

A) Full-stack SSE competitors (highest substitution risk)

Broad SSE/SASE platforms with strong brands, distribution, and R&D capacity capable of displacing Zscaler as the default enterprise security layer. Many are expanding into adjacencies like cloud workload security and digital experience monitoring.

Examples: Palo Alto Networks, Cisco, Fortinet, Netskope.

Go-to-market: Converged security plus SD-WAN, often tied to networking refresh cycles, supported by aggressive discounting. Note: SASE = SSE + SD-WAN under one operating model.

Threat scope:

• SSE: Direct substitution risk for ZIA/ZPA. Cloud-native peers (e.g., Netskope) are competitive in greenfield deployments, while PANW/Fortinet/Cisco hold an advantage in hybrid environments aligned to networking refresh cycles.

• Adjacencies: PANW’s Prisma Cloud overlaps with ZCP; Cisco’s ThousandEyes competes with ZDX; all are adding IoT/OT modules.

Where Zscaler wins:

• Cloud-native, multi-tenant architecture with global PoP performance.

• Identity-driven, cross-platform policy model.

• WAN-agnostic integration, including Zero Trust SD-WAN.

Where Zscaler loses:

• Perceived appliance simplicity and one-vendor appeal for network plus security.

• Entrenched networking procurement relationships.

• CASB depth in certain verticals (Netskope).

• Latency-sensitive SD-WAN perceptions in hardware-led deployments.

Investor view: This is the most strategically important battleground. Defending SSE leadership here is critical to sustaining attach momentum in adjacencies and maintaining pricing discipline.

B) Product specialists (partial wallet share risk)

Focused players with best-in-class depth in specific security or monitoring functions.

Examples: Wiz, Illumio, Armis, Dynatrace, New Relic, Catchpoint

Go-to-market: Domain-specific expertise delivered via specialist tooling.

Threat scope:

• ZCP: Wiz leads in developer-first CSPM/CNAPP; Illumio dominates microsegmentation.

• IoT/OT: Armis provides broader unmanaged device visibility and OT protocol coverage.

• ZDX: DEM vendors (Catchpoint, Dynatrace, New Relic) offer deeper app-level instrumentation.

Where Zscaler wins:

• Single-source procurement trends: Gartner projects >60% of new SSE deployments will be sourced from single-vendor stacks by 2027, up from <20% in 2023.

• Ability to add capabilities without requiring separate systems or management layers.

• Unified policy and analytics across users, workloads, and devices.

Where Zscaler loses:

• Specialist feature depth, especially in developer-first security and OT protocol coverage.

• Faster adoption cycles in niche markets not tied to SSE procurement.

Investor view: Low substitution risk for core SSE, but meaningful TAM erosion if attach rates in adjacencies stall. Risk increases in a slower SSE growth environment.

C) Platform-embedded security (pricing and bundling risk)

Security integrated into broader productivity, cloud, or edge platforms, often bundled at low or zero incremental cost.

Examples: Cloudflare, Microsoft, Google.

Go-to-market: SSE-adjacent security embedded into broader ecosystems.

Threat scope:

• SSE: Microsoft offers ZTNA, SWG, CASB in E5; Google embeds security into GCP; Cloudflare delivers ZTNA/SWG via its edge network.

• Adjacencies: Microsoft Defender for Cloud overlaps ZCP; Cloudflare’s network observability touches ZDX-adjacent areas.

Where Zscaler wins:

• Multi-cloud neutrality with consistent enforcement across environments.

• Independence from productivity/cloud provider roadmaps.

• Security-first architecture and SLA-backed performance.

Where Zscaler loses:

• Perceived sufficiency of bundled “good enough” tools.

• Deep native integration with each vendor’s broader stack.

Investor view: Pricing pressure and slowed expansion velocity are the primary risks, particularly in Microsoft/Google standardised environments. Cloudflare’s edge-centric execution adds an architectural challenge over the medium term.

D) Mid-market price attackers (cost-driven risk)

Lower-priced SSE offerings targeting mid-sized enterprises and budget-conscious buyers.

Examples: iboss, Skyhigh Security

Go-to-market: Streamlined SSE at materially lower ASPs, with limited adjacency scope.

Threat scope:

• Compete mainly in SWG/ZTNA at lower cost; minimal enterprise penetration.

Where Zscaler wins:

• Superior efficacy, scalability, and enterprise-grade SLAs.

Where Zscaler loses:

• Lowest-price wins in cost-first buying cycles.

Investor view: Limited impact on enterprise growth but caps penetration in lower-margin market tiers.

From Origins to Inflection Point

Zscaler’s trajectory to date reflects a rare combination of timing, architectural vision, and execution discipline. The shift away from perimeter-based models has created a structural tailwind for cloud-native security platforms, and Zscaler’s position as a neutral, globally distributed control point has so far allowed it to capture disproportionate share. Its expansion from ZIA into ZPA, workload protection, and digital experience monitoring shows a clear intent to deepen its role across security workflows, increasing both switching costs and share of wallet.

Yet the competitive terrain is tightening. Hyperscalers are embedding security into bundled offerings at negligible marginal cost, while Cloudflare and other edge-first challengers are converging on similar Zero Trust architectures. Specialist vendors continue to innovate rapidly in targeted niches, offering depth that can lure high-value workloads away from broad platforms.

The core investor questions therefore remain unresolved: can Zscaler defend pricing power and strategic relevance as integration accelerates, and can it grow product depth fast enough to remain the enterprise system-of-record for secure access rather than a commoditised policy layer?

These are the questions Part 2 will address — first by stress-testing Zscaler’s competitive position and economic resilience through the lens of Hamilton Helmer’s “7 Powers,” and then by examining the valuation, scenario outcomes, and risk-reward profile implied by today’s market price.

Sources

1. Agence nationale de la sécurité des systèmes d'information (ANSSI) (2024) – SecNumCloud Compliance Requirements.

2. Center for Strategic and International Studies (CSIS) (2024) – Global Data Sovereignty and Localisation Laws Tracker

3. CSIS (2024) – Global Data Sovereignty Tracker

4. European Union Agency for Cybersecurity (ENISA) (2024) – NIS2 Directive Implementation Timeline

5. Gartner (2024) – Cloud Shift: The Future of Enterprise Workloads. Gartner Research

6. Gartner (2024) – AI in Security Forecast: Augmented Cyber Operations by 2030

7. Gartner (2024) – Cloud Compliance Forecast

8. Gartner (2024) – Microsegmentation and East-West Workload Security Forecast 2024–2030

9. Gartner (2024) – SSE Market Forecast

10. Gallup (2024) – State of the Workplace 2024: Hybrid and Remote Work Trends

11. Gartner (2024) – Zero Trust Networking and Workload Security Forecast

12. IBM Security (2024) – Cost of a Data Breach Report: OT and Industrial Cybersecurity Trends

13. IDC (2024) – Industrial Cybersecurity and OT Threat Landscape Report

14. Microsoft (2024) – Digital Defense Report 2024: AI-driven Threat Landscape

15. Ministry of Electronics and Information Technology (MeitY), India (2024) – Digital Personal Data Protection Act (DPDP) Guidelines

16. Mordor Intelligence (2024) – Digital Experience Monitoring Market Report

17. Office of Management and Budget (OMB) (2022) – M-22-09: Federal Zero Trust Strategy

18. SANS Institute (2024) – ICS/OT Cybersecurity Survey

Disclaimer

This article is provided for information purposes only. This article has been prepared based upon information, including market prices, data and other information, from sources believed to be reliable, but the authors do not warrant its completeness or accuracy. Any opinions and estimates constitute our judgment as of the date of this material and are subject to change without notice. Past performance is not indicative of future results. This article is not intended as an offer or solicitation for the purchase or sale of any financial instrument. The authors do not provide individually tailored investment advice. Any opinions and recommendations herein do not take into account individual circumstances, objectives, or needs and are not intended as recommendations of particular securities, financial instruments or strategies. You must make your own independent decisions regarding any securities, financial instruments or strategies mentioned or related to the information herein.

We’re building a concentrated portfolio of resilient, growth-oriented businesses with a 10+ year investment horizon. Our mission: to maximise long-term value through deep, differentiated analysis.

We publish one comprehensive research deep dive each month.

Previous reports: Confluent (CFLT) | Snowflake (SNOW)

If you're passionate about exploring the world’s most transformative companies and want early access to our latest deep-dive reports, subscribe for free below:

Subscribe now

In an era where milliseconds define user experience and cyber threats pose constant risks, Cloudflare has evolved from a niche performance project into a critical internet infrastructure provider. Founded in 2009 with a mission to “help build a better Internet,” Cloudflare today operates a global network spanning 335+ cities in 125+ countries, offering enterprise-grade speed, security, and programmability without relying on traditional hardware.

What sets Cloudflare apart isn’t a single dominant moat, but a system of reinforcing advantages: global cost leverage, a tightly integrated product suite that accelerates adoption, and a high-velocity execution culture that enables rapid innovation and deployment. These dynamics combine to create a flywheel effect that strengthens with scale.

However, Cloudflare’s position is not unassailable. Hyperscalers like AWS could commoditize key offerings through aggressive bundling and pricing, while entrenched security incumbents such as Zscaler and Palo Alto Networks maintain deep enterprise relationships and robust product ecosystems that are hard to displace.

In this report, we trace Cloudflare’s journey from a point solution to a full-stack infrastructure platform—unpacking the strategic architecture behind its growth, assessing competitive threats, and exploring how its expanding role at the edge could reshape internet infrastructure.

Table of contents

• 1 - Why Cloudflare exists: The company’s evolution, strategy, and current role within internet infrastructure

• 2 - Market growth drivers: An overview of TAM and key factors supporting the market’s long-term growth outlook

• 3 - Competitive landscape: Who Cloudflare competes with and strengths / weaknesses vs each category

• 4 - Power analysis: Analysing Cloudflare through the lens of Hamilton Helmer’s 7 powers framework

• 5 - Strategic risks: Evaluating Cloudflare’s competitive advantages against key existential business risks

• Conclusion: Key takeaways and implications for Cloudflare as an investment opportunity

1 - Why Cloudflare exists

Cloudflare began with a simple but unconventional belief: security should not slow the internet down - it should make it faster.

That idea took shape in 2004, when Matthew Prince and Lee Holloway launched Project Honey Pot, an open-source initiative for tracking email spammers. By 2008, it was protecting tens of thousands of websites and logging billions of malicious activities. But there was a clear limitation: they could see threats, but not stop them. That insight opened the door to a bigger ambition - could security be embedded directly into the internet’s infrastructure?

Prince partnered with Michelle Zatlyn, a Harvard Business School classmate, and Holloway to launch Cloudflare in 2009. Their shared goal: build infrastructure that made the internet safer, faster, and more reliable.

“We didn’t set out to build a CDN or a security tool. We set out to build a better internet.” – Matthew Prince, co-founder & CEO

Harder, better, faster, stronger

Early sceptics argued that adding a security layer would slow down websites and create unacceptable latency. This critique fuelled an obsession with speed and performance within Cloudflare’s founding team, and when the beta version launched in June 2010, critics fell silent. Websites didn't just become safer, they loaded 30% faster.

Over the subsequent years, Cloudflare expanded rapidly. Between 2010 and 2016, it launched numerous features and built out a global network, with a core focus on both performance and simplicity.

• Cloudflare’s network includes datacenters (the blue dots below) and its backbone (lines below, which are fiber optic cables connecting these).

• Cloudflare leases space in available datacenters install its servers and networking equipment.

Cloudflare’s network

Two key decisions were pivotal during this early growth phase, setting the foundations for the company today:

1. Cloudflare's freemium model allowed it to serve millions of small websites at minimal marginal cost by using idle network capacity. These users not only enhanced Cloudflare’s visibility into threats but also provided valuable feedback, enabling rapid product iterations.

2. Cloudflare's unified architecture - managing DNS, WAF, CDN, and DDoS protection through a single control plane - enabled the instant, global deployment of new features without the overhead of hardware upgrades or fragmented codebases.

Together, these strategic choices propelled viral adoption and provided Cloudflare with structural advantages relative to its competitors.

The connectivity cloud

Initially, Cloudflare’s job was straightforward: protect and accelerate public websites. But as internet infrastructure grew more complex, the company’s ambitions expanded. Rather than just defending websites, Cloudflare set out to secure and optimise all traffic flowing across the internet - covering APIs, internal apps, employee devices, and edge computing environments.

That vision evolved into the Connectivity Cloud: a unified global platform that seamlessly integrates security, networking, and compute. Its core elements include:

• Cloudflare One – A Zero Trust suite replacing VPNs and firewalls with identity-aware controls.

• 1.1.1.1 – A privacy-first DNS resolver prioritising speed and confidentiality.

• Workers, R2, KV, D1 – A developer platform enabling global, serverless applications.

Unlike disjointed point solutions, Cloudflare delivers a cohesive architecture where every component is designed to work together by default. Services are delivered through a shared infrastructure, configured via a unified interface, and governed under consistent policy frameworks.

Cloudflare’s product suite over time

The practical benefits are illustrated by customers like Shopify, which relies on Cloudflare to support traffic during Black Friday sales - when transaction volumes reach nearly $4m per minute. Cloudflare helps ensure low latency, operational resilience, and effective DDoS mitigation, all without requiring custom tuning or specialised engineering effort.

This gets to the core of Cloudflare’s value proposition: eliminating complexity. Developers can build without worrying about orchestration. Enterprises can scale globally while enforcing security policies natively in the network. And as adoption deepens, Cloudflare becomes more than infrastructure - it becomes the connective layer underpinning the modern internet.

Becoming the internet’s connective layer requires not just architectural elegance, but alignment with where enterprise infrastructure is heading. We now turn to the structural forces shaping that terrain.

2 - Market growth drivers

Cloudflare operates at the intersection of several structurally expanding markets: Zero Trust security, edge compute, cloud networking, and serverless platforms. Each of these categories alone represents a large opportunity. Together, they signal a broader architectural shift in enterprise IT from perimeter-centric, hardware-defined models to globally distributed, software-defined networks.

Cloudflare estimates its adressable market at $181b for 2025, we use a more conservative bottom up estimate of $105–115b. This is forecast at >15% p.a. over the next decade. This reflects bottom-up sizing across Zero Trust, edge compute, serverless platforms, and cloud networking, driven by foundational changes in how digital systems are secured, scaled, and operated.

Four key structural drivers underpin this growth trajectory

A) Rapid growth in global internet traffic

Global internet traffic continues to rise sharply, driven by data-heavy applications like video conferencing, high-definition streaming, and generative AI. This growth is both absolute and structural – not just more users, but new types of workloads with more demanding latency and bandwidth requirements.

• In 2024, global internet exchanges handled over 68 exabytes of data, up 15% YoY, more than doubling since 2020.

• Average monthly smartphone data usage reached 20.3 GB per user in 2024, projected to exceed 23.8 GB in 2025.

• AI and LLM-driven services are beginning to account for a meaningful share of global traffic.

This surge places increasing pressure on traditional backbone infrastructure. Enterprises are responding by investing in distributed network architectures, edge compute, and latency-optimised delivery platforms.

Cloudflare product relevance:

• CDN, Argo Smart Routing, and Network Interconnect reduce latency and packet loss, optimising performance at the edge.

• Workers allows for compute workloads to be executed closer to the user, improving responsiveness for AI inference and real-time applications.

While traffic growth is undeniable, it does not necessarily translate into higher revenue per bit. Much of this traffic (AI training, streaming) risks becoming commoditised unless paired with differentiated value capture. Cloudflare’s edge-native architecture enables value-added services (e.g. programmable routing and security) that preserve margin.

B) The cybersecurity imperative

Cybersecurity threats are growing in frequency, scale, and complexity. Attacks are no longer occasional disruptions – they are persistent, increasingly automated, and often nation-state backed. For enterprises, this has shifted security from a risk management concern to an operational priority.

• Cybercrime costs are projected to exceed $13.8t in 2025, growing c.13% YoY.

• Automated scan and attack traffic averaged 36,000 requests per second in 2024, up c.17% YoY.

• Latin America and Europe saw 53% and 35% YoY increases in attack volumes, respectively.

These dynamics are pushing enterprises to re-architect security from a defensive layer to an embedded system design – where Zero Trust is not just a framework, but a default assumption.

Cloudflare product relevance:

• Cloudflare One (Zero Trust platform) integrates access control (Access), browsing security (Browser Isolation), and traffic filtering (Gateway).

• Magic Firewall and Bot Management help neutralise volumetric and automated threats.

• Security is embedded directly in the edge network, not bolted on—minimising latency and attack surface.

Platforms that embed security into the fabric of network delivery, not just as a patchwork of tools, are becoming the foundation of modern IT environments.

C) Shift toward cloud-native and edge-first environments

Enterprises are migrating from hardware-defined perimeter firewalls and VPNs to identity-based, policy-driven access models delivered as-a-service.

• The Zero Trust security market is valued at c.$43b (2025F), with a forecast CAGR of c.17% through 2035.

• Cloud-native security and network frameworks accelerated post-2023, driven by remote work, multi-cloud complexity, and compliance mandates.

• Latency-sensitive applications—from real-time collaboration to LLM-based interfaces—are demanding edge-first compute models.

Cloudflare product relevance:

• Cloudflare Workers and Durable Objects support serverless, edge-native application architectures.

• Magic WAN and Magic Transit enable network modernisation without MPLS dependence.

• Developer Platform tools allow seamless integration with CI/CD pipelines, crucial for agile teams operating across multi-cloud environments.

Hyperscalers retrofit edge performance into architectures optimised for datacentre gravity - Cloudflare, by contrast, was born at the edge.

D) Regulatory pressure and data localisation

Over 150 countries have implemented or proposed data sovereignty requirements. These rules – often industry-specific and jurisdiction-dependent – place new burdens on infrastructure teams to manage where and how data is stored, processed, and routed.

• Jurisdictions like the EU and China impose stringent restrictions on data transfer and cross-border flows.

• Enterprises in regulated sectors increasingly seek platforms that can dynamically route and localise traffic by geography.

Cloudflare product relevance:

• Regional Services and Geo Key Manager allow data and encryption key localisation to meet jurisdictional constraints.

• Data Localisation Suite and policy-based routing provide granular control over how traffic and metadata traverse global infrastructure.

These compliance-oriented features are now gating factors in major RFPs, transforming Cloudflare’s global network from a performance differentiator into a regulatory moat.

A new infrastructure baseline

The enterprise stack is undergoing a fundamental reset. Low latency, embedded security, programmability, and localisation have ceased to be differentiators - they are now table stakes. For vendors, this changes the game: meeting the new baseline is necessary, but insufficient.

Cloudflare is architecturally aligned with this shift. Its Zero Trust platform, developer-native edge tooling, and programmable infrastructure position it as a natural choice for enterprises re-architecting around compliance, performance, and global scale. But technical strength alone won’t decide the outcome.

Winning this layer is about controlling defaults. Distribution, integration, and orchestration, rather than raw capability, will determine who sets the rules.

As the edge becomes the new control plane, platforms are in direct conflict. The battlefield has shifted from packet delivery speed, to policy enforcement, trust mediation, and control over enterprise routing logic. Hyperscalers, incumbent security vendors, and cloud-native challengers are converging on the same chokepoints. The key question is no longer market size, it’s who commands it.

In the next section, we examine where Cloudflare stands in this reconfigured competitive terrain and what it must defend to preserve strategic leverage.

3 - Competitive landscape

Every millisecond shaved from a DNS lookup, every blocked exploit, and every edge function execution brings Cloudflare into collision with hyperscalers, security incumbents and edge-native specialists. With real-time routing, embedded security, and programmable delivery now baseline, the competitive advantage shifts to who governs traffic flows, enforces policy, and anchors developer workflows.

Cloudflare faces a multi-sided attack, with competitors at one end trying to commoditise its products (hyperscalers) and those trying to fragment the stack (cloud-native specialists).

Section summary

Incumbents and legacy rivals

Cloudflare’s early wins came from unseating legacy vendors: CDNs, hardware firewalls, and telecom stacks.

• Akamai remains entrenched in high-throughput video and media use cases, where Cloudflare's architecture underperforms.

• F5 and Cisco retain hold in regulated sectors and operationally conservative environments through compliance, training lock-in, and contract inertia.

• Telcos control last-mile infrastructure and often retain bundled WAN, MPLS, and DNS relationships that shield them from disruption.

Takeaway: The low-hanging fruit is gone, though Cloudflare can still make gains as technology and industry requirements evolve.

Cloud-native specialists

Cloud-native peers exploit specific seams in Cloudflare’s architecture and aim to fragment rather than replace the stack, offering best-in-class point solutions.

• Zscaler dominates Zero Trust at scale, with strong SIEM integration, MSSP alignment, and deep enterprise credibility. Cloudflare wins on performance and integration simplicity, but trails on operational depth.

• Fastly leads in programmability, offering WASM-native compute and elite developer mindshare. It attracts performance-sensitive users frustrated by Cloudflare’s V8 constraints.

• Startups like Temporal and Redpanda pick off edge compute, eventing, or mesh networking use cases where Cloudflare’s primitives feel insufficient or opaque.

Takeaway: These players don’t need to displace Cloudflare, just carve off the most valuable parts. Cloudflare’s unified product suite—its greatest strength—could also be its most exposed flank if customers can get comfortable with the added complexity of stacking competitor products.

Platform competition

While Cloudflare is being squeezed from above by cloud natives, Hyperscalers provide pressure from below. Providing less functional, but essentially free, products, AWS, Microsoft, and GCP don’t need to out-innovate; they win by owning the procurement interface.

• Microsoft distorts pricing through aggressive bundling. Security tools within E5 render Cloudflare’s Zero Trust stack functionally “already paid for” in many enterprises.

• AWS undermines retention by embedding primitives like CloudFront, WAF, and S3 into the developer workflow, making Cloudflare redundant in many all-in-AWS environments.

• GCP subtly shifts standards via control of DNS, Chrome, and Android—shaping what performance and routing “should” look like.

Takeaway: This is a slow burn erosion, not a feature war. Cloudflare’s defence is neutrality and ease of use, but unless it delivers a meaningfully better experience the platform gravity poses a significant threat.

DIY and open-source challengers

Open-source stacks don’t threaten Cloudflare at enterprise scale, but they remain influential in high-performance and engineering-led teams.

• NGINX, HAProxy, and mesh VPNs offer fine-grained control and transparency where SaaS feels opaque or inflexible.

• Perception gaps around pricing clarity and debugging push some developers toward open alternatives even if the total cost is higher.

Takeaway: Cloudflare wins on reliability, security, and scale, but must maintain developer trust through radical clarity. When control, not convenience, drives decisions, DIY wins.

Incumbents and legacy rivals

Cloudflare faces entrenched competition across multiple fronts: legacy CDNs, on-prem hardware vendors, enterprise security giants, and telcos. Each group commands deep customer relationships and historical mindshare but most struggle to match Cloudflare’s unified, software-native architecture.

To gain ground, Cloudflare pairs bottom-up developer adoption with a growing enterprise sales push. This dual approach has delivered traction, but the harder task now is displacing incumbents in high-assurance, compliance-heavy environments.

Traditional CDN and internet infrastructure

Akamai, the legacy CDN leader, remains entrenched in high-throughput video and OTT workloads due to longstanding contracts, optimised media pipelines, and deep integration with legacy broadcasters.

Where Cloudflare is winning:

• Modern web and SaaS workloads: Cloudflare dominates in performance-driven companies like Discord and Notion, with real-time propagation and developer-first ergonomics.

• Developer-led adoption: Its freemium model, flat-rate pricing, and frictionless onboarding outmatch Akamai’s heavyweight sales cycle.

• Integrated cross-sell: Many customers adopt Cloudflare’s CDN incidentally (through security or compute use) making it the connective layer by default.

Where it is losing:

• Media-heavy use cases: Akamai retains dominance in long-form video and live broadcasts, where adaptive streaming, regional peering, and throughput tuning are essential.

• Live event infrastructure: Cloudflare’s web-optimised architecture underperforms for high-bandwidth, persistent streams in media-centric geographies.

Strategic focus: Cloudflare should avoid legacy throughput battles and double down on programmable delivery - where value is shifting toward computation at the edge. Enhancing Workers, R2, and AI integration positions it to own the next phase of CDN evolution. Akamai’s edge is baked into legacy contracts; Cloudflare’s is built for modern traffic.

On-premise hardware vendors

Cloudflare directly challenges legacy appliance vendors whose firewalls, VPNs, and ADCs powered pre-cloud enterprise networking. These incumbents retain footholds in regulated sectors via compliance, procurement inertia, and entrenched operational workflows.

Where Cloudflare is winning:

• Cloud-native displacement: Zero Trust and Magic Transit are dismantling legacy hardware stacks in favour of programmable, API-first infrastructure.

• Cost-led disruption: Flat-rate pricing undercuts vendors like F5, particularly in multi-region deployments.

• Developer-centric environments: CLI-heavy appliances struggle in environments optimising for automation and self-service.

Where it is losing:

• Regulated industries: Finance, defence, and telecom often require appliance-based control, segmentation, and validated routing - areas where legacy vendors still outperform.

• Procurement and training lock-in: Many IT teams are trained on legacy systems, and procurement cycles favour known vendors.

Strategic focus: Cloudflare must evolve from a software-defined alternative into a policy-defined upgrade. Success depends on easing transitions - not just through product, but co-managed onboarding and performance guarantees. Framing itself as an architectural leap, not just a cheaper option, will drive deeper enterprise wins.

Enterprise security software giants

Cloudflare competes with security incumbents who offer broad portfolios across XDR, firewalls, and orchestration. These vendors dominate SOC workflows, procurement cycles, and MSSP ecosystems.

Where Cloudflare is winning:

• Integrated simplicity: Mid-market buyers prefer Cloudflare’s unified deployment - DNS, access control, and WAF all governed through one control plane.

• Edge-native enforcement: Low-latency policy enforcement at PoPs outperforms regional datacentres for performance-sensitive environments.

• Consolidation-led modernisation: Organisations seeking vendor rationalisation gravitate to Cloudflare’s single-platform model.

Where it is losing:

• Threat intelligence and response depth: Legacy vendors offer richer telemetry, XDR tooling, and SOC integrations - key for regulated environments.

• Support ecosystem depth: MSSP-aligned security stacks remain difficult to displace, especially in Fortune 500 deployments.

Strategic focus: Cloudflare should invest in detection surfaces, SIEM compatibility, and export tooling - not to replicate XDR, but to enhance observability and trust. It wins not through feature parity, but by reducing security’s operational surface area.

Telecom and network service providers

Cloudflare competes with telecom carriers offering MPLS, DNS, WAN routing, and managed security services. These providers retain structural advantages through control of last-mile infrastructure and embedded contracts, particularly in markets with limited ISP competition.

Where Cloudflare is winning:

• Displacing MPLS and rigid WANs: Magic Transit enables flexible routing and DDoS protection at lower cost, especially attractive for multinational, cloud-native firms.

• Edge performance in underserved geographies: Cloudflare’s Anycast model consistently delivers lower latency than telcos with centralised architectures.

• Programmability and control: Telco-managed networks remain opaque and inflexible. Cloudflare offers policy-driven routing and visibility, appealing to DevOps-led environments.

Where it is losing:

• Legacy contracts and inertia: Many global enterprises are locked into multi-year WAN deals bundled with voice/data services.

• Bandwidth gatekeeping: In weak net neutrality markets, telcos can prioritise traffic from favoured CDNs, subtly disadvantaging Cloudflare.

• Lack of physical infrastructure: Cloudflare leases rather than owns fibre, limiting leverage in certain edge cases.

Strategic focus: Cloudflare must continue turning telcos from competitors into distribution partners - offering peering incentives and shared caching infrastructure to reduce last-mile costs. Where telcos sell rigidity, Cloudflare must sell optionality. It doesn’t need to own the pipes, just redefine how they’re used.

Cloud-native specialists

While Cloudflare has spent the past decade chipping away at legacy incumbents, its most formidable strategic threats now come from peers not predecessors. These challengers are cloud-native, product-led, and often more focused in scope, enabling them to move faster in specific categories.

Some, like Zscaler, are already entrenched in enterprise security. Others, like Fastly, bet on differentiated edge compute models. A new generation of startups are probing around the edges competing on technical nuance, developer affinity, or regulatory positioning.

These players don’t need to displace Cloudflare entirely to hurt it. They only need to fragment the stack - slowing convergence, siphoning high-margin verticals, or raising switching costs. In this environment, Cloudflare’s greatest strength (its unified platform) also becomes its most exposed flank which incentivises rivals to specialise and siphon discrete high-margin functions without replicating the whole.

The following subsections examine each class of disruptor, and where the structural risk lies.

Zscaler and zero trust competitors

Zscaler is Cloudflare’s most direct peer in the Zero Trust category. Unlike legacy security vendors, Zscaler was cloud-native from inception, positioning itself as a secure internet access and private application gateway platform. Its multi-tenant, proxy-based architecture closely mirrors Cloudflare One’s ambition but with greater maturity in large enterprise deployments.

Where Cloudflare is winning:

• Performance and global edge reach: Cloudflare enforces policy at every PoP, outperforming Zscaler’s region-based nodes for distributed teams.

• Unified platform value: Cloudflare bundles security, routing, and observability in a single interface - appealing to mid-market buyers seeking simplicity.

• Developer affinity: Zscaler lacks programmability. Cloudflare’s edge-native developer tools unlock new security-plus-app workflows.

Where it is losing:

• Enterprise security depth: Zscaler dominates six-figure Zero Trust deals via deep compliance, SIEM integrations, and security operations credibility.

• Sales execution at scale: Zscaler’s high-touch GTM outpaces Cloudflare in Fortune 500 security-led accounts.

Strategic focus: Cloudflare must resist mimicking Zscaler’s complexity. Its advantage lies in convergence - offering security not as a silo but as part of a programmable network fabric. Enhancing SIEM compatibility and threat visibility will improve fit without compromising simplicity.

Fastly and edge computing specialists

If Zscaler challenges Cloudflare on the security front, Fastly poses the sharpest threat on the programmable edge compute frontier. Unlike traditional CDNs, Fastly built its platform with developers in mind, emphasising custom logic, real-time control, and low-level performance. Its Compute@Edge platform uses WebAssembly for ultra-fast, sandboxed execution, contrasting with Cloudflare Workers’ JavaScript-first, V8-based model. This technical divergence represents a core battleground for developer mindshare.

Beyond Fastly, a wave of smaller challengers (Section.io, Edgio, and Netlify’s Edge Functions) are carving out positions at the intersection of CDN, CI/CD, and edge execution. Though smaller in scale, these players exploit points of friction in Cloudflare’s architecture to attract early adopters and niche communities.

Where Cloudflare is winning:

• Distribution and scale: Cloudflare’s 335+ PoPs deliver superior consistency outside core metros.

• Platform breadth: Workers, R2, KV, and D1 form a comprehensive edge stack rarely matched by Fastly’s narrower focus.

• Security leverage: Fastly lacks Cloudflare’s security layer, making it harder to compete on end-to-end infrastructure convergence.

Where it is losing:

• Programmability depth: Fastly supports more languages and low-level logic, giving it the edge in performance-sensitive edge applications. If WebAssembly becomes the standard for secure, high-performance edge workloads, Cloudflare’s V8 runtime may face obsolescence risk. Fastly’s WASM-native architecture is better aligned with that future and could pull ahead if developer expectations shift.

• Developer credibility: Among elite engineers, Fastly is viewed as the more open, performant option - especially where Cloudflare’s runtime feels limiting.

Strategic focus: Cloudflare must close the programmability gap without compromising ease of use. Continued investment in runtime flexibility, debugging, and developer transparency will be critical to hold the high end.

Niche startups and emerging challengers

Beneath the surface of high-profile competitors lies a more fragmented but potentially destabilising tier: startups and point-solution specialists. These firms are not attempting to replicate Cloudflare’s platform wholesale but are targeting specific areas where speed, transparency, or depth is lacking. Whether in observability, edge AI, or data privacy, they create risk not through scale, but through disruption of architectural cohesion.

Examples include:

• Bunny.net – targeting developer-led CDNs with transparent pricing and better user experience.

• Netbird, Tailscale – peer-to-peer Zero Trust networks exploiting simplicity and mesh-based architecture.

• Redpanda, Upstash, Temporal – edge-native data and state management tools designed to outperform Cloudflare’s current storage and event frameworks.

Where Cloudflare is winning:

• Unified surface area: Few rivals offer storage, compute, and security as a coherent whole. Cloudflare remains the go-to for teams seeking integration over piecemeal tools.

• Global reliability: Startups rarely match Cloudflare’s SLA guarantees, PoP scale, or DDoS protection.

Where it is losing:

• Developer trust at the margin: Perceptions of opacity (around pricing, throttling, or debugging) drive some users to leaner, more transparent alternatives.

• Ecosystem gaps: For AI inference, durable jobs, or stateful coordination, startups like Temporal or Redpanda offer stronger primitives.

Strategic focus: Cloudflare must foster trust through clarity on pricing and runtime behaviour. Supporting external integrations and open patterns will mitigate churn to niche stacks.

Platform competition

Hyperscalers control the ecosystems in which Cloudflare operates. They don’t need to win on product, they win on defaults, bundling, and procurement gravity. The risk is not sudden churn, but strategic erosion: Cloudflare becoming unnecessary before it is unseated.

Microsoft

Microsoft’s $20b+ security business thrives on bundling. E5 licensees inherit Entra ID, Defender, and Purview - tools few actively choose, but many use by default.

Where Cloudflare is winning:

• Multicloud and neutrality: Teams avoiding Azure lock-in prefer Cloudflare’s vendor-agnostic model with consistent performance across clouds.

• Performance-sensitive apps: Azure’s network prioritises intra-cloud latency; Cloudflare outperforms for public-facing, latency-critical traffic.

Where it is losing:

• Cost-conscious enterprises: Microsoft wins by pricing to zero - Cloudflare can’t compete with “already paid for.”

• Identity stack integration: Entra ID is deeply embedded in enterprise auth flows; Cloudflare layers on top, not underneath.

Strategic focus: Cloudflare must anchor on neutrality and transparency. For regulated, multicloud customers wary of platform lock-in, it offers clarity where Microsoft offers opacity.

AWS

AWS competes directly on primitives (CDN, WAF, DNS, DDoS, object storage) making Cloudflare’s value harder to isolate in all-AWS stacks.

Where Cloudflare is winning:

• Global edge performance: Cloudflare’s PoP footprint is broader and more granular than CloudFront’s regional model.

• Ease of use: AWS interfaces are powerful but siloed; Cloudflare offers unified policy management and faster time to value.

• Data economics: R2’s zero-egress pricing contrasts sharply with S3’s punitive exit fees - especially for bandwidth-heavy apps.

Where it is losing:

• Operational inertia: Many teams simply build everything inside AWS. Native integration trumps marginal performance in low-stakes workloads.

• Marketplace friction: Cloudflare often requires separate procurement cycles; AWS Marketplace streamlines onboarding and billing.

Strategic focus: Cloudflare must position itself as the connective layer across clouds. Winning isn’t about outperforming AWS inside its castle - it’s about being indispensable outside of it.

Google Cloud Platform (GCP)

GCP’s threat is more systemic than commercial. It shapes internet architecture through Chrome, Android, and DNS infrastructure - setting defaults more than it sells.

Where Cloudflare is winning:

• CDN and edge execution: GCP’s edge stack remains limited. Cloudflare leads in performance, particularly for API-driven and global applications.

• Developer visibility: Workers enjoys greater traction in JAMstack and edge-first communities.

Where it is losing:

• AI and data gravity: As inference moves to the edge, GCP’s model-serving and data tooling will attract builders seeking integrated pipelines.

• Protocol influence: Google’s role in DNS resolution and browser behaviour gives it outsized influence over routing and performance expectations.

Strategic focus: Cloudflare must differentiate on openness. It cannot out-standard Google, but it can become the neutral alternative for teams that fear platform overreach.

DIY and open-source

DIY and open-source solutions rarely threaten Cloudflare at scale but appeal to engineering-led teams seeking fine-grained control or vendor independence. These stacks (typically built on NGINX, HAProxy, or mesh VPNs) win not through features but by offering perceived transparency, flexibility, or cost savings.

Where Cloudflare is winning:

• Operational simplicity: Most companies lack the appetite to manage TLS, DDoS mitigation, and global routing. Cloudflare packages this into a unified, fully managed stack.

• Observability and integration: Open-source setups often require stitching together disparate tools. Cloudflare’s control plane simplifies operations and debugging.

• Resilience and coverage: Cloudflare’s ability to absorb large-scale attacks with sub-second mitigation is virtually unmatched in self-hosted environments.

Where it is losing:

• Control-focused engineering orgs: High-performance teams may still prefer tuning their own stack, particularly in performance-sensitive or compliance-heavy contexts.

• Cultural distrust of SaaS: Some developers remain sceptical of closed, centralised platforms—especially where pricing or policy clarity is lacking.

Strategic focus: Cloudflare must demonstrate that DIY carries higher long-term costs - not just in money, but cognitive and operational overhead. Transparent pricing, API-level interoperability, and reliability metrics will help it win over pragmatic engineers who might otherwise default to OSS.

Cloudflare’s competitive map spans every layer of the modern internet stack. Some threats are immediate and tactical. Others, like platform erosion or developer churn, move slowly but reshape the terrain over time. The company’s ability to withstand this pressure depends less on any single feature, and more on the compound advantage of its integrated platform.

To evaluate the durability of these defences, we must now turn from competitive tactics to strategic foundations. The question is not who Cloudflare outperforms today - but whether its structural advantages can scale, entrench, and resist erosion over the long term. We now assess Cloudflare’s positioning through the lens of strategic power.

4 - Power analysis

To assess the durability of Cloudflare’s strategic advantage, we apply Hamilton Helmer’s “7 Powers” framework. Cloudflare does not rely on any one of these alone, but instead benefits from multiple overlapping sources of strength, each at different levels of maturity.

Scale economies

Definition

Scale economies emerge when marginal costs decline faster than rivals can match - producing an unreplicable cost structure.

Rating: Strong (Increasing)

Cloudflare clearly exhibits this dynamic across infrastructure, engineering leverage, and go-to-market reach. The critical test is not whether it operates at scale, but whether that scale yields structurally advantaged unit economics. Against this bar, Cloudflare stands apart from smaller peers and even challenges hyperscalers in select domains.

Cloudflare’s global network spans 335+ cities, with close to 400 Tbps capacity. These edge nodes form the economic engine behind flat-rate pricing, free tier offerings, and real-time mitigation at a fraction of competitor cost. Every incremental domain, API, or Worker function improves asset utilisation and amortises core infrastructure.

This structural advantage manifests in three interlocking ways:

• Cost per bit and request: Cloudflare absorbs multi-terabit DDoS attacks without surcharge, while most vendors rely on burst pricing or capacity reservations. At $20/month, its Pro plan offers protections that would be financially ruinous for peers like Bunny.net or Fastly to replicate without incurring losses.

• Custom hardware and orchestration: Cloudflare avoids proprietary boxes, instead using commodity servers and its own high-efficiency stack. Features like Auto Placement and intelligent load distribution mean each server processes more requests per watt and dollar than rivals. This improves gross margins and enables faster global rollouts.

• Peering leverage: Its traffic scale unlocks favourable interconnects and co-location inside ISP facilities. Smaller vendors lack this bargaining power and must route via more expensive paths or suffer higher latency. Even AWS and GCP, while vast, optimise for internal workloads and not low-margin edge services. Cloudflare’s neutrality and focus allow better routing economics at the internet’s edge.

But the scale moat isn’t just physical. Cloudflare has created developer scale - amortising R&D across millions of users and benefiting from vast telemetry to refine security and performance features faster than security peers like Zscaler or edge specialists like Fastly. Each code push impacts trillions of requests, compounding the returns on innovation.

The power is real, but not unassailable. Key risks:

• Hyperscaler price aggression: AWS could slash CloudFront and WAF prices to blunt Cloudflare’s cost edge, particularly in bundles. However, Cloudflare’s platform cohesion and neutral positioning make it more accessible for multi-cloud and API-centric workloads.

• Diminishing geographic returns: With over 95% of global traffic already served within 50ms, adding new PoPs now delivers only marginal latency improvements. Cloudflare’s strategy is evolving from expanding geographic reach to deepening functional capabilities, like enabling AI inference at the edge. This shift helps preserve scale advantages even as horizontal expansion slows.

• Capex burden if traffic flattens: Flat-rate pricing depends on rising traffic and stable capacity utilisation. If traffic plateaus or AI workloads consolidate back into hyperscaler centres, Cloudflare could face underused infrastructure. For now, its pricing discipline and forward provisioning mitigate this.

In practical terms, Cloudflare’s scale advantages force competitors into asymmetric trade-offs:

• Fastly’s programmable edge excels technically, but lacks scale to offer comparable pricing or breadth.

• Zscaler dominates in deep enterprise Zero Trust, but its infrastructure model doesn’t benefit from the same broad network amortisation.

• Microsoft and AWS have superior capital budgets but must optimise across broader priorities, making Cloudflare more agile at the edge.

Put simply, scale isn’t just about being big - it’s about being bigger where it matters. Cloudflare’s architecture, pricing, and market orientation turn that bigness into strategic leverage.

Network effects

Definition

Network effects arise when the value of a product increases with each additional user.

Rating: Moderate (Stable to Slightly Increasing)

Unlike social platforms or marketplaces, Cloudflare’s network effects are indirect, invisible to most users, and often underestimated. Yet they play a growing role in sustaining its platform advantage - particularly in security, performance, and developer experience.

The strongest manifestation lies in threat intelligence. Every new domain, API, or app onboarded contributes telemetry that feeds Cloudflare’s real-time mitigation systems. When an attack hits one target, countermeasures propagate globally within seconds. This immune-system dynamic is only possible with mass-scale diversity - something niche providers cannot replicate. In effect, Cloudflare defends its users with the aggregated experience of trillions of daily requests.

This scale also sharpens its performance optimisation loop. Argo Smart Routing dynamically selects optimal paths based on real-time network conditions. More traffic means better models. While routing engines exist elsewhere, few operate with comparable signal density or in as many geographies. The result is consistently low latency and lower volatility, even during global congestion events.

The third, less obvious, vector is developer ecosystem compounding:

• There are now more than 3 million developers on the Cloudflare platform - nearly 10x over the last 5 years. As more developers use Workers, KV, and R2, the pool of shared templates, libraries, and patterns deepens.

• Ecosystem integrations (e.g., analytics, observability, deployment tooling) increase, improving time to value for new users.

• A growing user base attracts education content, community projects, and third-party add-ons that reinforce Cloudflare as the default starting point.

This resembles a platform gravity well. Even if switching is technically easy, Cloudflare becomes the path of least resistance. Workers may not yet rival AWS Lambda in ecosystem breadth, but for edge-native workloads, the network effects are self-reinforcing.

However, these effects are not bulletproof:

• Opacity and ecosystem friction: Unlike companies like GitHub or Snowflake, Cloudflare’s network benefits are mostly hidden. Customers benefit passively, but rarely feel the network improving with scale. This weakens user affinity and underplays the value proposition in procurement cycles.

• Narrow scope of direct interdependence: Unlike true network businesses, Cloudflare’s value is not contingent on peer density. A CDN user gains from global insights, but not from who else is on the platform. This limits virality and reduces barriers to churn.
  Commoditisation pressure: Hyperscalers like AWS wield rich internal telemetry and could replicate global routing or DDoS intelligence over time. If threat intelligence becomes standardised (via shared feeds or open-source proxies) the edge could erode.

Critically, the most investor-relevant question is not whether Cloudflare’s network effects are strong in isolation, but whether they compound with other powers. Here, the answer is clearer: the more domains it secures, the more data it captures, the more it improves routing and mitigation, the more developers trust it, the more integrations accrue, and so on. These loops are slower than consumer networks, but deeply synergistic.

Over time, new products like AI inference, queue-based messaging, and multi-tenant observability could widen the interdependence of workloads and intensify these network effects. But for now, they remain a moderate moat: real, compounding, but not immune to disruption.

Counter-positioning

Definition

Counter-positioning occurs when a challenger adopts a business model that incumbents cannot emulate without damaging their core economics. It is only a lasting source of advantage if the incumbent’s inaction remains structurally rational - driven by cannibalisation risk, internal conflict, or strategic constraint.

Rating: Moderate (Decreasing)

At inception, Cloudflare was classically counter-positioned: a software-first architecture, flat-rate pricing, and self-serve onboarding that made it economically irrational for incumbents to respond. Akamai couldn’t offer $20/month unmetered DDoS without imploding its enterprise margins. Cisco couldn’t launch a programmable Zero Trust suite without cannibalising hardware sales and partner channels.

But counter-positioning is a transient moat. Its durability hinges on whether incumbents remain structurally paralysed, and that window is narrowing fast.

• In security, legacy vendors have embraced cloud delivery. Palo Alto’s Prisma, Fortinet’s SASE suite, and Zscaler’s Zero Trust platform have all evolved beyond boxes.

• In CDN, Akamai has adopted programmable edge and now markets AI-powered acceleration and security integrations. Even hardware stalwarts like F5 are offering cloud-native, subscription-based services.

As such, counter-positioning is no longer a primary moat for Cloudflare. It was essential to its early disruption and still opens doors in margin-heavy markets, but its durability is fading.

Continued advantage depends less on incumbent paralysis and more on Cloudflare’s ability to out-execute across scale, process, and ecosystem lock-in.

Switching Costs

Definition

Switching costs refer to the financial, technical, or psychological friction a customer faces when changing providers. High switching costs discourage churn by embedding the service deeply into customer operations - either through complex integration, sunk time, or risk of disruption.

Rating: Moderate (Increasing)

As customers expand their use of Cloudflare’s platform, its services become integrated into production infrastructure and compound over time. A firm using Cloudflare for DNS, WAF, API gateway, Workers, and Zero Trust faces a multi-team, multi-month migration to unwind. This burden is rarely justified by price alone, especially given the operational risk of getting it wrong.

Key factors include:

• Runtime dependency: Apps built on Workers using KV, Durable Objects, or Queues are non-trivial to port. Rewriting for Lambda@Edge or Fastly Compute@Edge often requires architectural changes, especially for stateful or latency-critical logic. The more edge-native a workload becomes, the harder it is to decouple.

• Integrated security stack: For customers using Zero Trust access, Gateway, and WAF together, the policies, logging flows, and enforcement points are tightly embedded into security workflows. Migrating to Zscaler or Palo Alto equivalents means replicating not just configurations, but deeply ingrained operational practices, and risking security drift during transition.

• Process inertia: Enterprises invest in tuning, automation scripts, custom integrations, and staff training. Even if a rival offers equivalent features, the hidden costs of retraining and revalidation can outweigh the gains. One mid-sized SaaS firm that attempted to replace Workers and KV with Fastly Compute and self-hosted Redis found the migration took three months and introduced subtle latency bugs that delayed rollout and forced re-architecture - underscoring the real cost of exit.

These frictions are not absolute. Key caveats include:

• Portability by design: Cloudflare avoids proprietary formats and supports open standards. It doesn’t trap customers with closed tooling or opaque data models. This keeps switching possible, but not painless.

• Commodity-like core: At the CDN layer, switching costs remain low. Customers can and do swap in Fastly, Akamai, or even DIY stacks for basic delivery or caching. Retention here depends more on price/performance than entrenchment.

• Segmented usage: Many customers adopt Cloudflare tactically, e.g. using Workers but not security, or CDN but not DNS. The more fragmented the usage, the lower the effective switching burden.

Overall, while no single component is unbeatable, the bundle is deeply entrenched and hard to replicate in full. For now, switching costs remain moderate, but increasingly act as quiet, accumulating cement beneath the platform.

Branding

Definition

Brand power arises when intangible associations (trust, identity, prestige) compel customers to choose a product even when viable alternatives exist. A true brand moat allows companies to win or retain customers despite functional parity, and ideally justifies price premiums based on perception alone.

Rating: Weak (Slightly increasing)

Cloudflare commands respect among developers: its brand signals reliability, transparency, and modernity, but not margin protection. Among engineers, the company often serves as the default for DNS, WAF, and CDN, purely because of familiarity and reliability. Its educational blog posts, public postmortems, and open documentation build trust. For many, choosing Cloudflare signals modernity and sound technical judgment.

This manifests in several subtle ways:

• Trial preference: When evaluating new infrastructure, teams often begin with Cloudflare - not because it’s the cheapest or deepest, but because “it just works” and is safe to try.

• Cross-product extension: Existing users frequently expand usage into Workers, R2, or Zero Trust - trusting Cloudflare to deliver on simplicity and cost-predictability.

• Mid-market comfort: Buyers without deep security or networking teams rely on Cloudflare as a one-stop-shop. Its brand as an “internet utility” de-risks procurement.

However, these dynamics do not rise to the level of durable brand power. The brand opens doors; it doesn’t close them to rivals.

• No pricing leverage: Cloudflare competes on value and transparency, not premium pricing. Customers switch for features or economics, not loyalty. Brand affinity does not protect margins.

• No identity attachment: Unlike Apple or even Snowflake, Cloudflare lacks aspirational status. Customers do not signal status or ethos by being on Cloudflare. If a faster, cheaper, or better-integrated option emerges, they will consider it.

• Not category-defining: In Zero Trust or edge compute, Cloudflare is still building awareness. In many large-enterprise RFPs, Zscaler or AWS are assumed before Cloudflare is even considered.

Brand power may increase over time, especially if Cloudflare maintains engineering excellence and becomes the default edge platform across categories. But the moat remains shallow. The brand supports conversion, but doesn’t prevent churn.

Crucially, Cloudflare’s brand works best when reinforced by product strength. A few high-profile outages, opaque pricing moves, or stagnation in core products could materially damage perception. In this sense, the brand is a force multiplier, not a shield.

In sum: Cloudflare’s brand does not confer pricing power or deep loyalty, but it reliably drives trial, developer trust, and lateral product adoption. It greases adoption, not pricing power: a persuasive brand, but not a protective one. While weak by Helmer’s strict standards, the brand remains a meaningful force multiplier across Cloudflare’s broader platform strategy.

Cornered resource

Definition

A cornered resource is an asset (legal, contractual, or structurally embedded) that confers exclusive control and materially strengthens competitive position. It must be truly irreplicable, such that no competitor can access it, even with sufficient capital or will. Classic examples include proprietary IP, exclusive supply rights, or deeply embedded founder credibility.

Rating: Weak (Stable)

Nothing Cloudflare controls is off-limits to well-funded competitors. ISPs will peer with any provider of sufficient scale. Colocation centres are open to any firm with capital. Its DNS dataset, while immense, is not proprietary in a way that rivals like Google or Akamai couldn’t match. Even threat telemetry, a notional advantage, is rivalled by Zscaler’s enterprise-heavy dataset or AWS’s internal visibility across its cloud stack.

Three candidate resources fall short on scrutiny:

• Talent and engineering culture: Cloudflare is known for rapid shipping and technical depth, But the talent it attracts is neither exclusive nor structurally cornered - its engineering depth reflects process and culture more than access to singular minds or protected IP.

• Traffic intelligence: Cloudflare handles trillions of requests per day, feeding into its bot detection, DDoS mitigation, and routing models. But this data advantage is horizontal - hyperscalers have similar or better visibility within their own ecosystems. The insight derived from this traffic is valuable, but not uniquely inaccessible.

• Founding credibility: CEO Matthew Prince is an effective spokesperson and public advocate. However, founder-driven narrative strength is not the same as a cornered asset. His influence supports brand and agility, but could be replaced or replicated in effect.

Contrast this with companies like ASML (exclusive lithography patents) or TSMC (process IP and geographic scarcity), where access to the resource is contractually or physically locked. Cloudflare operates in open infrastructure territory - its advantage is in how it executes, not what it alone possesses.

Importantly, Cloudflare has avoided resource cornering by design. Its architecture is open, neutral, and standards-driven. This supports interoperability, but at the cost of exclusivity. It cannot force vendor lock-in through format control, proprietary APIs, or licensing regimes, as Oracle or Palantir do.

Could cornered resources emerge over time? Possibly, especially in areas like:

• AI inference at the edge, if paired with proprietary model tuning or data localisation IP.

• Integrated observability pipelines that capture unique diagnostic data beyond what hyperscalers expose.

• Sovereign-compliant network layers, if Cloudflare becomes a regulatory default in data-restricted geographies.

But these remain speculative. For now, the company’s strategic strength lies in operational excellence, integration depth, and developer affinity - not in exclusive control over critical assets.

Process power

Definition

Process Power arises when a company embeds tacit knowledge, unique workflows, and cultural routines into its operations that yield consistently superior outcomes. These processes must be hard to observe and difficult to replicate, even when rivals attempt to mimic inputs. Genuine process power is rare and often invisible - seen only in the outputs.

Rating: Moderate (Increasing)

Cloudflare’s product velocity and operational execution suggest process power is emerging, though it has not yet reached truly unassailable depth.

Few companies of comparable scale ship faster, iterate more frequently, or experiment as broadly. Cloudflare regularly launches multiple features per quarter across disparate domains - security, networking, storage, compute, AI inference. This velocity is not a function of size, but of design.

Key elements underpinning this include:

• Unified architecture: A single codebase and control plane allows every product to interoperate by default. Features are instantly deployable across the global edge network without versioning issues, patch windows, or fragmented support teams.

• Developer-led workflows: Cloudflare’s internal systems prioritise modularity and testability. Its engineering teams build tooling not just for end-users but for internal deployment - accelerating QA, rollback, and instrumentation. This has allowed the company to scale product lines without bloating coordination costs.

• Cultural alignment: The company’s public-facing transparency (technical blogs, detailed incident reports, and roadmap disclosures) is mirrored internally. Engineers have unusually broad context and autonomy. This creates a flywheel where customer feedback, telemetry, and product evolution are tightly looped.

These practices show up in outputs. Consider the rapid expansion of Workers from a niche JS runtime into a full edge development platform, complete with KV, R2, Queues, Durable Objects, D1, and AI inference - all rolled out in under four years. Or the consistent ability to underprice hyperscalers on bandwidth and storage without degrading performance, a feat requiring not just capex discipline but deep operational coordination.

However, this power is still maturing:

• Transparency dilutes defensibility: Cloudflare openly documents its architecture. This means best practices are visible and replicable. Fastly, AWS, and others can mimic the design, even if not the rhythm.

• Execution is not yet outcome-insulated: Cloudflare’s success is still visible in features and roadmap pace, not in consistent financial outperformance or category leadership across all products. Until process depth consistently translates into market dominance, the power remains emergent.

• Key-person reliance risk: Much of Cloudflare’s operational coherence stems from a tightly aligned founding team still in place. If this leadership transitions, it’s unclear whether the culture and systems would persist or fragment.

That said, process is compounding. As Cloudflare expands its edge stack and deepens integrations across services, the internal benefit of its execution model grows. New products are easier to build, test, and deploy because the infrastructure beneath them is coherent and battle-tested. This feedback loop mirrors what Snowflake built in analytics or what Shopify built in commerce - a foundational substrate that accelerates adjacent expansion.

In summary, Cloudflare’s internal machinery enables faster, more cohesive execution than most competitors. It’s not yet an unassailable moat, but it is a real and growing source of strategic leverage, especially as rivals struggle with siloed architectures, fragmented teams, or partner-channel friction. With time, this may become the company’s most defensible power.

Cloudflare’s strategic strengths, particularly its scale efficiencies, growing switching costs, and executional velocity, form a credible platform moat. Yet durable advantage does not imply immunity.

The right question shifts from “What does Cloudflare do well?” to “Where and how might it fail?” In the next section, we critically stress-test the company's strategic defences - challenging each source of advantage against plausible threats, investor scepticism, and asymmetric risk.

5 - Strategic risks

Strategic advantage is only as durable as the pressures it withstands. Cloudflare’s defensibility, while multi-faceted, faces credible risks across platform erosion, economic compression, and strategic misexecution. In this section, we evaluate not only where Cloudflare could falter, but whether its model has built-in resilience or structural brittleness.

A) Platform erosion by hyperscalers

Cloudflare’s biggest existential risk is from AWS, Microsoft, and GCP. These companies don’t need to beat Cloudflare on features, they can win through bundling, procurement integration, and owning the control plane where infrastructure decisions are made.

• Bundling economics: Microsoft’s inclusion of security tools in E5 shifts buyer logic from “best-of-breed” to “already paid for.” AWS offers bandwidth discounts and architectural guidance that make CloudFront the default within its ecosystem. Cloudflare can appear costly in comparison.

• Procurement defaulting: Teams provisioning infrastructure inside AWS or Azure face friction in introducing third-party services. Marketplace integration, billing consolidation, and support entitlements make hyperscaler-native tools the path of least resistance.

• Ecosystem asymmetry: Hyperscalers control developer workflows, observability layers, and increasingly AI/ML pipelines. Cloudflare cannot compete across this breadth. Its strength is neutrality, but that advantage is only noticeable when customers care. In many cases, they don’t.

This risk is structural and slow-burning. It won’t show up as sudden churn, but as reduced expansion, fewer Greenfield wins, and increasing dependency on developer affinity rather than procurement logic.

Cloudflare’s defence, multi-cloud positioning and focus, is rational but insufficient on its own. To resist erosion, it must offer a meaningfully better experience outside the hyperscaler castle. That means faster, cheaper, simpler, and more cohesive.

B) Limited Zero Trust expansion

In Zero Trust, Cloudflare faces a pincer attack: Zscaler from above, Microsoft from below.

• Zscaler dominates six-figure enterprise deployments. Its deep compliance, integration with SIEM/SOAR tooling, and high-touch sales execution make it nearly untouchable in regulated, high-assurance accounts. Cloudflare may match on features but lags on credibility and service assurance.

• Microsoft bundles Zero Trust tooling into E5 at near-zero marginal cost. For many security leaders, this renders standalone alternatives hard to justify - even if Cloudflare outperforms technically.

• Sales execution risk: Cloudflare’s bottom-up traction doesn’t naturally convert into six-figure expansion. Many Zero Trust deployments require security champions, internal change management, and cross-department orchestration. Cloudflare’s ability to scale that playbook remains unproven at the enterprise tier.

Cloudflare is caught between a rock and a hard place: Zscaler defends the high ground with deep enterprise entrenchment, while Microsoft captures the low ground through costless bundling and ecosystem gravity. Both make it difficult for Cloudflare to scale into the enterprise Zero Trust market without a step-change in go-to-market strategy and credibility.

The risk is twofold: growth stalls if Cloudflare can’t win larger accounts, and margins compress if it’s forced to discount heavily or over-serve lower-paying customers. Until it proves it can reliably execute six-figure Zero Trust expansions, Cloudflare’s enterprise ambitions remain more promise than proven.

C) Edge compute and programmability risk

Edge compute is where Cloudflare is most technically exposed. Fastly, AWS, and a constellation of startups all compete for developer mindshare in the emerging programmable edge.

• Fastly wins on performance depth, language flexibility (WASM support), and transparency. Elite engineering teams often view it as the technically superior platform, especially for high-throughput, latency-sensitive workloads.

• AWS offers broader integration. Developers building in Lambda, Step Functions, or Bedrock often stay inside the walled garden. Cloudflare must provide both technical and workflow advantage to justify a dual-stack.

• Developer trust risk: Cloudflare has occasionally been opaque around throttling, debugging support, and runtime behaviour. In edge compute, these concerns are magnified. Developers value control and clarity—traits Fastly and open-source alternatives often deliver better.

Failure here risks not just margin loss but strategic reclassification from edge platform to utility CDN. Without traction in high-value, programmable use cases, Cloudflare’s pricing power and product roadmap will be constrained by its infrastructure roots.

D) Margin compression and commoditisation

Even if Cloudflare retains customers, it may struggle to monetise usage growth profitably, especially in its foundational services.

• Flat-rate risk: Many of Cloudflare’s offerings (e.g. CDN, DDoS protection) operate on flat-rate models. While these drive adoption and loyalty, they cap revenue upside from bandwidth-heavy workloads like AI inference or streaming.

• Traffic mix shift: As traffic skews toward heavier, less value-dense content (e.g. model queries, video), cost-to-serve may rise faster than pricing flexibility - especially if customers remain price sensitive.

• Benchmarking pressure: Infrastructure buyers increasingly compare on price-per-bit and cost-per-request. Hyperscalers can cross-subsidise or bundle to win deals, undermining Cloudflare’s ability to sustain pricing without corresponding feature depth.

The core risk is cost overhang without corresponding revenue leverage. This could erode gross margin and reduce Cloudflare’s ability to reinvest.

E) Strategic coherence and bundle fragility

Cloudflare’s platform ambition, being the “Connectivity Cloud”, rests on a coherent vision: an integrated suite where every part amplifies the others. But expansion brings risk: is the bundle still additive, or simply broad?

• Category creep: Cloudflare now spans security, compute, storage, observability, AI inference. The risk is that few of these domains are deep enough to dominate and together, they may confuse rather than compel.

• Buyer misalignment: Storage, compute, and observability are typically bought by different teams on different timelines. A “one pane of glass” pitch may resonate with mid-market tech firms, but not with complex, siloed enterprises.

• Dilution of focus: If the platform becomes sprawling, it may lose the polish and opinionation that made early products compelling. New users may see Cloudflare as a jack-of-all-trades - not a best-in-class anything.

Strategic coherence matters more than breadth. If the platform story breaks, Cloudflare loses the ability to pull expansion revenue across the suite and becomes vulnerable to modular challengers picking off high-margin verticals.

F) Execution complexity at scale

Cloudflare’s shipping cadence, infrastructure discipline, and cultural cohesion are among its greatest strengths. But scale introduces entropy. As the company grows in headcount, geography, and product scope, can it maintain operational velocity?

• Coordination drag: More products mean more interdependencies. One misaligned launch (e.g. R2 limits, Workers billing) can stall multiple teams. The cost of cross-team orchestration rises nonlinearly.

• Cultural dilution: The founder-led, engineering-heavy ethos that defines Cloudflare today may weaken as layers of management, compliance, and enterprise process accumulate. Speed decays. Boldness fades.

• Talent and leadership depth: As the business shifts from product-led growth to strategic enterprise partnerships, Cloudflare will need different muscles including field sales, alliances, and customer success. Building those without losing its soul is a difficult feat.

If execution slips, the flywheel slows. Products stagnate. Innovation lags. And rivals with deeper vertical expertise or better customer support begin to outpace Cloudflare in enterprise settings.

Conclusion: A Platform of possibility, not certainty

Cloudflare stands at the convergence of multiple secular currents: cloud decentralisation, Zero Trust security, AI latency constraints, and a structural shift toward programmable infrastructure. It is not just selling services - it is trying to define the abstraction layer through which the modern internet is built, secured, and scaled. The ambition is enormous, the product velocity relentless, and the surface area of innovation (spanning performance, security, developer tooling, and compute) strategically expansive.

The size of the prize is large, with a TAM exceeding $100b and with real market momentum across multiple categories, and Cloudflare has the potential to become a default component in enterprise architectures. Its integrated platform approach, developer-first brand, and cloud-neutral stance create meaningful friction for rivals and allow for asymmetric leverage in cross-sell motions. The virtuous loop, where product usage fuels deeper integration (which in turn reinforces lock-in) could plausibly drive durable expansion.

Yet the path from potential to inevitability is steep.

Cloudflare's valuation embeds high expectations, requiring sustained high 20s revenue growth. If Cloudflare executes, compounding wallet share, embedding Workers as a credible compute layer, and building true Zero Trust depth, it could structurally reshape the cloud stack and justify its premium. But it must thread several needles to get there.

In sum: the opportunity is large, the moats are real, but the outcomes remain non-linear. Cloudflare is no longer just a CDN. It is a bet on convergence of security, performance, and compute at the edge, and a test of whether infrastructure platforms can earn not just usage, but trust.

The market will reward execution. But it will not forgive its absence.

Subscribe for thoughtful, in-depth analysis of the world’s most impactful companies—delivered directly to your inbox.

If you enjoyed this piece, a like is always appreciated!

Share

Subscribe now

Sources

1. Cloudflare - Our Story

2. Cloudflare - Press Releases

3. Cloudflare - Blog

4. Meritechcapital - S1 Breakdown

5. Hhhypergrowth - Investment Deep Dive

6. SEC - Filings

7. Softwareanalyst - Insights into cyber’s largest companies

8. Morningstar - Strategy and outlook

9. Grand View Research – Zero Trust Security Market Report

10. GMI Insights – Zero Trust Architecture Market

11. Grand View Research – Edge Computing Market

12. MarketsandMarkets – Edge Computing Forecast

13. Grand View Research – Cybersecurity Market

14. MarketsandMarkets – Application Security

15. Allied Market Research – CDN Market

16. Statista – Global CDN Revenues

17. Grand View Research – AI Inference Market

18. McKinsey – GenAI State of AI 2024

19. Gartner – Secure Access Service Edge (SASE)

20. IDC – Enterprise Network Infrastructure Forecast

21. Stratechery - Akamai

Disclaimer

This article is provided for information purposes only. This article has been prepared based upon information, including market prices, data and other information, from sources believed to be reliable, but the authors do not warrant its completeness or accuracy. Any opinions and estimates constitute our judgment as of the date of this material and are subject to change without notice. Past performance is not indicative of future results. This article is not intended as an offer or solicitation for the purchase or sale of any financial instrument. The authors do not provide individually tailored investment advice. Any opinions and recommendations herein do not take into account individual circumstances, objectives, or needs and are not intended as recommendations of particular securities, financial instruments or strategies. You must make your own independent decisions regarding any securities, financial instruments or strategies mentioned or related to the information herein.

Building on the success of Apache Kafka - an open-source framework its founders helped create - Confluent offers a fully managed, enterprise-grade platform designed to transport, process and share data in real-time.

In this article (Part 1), we explore how Confluent established itself as the 'control plane' for data-in-motion, discuss why the market remains nascent, and identify Confluent’s key competitive advantages and challenges.

In Part 2, we bring this home with an analysis of financial performance and valuation, and the overall investment case.

Contents

• 1 - Why does confluent exist?

  • Event streaming 101

  • Confluent’s origins

  • Building the Central Nervous System

• 2 - Market landscape and growth drivers

  • What’s driving adoption?

  • Industry outlook

• 3 - All roads lead to Confluent

  • Current competitive position

  • Incumbents

  • Hyperscalers

  • Emerging alternatives

  • Data platforms

• 4 - Powering the system (7 powers analysis)

  • Counter positioning

  • Scale economies

  • Network effects

  • Switching costs

  • Branding

  • Process power

  • Cornered resource

• Conclusion

1 - Why does Confluent exist?

Event streaming 101

Traditional data architectures run on batch processing: data is collected, cleaned, and processed hours - or even days - after it's generated. Event streaming flips that model. At its simplest, event streaming means each piece of data (e.g. a click, payment, or sensor reading) is treated as a live, immediate update rather than saved and processed later in batches. Each event travels instantly through systems, like electricity through a circuit, sparking actions immediately.

Imagine a customer clicking “purchase” - and within 300ms:

• A fraud detection model is triggered,

• The inventory system updates,

• A personalised email is queued, and

• A real-time dashboard reflects the transaction.

That’s event streaming.

Contrast this with traditional batch processing- where data from that same transaction might only update systems hours later, potentially causing missed fraud alerts, oversold inventory, or delayed customer insights.

Overall, the use cases are compelling:

• Real-time user experiences drive higher engagement.

• AI systems require live data to avoid model drift.

• Operational resilience improves with instant visibility and replayable logs.

Cloud-native systems depend on scalable, distributed pipelines.

Confluent’s origins

In 2011, LinkedIn engineers Jay Kreps, Neha Narkhede, and Jun Rao encountered a universal problem: their legacy data pipelines simply couldn’t handle LinkedIn's exploding real-time data needs. Frustrated by clunky batch processes delaying critical user notifications and analytics, they built Kafka - initially a side-project - which rapidly transformed into critical data infrastructure for Netflix, Uber, and beyond.

However, its rapid adoption exposed problems: complex operational demands, steep learning curves, and patchy security standards. Seeing Kafka’s rapid adoption alongside these operational challenges, the trio envisioned something bigger: a fully-managed, secure, enterprise-grade platform. This vision became Confluent’s mission to build a 'central nervous system' for data, unifying disparate apps and systems in real-time.

From day one, the team understood Kafka’s open-source DNA was integral to its success. Confluent has maintained its deep commitment to the open-source community, remaining one of Kafka’s top contributors, regularly publishing research, and actively engaging developers through meetups and its flagship annual conference, Current. This careful balance - leveraging open-source innovation while delivering proprietary enhancements - has been central to the company’s sustained leadership.

Building the Central Nervous System

As Kafka became the de facto standard for streaming data, the ubiquity created what CEO Jay Kreps calls a “foundational missing layer” in modern IT architecture - a central pipeline for data connecting all software systems so they can react intelligently to events as they happen. Confluent positions itself as the enterprise partner best-equipped to handle these sophisticated data-in-motion demands.

“businesses need data infrastructure that provides connectivity across the entire organisation with real-time flow…and the ability to build applications that react…in real-time. We think this new stack will evolve to be the central nervous system of every company” - Jay Kreps

While Kafka remains key for transporting events, enterprises also need a way to transform, govern and share those events. Where Confluent began as “Kafka-as-a-service”, the company has evolved a much broader vision: a universal control plane for real-time event streams. Confluent’s platform is designed to:

• Ingest and connect data in real time from over 120 connectors,

• Process events with Flink (via its Immerok acquisition),

• Govern data through schema registries, lineage, and RBAC,

• Share it securely with external teams or partners via Stream Sharing, and

• Seamlessly integrate analytics with Tableflow .

Together, these innovations form a virtuous cycle: processing enriches Kafka streams; governance builds trust; sharing and Tableflow enable immediate consumption by analytics and AI.

Wrapped within Confluent Cloud and powered by the proprietary Kora engine, the platform offers unmatched serverless elasticity, multi-cloud compatibility, and reliability - qualities few in-house teams or even hyperscalers can replicate fully.

2 - Market landscape & growth drivers

What’s driving adoption?

The world is demanding immediacy, and over the past 10 years the amount of data processed in real time has exploded - the global digital data generated rose from roughly 2 zettabytes in 2010 to about 181 zettabytes by 2025, a c.90x increase.

This growth has been driven by companies like Shopify, whose Black Friday sales now spike at nearly $4m per minute. Managing inventory in real-time across thousands of merchants worldwide, avoiding overselling and instantly detecting fraud - this demand isn't optional; it's mission-critical. Similarly, in autonomous vehicles, real-time data streams are not just critical but life-saving - sensor data processed milliseconds late can lead to catastrophic outcomes.

Batch-based systems aren’t capable of serving this demand, with this real-time precision requiring exactly the type of event-driven infrastructure Confluent provides. As a result, the company’s total addressable market (TAM) has grown c.20% per year since 2021 to more than $100b today.

Industry outlook

Looking forward, event streaming represents a fundamental shift in how enterprises manage and leverage data, with the potential to reshape enterprise IT by enabling instantaneous interactions with real-time information across all facets of a business.

While the pace at which enterprises shift away from legacy systems remains uncertain, the direction is inevitable. Numerous drivers are accelerating this transition in an increasingly digital landscape:

• Proliferation of IoT: With c.17 billion IoT devices in use today, companies are shifting compute closer to the data source to reduce latency and network load - making stream processing a critical enabler.

• Edge computing & decentralised architectures: Gartner estimates that in 2025, 75% of enterprise-generated data will be created or processed outside traditional data centres. This decentralisation reinforces event-driven architectures to handle data close to where it’s generated.

• AI, ML & real-time insights: Integrating real-time data into AI-driven systems (e.g., recommendation engines, fraud detection, autonomous systems) requires low-latency event streams. The rapid expansion of the big data market (from $240b in 2021 to projected $655b by 2029 - a c.15% CAGR) underscores this need.

• Regulatory pressure & privacy-by-design: Regulations like GDPR, CCPA, and evolving ePrivacy frameworks are pushing businesses to adopt real-time event processing for compliance - tracking consent events, data access, and erasure requests with immediacy.

• Composable/modular platform architectures: Emerging cloud-native trends emphasise loosely coupled, API-driven systems (microservices, serverless compute, event mesh) vastly simplifying scale and maintainability. The movement toward Kappa architecture, domain-driven event channels, and event-sourced systems demonstrates demand for stream-native design.

3 - All roads lead to Confluent

Current competitive position

In an increasingly crowded landscape of data integration solutions - including traditional message queues, enterprise ETL tools, cloud-native messaging platforms, and emerging open-source technologies - standing out requires significant mindshare and momentum.

Apache Kafka has emerged as the dominant standard in event streaming, with widespread adoption by more than 150,000 companies, including approximately 75% of the Fortune 500. This broad penetration has fostered a powerful developer ecosystem, often referred to as a self-reinforcing "developer flywheel," creating deep expertise, abundant resources, and extensive compatibility across platforms.

Confluent strategically capitalises on Kafka’s established position. By enhancing Kafka’s core capabilities and building complementary proprietary solutions, Confluent leverages Kafka's ubiquity and ecosystem momentum to establish meaningful competitive differentiation. However, sustaining this advantage requires continually navigating competitive pressures from multiple directions:

Incumbents (IBM, Tibco, Oracle)

One of Confluent’s fiercest opponents is not a flashy new platform but plain old inertia. For years, enterprises have shuttled data from transactional databases to warehouses with Informatica workflows or bespoke scripts, accepting multi-hour latency as “good enough.” Confluent must prove that seeing analytics seconds after an event - not the next morning - creates business value worth the added architecture.

While secular forces are working in its favor, the “if it ain’t broke” instinct remains a hurdle, and entrenched middleware continues to power mission-critical queues in banking and other regulated industries. Confluent addresses this challenge by positioning Kafka as a scalable, cost-effective, and open ecosystem alternative, promoting its benefits such as reduced costs per throughput and cloud-native agility.

Overall, this is a slow burn. Confluent’s strategy is to gradually replace these systems by initially complementing them in high-volume / real-time contexts, gaining enterprise mindshare, and being on the front foot when a breakup happens.

Hyperscalers (Microsoft, Google, AWS)

Major cloud vendors (Microsoft with Azure Event Hubs, Google with Pub/Sub and AWS with MSK and Kinesis) offer native streaming solutions that directly compete with Confluent. These hyperscalers attract enterprises through convenience, bundled pricing, and integration with cloud-native services.

Yet Confluent continues to stand apart. Because it’s cloud-agnostic, customers can run the same managed service across AWS, Azure, GCP, and on-prem infrastructure, stitching together pipelines that ingest data in one environment, process it in another, and land results wherever they choose. Feature depth is another differentiator: proprietary capabilities (self-balancing clusters, enterprise-grade security, the high-performance Kora engine, and more than 120 pre-built connectors) go well beyond the “primitive” functionality developers typically associate with single-cloud Kafka services.

In practice, many customers start with MSK or Event Hubs, but when workloads demand multi-region scalability, rigorous governance, or deep Kafka expertise, they graduate to Confluent. For example, a global retailer began with AWS MSK but faced challenges when scaling beyond North America. After encountering complexities around multi-cloud synchronisation, governance, and disaster recovery capabilities, it migrated seamlessly to Confluent - leveraging its robust, cross-cloud managed service and enterprise-grade governance capabilities.

Emerging alternatives (Apache Pulsar, Redpanda)

Newer technologies like Redpanda and Apache Pulsar have gained attention by addressing perceived limitations of Kafka.

• Redpanda re-implements Kafka’s API in C++ and eliminates ZooKeeper, presenting itself as a drop-in replacement for teams that need ultra-low latency or want to sidestep Kafka’s operational complexity. Redpanda usage remains modest today but could become increasingly relevant if its promise of simpler management and performance advantages gain wider adoption.

• Apache Pulsar, open-sourced by Yahoo in 2016, offers a different take on distributed streaming with segmented storage, native multi-tenancy, and unified support for both queue and pub/sub semantics that enable fine-grained isolation and complex routing. StreamNative, founded by Pulsar’s original creators, positions itself as a “Confluent for Pulsar,” and several vendors now expose a Kafka-compatible layer to ease migration. Analysts increasingly describe Pulsar as the most serious rival to Kafka - even if, in practice, only a small slice of Confluent customers have switched or run side-by-side evaluations.

Confluent’s playbook is to neutralise any advantage quickly. Features Pulsar trumpeted early are now standard in Confluent, and performance claims by Redpanda have been met by the Kora engine.

For now, Redpanda and Pulsar have had limited commercial impact. Their existence, however, keeps the bar high: Confluent must continue to innovate on performance, openness, and developer experience or risk giving users a reason to explore these leaner alternatives.

Data platforms (Snowflake, Databricks)

A subtler subplot in Confluent’s competitive narrative involves Snowflake and Databricks. Today these vendors complement, rather than confront, Confluent: they specialise in analytics and AI while depending on Kafka-level plumbing for the event stream itself. The strategic risk emerges only if either player decides to build a native, fully-featured streaming broker and pushes it across an already-entrenched customer base.

• Snowflake’s heritage is “data at rest,” yet it keeps inching toward real time. Features like Snowpipe Streaming and dynamic tables shrink ingest latency, but the architecture still favours micro-batch loads over the torrent of high-frequency messages Kafka excels at. Most deployments therefore pair Confluent for ingestion with Snowflake for warehousing—an arrangement Snowflake itself highlights in reference designs.

• Databricks travels a parallel path. Spark Structured Streaming and Delta Live Tables handle continuous processing, yet they still lean on an external bus (typically Kafka or Pulsar). In 2025 the two companies deepened their partnership, wiring Confluent Tableflow directly into the Databricks Lakehouse so that real-time events feed analytics and AI models without friction - hardly the stance of imminent rivals.

Confluent’s defensive play is straightforward: embed itself so deeply inside these ecosystems that displacement feels more painful than partnership. The expanded Databricks integration - promising “production-grade, real-time AI” - illustrates the tactic. By positioning Kafka as the streaming backbone for Snowflake’s warehouse and Databricks’ Lakehouse, Confluent reframes would-be competitors as allies and turns co-existence into lock-in of its own.

4 - Powering the system

Competitive moat analysis – 7 Powers Framework

Overall, Confluent has been able to successfully expand market share and out compete these rivals. The key question is if its early success can be sustained, and if it will be able to leverage its current foothold to gain an outsized share of the rapidly developing market.

To clearly evaluate Confluent's competitive positioning, we apply Hamilton Helmer's "7 Powers" framework. This structured lens enables an assessment of Confluent's strengths, areas of vulnerability, and long-term strategic resilience.

Counter positioning

Rating - Weak (Stable)

Initially, Confluent’s rise benefited from counter-positioning against legacy middleware providers, whose rigid and costly licensing structures made responding to open-source, subscription-based streaming solutions difficult. However, today, cloud providers and open-source competitors lack the structural constraints legacy incumbents faced. Although Confluent’s multi-cloud, vendor-neutral approach provides some differentiation, it’s not significantly restrictive to competitors. Consequently, counter-positioning currently offers minimal competitive insulation.

Overall, we now consider this power weak because it doesn’t significantly prevent competitors from attacking Confluent’s turf. It remains stable - Confluent will continue to differentiate as neutral/open, but this alone isn’t a hard-to-cross moat with the current competitive dynamics.

Scale economies

Rating - Weak (Stable)

When a firm truly wields Scale Power, each incremental unit becomes cheaper to produce in a way rivals cannot replicate, creating a runaway cost advantage. While Confluent has scaled significantly - operating tens of thousands of Kafka clusters and investing heavily in R&D - its scale economies appear weaker when compared to cloud providers like AWS, Microsoft, and Google.

Though Confluent enjoys significant operational efficiencies against smaller, niche competitors, this advantage diminishes substantially when placed alongside the vast resources of the cloud giants, limiting the long-term defensive value of scale economies.

Network effects

Rating - Weak (Stable to Slightly Increasing)

True network effects (where each additional user directly enhances the platform’s value) remain modest at Confluent. However, indirect ecosystem effects, notably Kafka’s expansive developer community and a growing integration ecosystem, do add substantial value.

Confluent’s nascent "Stream Sharing" feature, if widely adopted, could potentially strengthen these indirect network effects significantly. Nevertheless, current network effects, while present, are relatively limited in their competitive defensibility.

Overall, we consider network effects weak in Confluent’s moat. They exist in a limited form, but are not as self-reinforcing as, say, a user network. We expect this to remain mostly stable; Confluent will cultivate its ecosystem and possibly create stronger network effects (e.g. if data sharing or a marketplace takes off), but for now this isn’t the primary source of advantage.

Switching costs

Rating - Strong (Increasing)

Imagine a global bank running tens of millions of daily transactions through Confluent’s real-time fraud detection system. Switching to another platform isn't merely costly - it risks downtime, regulatory compliance issues, and billions in transactional uncertainty. These formidable barriers exemplify Confluent’s deep switching-cost moat.

With Confluent’s solutions so deeply embedded into mission-critical processes with extensive integrations, the potential operational disruption and high migration costs significantly deter enterprises from switching to alternatives. As Confluent expands its integrated solutions and deepens customer reliance, these switching costs continue to increase, solidifying customer retention.

Overall, switching costs remain one of Confluent’s strongest moats and we see them continuing to increase over time as Confluent broadens its platform.

Branding

Rating - Weak (Stable)

Confluent enjoys strong recognition among data architects and enterprises familiar with Kafka, yet its brand remains closely associated with Kafka itself, rather than uniquely distinguished.

While the Confluent brand does reduce sales friction and instills trust among large enterprise clients, it rarely commands pricing power independently, frequently leading to competitive pricing pressures from hyperscalers. Unless Confluent can significantly elevate standalone brand prestige, branding power remains stable but weak.

Cornered resource

Rating - Moderate (Stable to Slightly Weakening)

Confluent’s extensive expertise and leadership in Kafka - stemming from its founders, key engineers, and proprietary technologies such as the Kora engine- represent meaningful competitive resources.

These assets are somewhat defensible but not wholly exclusive, as competitors increasingly attract Kafka specialists and develop rival technologies. While Confluent continues to benefit from significant operational experience and proprietary insights, these resources remain vulnerable over time as industry knowledge disseminates broadly.

Process power

Rating - Moderate (Stable to Slightly Weakening)

Operational excellence and the sophisticated management of Kafka-based streaming services represent genuine process advantages for Confluent. These strengths manifest in consistently high reliability, low latency performance, and a disciplined innovation pipeline, evident in streamlined releases and sophisticated platform features.

Nonetheless, as many of these processes become more openly documented and understood across the industry, this advantage may weaken over time. For instance, AWS’s adoption of containerised deployments and automated cluster management illustrates how quickly hyperscalers can replicate best-in-class operational practices.

Overall, while process power remains a key part of Confluent’s competitive advantage, we expect this to be slowly eroded over time.

Conclusion

Overall, we rate Confluent’s competitive position as robust and likely to endure, though not invulnerable. The company enjoys meaningful switching costs, emerging network effects, and high-quality people and processes - but it faces several strategic threats that could disrupt its trajectory.

As discussed earlier, hyperscalers, emerging alternatives, and competing data platforms each pose significant challenges and could gradually chip away at Confluent’s market position. Winning this market requires relentless innovation - a strength Confluent has demonstrated consistently. However, any slowdown could quickly see Confluent’s real-time advantage freeze over, leaving it vulnerable to disruption.

Ultimately, the data-driven future belongs to those who can instantly capture, analyse, and act upon events. Confluent, at the epicenter of this shift, stands uniquely positioned - provided it continues innovating at pace, embracing open-source collaboration, and delivering a superior managed-service experience. In doing so, it won’t merely participate in the data revolution - it will power it - becoming the central nervous system of the data revolution.

That concludes Part 1. If you’ve made it this far, it would be great to hear your thoughts on the business and any pushbacks or challenges you have vs. our viewpoints.

In Part 2, we round out the discussion by diving into what this means for financial performance and our overall investment thesis.

Subscribe to get similar reports on today’s greatest companies straight in your inbox. If you enjoyed my writing, a like is always much appreciated.

Share

Subscribe now

Disclaimer

This article is provided for information purposes only. This article has been prepared based upon information, including market prices, data and other information, from sources believed to be reliable, but the authors do not warrant its completeness or accuracy. Any opinions and estimates constitute our judgment as of the date of this material and are subject to change without notice. Past performance is not indicative of future results. This article is not intended as an offer or solicitation for the purchase or sale of any financial instrument. The authors do not provide individually tailored investment advice. Any opinions and recommendations herein do not take into account individual circumstances, objectives, or needs and are not intended as recommendations of particular securities, financial instruments or strategies. You must make your own independent decisions regarding any securities, financial instruments or strategies mentioned or related to the information herein.

Sources

• markets.ft.com

• geekwire.com

• businessinsider.com

• confluent.io

While the company has since traded back up to ~$122, we believe that at this level, Snowflake’s valuation is still supported by conservative forecasts, including moderating growth in both customers and NRR.

Based on a DCF methodology, we value Snowflake at $126.22/sh - c.4% above its latest trading price. We believe now is an attractive time to start building a position in a high-quality name that is exposed to strong secular growth trends and with several meaningful growth catalysts that will drive long-term returns.

Some of the key assumptions included in our valuation are:

• Further declines in customer growth, with 17% for FY25 (vs. 22% in FY24 and 20% in Q1 FY25) and an ongoing decline of c.5% p.a.

• A continued reduction in NRR as the company’s customer base matures, with a forecast NRR of 125% for FY25 (vs. 131% for FY24).

• A decline in gross profit margin to 66% in the near term, with an average increase of 1% p.a. over the mid-term.

• A 15% cost of equity and terminal growth of 4.7% p.a. post FY35.

Providing further upside to our DCF, we assume that the material amount of cash being generated remains on the balance sheet and is underutilised (c.$21b by FY31). Finding accretive ways to deploy this capital, whether through customer acquisition or M&A, would add $28 (+23%) to our valuation if the company was able to earn a 10% p.a. return on this capital, while a 20% p.a. return would add $116 (+92%).

In the rest of this article, we dive deeper into the investment thesis, the background of the business, and key value levers. This is broken down into the following sections:

1. Investment thesis

2. How does Snowflake make money?

   • Revenue Model

   • Historical Performance & Outlook

3. What are Snowflake’s key costs?

   • Cost of Revenue

   • Operating Expenses

   • The Impact of Stock-based Compensation

4. Appendix: Financial Forecasts

Disclaimer:

This analysis is provided for informational purposes only and should not be considered as investment advice. While I strive to provide accurate and up-to-date information, all investment decisions should be based on your own research and consultation with a qualified financial advisor. I do not accept any liability for any losses or damages incurred based on the information provided. Always consider your financial situation, risk tolerance, and investment goals before making any investment decisions.

Share

1. Investment thesis

Product development is expected to fuel growth through a tough macro environment.

We believe prolonged negative sentiment has been driven by moderating revenue growth amidst a movement to a more constrained macro environment. Simultaneously, Snowflake has lacked products geared toward unstructured data and, as a result, has been unable to capitalise on increasing corporate investment in generative AI workloads.

While near-term macro headwinds may persist, new CEO Sridhar Ramaswamy (appointed Feb 2024) has created a positive momentum that we expect will enable Snowflake to generate strong growth despite the constrained spending environment.

Ramaswamy was previously Senior Vice President of Ads and Commerce at Google, where he oversaw all of Google's advertising and commerce products, including AdWords, AdSense, and Google Shopping.

Ramaswamy has focused on accelerating product development and innovation across Snowflake’s platform, especially in AI and machine learning capabilities.

Some of the key products expected over the next 2 years are:

• Snowpark enables customers to write code in languages like Python, Java, and Scala to manipulate and analyse their data directly on Snowflake's platform.

• Now close to c.50% adoption, growth is expected to continue steadily as additional services are introduced and existing customers are further educated on use cases.

• Container Services is a part of the Snowpark framework, designed to enable developers to run containerised workloads within the Snowflake data cloud.

  • Container Services will expand the kind of applications that can run on top of Snowflake and is expected to be generally available in the second half of 2024.

  • Dozens of partners are already building solutions that will leverage container services to serve their end customers.

• Streamlit, an open-source Python framework for data scientists and AI/ML engineers to deliver interactive web apps, is integrated with Snowpark.

  • Streamlit is not yet generally available on all three clouds, expected at the end of 2024.

• Cortex, now generally available, facilitates the deployment, management, and monitoring of ML models. As customers ramp up usage, this is expected to contribute materially to FY25 revenue growth.

• Iceberg is an open table format for managing large datasets, with features like versioned data, time travel, and incremental processing. Iceberg capability is expected to be generally available in the second half of 2024.

  • More than 300 customers are using Iceberg in public preview and many of Snowflake’s larger customers have indicated that, as a result of Iceberg, they are likely to use Snowflake for more workloads.

  • The movement of data out of Snowflake and into Iceberg storage is expected to be a negative headwind in the near term. Offsetting this, Iceberg will significantly increase the amount of data available to run queries on. While this is expected to be a net positive over time, management anticipates it will be a net negative for FY25.

• Unistore (Hybrid Tables) allows for real-time updates and low-latency queries, making them suitable for more transactional applications. Unistore is expected to be generally available in the second half of 2024.

  • Unistore opens up several new classes of applications that can run on top of Snowflake. These applications include workloads that require quick access to fresh data, such as real-time dashboards, operational analytics, and data-driven applications.

Snowflake is well-positioned as an industry leader that will benefit from long-term secular trends.

We believe that all companies will eventually adopt a cloud-centric operating model and that Snowflake is positioned to capture a significant share of this market (worth an estimated c.$70-100b p.a.) with its integrated, end-to-end solution.

Using Hamilton Helmer’s 7 powers framework, we assess that Snowflake currently benefits from a combination of counter positioning and switching costs and is expected to strengthen its network and scale economies over time.

• Brand: As a relatively new company vs. legacy data storage and analytics offerings, Snowflake does not have the same brand recognition. While we expect this to develop over time, we do not believe this will be a core driver of strategic differentiation.

• Cornered Resource: Snowflake does not have cornered resources relative to key competitors.

• Counter Positioning: Snowflake allows its customers the flexibility to avoid vendor lock-in and leverage a multi-cloud strategy, and the company’s cloud-native architecture is a significant advantage over traditional on-premises data warehousing solutions. Major cloud providers have been unwilling or unable to replicate this, particularly the separation of compute and storage.

• Network Economies: Snowflake’s platform enables companies to share, connect, collaborate, monetise, and acquire live data sets. Nearly one-third of Snowflake customers share data products as of Q1 2025, +24% YoY, and we believe that growing its data marketplace is key to Snowflake’s value proposition and a potential source of long-term differentiation.

• In addition, Snowflake integrates with a wide range of third-party tools and services, and increased use of the platform enables continued support of existing integrations and the introduction of new ones.

• Process Power: Snowflake has limited process power relative to key competitors.

• Scale Economies: Snowflake exhibits scale economies relative to potential new entrants; however, it has no comparative advantage over its direct competitors.

• Switching Costs: Snowflake has substantial switching costs, comprised of:

  • The complexity, cost and time of migrating data to another platform.

  • The cost and difficulty of replicating data transformations, pipelines, and integrations that are specific to Snowflake's architecture.

  • The cost of rewriting applications to conform to the SQL dialect of another platform.

  • The operational disruption of switching platforms is in terms of the immediate time required to transfer and the time taken to retrain staff on a new platform.

  • Contractual obligations and prepayments that lock customers in for the near to medium term.

Subscribe now

2. How does Snowflake make money?

Revenue Model

Snowflake provides a cloud computing platform that enables users to run various workloads on top of any of the 3 major Cloud Service Providers, or CSPs, being Google, Azure, and AWS.

This allows customers to consolidate data into a single source of truth to drive meaningful insights, apply AI to solve business problems, build data applications, and share data and data products.

The company’s cloud-native architecture consists of three independently scalable but logically integrated layers across storage, compute, and cloud services.

Centralised Storage

Snowflake ingests structured, semi-structured, and unstructured data to create a unified data record that is stored in a central repository in each account.

Indicative pricing structure:

• Customers pay for storage either on demand at a $/TB/month rate or on a capacity basis, where a set dollar amount of usage is purchased upfront.

• Prices typically range between c.$20-30/TB/mo on-demand (dependent on location and cloud service), with up to a 40% discount given for the largest capacity purchases.

• Customers are charged per TB for data transfers between different regions or different cloud providers, prices ranging significantly between c.$20 and c.$190/TB dependent on the region/provider. Data transfers within region are typically free.

Multi-cluster Compute

Snowflake provides dedicated resources to enable users to simultaneously access common data sets for many use cases with minimal latency.

Customers can create and manage virtual warehouses, or Snowpark container services compute nodes, as needed to combine and process data from storage (respectively known as “Virtual Warehouse Services” and “SPCS Compute”).

Indicative pricing structure:

• Rates are charged based on the effective size of the Virtual Warehouse or Compute Node while in operation.

• Credits are consumed per second, with a 1-minute minimum every time the service is started or resumed.

• Credits start at $2/credit for the Standard plan, with $3/credit for Enterprise and $4/credit for Business Critical.

Cloud Services

Snowflake’s Cloud Services segment includes the suite of functionalities that run on Snowflake’s cloud infrastructure, including:

• Snowpark and integrations with machine learning libraries and tools. This feature facilitates machine learning model development and execution directly within Snowflake.

• Secure data sharing and integration with third-party AI and ML platforms.

• Advanced SQL functions and tools for analytics that support machine learning workflows.

• Automatic scaling, concurrency management, and data storage optimisations.

• Automatic Query Optimisation and other performance enhancements.

• Features for monitoring and anomaly detection.

Indicative pricing structure:

• Cloud Services are charged based on the amount of compute resources used while operating the service, at 4.4 Credits per hour of use.

• AI Features are charged per million tokens used and differ based on the LLM. For example, using Cortex Fine-Tuning (Training) for llama3-70b costs 3.4 Credits per million tokens.

Historical Performance & Outlook

Customers

• Snowflake’s customer growth has declined over time as the company has added a relatively consistent number of customers to a growing base.

• The company added 1.7k customers in FY21, 1.8k in FY22, 1.8k in FY23, and 1.6k in FY24, and we forecast this to remain relatively stable with a slight decline over time. This equates to an 11% CAGR from FY24-31.

Product Revenue per Customer

Snowflake’s strategy is to “Land and Expand”, investing in acquiring customers that will compound over time.

Revenue is not seen immediately at <$100k per customer in the year of acquisition; however, grows substantially as they increase their usage and adopt a greater range of products and services.

• Revenue per new customer added each year has fluctuated over time, climbing from $63k in 2020 to a peak of $85k in 2022 before returning to $75k in 2023-2024. We forecast this figure to be flat over time.

• Revenue per existing customer nearly doubled between 2020 and 2024 from $171k to $327k/customer.

Over the past two years, Snowflake had strong per-customer growth across all segments, with 35% p.a. growth in its top 25 customers, 108% p.a. growth for other Forbes 2000 customers, and 14% p.a. growth for the remaining customer base.

We forecast a 9% CAGR in revenue per customer from FY24-31, compared to an 18% CAGR from FY20-24. We believe this is conservative, with significant upside potential from an increased product development cadence driving more use cases within businesses.

Other Revenue

Snowflake generates other ad hoc revenue from professional services, including customer implementations and migrations from legacy solutions. We assume this revenue remains constant as a proportion of product revenue.

That covers revenue, now on to costs.

Subscribe now

3. What are Snowflake’s key costs?

Cost of Product Revenue

Snowflake’s most substantial product revenue cost is third-party infrastructure, at c.18% of revenue in FY24, followed by personnel/other overheads at c.7% and amortisation of software development costs at c.2%.

The company has achieved significant margin improvement over time as its scale has allowed for greater purchasing power and bulk discounting; however, infrastructure expenses have recently come under pressure.

Key costs include:

• Third-party infrastructure expenses incurred in connection with the customer's use of the Snowflake platform and its deployment and maintenance on public clouds, including different regional deployments.

• Personnel and overheads include expenses associated with customer support, maintaining service availability, and platform security.

• Amortisation expenses relate to capitalised internal-use software development costs and acquired intangible assets.

Snowflake has now had two consecutive quarters, Q4FY24 and Q1FY25, in which costs increased as a percentage of revenue. Management attributes margin pressure to newly launched product capabilities and features that have not yet reached economies of scale and GPU-related costs as the company invests in new AI initiatives.

We forecast higher costs holding at current levels for FY25. However, we expect the trend of margin improvement to continue in the longer term as compute becomes increasingly commoditised and capacity catches up with demand.

Cost of Other Revenue

Snowflake's costs to provide other revenues include charges from global system integrators, managed service providers, and resellers.

This activity has historically been undertaken at a loss, which I hold constant moving forward.

Operating Expenses

While not separately reported as a category, Snowflake has commented that personnel costs, consisting of salaries, benefits, bonuses, stock-based compensation, and sales commissions, are the most significant component of operating expenses.

In addition to staff, there are a range of other expenses split up into the three categories below. These include referral fees paid to third parties, advertising costs, third-party R&D, subscriptions, and corporate expenses.

Sales & Marketing

Sales & Marketing is expected to remain Snowflake’s largest expense as the company continues to spend money on winning and retaining customers; however, we expect it will fall as a % of revenue over time as incumbents make up an increasing proportion of the customer base and retention is typically cheaper than acquisition.

We forecast a c.18% p.a. increase in the total expense from FY24-31, falling from c.52% of revenue to c.40% of revenue.

Key costs include:

• Sales and marketing staff, sales commissions, certain referral fees paid to third parties, advertising costs, business development, and travel.

• Note that sales commissions tied to customers’ consumption are expensed in the same period as they are earned, while commissions and referral fees earned upon contract origination are deferred and then amortised over five years.

Research & Development

Due to a significant increase in product development efforts, we expect R&D costs to continue climbing in the next few years before stabilising.

We forecast a c.20% p.a. increase in the total expense from FY24-31, falling from c.48% of revenue to c.43% of revenue.

Key costs include:

• R&D staff, contractor and professional services fees, third-party platform development costs, amortisation of acquired intangible assets, and software and subscription services.

General & Administrative

After significant increases in 2021-22 of >50% p.a., growth has since fallen closer to 10% p.a. We have assumed a near-term increase to 18% for FY25, declining toward a long-term rate of 10% over time.

Key costs include:

• Finance, legal, human resources, facilities, and administrative staff, professional services fees, software and subscription services, and other corporate expenses.

The Impact of Stock-based Compensation

Stock-based compensation (SBC) makes up more than a third of total operating expenses. Given its significant size and dilutive impact on shareholders, this causes concern for many investors.

Our stance is that using SBC rather than cash is positive from both a valuation perspective and the ability to provide powerful incentives that align employees' interests with long-term shareholder value.

Breaking down Snowflake’s SBC expense:

Snowflake’s SBC is classified into two main types, equity-classified RSUs and stock options, with other issuance of restricted common stock or acquisition consideration undertaken ad-hoc.

• Stock options: Earlier in Snowflake’s life, stock options were the primary compensation mechanism used by the company. The company ended 2020 with 81 million unvested options, with a weighted averaged exercise price of c.$7.5/sh. Since then the company has only issued another 1.5 million.

• Equity-classified RSUs: This is now the primary method of compensation. In contrast to options, there is no payment required when these vest.

How does SBC impact valuation?

When a company uses SBC, it pays for a large proportion of its staff costs using equity at the current period’s share price, defers that payment by 1-4 years, and locks in staff / incentivises them to hit their KPIs.

Based on our forecasts for the next five years, this means the company can use an additional $11bn of cash, which it can spend on increasing its competitive position or on customer acquisition.

Excluding SBC, I estimate the fair value of Snowflake would more than halve. This is because the value of the cash ($11bn by FY31) significantly outweighs the dilutive impact (c.17% increase in shares outstanding by FY31) on a DCF basis.

What I haven’t factored in here is that Snowflake would also need to raise c.$2b in equity to remain solvent under a no-SBC scenario.

That’s it for today. If you found this research interesting, tap the ♥ button and make sure to share it with friends and colleagues who love technology and investing as much as you do.

If you want to read more about the companies at the forefront of innovation that are best positioned to capture value and become generational businesses, then make sure to subscribe and receive our latest updates.

Share

Subscribe now

Appendix: Financial Forecasts

Disclaimer:

The content shared on this Substack is for informational and educational purposes only and does not constitute financial advice.

I am not a licensed financial adviser, and nothing in this publication should be interpreted as personalised financial advice, a recommendation, or an offer to buy or sell any financial product.

Investing involves risk. You should seek advice from a licensed financial adviser in your country before making any investment decisions. Past performance is not indicative of future results. Any opinions expressed are my own and do not reflect the views of any affiliated organisations.

By reading this publication, you agree not to hold the author liable for any decisions you make based on the information provided.

Subscribe now

Building an Economic Moat

To succeed in the long run, great businesses must build what Warren Buffett calls an "economic moat", a term Buffett coined as an homage to the moat of a castle, that comprises one or more factors that enable a company to produce products and provide value that others cannot.

While the moat is a cornerstone of any company’s success, it is not a static target and must constantly be torn down and rebuilt as industries and the companies within them evolve. Enter Hamilton Helmer and his 7 Powers framework.

This framework differentiates momentary advantage from durable Power - concepts which are often confused.

Always ask: is this edge self-reinforcing, and does it create asymmetric pain for competitors? If it can be bought, replicated, or hired away, it’s not Power.

The 7 Powers framework

Hamilton Helmer’s 7 Powers outlines 7 strategic levers (powers) that enable a company to create enduring value and defend against competition.

Here’s a quick cheat sheet, with further detail and explanation down below:

1. Scale economies: per-unit costs decline in a way that creates structural cost advantage as output increases.

2. Network economies: each additional user increases the product’s value for all other users.

3. Counter Positioning: the incumbent is rationally unwilling to copy the entrant's superior model because doing so would harm its existing business.

4. Switching Costs: Customers would face significant pain—operational, financial, or psychological—if they switched to a competitor.

5. Brand: Allows the company to charge a premium or retain customers without superior functionality.

6. Cornered Resource: Exclusively controlling a critical resource or asset (e.g. talent, IP, data) that competitors cannot replicate or acquire.

7. Process Power: A unique set of processes within a company that are extremely difficult to replicate and yield superior performance.

1. Scale Economies

Scale economies are cost advantages that a business gains due to its scale of operation - e.g. per-unit costs decline in a way that creates structural cost advantage as output increases.

These typically occur in one of three ways:

• Purchasing power: Companies like Costco, which orders large quantities of few products, often account for the majority of their customers’ business. Due to this, they have significant bargaining power that can drive lower costs.

• Efficiency gains: As a company grows, efficiency can be gained in many ways, including greater skill in producing goods or gains from methods or machinery that can be employed only at higher volumes.

• Fixed-cost amortisation: New competitors face the substantial barrier of investing hundreds of millions or billions in production, research, development, or marketing. Companies like Nike can invest in large sponsorship deals that competitors can’t afford because it can spread the cost over its massive customer base. This, in turn, attracts more customers and creates a virtuous cycle.

Key Indicators: Marginal cost advantage is durable and compounds with growth. Competitors can’t match pricing profitably at smaller scale. Evident in infrastructure-heavy businesses (e.g. TSMC, AWS).

False Signals / Illusions: Temporary margin improvement via fixed cost leverage. Marketing scale or brand spend without structural cost advantage.

2. Network Economies

Network economies occur when the value of a product or service increases as more people use it e.g. each additional user increases the product’s value for all other users. When a firm truly wields Scale Power, each incremental unit becomes cheaper to produce in a way rivals cannot replicate, creating a runaway cost advantage.

This can be broken down into direct and indirect effects:

• Direct network effects: Value increases directly with the number of users. For example, Uber's value increases when more people use it because this drives an increase in drivers, greater area coverage, and more reliable pick-up times.

• Indirect network effects: Value increases due to the growth of a complementary network, such as content or service providers. An example is the popularity of Apple’s iOS platform, which attracts developers to create apps for iPhones, making iPhones more attractive to consumers. The more users the platform has, the more developers are incentivised to create applications for it, etc.

Key Indicators: Churn rises if network density declines. User retention or conversion improves with user base growth. Strong network utility (e.g. liquidity, communication, reputation).

False Signals / Illusions: Large user base with siloed interactions (e.g. forums, individual communities). “Community” claims without user interdependence.

3. Counter-positioning

Counter-positioning occurs when a company adopts a superior business model that competitors are unwilling or unable to adopt e.g. the incumbent is rationally unwilling to copy the entrant's superior model because doing so would harm its existing business

An example of this was Netflix's disruption of the distribution model for movies and TV in the early 2000s:

• Netflix introduced a subscription model with unlimited rentals for a flat monthly fee, eliminating late fees and offering customers more predictable costs.

• Traditional video rental companies like Blockbuster had significant investments in physical stores and inventory, making it difficult to pivot to an online model without incurring substantial losses.

• The shift from per-rental fees to a subscription model also threatened incumbents' existing revenue streams, creating further disincentive to change.

Key Indicators: 1. New model is superior and economically threatening to incumbent. 2. Incumbent inaction is rational, not incompetence. 3. Look for cannibalization risk, internal conflict, or shareholder resistance.

False Signals / Illusions: Legacy players just being slow or bureaucratic or entrant’s success driven by novelty, not business model asymmetry.

4. Switching Costs

Switching costs refer to the monetary, time, or psychological barriers that dissuade customers from purchasing a competing product. Would customers face significant pain—operational, financial, or psychological—if they switched to a competitor?

While there are many types of switching costs, they aren’t all created equal. The best types are those that are entwined the deepest in user behaviour, with ecosystems of multiple products and integrations that are hard to replace as a collective.

Some types of switching costs include:

• Ecosystems: When a product or service is part of an ecosystem, switching costs increase due to dependencies on related products or services and the impact of bundling. Because Microsoft bundles its products into a single cost line and makes integration between its apps seamless, this creates a high hurdle for competing products to overcome.

• Integrations: When a product or service is integrated into a customer’s workflow or system, switching can require reconfiguring or replacing complementary products.

• Product complexity: Customers invest time and effort in learning how to use a product or service. The more complex the product, the steeper the learning curve and the higher the switching costs.

• Psychological: In products like social media platforms, there may be a psychological barrier to switching unless the rest of your network also switches.

Key Indicators: Customer retention is non-contractual and irrationally sticky. Migration requires retraining, data transfer, or workflow disruption. High multi-year NRR (Net Revenue Retention).

False Signals / Illusions: Habit or laziness misread as lock-in. “Sticky” product with low actual friction to switch.

5. Brand

Brand power is defined as a company's ability to create a perception of greater value e.g. it allows the company to charge a premium or retain customers without superior functionality.

Some examples of brand power at work include:

• Value signalling: Brands often use their products to signal certain values to their customers, such as luxury, sustainability, or innovation. Consumers then adopt these products as a way to communicate their own values and identity to others. For example, owning a Hermès Birkin bag shows others you are part of an exclusive community that both has the means to acquire a bag and appreciates the quality and heritage of the brand.

• Perceptual adaptation: People become accustomed to products over time, developing a specific expectation for the taste and feel of their preferred brand (think Coke vs. Pepsi). Once they are adapted to this specific sensory experience, any small change from it becomes noticeable and often distasteful.

Key Indicators: Customers pay more despite viable alternatives. Brand signals identity, trust, or status—not just familiarity. Pricing power sustained over time.

False Signals / Illusions: Marketing spend confused with brand Power. High awareness without pricing premium or loyalty.

6. Cornered Resource

Cornered Resource stems from exclusively controlling a critical resource or asset (e.g. talent, IP, data) that competitors cannot replicate or acquire. This could be proprietary technology, exclusive partnerships, high-quality people, or regulatory licenses.

• Technology: Companies like TSMC and ASML have developed bleeding-edge technologies and have proprietary knowledge that competitors cannot replicate without spending years and billions of dollars on R&D.

• Partnerships: Strategic alliances, like Apple's exclusive agreements with key suppliers, enable companies to secure priority access to the best components and technologies. This leaves competitors with inferior options or longer lead times.

• People: Quality staff are scarce, particularly in highly technical or specialised fields. Hermès, for example, employs the majority of the world’s artisan leather goods makers.

• Intellectual property: Pharmaceutical companies like Eli Lilly rely heavily on patents to protect their drug discoveries, with exclusive rights to produce and sell a drug for a specified period.

• Raw materials: Control over raw materials can create barriers for competitors who struggle to secure the same quality or quantity of resources, leading to higher costs or limited production capacity. De Beers, for example, has historically dominated the diamond industry by controlling a large portion of the world's diamond supply.

Key Indicators: The resource materially improves competitive position. It’s truly exclusive—contractual, legal, or deeply embedded. Examples: proprietary data, founder credibility, exclusive supply rights

False Signals / Illusions: Generic talent or public data miscast as “cornered.” Superstar founder effect exaggerated or commoditized over time.

7. Process Power

Process power refers to the superior execution of business processes that drive efficiency, quality, or innovation. Companies with strong process power have developed a unique set of processes that are extremely difficult to replicate and yield superior performance.

• Process improvement: Amazon's ethos is centred around constant improvement. The company uses data and customer feedback to continually improve its processes, from supply chain to customer experience.

"Our success at Amazon is a function of how many experiments we do per year, per month, per week, per day. Being wrong might hurt you a bit, but being slow will kill you." - Jeff Bezos

• Process innovation: NVIDIA has historically outpaced its competitors by pioneering more efficient processes, like virtual simulations and AI-driven design, allowing it to achieve faster product development timelines than its competitors.

Key Indicators: Tacit knowledge embedded in workflows and culture. Long-term consistency in execution excellence. Competitors fail to match outcomes even after copying inputs.

False Signals / Illusions: “Good culture” or operational excellence without hard-to-copy process depth. High performance explained by temporary leadership, not systems.

Share

Due to this, a significant part of our focus when analysing investments is on four key areas that we believe are critical in identifying which companies will not only successfully weather the storm, but will come out stronger.

These areas are what we call the 4 Pillars of success.

• People

• Purpose

• Power

• Profit

1. People

People are the backbone of any business, and having the right founder and team is paramount. When evaluating a company’s People capability, we look for:

• Incentives: We prefer founder-led businesses where the founder, senior leadership, and board members have significant equity. Incentives are powerful determinants of behaviour, creating the right environment for maximising long-term value. As the late Charlie Munger famously quoted, “Show me the incentive, and I will show you the outcome.”

• Leadership: We like companies helmed by visionary leaders with a “je ne sais quoi.” These leaders have the right combination of vision, resilience, and expertise and can inspire and drive those around them. Importantly, these leaders are highly ambitious and are doing their life’s work.

• Culture of excellence: The best companies have a culture that attracts top talent, inspires loyalty, and consistently leads to the highest standards in their products and services. These teams are often highly experimental, with rapid iteration cycles, where collaboration is valued and people of all levels are empowered to provide real input. A great example of this is Disney in the 1930s, where Walt Disney cultivated an environment where creativity thrived and innovation flourished, leading to a golden age in animation.

2. Power

Capturing the lion’s share of industry growth through existing customer expansion and new customer acquisition is only possible from a position of strong and improving defensibility.

Due to this, the second element we look for is an enduring competitive advantage that consistently improves every year and is extremely hard to replicate.

To form a view of a company’s Power, we have adopted the framework created by Hamilton Helmer in his book 7 Powers. In this book, Helmer identifies seven distinct “powers” that allow companies to generate “persistent differential returns” compared to their competitors.

No single moat is impenetrable, so great companies typically combine two or more powers. They will also actively pursue strategies that add new powers or increase the strength of the ones they already possess.

3. Purpose

An essential trait of great companies is the ability to ignore noise from the outside - whether investment analysts, media, or the mob - which can steer focus away from what matters.

Underpinning this ability is typically a well-defined and compelling mission (what are we trying to achieve?), vision (what does the world look like when we’ve achieved it?) and strategy (what’s our plan to win?) ingrained into every company member’s ethos. This is what we refer to as Purpose.

A company’s purpose helps to connect the dots between current activities and future objectives, grounds decision-making and allows for greater business discipline. Ultimately, this means a business can grow faster because it is focused on the things that truly matter.

4. Profit

To succeed in the long run, a company must be able to 1) grow sustainable, recurring revenue streams and 2) maximise the proportion of this revenue that ends up as profit.

• Revenue opportunity: To maximise revenue growth, we believe a company needs to be a leader and key beneficiary in an industry with significant growth tailwinds. On top of this, we look for multiple growth levers and visible opportunities to expand on these over time (whether solving more problems for the same customer set or expanding into adjacent products or markets).

• Good economics: Growth is important, but it must be supported by the right business model. We look for companies that generate high returns on capital, with strong unit economics and high incremental margins that drive operating leverage. This allows for healthy free cash flow generation, enabling re-investment to support growth without external capital.

That’s it for now. If you enjoyed this article, please like it and share it with others who might be interested.

Subscribe now

Share

To enable this, these companies must:

• Operate in an industry with large revenue potential (e.g. lots of customers, high prices, or both)

• Compound customer-level growth via multi-product growth and pricing power

• Provide real, differentiated value to their customers which is the key enabler - the reason people will continue to buy current and new products

Big important industries

TAM is a commonly used metric, equating to a company’s maximum possible revenue if it had 100% market share. This can be better defined as 100% share of the future expected size of the market for the company’s current products / services.

Understanding the possible future market, rather than what it currently is, is one of the key factors in determining revenue capacity for companies that are creating new industries or expanding previous boundaries.

• When the iPhone was first released in 2007, 122 million smartphones were sold globally at an average price of ~$100. By improving user value, Apple and fast followers like Samsung expanded both the market’s volume and the average price point, driving a >15x increase in TAM.

• When Tesla released the Model S in 2012, the market for electric vehicles was a niche area only inhabited by hobbyists, and less than 1% of global vehicle sales were electric. As a result of technological improvements, particularly safer and longer-lasting batteries, electric vehicles have grown to c.20% of new car sales today.

Product / feature expansion

The ability of a company to leverage its initial product or products to drive further growth is one of the most important traits separating the good from the great.

A company’s first product provides an entry point, which the best companies then use to embed themselves into a customer’s life - solving more problems and creating more customer value.

• By leveraging the iPhone, Apple expanded its share of consumer wallets through the app store, accessories like AirPods, and complimentary products like iPads. Apple’s ecosystem also created an unfair advantage over companies competing in any of these standalone areas.

Product expansion provides the opportunity to acquire customers who weren’t interested in the first product(s) - increasing the size of the customer base and expanding the TAM.

• Tesla’s first product, the Model S, was an expensive sports car that targeted a small audience. Subsequent Models X, Y, and 3 expanded the company’s reach into different automobile market segments and attracted customers who weren’t interested in the S.

Pricing power

Aside from product range and feature expansion, pricing is the other key opportunity for growth.

The ability of a company to increase pricing year after year is a powerful driver of profitability. However, this requires a company to produce a product its competitors cannot sustainably replicate. To do this, a company must provide real, differentiated customer value.

Give the customers what they want

The ability of a company to provide customers with value is the lynchpin that drives both TAM and revenue expansion opportunities.

The value that customers receive determines why they are willing to buy a product and how much they are willing to pay.

Companies can provide their customers with value in numerous ways, with some of the main ones being:

• Price: Consumers want a bargain. Walmart, Amazon, McDonald’s, and Coca-Cola offer better prices than other options.

• Convenience: Easier is better, and removing friction provides value. Uber means you no longer have to call a taxi and wait an unknown amount of time for it to arrive. Coca-Cola makes its products available everywhere.

• Brand: Some companies make customers feel like they’re “part of the club” - connected to the brand, its values, and a community of like-minded people. You’re an “Apple person”, and you would never dream of owning a Samsung.

• User experience: Sometimes, the little things matter the most, whether it’s extra legroom on a flight or an intuitive website. Companies like Apple and Amazon centre their design and philosophy around ensuring customers enjoy using their products and services.

• Quality: There’s often no substitute for high-quality design and materials. Companies like Rolls-Royce are valued for their elegance and engineering excellence.

Importantly, companies must provide differentiated value that can’t be copied by their competitors.

A truly great business must have an enduring “moat” that protects excellent returns on invested capital. The dynamics of capitalism guarantee that competitors will repeatedly assault any business “castle” that is earning high returns. Therefore a formidable barrier such as a company’s being the low-cost producer (GEICO, Costco) or possessing a powerful world-wide brand (Coca-Cola, Gillette, American Express) is essential for sustained success.  Business history is filled with “Roman Candles,” companies whose moats proved illusory and were soon crossed. - Warren Buffet.

If you enjoyed this article, please like it and share it with others who might be interested.

Subscribe now

Share

Today’s successful leaders are the contemporary equivalents of historical commanders like Napoleon Bonaparte. They a “je ne sais quoi”, or indefinable, elusive quality made up a unique combination of traits that enables them to pursue their goals with an intense focus and inspire those around them.

Across all great leaders, 4 of the most common shared traits are:

1. Vision - an ability to imagine a completely different future, do things seen as impossible by others, and inspire those around you to pursue your vision

2. Leadership - an ability to ‘connect the dots’ in an organisation, enabling employees to excel beyond their preconceived limits, and creating a whole that is much greater than the sum of its part

3. Resilience - the ability of a founder to take a contrarian view and remain intensely focused despite immense headwinds

4. Growth Mindset - a lifelong approach to learning, with a deep understanding of not only their own domain but of the complex web of interconnected systems that make up the world. These leaders have an insatiable appetite for knowledge that leads them to make novel discoveries and connect seemingly unrelated areas

Subscribe now

Share

Vision

The ability to imagine a completely different future, do things seen as impossible by others, and inspire those around you to pursue your vision, is a hallmark of greatness. Steve Jobs exemplified these traits completely, and was renowned for his unparalleled passion and visionary mindset.

When Jobs introduced the iPhone, he envisioned a future where people could carry a mini-computer in their pockets that was user-friendly and capable of performing a wide range of tasks seamlessly. The iPhone's impact on society at large was profound, and Jobs’ ability to bring it to life transformed Apple into one of the most influential and successful companies in the world.

“The people who are crazy enough to think they can change the world are the ones who do” - Steve Jobs.

Jobs combined his inspiring vision with a deep passion for everything he created. His passion for design and user experience was at the core of his success, with Jobs refusing to accept anything less than exceptional and forcing the development of revolutionary technology. Overall, Jobs' ability to merge his passion with his visionary outlook set him apart as a true trailblazer in the world of technology and entrepreneurship.

“I’ve never been able to think of my work and my life as different things, they are the same thing, make what you love your work” - Steve Jobs’

Leadership

While a leader’s vision is important, in parallel they must foster the capacity for innovation and continued reinvention throughout the business.

While Steve Jobs was an amazing visionary, he also recognised the importance of building a strong team around him to fill his gaps and allow for scale.

He encouraged a sense of unity and shared purpose, inspiring Apple’s employees to excel beyond their preconceived limits and resulting in remarkable achievements that extend beyond the capabilities of any one person.

“It doesn't make sense to hire smart people and tell them what to do; we hire smart people so they can tell us what to do” - Steve Jobs.

Resilience

In the words of Rocky, “it ain't about how hard you hit. It's about how hard you can get hit... and keep moving forward. How much you can take and keep moving forward. That's how winning is done!”. This mantra applies to every facet of life, and is a key trait of successful leaders. Nobody ever wins on their first try. Starting a business is hard, scaling a business is harder, and maintaining a competitive edge is hardest.

One of the most stubborn and determined modern day leaders is Elon Musk who has, on multiple occasions, been on the verge of ruin. An example of this was the perilous start of SpaceX, which saw three failed attempts to launch its Falcon 1 rocket into orbit and had exhausted the $100m of funding provided by Musk. Failure was not an option in Musk’s eyes, and he invested his remaining net worth and borrowed from friends and family to push forward with a fourth (ultimately successful) launch.

“When something is important enough, you do it even if the odds are not in your favour” - Elon Musk.

When paired with deep product knowledge, industry expertise, and a vision for the future, the ability of a founder to take a contrarian view and to drive down an unpaved road is critical to success. Some of the largest and most successful companies in the world have been built by stubborn founders who drowned out the noise and charged ahead into the unknown.

“Resillience matters in success. I don’t know how to teach it to you, except I hope suffering happens to you… greatness comes from character, and character isn’t formed out of smart people it’s formed out of people who have suffered” - Jensen Huang.

Growth Mindset

The best leaders have an insatiable appetite for knowledge across all domains. Warren Buffett is a big believer in lifelong learning and estimates he spends as much as 80 percent of his day reading, while Bill Gates believes that continuous learning is totally fundamental to self-reflection and development in life. This constant learning, combined with the other above traits, enables leaders to learn and grow from failure and continually improve on their ideas.

“I constantly see people rise in life who are not the smartest, sometimes not even the most diligent, but they are learning machines. They go to bed every night a little wiser than they were when they got up and boy does that help, particularly when you have a long run ahead of you.” - Charlie Munger.

Multi-disciplinary learning also creates a wider context window and ability to identify trends and opportunities that others don’t see. Elon Musk for example, who was passionate about cars, renewable energy and technology, saw the potential to bring these fields together with Tesla.

How to identify a leader with the right attributes

When assessing whether a founder is an extraordinary, “n of 1”, individual, I ask the following questions:

• Have they articulated a clear vision, and resounding passion for what their company, industry and mission?

• Have they built a team of experts around them that will help them to supercharge their ambitions?

• Do they continued to push the boundaries and develop new innovative products despite reservations from their peers or investors?

• Do they cross reference industries and ideas that are outside of their core area?

Leaders that receive a strong YES response to every question are the best placed to thrive in today’s rapidly changing world, where industries are uprooted, business models evolve, and competition adapts continuously.

Companies led by these generational founders are the best placed to become the Space X, Apple, or NVIDIA of the future.

If you’d like to see more posts like this one, then support the channel by subscribing for free and using the button below and share it with others you think might be interested.

If there’s a specific topic or company you want me to do a deep dive on, or if you have any questions about this article, don’t hesitate to reach out.

Subscribe now

Share