Last week, I caught up with Matthew Prince and Michelle Zatlyn, the co-founders of CloudFlare, one of the hottest startups around. If you don’t know what CloudFlare does, you should, because it could be a monster company in the making. It could also make your web site faster and protect you from Denial Of Service attacks. So read on…
Matthew and Michelle met at Harvard Business School. CloudFlare’s third co-founder, Lee Holloway, joined them in starting the company. CloudFlare is funded by Venrock, Pelion, and NEA.
Here’s the conversation I had with Matthew in Davos last week, where CloudFlare was honored as a Technology Pioneer. Michelle showed up shortly thereafter. (Thanks to BI’s Kamaila Sanders for transcribing the file.)
HENRY BLODGET: Matthew, thank you for doing this. So what is CloudFlare?
MATTHEW PRINCE: CloudFlare is a really simple service. We make the Internet faster and we protect websites from bad guys. So on average it takes about 5 minutes to sign up for CloudFlare, you don’t have to install any hardware or software, you don’t have to change a single line of code, so you make one change to your DNS setting so to the network level setting. And once you do that your website will be twice as fast and you will be protected from hackers and spammers and denial of service attacks, so a really wide range of attacks and what’s pretty amazing is CloudFlare launched a year and a half ago in September 2010 and in that time we have grown so much that we now handle more traffic than Amazon, Twitter, Wikipedia, Zynga, and AOL combined.
BLODGET: What you just described sounds like a miracle. So what happens when we change our DNS settings?
PRINCE: So we run, currently, 14 data centres scattered all around the world, 3 in Asia, 7 throughout the United States, and 4 in Europe and we’re continuously expanding that and what happens is, your traffic, instead of going directly to your website it will pass through one of our data centres and at that point we can sort of clean and accelerate the traffic.
So to clean it we look for patterns of what a hacker would do or something like that and we can actually stop those attacks before it even gets anywhere near your data centre.
To accelerate it, we do a lot of different things. We actually cache some of the static objects that are part of your site. We’ll dynamically change the site to make sure that it loads fast on an iPhone or an iPad versus a laptop computer or a desktop PC. All of those add up to being a fairly significant performance gain and also just decreasing the overall load on your server. So we’ll just cut your bandwidth usage in half, we’ll cut the amount of requests to your web server in half and that means that it makes your system much more efficient.
BLODGET: Not to get too technical, because I can’t, but we have something called varnish to already do some of the things your talking about. Does that affect our ability to use CloudFlare? Would we recode that?PRINCE: No, I mean varnish is a terrific piece of software and it lives on your actual servers in your actual data centre but the problem is that, typically you have one data centre in one place and that becomes a single point of failure for most networks and so something like a denial of service attack literally will plug up the pipes to that one data centre and it can knock you offline. What CloudFlare does is it actually makes it so that instead of you having one data centre it’s like you have 14 around the world. We are continuously expanding that and that means that you get the benefits of something like Varnish, which is very complimentary to that but expand it out so it has the global distribution and the network diversity. It’s a lot like diversifying a stock portfolio where you are literally spreading the requests out across a lot of different places and then making it much less susceptible to risk in any one location.
BLODGET: And how is it different than a content delivery network, which we’ve had for over 10 years now?
PRINCE: There’s a lot that’s very similar and we were inspired by a lot of the content delivery network guys, but as you probably know the content delivery networks are typically very, very expensive so tens of thousands of dollars a month is the average selling price for a service like Akamai or Limelight and so that really limits the market for those types of services down to maybe 10 thousand websites in total. Akamai has about three thousand customers and they are the market leader by far. We had about three thousand customers every 3 days so it’s just a very different thing. We have been able to do that by two things. The first was making it just incredibly simple to set up. It takes about five minutes to set up compared with a typical content delivery network, which will take two weeks and a really smart engineering team to get configured correctly. The other thing we did is we made it inexpensive. So we actually offer the service for free to a lot of our users but we hope that they’ll pay us more if they want more features and then the price points are often 1/1000 of the price of the typical content delivery system.
BLODGET: And what are the price points, how much are you going to charge us when we sign up?
PRINCE: The self-service models start at free, $20 dollars a month, or $200 dollars a month. We also have a lot of enterprise customers that use us, which for a content delivery network setting would be paying 20-one hundred thousand dollars a month and they pay us around $2,000 dollars a month so it’s a really big cost savings and what we’ve found is, we don’t typically end up competing for dollars in a budget with a security software or something else that you might already have in your network. Instead what we usually do is we say, sign up for a service, see how much we’re saving you in your bandwidth bill and then just give us some percentage of whatever that savings is. So the dollars that we compete for are actually the dollars of the bandwidth providers, not necessarily the other security solutions that are out there.
BLODGET: An investor I talked to, who first made me aware of you, said CloudFlare is one of the fastest growing software companies he had ever seen. So, how big are you and how old are you, when did you start the company?
PRINCE: When we started there were three of us that co-founded the company: Michelle Zatlyn, Lee Holloway, and myself and we started the company originally in early 2009. We raised money, we won a business plan competition and we sort of took some time to figure things out and raise some money from just great investors Venrock, a guy named Ray Rothrock at Venrock and Carl Ledbetter who is the former CTO at Novell and works for a firm called Pelion Ventures, which is a great firm and we raised money from them in 2009 and spent almost an entire year just building the product, really getting it very stable. We launched in September of 2010 and we have just been on a rocket ship ever since. It’s really pretty remarkable to watch as we have gotten adoption and not just, I mean people keep asking how are you going to break out of Silicon Valley, you know our second largest market is China, our third is Brazil, Turkey is fourth, you know we have become this global company overnight without spending a dollar on marketing or having a single sales person on staff and it’s really remarkable that a lot of the things that you’ve talked about, just the influence of social media and building a product that really surprises and delights people and that, that in and of itself is a way to get people pulled into larger and larger companies over time. It’s extraordinary.
BLODGET: How big is the company in terms of people now?
PRINCE: We just hired our 30th employee. It’s tiny. We think that we’ll be doing more traffic by the end of the year than Yahoo! and we’ll have 1/1000 of the employees of Yahoo! so that speaks to the leverage and the scale in the business, which is pretty substantial. The other thing is, we are very much an engineering driven company so almost everyone who is on the team is an engineer and that’s allowing us to do some things that are pretty remarkable.
BLODGET: So now that you have this extraordinary of traffic, what are you seeing, any trends that are cool?
PRINCE: Over the course of the last year we saw a 700 per cent increase in denial of service attacks. That’s one of the disturbing trends thats out there. I think some of the rise of the Anonymous and the Occupy Wall Street Movements that have used these tools in order to literally knock people offline is really troubling to us and our service is very good at stopping that and that’s actually been responsible for some of the growth. Some fairly large companies call us up and say, “we have been threatened, can you help us stay online?” and we have done that. We see a lot of other trends just in terms of, we get a huge sense of what’s going on online so the day about a week ago when the internet blacked out because of SOPA protesting the copyright legislation, one of the things we did is we tracked search engine crawl rates so we see this huge pattern of search engine crawl rates. Google dropped their overall crawl rate by over 60 per cent that day in order to make sure that SOPA protests didn’t actually affect them and those sorts of things you can only see if you have a macro level scale of the trend that we have and the core value proposition that we have for CloudFlare is that we get a little bit smarter in protecting all the other sites that are on the system and I really don’t think that there’s another company on the web today that has a better view into the threats that are out there and the different challenges that websites face and that’s whats bringing us into larger and larger accounts.
BLODGET: How do you stop a denial of service attack?
PRINCE: We have really big pipes and we buy tons and tons of bandwidth from all these different data centres around the world so the first step in stopping it is to make sure we have a bigger pipe than the attacker has and we have a substantially larger pipe than any individual organisation that would be online unless they’re Google or Facebook or Yahoo! and at some point there’s no reason we won’t have a larger pipe than they do so at some level a denial of service attack is about having resource exhaustion. Either you fill a pipe up or you completely saturate the computers that are behind that. So at every step we have tried to make sure that you have more resources than you would need and again its like a diversification strategy. We pool resources across a number of different sites and as a result of that we’re able to sustain very big attacks that have come against us.
BLODGET: One of the big challenges now with more video and more mobile and everything else is just bandwidth in general, a big crisis, obviously a spectrum crisis and so forth, would CloudFlare help that just by making everything more efficient?
PRINCE: To some extent we can, we specifically, video has really driven the expansion of bandwidth and one of the things that traditional CDM’s do that we don’t do is video. So if your streaming video off your sight directly then we are not the best service for you but then really only about 1000 sites on the internet, Yahoo!, YouTube, Vimeo, Facebook and a few others that are actually really streaming video and they would be better off using Akamai or something. If you are just embedding YouTube videos or something like that we work great but were not a great streaming service but they way we benefitted from that though is because video has pushed the bandwidth demands up so much capacity is being built out for that and the cost of bandwidth is dropping precipitously and so that’s part of what has allowed us to actually build CloudFlare out at this time and offer a service that we give away for free in a lot of cases or a very substantial discount. So I think that while, we can help, what we can really help is make sure that you are getting the best prices on bandwidth that you possibly can because we will cut your bandwidth usage in half and we just absorb so much of that because we just again aggregated all of these bandwidth users together and that means that we just get better pricing than almost anyone.
BLODGET: So, what’s next over the next couple of years?
PRINCE: So, last night, you know I was in an event and I met Tim Berners- Lee, who literally can lay claim to inventing the Internet and somewhat flippantly I said, “great job over the last 22 years, we’ll take it from here.” We really think that CloudFlare’s vision is to rebuild a lot of the network in a way that is optimised around what the internet has become as opposed as to what it was built to do. Things that we’re doing that we’re really excited about is solving the hardest problems on the Internet. So things like the transition from IPv4 to IPv6. The world is running out of IP addresses and we realised that we were in a very good position to help deal with that transition so what we can do is with the single push of a button, let you keep your website on its existing infrastructure, upgrade that on your own time frame however you want, but all of a sudden your website becomes available to the IPv6 visitors on the web and we act as a gateway between those two things.
Similarly with security it’s just shameful that we don’t have more sites that have SSL protection and the reason why is it’s too expensive and it’s too hard technically for people to implement. We’re making it simpler and less expensive and again with just one click we will allow you to enable SSL on your site. In certain places we’re doing things where we’re literally reinventing network protocols from our edge nodes back to the origin server it may be that TCP and HDTP aren’t the most efficient way for us to transmit data between those things and we’re working on some things to get a 50, 60 70 per cent increase in the efficiency of data transmitted between those and what that means is that you can host your website anywhere in the world and so long as CloudFlare continues to build out our network, it will be as if you are hosting it right next door to the actual person who is visiting your site. That’s what’s necessary to make a fast, app-like web that can really take the internet to the next level.
Larry Page once said that it’s easier to solve big, hard problems than little easy problems and so we keep trying to set our sights at how are we going to solve some of the hardest problems on the internet? That’s what really motivates our team.
BLODGET: The way you describe that it sounds just incredibly capital-intensive, building out the data centres and so forth?
PRINCE: We own all of our own equipment in all of these places, we lease space in existing data centres. We want to be in places where your packets would have otherwise gone through. One of the things I’m really proud of is we realised early on that at core our business was about being as efficient at processing bytes of information as possible and so to get to this level where we do about 20 seven billion page views a month through our network. We spent less than $1.5 million dollars on our total capital expenditures so we’re pretty confident that we have enough dry powder to really build out a network that can literally power the Internet.
SEE ALSO: 11 Rising Tech Stars To Watch In 2012