Matthew Prince

Prince positions Cloudflare as the first agentic cloud, distinct from neoclouds and hyperscalers, with developers flocking to it.

Cloudflare isn't a neocloud. We're also not, as some of you have called us, the fourth public cloud. We're something different. We're the first agentic cloud, and developers are flocking to us to build the agentic AI future.

Prince says agents will outnumber humans online 1,000 to 1 sooner than five years, and container-based clouds can't keep up cost-effectively.

I predicted last quarter that within five years, agents would outnumber humans online 1,000 to 1. A quarter later, I'll take the under on the timing of that bet based on everything we're seeing today. The container-based architecture of the hyperscalers and neoclouds just can't keep up in a cost-effective way with the new agentic paradigms of today.

Prince warns a wave of AI-discovered vulnerabilities will hurt for about two years, though the internet is becoming safer.

It's coming, and it's going to be bad, and it's going to be bad for, I think, two years. But the good news is, we're finding the monsters, we're cleaning them up, and the internet is actually getting safer.

Prince says CISOs are panicking and the worst of the vulnerability wave is not yet over.

I think right now what CISOs are doing is panic. It feels like the sky is falling. Again, I think everyone is sort of holding their breath and saying, "Hopefully the worst of it's over." I know for a fact the worst of it is not over.

Prince expects agent-era micropayment business models (Act 4) to become Cloudflare's largest business within ten years.

I don't know exactly how long it will be before it turns into major sources of revenue, but if you look out in the more distant horizon, if you look 10 years out, I would imagine that this becomes the largest part of Cloudflare's business.

Prince argues agents must compensate content creators because agent traffic requires massive infrastructure.

if agents are going to be 1,000 times human traffic online, that's going to require more bandwidth, that's going to require more servers, that's going to require more things to actually power it, and someone has to pay for it. It can't be a free ride for all the agents that are out there.

Prince criticizes neocloud financial-engineering deals as unsustainable and says Cloudflare would never do them.

We have watched a bunch of really dumb deals get done. Obviously, the market is digesting those right now. Those just are not the sorts of deals that we would ever do. I think as the market gets more rational and as we actually figure out, okay, you cannot sell a dollar for $0.50 and be in business over the long term

Prince says customers are buying the unified Cloudflare platform, turning point-solution Zero Trust vendors into mere features.

people aren't buying just Zero Trust. They're not just buying WAF, they're not just buying DDoS, they're not just buying the developer platform. They're buying the overall platform of Cloudflare, and they're seeing that if you incorporate and use all of what we do, that you get a much more holistic solution. As a result, the Zero Trust vendors effectively just become features within what is a much larger platform play.

Prince says AI outperforms humans at measurement functions, justifying Cloudflare's flatter organization with more builders and sellers.

AI is incredibly good at measuring things. And we have found across our business that in many cases, it's better than what humans can do. AI has bias, but the bias is not correlated to the rest of the organization, unlike what everything else has done.

Prince says new President of Revenue Christian Smith can lead go-to-market through rapid expansion and shares Cloudflare's belief in the size of its market opportunity.

Christian has consistently proven he can lead global go-to-market organizations through periods of rapid expansion with discipline, operational rigor, and a steadfast focus on customers. He shares our belief in Cloudflare's mission and in the size of the opportunity in front of us. We are excited to have him on board for this next chapter.

Prince says Cloudflare has partnered with nearly every major frontier AI lab and security firm hunting for flaws in existing software.

We've partnered with nearly every major frontier AI lab and security company searching for flaws in existing software.

Prince says Cloudflare aims to be the first agentic cloud, built on isolates for efficiency, and predicts agents will outnumber humans 1,000 to 1 within five years.

Strategically: Cloudflare aims to become the first agentic cloud. (Cloud). We are not a new cloud, nor the fourth public cloud. We are built on isolation technology rather than containers, offering unmatched efficiency in geographic and density scaling. I predict that within five years, the number of agents will exceed humans by a ratio of 1,000 to 1—I’m betting it happens even sooner.

Prince says the Act 4 agent-internet business model line began generating revenue and could become Cloudflare's largest segment within a decade.

Act 4—A product line helping define new internet business models—recognized revenue for the first time this quarter: pay-per-crawl, micropayments, and agent disclosure of intent for lower fees. Collaboration with OpenAI provides page change notifications, helping crawlers reduce costs. A decade from now, this business could become our largest segment.

Prince warns that a wave of severe vulnerabilities is coming and will persist for two more years.

Security: Six of the most severe vulnerabilities in history were disclosed within 14 days. The worst is yet to come, and this state will persist for another two years.

Prince argues first-generation Zero Trust vendors fail on agent identity and are being reduced to features as customers buy platforms.

First-generation Zero Trust vendors aren't addressing the issue of agency identity; clients are abandoning ongoing RFPs; customers are buying an "entire platform," and first-generation vendors are becoming mere features.

Prince says AI agents handle measurement tasks cheaply and Cloudflare will hire more builders and sellers, exceeding pre-layoff headcount by year-end.

AI excels at "measurement"-type tasks—for example, Heather from the IR team used an agent to complete the entire team’s previous earnings materials, with token costs under a few hundred dollars. We’re shifting toward hiring more builders and sellers, and by year-end, our total headcount will exceed what it was before the layoffs.

Prince says the AI and agents era has arrived and positions Cloudflare as the first agentic cloud that developers are flocking to.

Now we're in the era of AI and agents," he said, describing Cloudflare as "the first agentic cloud, and developers are flocking to us to build the agentic AI future.

Matthew Prince said Cloudflare has built the development platform for the AI-powered Internet, with annualized revenue passing $3 billion and Q3 revenue up 39% year over year.

We crossed $3 billion in annualized revenue with revenue of $782 million, up 39% year over year,

Prince says Cloudflare has built the development platform for the AI-powered Internet, that organizations rely on it for protection as threats escalate, and that it is in a higher gear for its next growth phase.

We have built the development platform for the AI-powered Internet—and as digital threats escalate, organizations of every size continue to rely on Cloudflare for protection. Our engine is firing on all cylinders, and we've found an even higher gear for this next phase of growth.

Prince says Cloudflare faces a large market opportunity and that new revenue chief Christian Smith shares that belief as the company scales toward $5 billion in ARR.

He shares our belief in Cloudflare's mission and in the size of the opportunity in front of us. We are excited to have him on board for this next chapter.

Matthew Prince says Cloudflare is seeing a fundamental rewrite of the Internet to handle machine-to-machine traffic driven by AI.

we are seeing a fundamental rewrite of the Internet for machine-to-machine traffic.

Matthew Prince says he has lived in abject terror over AI-found bugs leaking before patches, and predicts a critical internet-wide vulnerability roughly every week for the next two years.

“The last two months, I’ve been living in a state of abject terror that someone else would find the bug or the information would leak before everyone had patches and fixes in place,” said Matthew Prince, CEO of Cloudflare. “For the next two years, we’re going to be living in a state where, on average, every week there is a critical, internet-wide vulnerability.”

Prince argues that although the next two years will feel like the sky is falling, finding these flaws with AI will ultimately yield a much safer internet.

“You’re actually safer in a world where we are finding these things,” Prince said. “The next two years, it’s going to feel like the sky is falling, but I think we come out the other end of it with a much safer internet.”

Matthew Prince said Cloudflare saw exploitation attempts of the PHP flaws surge from thousands before disclosure to millions soon after the announcement.

That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,

Prince warns that AI-assisted vulnerability research will unearth long-hidden bugs in unaudited code, leading to a year or two of constant security crises, with other serious flaws already being patched.

I think we're going to have a year or two where every week it feels like the sky is falling,

Prince warns that AI-driven vulnerability discovery will bring a couple of years of weekly security upheaval.

I think we're going to have a couple years where every single week it's going to feel like the sky is falling,

Prince says Cloudflare knows of more severe vulnerabilities in other critical software beyond PHP.

a bunch of additional severe vulnerabilities that are present in other pieces of critical software

Matthew Prince said Cloudflare saw an exponential surge in attempts to exploit the PHP vulnerabilities after disclosure, showing how fast attackers move to weaponize new flaws.

Matthew Prince, CEO of cybersecurity and monitoring company Cloudflare, said this week that the company observed an exponential increase in attempts to exploit vulnerabilities following their disclosure, illustrating how quickly malicious actors are trying to leverage these flaws for their own gain.

Matthew Prince warned that AI-discovered PHP2Shell flaws could usher in a couple of years of heightened internet security chaos.

Cloudflare chief Matthew Prince warned that AI‑discovered PHP2Shell vulnerabilities, affecting roughly 70% of web traffic, could usher in “a couple years” of heightened internet‑security chaos.

Matthew Prince said Cloudflare is seeing one million attack-related communications per minute following the PHP flaw disclosure, mostly probes for vulnerable servers that are blocked, though servers are being compromised elsewhere.

We are seeing one million attack-related communications per minute.

Prince warns that AI-discovered software vulnerabilities will make the next couple of years feel like a weekly crisis.

we're going to have a couple of years where every single week it's going to feel like the sky is falling

Prince frames the flood of AI-found flaws as ultimately positive, since many long-hidden bugs will be cleaned up.

The reality is, we're going to get a lot of this stuff cleaned up

Matthew Prince warned that AI-accelerated vulnerability discovery could surface more critical bugs in the coming months, leading to emergency patches and service disruptions.

Cloudflare CEO Matthew Prince warned that more critical bugs could emerge in coming months, potentially triggering emergency patches and service disruptions.

Prince reported that exploit attempts against the PHP flaws on Cloudflare's network escalated from thousands to millions within hours of the announcement.

Across the Cloudflare network we saw thousands of attempts to exploit it,” he wrote in a post on X. “That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now.

Prince reported that exploitation attempts against the PHP flaws escalated from thousands before disclosure to millions after the announcement.

"In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it," Cloudflare CEO Matthew Prince said in a post on X late on Wednesday. "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."

Matthew Prince said Cloudflare saw tens of thousands of exploit attempts for the PHP flaw within 45 minutes of discovery, now grown to millions.

Matthew Prince, the head of the cybersecurity firm CloudFlare, said his organization saw tens of thousands of attempts to exploit the flaw in the first 45 minutes of its discovery. That's now in the millions, Prince said on Thursday.

Matthew Prince reported that exploitation attempts against the PHP2Shell vulnerability surged from thousands before disclosure to millions after it, as seen across Cloudflare's network.

In the 10 hours before [PHP2Shell] was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

Matthew Prince said Cloudflare's network saw thousands of PHP2Shell exploit attempts before public disclosure, escalating to millions after the announcement.

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

Matthew Prince reported that exploitation attempts against the PHP2Shell vulnerabilities on Cloudflare's network escalated from thousands to millions within hours of disclosure.

In a recent post on X, Matthew Prince stated that Cloudflare’s network observed thousands of exploitation attempts in the 10 hours prior to the vulnerability disclosure. Within 45 minutes of the announcement, this number surged to tens of thousands, reached hundreds of thousands within two hours, and has now climbed to millions.

Matthew Prince reported that exploit attempts against the PHP vulnerability (#php2shell) escalated from thousands before disclosure to millions after, as seen across Cloudflare's network.

In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

Prince says that if current trends continue, machine traffic could reach 1,000 times human traffic within five years.

Prince has also said that, if current trends hold, machine traffic could be 1,000 times human traffic within five years.

Prince reported that exploitation attempts of the PHP flaw began before public disclosure and escalated rapidly to millions after the announcement.

In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,

Matthew Prince said exploitation of the critical PHP vulnerability began hours before public disclosure and escalated rapidly to millions of attempts on Cloudflare's network.

10 hours before the public announcement, thousands of exploitation attempts were recorded on our network. Within 45 minutes of the announcement, this figure increased to tens of thousands, within 2 hours it reached hundreds of thousands, and now we are talking about millions of attempts.

Matthew Prince said Cloudflare saw exploitation attempts of the PHP flaw escalate from thousands before disclosure to millions after, showing how fast attackers weaponize newly announced vulnerabilities.

In the 10 hours before it was publicly announced, across the network we saw ‌thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now.

Prince argues enterprise AI tools should not force a trade-off between speed and security, citing Cloudflare's own internal use of Cloudflare OS.

AI tools shouldn't force companies to choose between moving fast and staying secure. We built Cloudflare OS for our own teams first and saw how much faster and more safely we could move.

Prince framed Cloudflare's partnership with Idealab.ai, including $100,000 in credits per startup, as a way to match entrepreneurs with vetted AI-generated business ideas suited to their skills.

helping match talented entrepreneurs with vetted business ideas matched to their skill sets.

Prince argues enterprises should not have to trade speed for security in AI adoption, citing Cloudflare's internal use of Cloudflare OS as proof.

"AI tools shouldn't force companies to choose between moving fast and staying secure," said Matthew Prince, Co-founder and CEO of Cloudflare. "We built Cloudflare OS for our own teams first and saw how much faster and more safely we could move.

Prince says Cloudflare aims to deliver a secure, company-aware AI workspace out of the box, avoiding costly multi-million-dollar enterprise AI rollouts.

The goal is simple: a secure, company-aware AI workspace from day one, without turning every rollout into a multi-million dollar engineering project.

Matthew Prince says upgrading web security ahead of quantum computers' ability to break it is one of the biggest coordination challenges in Internet history.

Upgrading the web's security before quantum computers can break it is one of the biggest coordination challenges in the history of the Internet,