Cloudflare has posted its fastest growth in nearly four years, with third-quarter revenue rising 39% to $782.5m and annualised sales passing $3bn. For UK organisations that already route traffic, DNS and remote access through the platform, the numbers show how concentrated that dependence is becoming.
What happened
Cloudflare published its results for the three months to 30 September 2026 after the US market closed on 5 November. Revenue came in at $782.5m, compared with $562.0m a year earlier. Chief executive Matthew Prince described it as “Cloudflare’s best quarter ever” and said the company had crossed $3bn in annualised revenue.
Profitability on an adjusted basis also improved. Non-GAAP operating income reached $137.1m, a margin of 17.5% against 15.3% twelve months ago, and non-GAAP earnings per share were $0.38. On a GAAP basis the business still lost money: an operating loss of $67.9m and a net loss of $34.1m, or $0.10 a share. Free cash flow was $82.1m, around 10% of revenue, slightly ahead of last year in absolute terms but lower as a share of sales. Cash and securities stood at $5.13bn at the end of the quarter.
Looking ahead, Cloudflare guided to fourth-quarter revenue of $845m to $846m and full-year 2026 revenue of $2.963bn to $2.964bn, with non-GAAP operating income for the year of $462m to $463m. Current remaining performance obligations, a useful indicator of contracted business still to be recognised, grew 37% year on year.
The company also confirmed a change at the top of its sales organisation. Christian Smith, who previously ran revenue at Splunk according to 24/7 Wall St, becomes President of Revenue. BigGo Finance’s summary of the earnings call says he succeeds Mark Anderson, who retires at the end of the year.
The detail
Behind the headline growth sit a few figures that matter for anyone assessing Cloudflare as a supplier rather than an investment. Gross margin slipped to 71.2% on a GAAP basis, down from 74.0%, which can reflect heavier spending on network capacity and lower-margin workloads.
According to BigGo Finance’s account of the call, management said the main upside came from variable revenue on pool-of-funds contracts, where customers consumed pre-committed spend faster than expected. The same summary reports dollar-based net retention of 122%, roughly 5,000 customers paying more than $100,000 a year, and a record number of new paying customers. It also says Cloudflare now expects to reach GAAP profitability in the fourth quarter of 2026, well ahead of an earlier 2028 target. These are call comments, not release figures.
On security specifically, BigGo reports that executives pointed to rising threat levels as a driver for Zero Trust and SASE (secure access service edge) sales, and claimed share gains against first-generation Zero Trust vendors. Cloudflare’s developer platform, Workers, was said to have passed 10 million active developers, and the company recorded its first revenue from products that charge AI agents and crawlers for access to content.
Geographically, the call summary puts EMEA at 26% of revenue, growing 32% year on year, well behind 44% growth in the United States but still a substantial and fast-growing slice of the business.
Why it matters for UK organisations
Cloudflare is not just another security vendor posting a good quarter. A large share of UK websites, public sector services, retailers and SaaS providers sit behind its network for DNS, DDoS mitigation, web application firewall and bot management. Increasingly, firms also use it for remote access and secure web gateway functions that used to live in on-premises firewalls and VPN concentrators. When a supplier grows at this pace, more of the UK’s internet-facing attack surface ends up funnelled through a single provider.
That concentration is now a regulatory question as well as a commercial one. The Cyber Security and Resilience Bill brings managed service providers into scope and gives regulators powers over critical suppliers, and the Bank of England, PRA and FCA already require regulated firms to manage material third-party dependencies. A CDN and Zero Trust platform that fronts a bank’s customer channels or an NHS supplier’s portal is exactly the kind of dependency boards should be able to describe, test and exit if needed.
The results also say something about the market. Strong growth at cloud-delivered platforms like this one adds to competitive pressure on vendors whose revenue still leans on firewall and appliance refresh cycles. For UK buyers, that means more leverage when renewing appliance contracts, but also more pressure from suppliers to consolidate onto one platform.
Expert view
In my experience, the security value of a platform like Cloudflare is real, but it is only as good as the configuration sitting on top of it. When we test organisations that proxy everything through a CDN, the most common finding is not a flaw in the provider, it is an origin server that can still be reached directly, bypassing the WAF and DDoS protection entirely. A strong quarter for the vendor does nothing to fix that.
The second issue is resilience. Large edge providers have had significant global outages in recent years, and when they go down, every customer goes down together. Businesses that moved DNS, access control and web protection to the same provider for simplicity have, without always realising it, created a single point of failure across several layers of their stack.
Finally, the push towards AI agent workloads and pay-per-crawl charging is worth watching. It shows the edge is becoming a policy enforcement point for machine-to-machine traffic, not just human browsing. That is useful for defenders, but it also means more business logic, and more sensitive decisions, are being made inside a third party’s infrastructure. Security teams should treat those rules with the same change control and review they apply to their own firewall policies.
What to do now
- Map your dependency. List every service that relies on Cloudflare or a similar edge provider: DNS, CDN, WAF, Zero Trust access, email routing. Record it in your supplier register and risk assessment.
- Lock down origin access. Make sure origin servers only accept traffic from the provider’s published ranges or through authenticated tunnels. This maps directly to the Cyber Essentials firewall and secure configuration controls.
- Protect the admin account. Enforce phishing-resistant MFA, role-based access and audit logging on the provider dashboard and API tokens. Compromise of that console is compromise of your whole perimeter, so treat it under the Cyber Essentials user access control requirements.
- Plan for an outage. Document and test a fallback for DNS and critical access paths, such as secondary DNS or a break-glass route for administrators.
- Use the market at renewal. With cloud platforms growing fast and appliance vendors under pressure, benchmark pricing and contractual exit terms before committing to multi-year consolidation deals.
Bottom line
Cloudflare’s 39% revenue growth confirms that cloud-delivered security and edge services are where much of the industry’s money is now going. For UK organisations, the takeaway is less about the share price and more about dependency: the more of your perimeter one supplier runs, the more important it becomes to configure it well, monitor it closely and know what happens when it fails.
