Cloudflare Deep-Dive Update: $305 Target Price, the Agentic Web, and How Rule of 50 Revalues an Edge AI Platform
目录
Too Long; Didn’t Read
I. What Cloudflare Actually Sells: It Is Moving from an Internet Edge Company to an AI Application Control Plane
II. Why Morgan Stanley Raised the Target Price to $305: Not an EPS Upgrade, but an FCF Multiple Re-rating
III. Vercel Ship Added a New Variable Last Week: Developer-Platform Competition Is Not Just About Cloud Vendors
IV. 1Q26 Has Already Proven Demand Is Strong, but Also Exposed Friction in Gross Margin, RPO, and DBNRR
V. Why the Agentic Web Could Be Valuable: Cloudflare Sits at the Intersection of Content, Models, Enterprises, and Developers
VI. Capability Transfer: From CDN Efficiency to an AI-First Organization, Cloudflare Is Betting on the Same Engineering Culture
VII. How to Judge Valuation: $305 Is Reasonable, but the “Narrative Multiple” and “Execution Multiple” Need to Be Separated
8. What to Watch Over the Next Four Quarters: Do Not Just Track the Stock Price; Track Developer ARR, Cloudflare One, and Gross Margin
9. Peer Comparison: Cloudflare Is Not the Purest AI Company or the Cheapest Software Company, but It Sits Closest to the Traffic Entry Point
X. Investment Conclusion: Shift From “High-Multiple Security Software” to “AI Internet Control Plane,” but the Validation Window Is Now Open
本内容基于公开资料和研报数据整理，不构成任何投资建议，不代表任何个人观点，仅供学习参考，请理性阅读
Cloudflare’s repricing is not just Morgan Stanley raising its target price to $305. It reflects the market starting to view the company less as a CDN and security vendor, and more as a combination of developer platform, Zero Trust, and Agentic Web control plane. The key test is whether AI traffic can drive both 30% growth and margin expansion.
Too Long; Didn’t Read
The target-price increase has an anchor. Morgan Stanley raised its Cloudflare target price from $245 to $305. The core change was not a small near-term EPS revision, but an increase in the valuation multiple from 38x 2034E FCF to 48x, while maintaining 2034E FCF per share at about $12.13. In other words, the sell side is underwriting longer growth durability and higher FCF certainty, not one quarter of revenue upside.
The company profile has changed. Cloudflare used to be viewed as a CDN, security, and networking services provider. It now looks more like a developer and security infrastructure platform sitting close to the internet entry point. It serves content delivery, application security, and Zero Trust, while also using developer products such as Workers, R2, D1, and Durable Objects to support AI agent applications. The valuation debate has shifted from “what multiple should security software get?” to “can an edge AI platform compound through the cycle?”
The Agentic Web is the new option. The key figures disclosed at Analyst Day were that AI agent requests on Cloudflare’s network grew 1,700% from June 1, 2025 to May 31, 2026, developer platform ARR grew 137% in 2025, and platform developers increased from about 3 million to more than 5.5 million. This option is still early, but it explains why the market is willing to revisit Cloudflare’s TAM and long-term margins.
Vercel makes the competition more real. Observations from Vercel Ship over the past week show that developer-platform competition comes not only from AWS, Azure, and Google Cloud, but also from platforms such as Vercel that sit closer to front-end workflows, dynamic web experiences, and agent deployment. Cloudflare’s advantages are its 300-plus edge locations, isolets architecture, and network-entry position. Its gaps remain developer experience, GPU operating complexity, and still-developing mindshare in dynamic applications.
Financial validation is not complete. 2026Q1 revenue was US$639.755mn, up about 34% YoY, with gross margin of about 71.2%, operating cash flow of US$158.33mn, and operating cash flow less capex of about US$93.099mn. Growth remains strong, but gross margin is below the prior long-term range of 75-77%, while RPO growth and DBNRR have also shown signs of slowing. This means Rule of 50 has not already been delivered; it still needs to be proven over the next four to eight quarters.
Four numbers matter. The most important question ahead is not whether the stock immediately catches up to $305, but whether developer product ARR, Cloudflare One ARR, new large enterprise customers, and gross-margin recovery can move together. If the company approaches 30% revenue growth and an operating margin of around 20% in 2027, the valuation upgrade can persist. If gross margin keeps falling while RPO and DBNRR weaken, the Agentic Web will first be treated by the market as an expensive narrative.
I. What Cloudflare Actually Sells: It Is Moving from an Internet Edge Company to an AI Application Control Plane
Cloudflare’s business used to be easy to understand: put customers’ websites, applications, and traffic in front of its global network, then provide content delivery, DDoS protection, application security, DNS, load balancing, and network performance optimization. That old profile is not wrong, but it is no longer enough. Today, Cloudflare looks more like a programmable network attached to the internet entry point. Customers are no longer just using it to accelerate pages; they are also running application deployment, security policies, API calls, data storage, and AI agent traffic on that network.
The company’s most distinctive asset is not one or two security products, nor the standalone number of CDN nodes, but its network position. At Analyst Day, Cloudflare management emphasized that the company sits at the entry point of more than 20% of internet traffic, while connecting content owners, enterprise customers, developers, and AI model providers. This position puts it closer to real traffic than traditional security software, and closer to the execution layer across clouds, applications, and endpoints than ordinary cloud vendors.
Cloudflare’s business can be divided into four layers. The first is application services and security, namely CDN, DDoS, firewall, Bot Management, API security, and application performance. The second is networking and Zero Trust, including Cloudflare One, SASE, remote access, browser isolation, data protection, and enterprise network replacement. The third is the developer platform, including Workers, Pages, R2, D1, Queues, and Durable Objects, which allow developers to build applications directly on Cloudflare’s network. The fourth is the Agentic Web, the new internet infrastructure that enables AI agents to be identified, authorized, monetized, protected, and orchestrated.
This framework explains why Cloudflare’s valuation has remained high. Viewed only as application security or CDN, it is hard to support a high long-term multiple. Viewed only as Zero Trust, it must compete with Zscaler, Palo Alto, CrowdStrike, Netskope, and others. Viewed only as a developer platform, it runs into Vercel, Netlify, DigitalOcean, AWS Lambda, Cloud Run, and edge-computing products. But if the four layers are stacked together, Cloudflare is not selling a point product. It is selling the control plane through which enterprises and developers connect applications to the internet, AI, and users.
Cloudflare’s real corporate characteristic is that the same network serves two groups of people. One group is CIOs, CISOs, and IT architecture teams, who buy security, access control, performance, and reliability. The other is developers, who buy deployment speed, serverless experience, low latency, storage, and invocation cost. Many software companies serve only one of these two groups. Cloudflare touches both. The benefit is significant cross-sell potential; the drawback is product complexity, a sales narrative that can easily become diffuse, and near-term financials that are harder to fully explain using traditional software metrics.
Once AI agents are placed into this framework, Cloudflare’s value becomes clearer. An agent is not an ordinary user, nor an ordinary API request. It repeatedly visits webpages, calls tools, reads data, executes tasks, moves across systems, and requires identity, permissions, auditability, billing, and abuse prevention. The traditional internet is “humans visiting pages.” The Agentic Web is “software agents accessing services.” This reconnects security, developer platforms, and network entry points.
The AI Cost Inflection Point Is Arriving: From Token Euphoria to On-Device Inference, Capital Is Reallocating Valuation Weight Across Compute, Software, and Hardware
This is also where Cloudflare differs from pure AI compute companies. Nvidia, Broadcom, Marvell Technology, TSMC, and the HBM supply chain sell hardware capability inside AI factories. Cloudflare sells network control among applications, users, agents, and models. Hardware companies benefit from training, inference, and network equipment upgrades. Cloudflare benefits from governance and deployment after AI traffic truly enters the application layer. It is not on the same layer as the “picks and shovels” vendors; it is the highway, toll booth, and security checkpoint after AI applications go live.
The main conclusion of this update is direct: Cloudflare should no longer be framed only as a CDN company or security software company. Its current valuation reflects the market pricing a composite asset of “edge network + Zero Trust + developer platform + Agentic Web option.” If this combination works, a $305 target price is not the endpoint. If it does not, the current high multiple will compress quickly.
II. Why Morgan Stanley Raised the Target Price to $305: Not an EPS Upgrade, but an FCF Multiple Re-rating
The key to Morgan Stanley’s target-price increase is not a major change in near-term EPS forecasts, but an upgraded valuation framework. The base-case target price, forward FCF, discount rate, and multiple changes are best viewed in one table: the real change is not near-term earnings, but the market’s willingness to assign Cloudflare a longer growth duration and greater platform scarcity.
This is a very clear “asset-quality re-rating.” If the market merely believed Cloudflare would sell a few more quarters of security products, it would not raise the forward FCF multiple by this much. The multiple increase means the sell side believes Cloudflare has a longer growth runway, a stronger platform position, and higher visibility into long-term cash flow from AI. The near-term model has not changed much; the long-term asset attributes have.
Why is Morgan Stanley willing to assign a higher multiple? The answer is the Rule of 50. Cloudflare has long talked about the Rule of 40, meaning the sum of revenue growth and operating margin reaches 40%. After analyst day, management raised the North Star metric to the Rule of 50 and laid out a path to achieving it in 2027 and exceeding it in 2028. This language is important because the long-running debate around Cloudflare has been: “Growth is attractive, but when will margins be released like a mature software company?” Now the company has committed to growth and margin within the same framework.
The math behind the Rule of 50 is simple: revenue growth cannot fall materially behind, operating margin must continue to rise, and FCF must keep pace. Management has moved the long-term margin framework higher overall, effectively telling the market that although developer platforms and AI traffic may pressure gross margin in the short term, they will not destroy the long-term profit structure of a software company.
The easiest point to miss in this framework is the relaxed gross-margin target. Cloudflare’s prior long-term gross-margin target was 75-77%; it is now 70-77%. On the surface, that looks negative, because the developer platform, edge AI, and agent traffic will bring more network, compute, and storage costs. But management also raised the operating-margin and FCF-margin targets, indicating that the company is shifting the focus of margin expansion from “gross margin stays high forever” to “revenue scale, sales efficiency, R&D; efficiency, and G&A; leverage are released together.”
That is also why the $305 target price cannot simply be interpreted as “Morgan Stanley is more bullish.” The real debate is whether lower-gross-margin developer products and AI traffic represent declining pricing power, or a modest gross-margin sacrifice in exchange for a larger TAM. If it is the former, the high multiple is dangerous. If it is the latter, operating margin may still recover through scale effects, and a wider gross-margin range is simply what a growth platform looks like as it enters its next phase.
Viewed within the AI infrastructure chain, Cloudflare’s valuation logic has some similarities with hardware leaders: both are moving from single-product suppliers to platform infrastructure companies. The difference is that hardware platforms are constrained by chips, packaging, networking, and power, while Cloudflare is constrained by developer adoption, network efficiency, sales execution, and enterprise security budgets. Morgan Stanley’s multiple increase is essentially a bet that Cloudflare can convert those constraints into new pricing power.
The base-case implied requirements are not low. Revenue of about $15.6 billion and FCF of about $5.1 billion in 2034 imply that, starting from $2.167937 billion of revenue in 2025, Cloudflare must sustain a very high compound growth rate for nearly another decade while lifting FCF margin to around 30%. If Cloudflare is merely a mature CDN company, this model is obviously too expensive. Only if it becomes the internet control plane for the AI-agent era does this model have valuation room.
III. Vercel Ship Added a New Variable Last Week: Developer-Platform Competition Is Not Just About Cloud Vendors
The most important thing to watch over the past week was not another Cloudflare product release, but the competitive benchmark created by Vercel Ship. In its Vercel Ship observations, Goldman Sachs analyzed Cloudflare, DigitalOcean, Shopify, Okta, and Salesforce together, with a clear conclusion: agent applications will reconnect developer platforms, identity, front end, runtime, hosting, and cost optimization. Cloudflare is a beneficiary, but it does not lack competitors.
Vercel’s value proposition is different from Cloudflare’s. Vercel enters through front-end development, Next.js, deployment experience, and the dynamic web, emphasizing faster application building, deployment, and iteration for engineers. Cloudflare enters through its global network, edge nodes, security, and low-cost runtime, emphasizing code execution, application protection, and traffic orchestration at the internet entry point. One is more oriented toward the software layer and developer workflow; the other is more oriented toward network architecture and a globally distributed platform.
One important Vercel argument is that a developer compute platform does not necessarily need to be distributed across 300+ nodes to deliver strong performance and economics. It believes roughly 20 high-density nodes can cover low-millisecond latency needs for 90% of the world’s population. This is a very practical reminder for Cloudflare: the number of edge nodes is not an absolute moat. The real moat is the products on those nodes, developer experience, cost curve, reliability, and ecosystem integration.
Cloudflare is not without a response. Its isolets architecture was designed precisely for a high-density, low-overhead, multi-tenant isolated edge runtime. The Workers ecosystem has been operating for years. R2 bypasses traditional object-storage egress costs, Durable Objects solves state, and D1 provides an edge database. The question is not whether Cloudflare has products, but whether developers are willing to place more complex, more dynamic, more stateful agent applications on Cloudflare, rather than continuing to choose Vercel, AWS, Google Cloud, or internal platforms.
That is the value of Vercel Ship. It pushes Cloudflare’s competition from “faster and safer than traditional CDNs” to “who can become the default deployment platform for next-generation AI applications.” On this question, Cloudflare has the network entry point and security control, Vercel has front-end workflow and developer mindshare, and cloud vendors have GPUs, models, databases, and enterprise contracts. Over the next few years, what will really matter is not whose slogan sounds more like AI, but who can build the most balanced product across cost, latency, state management, security, and developer experience.
Vercel Ship also delivered an important cost signal. Enterprises are managing token and compute spending more granularly, rather than looking only at model quality. Goldman Sachs noted that some enterprises can see major cost reductions after a few weeks of optimization, while Vercel’s Fluid Compute reduces the cost of long-running, stateful agent workloads by charging only for active execution. Cloudflare’s opportunity is here: if it can prove Workers and edge runtimes are faster, cheaper, and safer for agent applications at the same time, developer-platform growth will be not just an “AI concept,” but an actual budget migration.
But the competitive pressure must also be stated clearly. Vercel is closer to modern front-end and product teams. Many enterprise agent entry points will ultimately be websites, apps, workbenches, customer-service interfaces, and e-commerce interfaces, not network-layer consoles. If Cloudflare cannot package its underlying network advantages into a sufficiently smooth developer experience, its advantages will remain at the infrastructure layer and cannot be fully converted into application-layer share.
This is also why Cloudflare’s valuation is not a low-risk re-rating. The more important the developer platform becomes, the more open the competition becomes. The larger the Agentic Web becomes, the more uncertain the standards become. The faster AI traffic grows, the more easily the market can amplify gross-margin and CapEx pressure. Vercel Ship makes the Cloudflare story more credible, but it also gives the market a more specific view of the competitors.
IV. 1Q26 Has Already Proven Demand Is Strong, but Also Exposed Friction in Gross Margin, RPO, and DBNRR
Cloudflare’s 1Q26 gave bulls plenty of good news. Official disclosures confirmed that revenue maintained high growth, gross profit and operating cash flow still supported platform expansion, and operating cash flow after capital expenditures was also positive. The specific numbers are clearer in table form: this is no longer a company that only burns cash to buy growth, but it is still some distance from the profit structure of a mature software company.
The more important part is the operating metrics. Morgan Stanley emphasized in its earnings report that developers, large customers, channels, and agent requests all delivered positive signals in the same quarter. This multi-line resonance matters more than a simple revenue beat, because it shows Cloudflare is moving from single-product selling toward platform expansion.
This set of numbers explains why the market is willing to listen to the Rule of 50 narrative. Cloudflare is not trading price cuts for growth, nor is it relying only on small customers to lift revenue. Large customers, channels, developers, agent traffic, and security products all delivered positive signals in the same quarter. This multi-line resonance is a typical signal that a software company is moving from product-led growth to platform-led growth.
But 1Q26 was not perfect. The biggest issue was gross margin. The company’s gross margin declined, partly because related network costs moved from sales expense to cost of revenue after free traffic converted into paid traffic, and partly because the developer platform, edge computing, and new products carry lower gross margins than the mature security business. Management emphasized that unit economics are still improving, but in the short term the market will see gross margin decline before it sees long-term scale effects.
The second issue was RPO. Morgan Stanley noted that total RPO in 1Q26 was $2.5435 billion, up 36% YoY, below market expectations of close to 39%, and down from 48% YoY growth in 4Q25. Current RPO grew 34% YoY, broadly in line with expectations. This number is not bad, but for a high-multiple software company, slower RPO growth will make the market question large deals and future revenue visibility.
The third issue was DBNRR. 1Q26 DBNRR was 118%, down 2 percentage points from 120% in the prior quarter, but up 7 percentage points YoY. Management explained that accelerated new-customer bookings temporarily diluted cohort metrics, while gross retention reached a four-year high. This explanation makes sense, but investors still need to see whether net retention stabilizes again around 120%. The biggest risk for a platform company is strong new-customer growth alongside slowing expansion from existing customers.
The 20% workforce reduction also needs to be viewed from both sides. Management framed it as a migration toward an AI-first operating model, with internal AI usage growing more than 600% over three months, while retaining and even planning to increase quota-carrying sales capacity. If executed smoothly, this would significantly improve sales, R&D;, and back-office efficiency, and would form part of the Rule of 50 case. If execution is poor, layoffs could hurt product cadence, customer service, and organizational culture, especially because Cloudflare is in the middle of multi-product-line expansion.
This is Cloudflare’s most important financial question today: it needs to prove three things at the same time. First, revenue growth can remain close to 30%. Second, the short-term gross margin decline will not undermine long-term 30%+ operating margins. Third, the developer platform and AI traffic are not only bringing usage, but also high-quality ARR, RPO, and FCF. Proving only one of these is not enough to support 48x forward FCF.
V. Why the Agentic Web Could Be Valuable: Cloudflare Sits at the Intersection of Content, Models, Enterprises, and Developers
The Agentic Web sounds abstract, but the problem it addresses is very real. Today, large models and agents are increasingly accessing webpages, calling APIs, scraping content, executing transactions, filling out forms, reading databases, and triggering workflows. The old internet assumed the visitor was human, and security and business models were designed around humans. The new internet will have a large volume of software agents that need identity, permissions, rate limits, payment, auditability, and content authorization.
Cloudflare’s position here is unusual. Content owners worry that model companies scrape content without compensation. Model companies need reliable access to the internet. Enterprises need to allow agents to access internal applications without losing control. Developers need to deploy agent applications at lower cost and lower latency. If Cloudflare can become the middle layer, it can sell services simultaneously to content owners, enterprises, developers, and model companies.
This opportunity is still early and should not be treated as revenue that has already materialized. But it is enough to change the valuation language. In the past, when Cloudflare talked about TAM, the market would ask how the company would divide the pie with Akamai, Fastly, security software vendors, and cloud providers. Now, when it talks about the Agentic Web, the market starts asking whether it can become a new internet control plane for the AI era. This is a shift from “share of an existing market” to “rules of a new market.”
Morgan Stanley noted after the analyst day that Cloudflare’s 2026 addressable market is about $238 billion, and is expected to grow at a 17% CAGR to $384 billion by 2029. That estimate does not yet fully include Act 4 opportunities such as the Agentic Web. TAM numbers themselves should not be accepted mechanically, but they show that management has continued to push the company’s boundaries from application services, cybersecurity, and developer services into content authorization, agent verification, and internet business models.
Cloudflare’s advantage is not that it can define a new protocol on its own, but that it is already on the path of real traffic. Many internet companies do not have enough incentive to build complex agent identification, access authorization, and settlement systems themselves. Many model companies also do not want to negotiate access rules individually with every content owner. If Cloudflare can provide an executable, auditable, monetizable middle layer, it could upgrade from “protecting websites” to “managing the economic relationship between agents and websites.”
Viewed alongside the AI hardware cycle, the Agentic Web is the second half of compute demand transmitting into the application layer. The first half is GPUs, ASICs, HBM, networking, and power building token-production capacity. The second half is enterprises and consumers consuming those tokens through agents and embedding agents into workflows. Cloudflare benefits from the second half: the cheaper tokens become, the more persistent agents become, and the more automated applications become, the more important access control across websites, APIs, and enterprise systems becomes.
But the Agentic Web also has three uncertainties. First, standards are not settled. Content authorization, micropayments, agent identity, and model access rules may be determined jointly by industry alliances, browsers, model companies, or regulators. Cloudflare may not be able to monopolize them. Second, the monetization path is not settled. A 1,700% increase in AI agent requests does not equal 1,700% revenue growth; much of the traffic may bring costs first. Third, customer budgets are not settled. Enterprises are willing to pay for security and access control, but how much they are willing to pay for agent verification and micropayments will still depend on concrete ROI.
Therefore, the Agentic Web should be treated as a long-term call option, not a short-term revenue item. The correct bullish statement is not “this business is already large,” but “Cloudflare is standing in one of the most likely positions to monetize it.” The correct bearish rebuttal is also not “this concept does not exist,” but “traffic growth is still separated from revenue and profit by three gates: productization, pricing, and standardization.”
VI. Capability Transfer: From CDN Efficiency to an AI-First Organization, Cloudflare Is Betting on the Same Engineering Culture
Cloudflare has been able to sustain high growth not because of a single hit product, but because it has continuously abstracted a global network into an expanding set of software products. First CDN and DDoS, then application security, then Zero Trust, then the developer platform. Each expansion has led outsiders to question whether it has entered another highly competitive new market, but its usual playbook is to reuse underlying network capabilities into cheaper, simpler, and more integrated products.
This capability transfer has a track record, but it also carries costs. The track record is an increasingly broad product portfolio and expanding cross-sell potential with large customers. The cost is pressure on gross margin and organizational complexity, because new products lack scale in the early stages, customer education costs are high, and sales motions become more complex. Cloudflare’s entry into the Agentic Web is essentially another application of the same capability-transfer logic: abstracting network, security, and developer-platform capabilities into infrastructure for the AI-agent era.
Management’s roughly 20% headcount reduction in 2026Q1, alongside its emphasis on an AI-first operating model, is the organizational version of this capability transfer. Cloudflare is not only selling AI to customers; it is also trying to AI-enable internal R&D;, sales, support, and management workflows. If execution succeeds, this helps explain why the company is willing to raise its long-term operating-margin target to 30%+, because the decline in expense ratios would come not from stopping innovation, but from higher automation and better sales efficiency.
One detail is especially worth watching: the layoffs were not described as cost cuts after weaker demand, but as an organizational restructuring for the next phase of growth, while preserving quota-carrying sales capacity. If sales capacity, pipeline, and large-deal growth remain strong over the next few quarters, the market will interpret this RIF as AI-first efficiency release. If large deals slow, customer support deteriorates, or product cadence is disrupted, the market will again worry that the company weakened its organizational muscle during its most complex phase of expansion.
Cloudflare One is an intermediate proof point for capability transfer. In 2025, Cloudflare One ARR grew 43%, above the companywide growth rate, showing that Cloudflare is not merely selling an add-on feature in enterprise security. After enterprises deploy AI, access control, data protection, application isolation, and cost management will become more important, and Zero Trust may become one prerequisite for launching AI applications. This opportunity is closer than Agentic Web, because enterprises already have budgets; those budgets are simply migrating from traditional networking and security appliances to unified cloud-security platforms.
The developer platform is proof of higher elasticity. In 2025, Developer ARR grew 137%, and the number of developers exceeded 5.5 million, showing that Cloudflare is no longer just an enterprise IT tool. The developer platform’s advantages are fast growth, a strong ecosystem, and entry into the AI-application build chain; its disadvantages are lower gross margin, high usage volatility, and many competitors. It is key to whether Cloudflare can be viewed as AI-application infrastructure, but it is also a source of gross-margin pressure.
So Cloudflare’s capability transfer is not risk-free expansion. Every time it enters a new layer, it must re-prove product depth, customer adoption, and profit quality. What investors are really buying is Cloudflare’s ability to continuously productize the same network, not treating every new product launch as an independent TAM addition.
VII. How to Judge Valuation: $305 Is Reasonable, but the “Narrative Multiple” and “Execution Multiple” Need to Be Separated
The valuation debate around Cloudflare can be split into two parts. The first is the narrative multiple, meaning how much long-term option value the market is willing to assign to Agentic Web, edge AI, and the developer platform. The second is the execution multiple, meaning whether revenue, RPO, DBNRR, gross margin, operating margin, and FCF can be delivered consistently. The $305 price target assigns relatively high weight to both.
Looking only at 2026 revenue and profit, Cloudflare is not cheap. After analyst day, Morgan Stanley estimated 2026E revenue of roughly $2.810 billion, 2027E revenue of roughly $3.575 billion, and 2028E revenue of roughly $4.504 billion; operating margin remains around 15% from 2026E to 2028E, with a real move toward 20%+ depending on operating leverage after 2027. On near-term sales multiples, it is hard to call the valuation low.
A more prudent valuation approach is to view $305 as a “platform-premium target in the base case,” not an unconditionally reasonable price. If Cloudflare maintains roughly 30% revenue growth over the next four quarters, Cloudflare One and Developer ARR continue to outgrow the company, gross margin stops breaking materially lower, and RPO and DBNRR stabilize, the market will accept 48x forward FCF. If these conditions loosen at the same time, the market will first cut the multiple, then ask when Agentic Web can monetize.
A common misunderstanding should be avoided here: investors should not dismiss the entire valuation just because Agentic Web is still early; nor should they linearly raise forward revenue because AI requests grew 1,700%. The more reasonable middle-ground judgment is that Agentic Web increases the probability that Cloudflare becomes a platform asset, but the near-term target price is still mainly determined by revenue growth, enterprise sales, developer ARR, gross margin, and FCF.
Compared with the AI hardware chain, Cloudflare’s valuation depends more on long-term discounted cash flow than on supply-demand gaps over the next two years. The hardware chain can be verified quickly through orders, capacity, pricing, and gross margin; Cloudflare’s verification cycle is longer, and much product adoption and ecosystem migration will not immediately become revenue. The benefit is that if platform status is established, growth duration will be longer; the drawback is that when market sentiment deteriorates, long-duration multiples are more fragile.
In an optimistic world, Cloudflare becomes the default control layer for AI agents accessing the internet, the developer platform continues 100%+ ARR growth for a period, Cloudflare One maintains growth above the companywide rate, the company enters Rule of 50 territory in 2027, and revenue and FCF both step up before 2030. In that world, the $405 bull case can hold.
In the base world, Cloudflare sustains roughly 30% revenue growth for several years, developers and Zero Trust contribute incremental growth, but Agentic Web commercializes more slowly, gross margin stabilizes in the 70-77% range, and operating margin gradually advances toward 20% and 30%. This world corresponds to $305.
In the bear world, AI traffic brings more network and compute costs, developer-platform competition intensifies, Vercel and cloud vendors capture more frontend and runtime mindshare, RPO, DBNRR, and large-deal growth slow, and gross margin stays below market expectations. In that world, the $175 bear case is not exaggerated, because the high multiple would compress first.
8. What to Watch Over the Next Four Quarters: Do Not Just Track the Stock Price; Track Developer ARR, Cloudflare One, and Gross Margin
The most important thing for Cloudflare from here is not telling more AI stories, but compressing the AI story into trackable numbers. Investors should divide the metrics into four groups: growth quality, platform adoption, margin trajectory, and Agentic Web productization. Only if all four improve together can the $305 target price move from a sell-side scenario to market consensus.
This table also helps assess whether pullbacks are buyable. If the stock pulls back only because high-valuation software broadly derates, while the indicators above have not deteriorated, Cloudflare remains an asset worth continuously tracking within AI software infrastructure. If a pullback comes with simultaneous weakness in RPO, DBNRR, gross margin, and Developer ARR, that is not valuation volatility; it is the platform story being disproved.
The most important thing to watch in the next earnings report is not a single revenue beat, but revenue quality. Revenue growth of 34% is no longer novel; the key is where the growth comes from. If growth mainly comes from low-margin developer usage while enterprise large deals, Cloudflare One, and RPO do not strengthen at the same time, the market will worry that Cloudflare is merely turning AI traffic into cost. If growth is jointly driven by Developer ARR, Cloudflare One, channels, and large customers, gross-margin pressure will be easier to accept.
The second focus is the gross-margin explanation. Management can say the gross-margin decline comes from free traffic converting to paid, the developer platform, and the AI product mix, but investors need to see unit economics improve. The best signal is stable gross margin while usage and ARR continue to grow; a weaker signal is that the faster usage grows, the lower gross margin goes, and operating-margin targets become increasingly dependent on layoffs and expense control.
The third focus is Agentic Web customer cases. A 1,700% increase in requests is an attractive number, but the market still needs more specific commercialization signals: whether content owners are willing to authorize agent access through Cloudflare, whether model companies are willing to plug into access rules, whether enterprises are willing to pay for agent governance, and whether developers use Cloudflare as the runtime for agent applications. Without these cases, Agentic Web is only valuation optionality; with them, it can start entering the model.
Cloudflare’s position in the AI chain is not as direct as hardware, but it is just as important. Hardware networking solves interconnection among machines; Cloudflare solves interconnection among applications, users, agents, and data. The bottlenecks for the former are bandwidth, power consumption, and switching; the bottlenecks for the latter are identity, permissions, cost, and business model. The more AI moves from training to applications, the more important this latter half becomes.
The final investment judgment can be compressed into one sentence: Cloudflare is one of the few software companies exposed simultaneously to AI application deployment, enterprise security migration, and the restructuring of internet traffic, but its valuation already requires management to turn the story into Rule of 50. A $305 target price is a reasonable upward revision direction, but it is not a free margin of safety. The real buying opportunity should appear when platform metrics keep improving while the market pulls back only because of multiple volatility; the real selling point should appear when Agentic Web traffic is hot, but RPO, DBNRR, gross margin, and FCF fail to follow.
9. Peer Comparison: Cloudflare Is Not the Purest AI Company or the Cheapest Software Company, but It Sits Closest to the Traffic Entry Point
The easiest way to misread Cloudflare is that it appears to touch a bit of everything. Compared with security software, it does not tell only an enterprise-security story like Zscaler or Palo Alto. Compared with developer platforms, it does not own front-end developer mindshare as clearly as Vercel. Compared with cloud providers, it lacks the full stack of models, databases, and GPU resources. Compared with traditional CDNs, it is obviously much more expensive. But precisely because of this, its peer set cannot be selected from only one basket.
A more reasonable comparison is to place Cloudflare on three axes. The first is the traffic entry point: who stands between users, websites, APIs, and applications. The second is the developer runtime: who can let engineers deploy next-generation AI applications with low friction. The third is enterprise governance: who can make CIOs and CISOs comfortable connecting agents, data, and applications. Cloudflare may not be number one on any single axis, but it is one of the few companies with a position on all three.
This comparison shows that Cloudflare’s excess returns will not come from “no competition.” Its excess returns come from the intersection of competition. If enterprises only need a security gateway, Zscaler and Palo Alto are very strong. If developers only need front-end hosting, Vercel is very strong. If customers only need models and databases, the cloud providers are very strong. Cloudflare’s opportunity lies in the moment when enterprises want to place external users, internal applications, AI agents, content access, and developer deployment into the same control plane. At that point, its network position becomes scarce.
This is also why Cloudflare’s valuation depends more on product integration than many software companies do. Winning with a single product is not enough; multiple products must pull each other forward. Workers brings developers. R2 and D1 improve application retention. Cloudflare One pulls in enterprise security budgets. Application services and CDN provide the traffic entry point. Agentic Web places future AI access rules on the same network. As long as this flywheel turns, customers can move from single-product procurement to platform procurement. If the flywheel fails to turn, Cloudflare will be broken up by the market into multiple highly competitive point markets.
The peer comparison also provides valuation discipline: Cloudflare should not receive unlimited multiple expansion simply because of “AI,” nor should it be discounted like a traditional CDN simply because gross margin is temporarily below 75%. Its fair valuation depends on whether the platform flywheel can be proven with numbers. If developers, Zero Trust, and Agentic Web all improve at the same time, Cloudflare is scarcer than single-category security software. If only traffic and developer usage grow, while enterprise ARR and margins do not keep up, the market will reclassify it as a combination of low-margin edge computing and highly competitive security software.
This is also important for trading cadence. Cloudflare’s share price often swings sharply because its valuation is high. An ordinary pullback is not itself a buying opportunity; a pullback with improving metrics is. An ordinary rally is not itself a sell signal either; a rally with deteriorating metrics is what becomes dangerous. To track this company, investors cannot look only at AI news and sell-side target prices. They must continuously keep Developer ARR, Cloudflare One ARR, RPO, DBNRR, gross margin, and FCF in the same table.
X. Investment Conclusion: Shift From “High-Multiple Security Software” to “AI Internet Control Plane,” but the Validation Window Is Now Open
The core of this deep update on Cloudflare is not that “Morgan Stanley raised its price target, so the stock should go up.” More importantly, Cloudflare’s asset identity is migrating: the old asset was high-growth cybersecurity and CDN; the new asset is an internet control plane built on the combination of developer platform, Zero Trust, and the Agentic Web. The market is willing to assign a $305 price target because the new asset has a longer growth runway and greater FCF potential.
What makes the company most compelling is that it already has three real pillars. First, 2026Q1 revenue grew roughly 34% YoY, while developer count, $1 million-plus deals, channel revenue, and large-customer metrics all improved simultaneously. Second, the analyst day laid out a long-term framework of Rule of 50, 30%+ operating margin, and 30-35%+ FCF margin. Third, Vercel Ship over the past week again confirmed that the AI agent era requires a new developer runtime and cost-optimization platform, and Cloudflare is positioned at the center of this migration.
The key risks are also threefold. First, gross margin is already under pressure from the mix of developer platform, free-to-paid traffic conversion, and edge compute; the company must prove future improvement in unit economics. Second, the marginal slowdown in RPO and DBNRR cannot persist, otherwise visibility into high growth will be questioned. Third, neither Vercel nor the cloud providers will easily cede the agent application runtime to Cloudflare; developer experience and ecosystem mindshare will become an even harsher competitive battleground than network node count.
Therefore, Cloudflare should be tracked through “validation-based holding” rather than “pure narrative-driven chasing.” Bulls must acknowledge that it is indeed expensive, but also recognize that it is one of the few software companies connecting AI applications, Zero Trust, developer platform, and internet traffic entry points. Bears must acknowledge that gross-margin and competitive risks are real, but they also cannot reduce it to an ordinary CDN company. The real disagreement between the two sides lies in the metrics over the next 4 to 8 quarters.
If Cloudflare can approach Rule of 50 with real numbers around 2027, $305 is only a transitional anchor for platform re-rating. If it can only tell an Agentic Web story but cannot convert traffic into high-quality ARR and FCF, its valuation will return to the constraints of traditional high-growth software. The investment question now is not whether Cloudflare has an AI story, but whether the company can turn its position as an AI internet entry point into sustainable revenue, profit, and cash flow.Cloudflare Deep-Dive Update: $305 Target Price, the Agentic Web, and How Rule of 50 Revalues an Edge AI Platform
目录
Too Long; Didn’t Read
I. What Cloudflare Actually Sells: It Is Moving from an Internet Edge Company to an AI Application Control Plane
II. Why Morgan Stanley Raised the Target Price to $305: Not an EPS Upgrade, but an FCF Multiple Re-rating
III. Vercel Ship Added a New Variable Last Week: Developer-Platform Competition Is Not Just About Cloud Vendors
IV. 1Q26 Has Already Proven Demand Is Strong, but Also Exposed Friction in Gross Margin, RPO, and DBNRR
V. Why the Agentic Web Could Be Valuable: Cloudflare Sits at the Intersection of Content, Models, Enterprises, and Developers
VI. Capability Transfer: From CDN Efficiency to an AI-First Organization, Cloudflare Is Betting on the Same Engineering Culture
VII. How to Judge Valuation: $305 Is Reasonable, but the “Narrative Multiple” and “Execution Multiple” Need to Be Separated
8. What to Watch Over the Next Four Quarters: Do Not Just Track the Stock Price; Track Developer ARR, Cloudflare One, and Gross Margin
9. Peer Comparison: Cloudflare Is Not the Purest AI Company or the Cheapest Software Company, but It Sits Closest to the Traffic Entry Point
X. Investment Conclusion: Shift From “High-Multiple Security Software” to “AI Internet Control Plane,” but the Validation Window Is Now Open
本内容基于公开资料和研报数据整理，不构成任何投资建议，不代表任何个人观点，仅供学习参考，请理性阅读
Cloudflare’s repricing is not just Morgan Stanley raising its target price to $305. It reflects the market starting to view the company less as a CDN and security vendor, and more as a combination of developer platform, Zero Trust, and Agentic Web control plane. The key test is whether AI traffic can drive both 30% growth and margin expansion.
Too Long; Didn’t Read
The target-price increase has an anchor. Morgan Stanley raised its Cloudflare target price from $245 to $305. The core change was not a small near-term EPS revision, but an increase in the valuation multiple from 38x 2034E FCF to 48x, while maintaining 2034E FCF per share at about $12.13. In other words, the sell side is underwriting longer growth durability and higher FCF certainty, not one quarter of revenue upside.
The company profile has changed. Cloudflare used to be viewed as a CDN, security, and networking services provider. It now looks more like a developer and security infrastructure platform sitting close to the internet entry point. It serves content delivery, application security, and Zero Trust, while also using developer products such as Workers, R2, D1, and Durable Objects to support AI agent applications. The valuation debate has shifted from “what multiple should security software get?” to “can an edge AI platform compound through the cycle?”
The Agentic Web is the new option. The key figures disclosed at Analyst Day were that AI agent requests on Cloudflare’s network grew 1,700% from June 1, 2025 to May 31, 2026, developer platform ARR grew 137% in 2025, and platform developers increased from about 3 million to more than 5.5 million. This option is still early, but it explains why the market is willing to revisit Cloudflare’s TAM and long-term margins.
Vercel makes the competition more real. Observations from Vercel Ship over the past week show that developer-platform competition comes not only from AWS, Azure, and Google Cloud, but also from platforms such as Vercel that sit closer to front-end workflows, dynamic web experiences, and agent deployment. Cloudflare’s advantages are its 300-plus edge locations, isolets architecture, and network-entry position. Its gaps remain developer experience, GPU operating complexity, and still-developing mindshare in dynamic applications.
Financial validation is not complete. 2026Q1 revenue was US$639.755mn, up about 34% YoY, with gross margin of about 71.2%, operating cash flow of US$158.33mn, and operating cash flow less capex of about US$93.099mn. Growth remains strong, but gross margin is below the prior long-term range of 75-77%, while RPO growth and DBNRR have also shown signs of slowing. This means Rule of 50 has not already been delivered; it still needs to be proven over the next four to eight quarters.
Four numbers matter. The most important question ahead is not whether the stock immediately catches up to $305, but whether developer product ARR, Cloudflare One ARR, new large enterprise customers, and gross-margin recovery can move together. If the company approaches 30% revenue growth and an operating margin of around 20% in 2027, the valuation upgrade can persist. If gross margin keeps falling while RPO and DBNRR weaken, the Agentic Web will first be treated by the market as an expensive narrative.
I. What Cloudflare Actually Sells: It Is Moving from an Internet Edge Company to an AI Application Control Plane
Cloudflare’s business used to be easy to understand: put customers’ websites, applications, and traffic in front of its global network, then provide content delivery, DDoS protection, application security, DNS, load balancing, and network performance optimization. That old profile is not wrong, but it is no longer enough. Today, Cloudflare looks more like a programmable network attached to the internet entry point. Customers are no longer just using it to accelerate pages; they are also running application deployment, security policies, API calls, data storage, and AI agent traffic on that network.
The company’s most distinctive asset is not one or two security products, nor the standalone number of CDN nodes, but its network position. At Analyst Day, Cloudflare management emphasized that the company sits at the entry point of more than 20% of internet traffic, while connecting content owners, enterprise customers, developers, and AI model providers. This position puts it closer to real traffic than traditional security software, and closer to the execution layer across clouds, applications, and endpoints than ordinary cloud vendors.
Cloudflare’s business can be divided into four layers. The first is application services and security, namely CDN, DDoS, firewall, Bot Management, API security, and application performance. The second is networking and Zero Trust, including Cloudflare One, SASE, remote access, browser isolation, data protection, and enterprise network replacement. The third is the developer platform, including Workers, Pages, R2, D1, Queues, and Durable Objects, which allow developers to build applications directly on Cloudflare’s network. The fourth is the Agentic Web, the new internet infrastructure that enables AI agents to be identified, authorized, monetized, protected, and orchestrated.
This framework explains why Cloudflare’s valuation has remained high. Viewed only as application security or CDN, it is hard to support a high long-term multiple. Viewed only as Zero Trust, it must compete with Zscaler, Palo Alto, CrowdStrike, Netskope, and others. Viewed only as a developer platform, it runs into Vercel, Netlify, DigitalOcean, AWS Lambda, Cloud Run, and edge-computing products. But if the four layers are stacked together, Cloudflare is not selling a point product. It is selling the control plane through which enterprises and developers connect applications to the internet, AI, and users.
Cloudflare’s real corporate characteristic is that the same network serves two groups of people. One group is CIOs, CISOs, and IT architecture teams, who buy security, access control, performance, and reliability. The other is developers, who buy deployment speed, serverless experience, low latency, storage, and invocation cost. Many software companies serve only one of these two groups. Cloudflare touches both. The benefit is significant cross-sell potential; the drawback is product complexity, a sales narrative that can easily become diffuse, and near-term financials that are harder to fully explain using traditional software metrics.
Once AI agents are placed into this framework, Cloudflare’s value becomes clearer. An agent is not an ordinary user, nor an ordinary API request. It repeatedly visits webpages, calls tools, reads data, executes tasks, moves across systems, and requires identity, permissions, auditability, billing, and abuse prevention. The traditional internet is “humans visiting pages.” The Agentic Web is “software agents accessing services.” This reconnects security, developer platforms, and network entry points.
The AI Cost Inflection Point Is Arriving: From Token Euphoria to On-Device Inference, Capital Is Reallocating Valuation Weight Across Compute, Software, and Hardware
This is also where Cloudflare differs from pure AI compute companies. Nvidia, Broadcom, Marvell Technology, TSMC, and the HBM supply chain sell hardware capability inside AI factories. Cloudflare sells network control among applications, users, agents, and models. Hardware companies benefit from training, inference, and network equipment upgrades. Cloudflare benefits from governance and deployment after AI traffic truly enters the application layer. It is not on the same layer as the “picks and shovels” vendors; it is the highway, toll booth, and security checkpoint after AI applications go live.
The main conclusion of this update is direct: Cloudflare should no longer be framed only as a CDN company or security software company. Its current valuation reflects the market pricing a composite asset of “edge network + Zero Trust + developer platform + Agentic Web option.” If this combination works, a $305 target price is not the endpoint. If it does not, the current high multiple will compress quickly.
II. Why Morgan Stanley Raised the Target Price to $305: Not an EPS Upgrade, but an FCF Multiple Re-rating
The key to Morgan Stanley’s target-price increase is not a major change in near-term EPS forecasts, but an upgraded valuation framework. The base-case target price, forward FCF, discount rate, and multiple changes are best viewed in one table: the real change is not near-term earnings, but the market’s willingness to assign Cloudflare a longer growth duration and greater platform scarcity.
This is a very clear “asset-quality re-rating.” If the market merely believed Cloudflare would sell a few more quarters of security products, it would not raise the forward FCF multiple by this much. The multiple increase means the sell side believes Cloudflare has a longer growth runway, a stronger platform position, and higher visibility into long-term cash flow from AI. The near-term model has not changed much; the long-term asset attributes have.
Why is Morgan Stanley willing to assign a higher multiple? The answer is the Rule of 50. Cloudflare has long talked about the Rule of 40, meaning the sum of revenue growth and operating margin reaches 40%. After analyst day, management raised the North Star metric to the Rule of 50 and laid out a path to achieving it in 2027 and exceeding it in 2028. This language is important because the long-running debate around Cloudflare has been: “Growth is attractive, but when will margins be released like a mature software company?” Now the company has committed to growth and margin within the same framework.
The math behind the Rule of 50 is simple: revenue growth cannot fall materially behind, operating margin must continue to rise, and FCF must keep pace. Management has moved the long-term margin framework higher overall, effectively telling the market that although developer platforms and AI traffic may pressure gross margin in the short term, they will not destroy the long-term profit structure of a software company.
The easiest point to miss in this framework is the relaxed gross-margin target. Cloudflare’s prior long-term gross-margin target was 75-77%; it is now 70-77%. On the surface, that looks negative, because the developer platform, edge AI, and agent traffic will bring more network, compute, and storage costs. But management also raised the operating-margin and FCF-margin targets, indicating that the company is shifting the focus of margin expansion from “gross margin stays high forever” to “revenue scale, sales efficiency, R&D; efficiency, and G&A; leverage are released together.”
That is also why the $305 target price cannot simply be interpreted as “Morgan Stanley is more bullish.” The real debate is whether lower-gross-margin developer products and AI traffic represent declining pricing power, or a modest gross-margin sacrifice in exchange for a larger TAM. If it is the former, the high multiple is dangerous. If it is the latter, operating margin may still recover through scale effects, and a wider gross-margin range is simply what a growth platform looks like as it enters its next phase.
Viewed within the AI infrastructure chain, Cloudflare’s valuation logic has some similarities with hardware leaders: both are moving from single-product suppliers to platform infrastructure companies. The difference is that hardware platforms are constrained by chips, packaging, networking, and power, while Cloudflare is constrained by developer adoption, network efficiency, sales execution, and enterprise security budgets. Morgan Stanley’s multiple increase is essentially a bet that Cloudflare can convert those constraints into new pricing power.
The base-case implied requirements are not low. Revenue of about $15.6 billion and FCF of about $5.1 billion in 2034 imply that, starting from $2.167937 billion of revenue in 2025, Cloudflare must sustain a very high compound growth rate for nearly another decade while lifting FCF margin to around 30%. If Cloudflare is merely a mature CDN company, this model is obviously too expensive. Only if it becomes the internet control plane for the AI-agent era does this model have valuation room.
III. Vercel Ship Added a New Variable Last Week: Developer-Platform Competition Is Not Just About Cloud Vendors
The most important thing to watch over the past week was not another Cloudflare product release, but the competitive benchmark created by Vercel Ship. In its Vercel Ship observations, Goldman Sachs analyzed Cloudflare, DigitalOcean, Shopify, Okta, and Salesforce together, with a clear conclusion: agent applications will reconnect developer platforms, identity, front end, runtime, hosting, and cost optimization. Cloudflare is a beneficiary, but it does not lack competitors.
Vercel’s value proposition is different from Cloudflare’s. Vercel enters through front-end development, Next.js, deployment experience, and the dynamic web, emphasizing faster application building, deployment, and iteration for engineers. Cloudflare enters through its global network, edge nodes, security, and low-cost runtime, emphasizing code execution, application protection, and traffic orchestration at the internet entry point. One is more oriented toward the software layer and developer workflow; the other is more oriented toward network architecture and a globally distributed platform.
One important Vercel argument is that a developer compute platform does not necessarily need to be distributed across 300+ nodes to deliver strong performance and economics. It believes roughly 20 high-density nodes can cover low-millisecond latency needs for 90% of the world’s population. This is a very practical reminder for Cloudflare: the number of edge nodes is not an absolute moat. The real moat is the products on those nodes, developer experience, cost curve, reliability, and ecosystem integration.
Cloudflare is not without a response. Its isolets architecture was designed precisely for a high-density, low-overhead, multi-tenant isolated edge runtime. The Workers ecosystem has been operating for years. R2 bypasses traditional object-storage egress costs, Durable Objects solves state, and D1 provides an edge database. The question is not whether Cloudflare has products, but whether developers are willing to place more complex, more dynamic, more stateful agent applications on Cloudflare, rather than continuing to choose Vercel, AWS, Google Cloud, or internal platforms.
That is the value of Vercel Ship. It pushes Cloudflare’s competition from “faster and safer than traditional CDNs” to “who can become the default deployment platform for next-generation AI applications.” On this question, Cloudflare has the network entry point and security control, Vercel has front-end workflow and developer mindshare, and cloud vendors have GPUs, models, databases, and enterprise contracts. Over the next few years, what will really matter is not whose slogan sounds more like AI, but who can build the most balanced product across cost, latency, state management, security, and developer experience.
Vercel Ship also delivered an important cost signal. Enterprises are managing token and compute spending more granularly, rather than looking only at model quality. Goldman Sachs noted that some enterprises can see major cost reductions after a few weeks of optimization, while Vercel’s Fluid Compute reduces the cost of long-running, stateful agent workloads by charging only for active execution. Cloudflare’s opportunity is here: if it can prove Workers and edge runtimes are faster, cheaper, and safer for agent applications at the same time, developer-platform growth will be not just an “AI concept,” but an actual budget migration.
But the competitive pressure must also be stated clearly. Vercel is closer to modern front-end and product teams. Many enterprise agent entry points will ultimately be websites, apps, workbenches, customer-service interfaces, and e-commerce interfaces, not network-layer consoles. If Cloudflare cannot package its underlying network advantages into a sufficiently smooth developer experience, its advantages will remain at the infrastructure layer and cannot be fully converted into application-layer share.
This is also why Cloudflare’s valuation is not a low-risk re-rating. The more important the developer platform becomes, the more open the competition becomes. The larger the Agentic Web becomes, the more uncertain the standards become. The faster AI traffic grows, the more easily the market can amplify gross-margin and CapEx pressure. Vercel Ship makes the Cloudflare story more credible, but it also gives the market a more specific view of the competitors.
IV. 1Q26 Has Already Proven Demand Is Strong, but Also Exposed Friction in Gross Margin, RPO, and DBNRR
Cloudflare’s 1Q26 gave bulls plenty of good news. Official disclosures confirmed that revenue maintained high growth, gross profit and operating cash flow still supported platform expansion, and operating cash flow after capital expenditures was also positive. The specific numbers are clearer in table form: this is no longer a company that only burns cash to buy growth, but it is still some distance from the profit structure of a mature software company.
The more important part is the operating metrics. Morgan Stanley emphasized in its earnings report that developers, large customers, channels, and agent requests all delivered positive signals in the same quarter. This multi-line resonance matters more than a simple revenue beat, because it shows Cloudflare is moving from single-product selling toward platform expansion.
This set of numbers explains why the market is willing to listen to the Rule of 50 narrative. Cloudflare is not trading price cuts for growth, nor is it relying only on small customers to lift revenue. Large customers, channels, developers, agent traffic, and security products all delivered positive signals in the same quarter. This multi-line resonance is a typical signal that a software company is moving from product-led growth to platform-led growth.
But 1Q26 was not perfect. The biggest issue was gross margin. The company’s gross margin declined, partly because related network costs moved from sales expense to cost of revenue after free traffic converted into paid traffic, and partly because the developer platform, edge computing, and new products carry lower gross margins than the mature security business. Management emphasized that unit economics are still improving, but in the short term the market will see gross margin decline before it sees long-term scale effects.
The second issue was RPO. Morgan Stanley noted that total RPO in 1Q26 was $2.5435 billion, up 36% YoY, below market expectations of close to 39%, and down from 48% YoY growth in 4Q25. Current RPO grew 34% YoY, broadly in line with expectations. This number is not bad, but for a high-multiple software company, slower RPO growth will make the market question large deals and future revenue visibility.
The third issue was DBNRR. 1Q26 DBNRR was 118%, down 2 percentage points from 120% in the prior quarter, but up 7 percentage points YoY. Management explained that accelerated new-customer bookings temporarily diluted cohort metrics, while gross retention reached a four-year high. This explanation makes sense, but investors still need to see whether net retention stabilizes again around 120%. The biggest risk for a platform company is strong new-customer growth alongside slowing expansion from existing customers.
The 20% workforce reduction also needs to be viewed from both sides. Management framed it as a migration toward an AI-first operating model, with internal AI usage growing more than 600% over three months, while retaining and even planning to increase quota-carrying sales capacity. If executed smoothly, this would significantly improve sales, R&D;, and back-office efficiency, and would form part of the Rule of 50 case. If execution is poor, layoffs could hurt product cadence, customer service, and organizational culture, especially because Cloudflare is in the middle of multi-product-line expansion.
This is Cloudflare’s most important financial question today: it needs to prove three things at the same time. First, revenue growth can remain close to 30%. Second, the short-term gross margin decline will not undermine long-term 30%+ operating margins. Third, the developer platform and AI traffic are not only bringing usage, but also high-quality ARR, RPO, and FCF. Proving only one of these is not enough to support 48x forward FCF.
V. Why the Agentic Web Could Be Valuable: Cloudflare Sits at the Intersection of Content, Models, Enterprises, and Developers
The Agentic Web sounds abstract, but the problem it addresses is very real. Today, large models and agents are increasingly accessing webpages, calling APIs, scraping content, executing transactions, filling out forms, reading databases, and triggering workflows. The old internet assumed the visitor was human, and security and business models were designed around humans. The new internet will have a large volume of software agents that need identity, permissions, rate limits, payment, auditability, and content authorization.
Cloudflare’s position here is unusual. Content owners worry that model companies scrape content without compensation. Model companies need reliable access to the internet. Enterprises need to allow agents to access internal applications without losing control. Developers need to deploy agent applications at lower cost and lower latency. If Cloudflare can become the middle layer, it can sell services simultaneously to content owners, enterprises, developers, and model companies.
This opportunity is still early and should not be treated as revenue that has already materialized. But it is enough to change the valuation language. In the past, when Cloudflare talked about TAM, the market would ask how the company would divide the pie with Akamai, Fastly, security software vendors, and cloud providers. Now, when it talks about the Agentic Web, the market starts asking whether it can become a new internet control plane for the AI era. This is a shift from “share of an existing market” to “rules of a new market.”
Morgan Stanley noted after the analyst day that Cloudflare’s 2026 addressable market is about $238 billion, and is expected to grow at a 17% CAGR to $384 billion by 2029. That estimate does not yet fully include Act 4 opportunities such as the Agentic Web. TAM numbers themselves should not be accepted mechanically, but they show that management has continued to push the company’s boundaries from application services, cybersecurity, and developer services into content authorization, agent verification, and internet business models.
Cloudflare’s advantage is not that it can define a new protocol on its own, but that it is already on the path of real traffic. Many internet companies do not have enough incentive to build complex agent identification, access authorization, and settlement systems themselves. Many model companies also do not want to negotiate access rules individually with every content owner. If Cloudflare can provide an executable, auditable, monetizable middle layer, it could upgrade from “protecting websites” to “managing the economic relationship between agents and websites.”
Viewed alongside the AI hardware cycle, the Agentic Web is the second half of compute demand transmitting into the application layer. The first half is GPUs, ASICs, HBM, networking, and power building token-production capacity. The second half is enterprises and consumers consuming those tokens through agents and embedding agents into workflows. Cloudflare benefits from the second half: the cheaper tokens become, the more persistent agents become, and the more automated applications become, the more important access control across websites, APIs, and enterprise systems becomes.
But the Agentic Web also has three uncertainties. First, standards are not settled. Content authorization, micropayments, agent identity, and model access rules may be determined jointly by industry alliances, browsers, model companies, or regulators. Cloudflare may not be able to monopolize them. Second, the monetization path is not settled. A 1,700% increase in AI agent requests does not equal 1,700% revenue growth; much of the traffic may bring costs first. Third, customer budgets are not settled. Enterprises are willing to pay for security and access control, but how much they are willing to pay for agent verification and micropayments will still depend on concrete ROI.
Therefore, the Agentic Web should be treated as a long-term call option, not a short-term revenue item. The correct bullish statement is not “this business is already large,” but “Cloudflare is standing in one of the most likely positions to monetize it.” The correct bearish rebuttal is also not “this concept does not exist,” but “traffic growth is still separated from revenue and profit by three gates: productization, pricing, and standardization.”
VI. Capability Transfer: From CDN Efficiency to an AI-First Organization, Cloudflare Is Betting on the Same Engineering Culture
Cloudflare has been able to sustain high growth not because of a single hit product, but because it has continuously abstracted a global network into an expanding set of software products. First CDN and DDoS, then application security, then Zero Trust, then the developer platform. Each expansion has led outsiders to question whether it has entered another highly competitive new market, but its usual playbook is to reuse underlying network capabilities into cheaper, simpler, and more integrated products.
This capability transfer has a track record, but it also carries costs. The track record is an increasingly broad product portfolio and expanding cross-sell potential with large customers. The cost is pressure on gross margin and organizational complexity, because new products lack scale in the early stages, customer education costs are high, and sales motions become more complex. Cloudflare’s entry into the Agentic Web is essentially another application of the same capability-transfer logic: abstracting network, security, and developer-platform capabilities into infrastructure for the AI-agent era.
Management’s roughly 20% headcount reduction in 2026Q1, alongside its emphasis on an AI-first operating model, is the organizational version of this capability transfer. Cloudflare is not only selling AI to customers; it is also trying to AI-enable internal R&D;, sales, support, and management workflows. If execution succeeds, this helps explain why the company is willing to raise its long-term operating-margin target to 30%+, because the decline in expense ratios would come not from stopping innovation, but from higher automation and better sales efficiency.
One detail is especially worth watching: the layoffs were not described as cost cuts after weaker demand, but as an organizational restructuring for the next phase of growth, while preserving quota-carrying sales capacity. If sales capacity, pipeline, and large-deal growth remain strong over the next few quarters, the market will interpret this RIF as AI-first efficiency release. If large deals slow, customer support deteriorates, or product cadence is disrupted, the market will again worry that the company weakened its organizational muscle during its most complex phase of expansion.
Cloudflare One is an intermediate proof point for capability transfer. In 2025, Cloudflare One ARR grew 43%, above the companywide growth rate, showing that Cloudflare is not merely selling an add-on feature in enterprise security. After enterprises deploy AI, access control, data protection, application isolation, and cost management will become more important, and Zero Trust may become one prerequisite for launching AI applications. This opportunity is closer than Agentic Web, because enterprises already have budgets; those budgets are simply migrating from traditional networking and security appliances to unified cloud-security platforms.
The developer platform is proof of higher elasticity. In 2025, Developer ARR grew 137%, and the number of developers exceeded 5.5 million, showing that Cloudflare is no longer just an enterprise IT tool. The developer platform’s advantages are fast growth, a strong ecosystem, and entry into the AI-application build chain; its disadvantages are lower gross margin, high usage volatility, and many competitors. It is key to whether Cloudflare can be viewed as AI-application infrastructure, but it is also a source of gross-margin pressure.
So Cloudflare’s capability transfer is not risk-free expansion. Every time it enters a new layer, it must re-prove product depth, customer adoption, and profit quality. What investors are really buying is Cloudflare’s ability to continuously productize the same network, not treating every new product launch as an independent TAM addition.
VII. How to Judge Valuation: $305 Is Reasonable, but the “Narrative Multiple” and “Execution Multiple” Need to Be Separated
The valuation debate around Cloudflare can be split into two parts. The first is the narrative multiple, meaning how much long-term option value the market is willing to assign to Agentic Web, edge AI, and the developer platform. The second is the execution multiple, meaning whether revenue, RPO, DBNRR, gross margin, operating margin, and FCF can be delivered consistently. The $305 price target assigns relatively high weight to both.
Looking only at 2026 revenue and profit, Cloudflare is not cheap. After analyst day, Morgan Stanley estimated 2026E revenue of roughly $2.810 billion, 2027E revenue of roughly $3.575 billion, and 2028E revenue of roughly $4.504 billion; operating margin remains around 15% from 2026E to 2028E, with a real move toward 20%+ depending on operating leverage after 2027. On near-term sales multiples, it is hard to call the valuation low.
A more prudent valuation approach is to view $305 as a “platform-premium target in the base case,” not an unconditionally reasonable price. If Cloudflare maintains roughly 30% revenue growth over the next four quarters, Cloudflare One and Developer ARR continue to outgrow the company, gross margin stops breaking materially lower, and RPO and DBNRR stabilize, the market will accept 48x forward FCF. If these conditions loosen at the same time, the market will first cut the multiple, then ask when Agentic Web can monetize.
A common misunderstanding should be avoided here: investors should not dismiss the entire valuation just because Agentic Web is still early; nor should they linearly raise forward revenue because AI requests grew 1,700%. The more reasonable middle-ground judgment is that Agentic Web increases the probability that Cloudflare becomes a platform asset, but the near-term target price is still mainly determined by revenue growth, enterprise sales, developer ARR, gross margin, and FCF.
Compared with the AI hardware chain, Cloudflare’s valuation depends more on long-term discounted cash flow than on supply-demand gaps over the next two years. The hardware chain can be verified quickly through orders, capacity, pricing, and gross margin; Cloudflare’s verification cycle is longer, and much product adoption and ecosystem migration will not immediately become revenue. The benefit is that if platform status is established, growth duration will be longer; the drawback is that when market sentiment deteriorates, long-duration multiples are more fragile.
In an optimistic world, Cloudflare becomes the default control layer for AI agents accessing the internet, the developer platform continues 100%+ ARR growth for a period, Cloudflare One maintains growth above the companywide rate, the company enters Rule of 50 territory in 2027, and revenue and FCF both step up before 2030. In that world, the $405 bull case can hold.
In the base world, Cloudflare sustains roughly 30% revenue growth for several years, developers and Zero Trust contribute incremental growth, but Agentic Web commercializes more slowly, gross margin stabilizes in the 70-77% range, and operating margin gradually advances toward 20% and 30%. This world corresponds to $305.
In the bear world, AI traffic brings more network and compute costs, developer-platform competition intensifies, Vercel and cloud vendors capture more frontend and runtime mindshare, RPO, DBNRR, and large-deal growth slow, and gross margin stays below market expectations. In that world, the $175 bear case is not exaggerated, because the high multiple would compress first.
8. What to Watch Over the Next Four Quarters: Do Not Just Track the Stock Price; Track Developer ARR, Cloudflare One, and Gross Margin
The most important thing for Cloudflare from here is not telling more AI stories, but compressing the AI story into trackable numbers. Investors should divide the metrics into four groups: growth quality, platform adoption, margin trajectory, and Agentic Web productization. Only if all four improve together can the $305 target price move from a sell-side scenario to market consensus.
This table also helps assess whether pullbacks are buyable. If the stock pulls back only because high-valuation software broadly derates, while the indicators above have not deteriorated, Cloudflare remains an asset worth continuously tracking within AI software infrastructure. If a pullback comes with simultaneous weakness in RPO, DBNRR, gross margin, and Developer ARR, that is not valuation volatility; it is the platform story being disproved.
The most important thing to watch in the next earnings report is not a single revenue beat, but revenue quality. Revenue growth of 34% is no longer novel; the key is where the growth comes from. If growth mainly comes from low-margin developer usage while enterprise large deals, Cloudflare One, and RPO do not strengthen at the same time, the market will worry that Cloudflare is merely turning AI traffic into cost. If growth is jointly driven by Developer ARR, Cloudflare One, channels, and large customers, gross-margin pressure will be easier to accept.
The second focus is the gross-margin explanation. Management can say the gross-margin decline comes from free traffic converting to paid, the developer platform, and the AI product mix, but investors need to see unit economics improve. The best signal is stable gross margin while usage and ARR continue to grow; a weaker signal is that the faster usage grows, the lower gross margin goes, and operating-margin targets become increasingly dependent on layoffs and expense control.
The third focus is Agentic Web customer cases. A 1,700% increase in requests is an attractive number, but the market still needs more specific commercialization signals: whether content owners are willing to authorize agent access through Cloudflare, whether model companies are willing to plug into access rules, whether enterprises are willing to pay for agent governance, and whether developers use Cloudflare as the runtime for agent applications. Without these cases, Agentic Web is only valuation optionality; with them, it can start entering the model.
Cloudflare’s position in the AI chain is not as direct as hardware, but it is just as important. Hardware networking solves interconnection among machines; Cloudflare solves interconnection among applications, users, agents, and data. The bottlenecks for the former are bandwidth, power consumption, and switching; the bottlenecks for the latter are identity, permissions, cost, and business model. The more AI moves from training to applications, the more important this latter half becomes.
The final investment judgment can be compressed into one sentence: Cloudflare is one of the few software companies exposed simultaneously to AI application deployment, enterprise security migration, and the restructuring of internet traffic, but its valuation already requires management to turn the story into Rule of 50. A $305 target price is a reasonable upward revision direction, but it is not a free margin of safety. The real buying opportunity should appear when platform metrics keep improving while the market pulls back only because of multiple volatility; the real selling point should appear when Agentic Web traffic is hot, but RPO, DBNRR, gross margin, and FCF fail to follow.
9. Peer Comparison: Cloudflare Is Not the Purest AI Company or the Cheapest Software Company, but It Sits Closest to the Traffic Entry Point
The easiest way to misread Cloudflare is that it appears to touch a bit of everything. Compared with security software, it does not tell only an enterprise-security story like Zscaler or Palo Alto. Compared with developer platforms, it does not own front-end developer mindshare as clearly as Vercel. Compared with cloud providers, it lacks the full stack of models, databases, and GPU resources. Compared with traditional CDNs, it is obviously much more expensive. But precisely because of this, its peer set cannot be selected from only one basket.
A more reasonable comparison is to place Cloudflare on three axes. The first is the traffic entry point: who stands between users, websites, APIs, and applications. The second is the developer runtime: who can let engineers deploy next-generation AI applications with low friction. The third is enterprise governance: who can make CIOs and CISOs comfortable connecting agents, data, and applications. Cloudflare may not be number one on any single axis, but it is one of the few companies with a position on all three.
This comparison shows that Cloudflare’s excess returns will not come from “no competition.” Its excess returns come from the intersection of competition. If enterprises only need a security gateway, Zscaler and Palo Alto are very strong. If developers only need front-end hosting, Vercel is very strong. If customers only need models and databases, the cloud providers are very strong. Cloudflare’s opportunity lies in the moment when enterprises want to place external users, internal applications, AI agents, content access, and developer deployment into the same control plane. At that point, its network position becomes scarce.
This is also why Cloudflare’s valuation depends more on product integration than many software companies do. Winning with a single product is not enough; multiple products must pull each other forward. Workers brings developers. R2 and D1 improve application retention. Cloudflare One pulls in enterprise security budgets. Application services and CDN provide the traffic entry point. Agentic Web places future AI access rules on the same network. As long as this flywheel turns, customers can move from single-product procurement to platform procurement. If the flywheel fails to turn, Cloudflare will be broken up by the market into multiple highly competitive point markets.
The peer comparison also provides valuation discipline: Cloudflare should not receive unlimited multiple expansion simply because of “AI,” nor should it be discounted like a traditional CDN simply because gross margin is temporarily below 75%. Its fair valuation depends on whether the platform flywheel can be proven with numbers. If developers, Zero Trust, and Agentic Web all improve at the same time, Cloudflare is scarcer than single-category security software. If only traffic and developer usage grow, while enterprise ARR and margins do not keep up, the market will reclassify it as a combination of low-margin edge computing and highly competitive security software.
This is also important for trading cadence. Cloudflare’s share price often swings sharply because its valuation is high. An ordinary pullback is not itself a buying opportunity; a pullback with improving metrics is. An ordinary rally is not itself a sell signal either; a rally with deteriorating metrics is what becomes dangerous. To track this company, investors cannot look only at AI news and sell-side target prices. They must continuously keep Developer ARR, Cloudflare One ARR, RPO, DBNRR, gross margin, and FCF in the same table.
X. Investment Conclusion: Shift From “High-Multiple Security Software” to “AI Internet Control Plane,” but the Validation Window Is Now Open
The core of this deep update on Cloudflare is not that “Morgan Stanley raised its price target, so the stock should go up.” More importantly, Cloudflare’s asset identity is migrating: the old asset was high-growth cybersecurity and CDN; the new asset is an internet control plane built on the combination of developer platform, Zero Trust, and the Agentic Web. The market is willing to assign a $305 price target because the new asset has a longer growth runway and greater FCF potential.
What makes the company most compelling is that it already has three real pillars. First, 2026Q1 revenue grew roughly 34% YoY, while developer count, $1 million-plus deals, channel revenue, and large-customer metrics all improved simultaneously. Second, the analyst day laid out a long-term framework of Rule of 50, 30%+ operating margin, and 30-35%+ FCF margin. Third, Vercel Ship over the past week again confirmed that the AI agent era requires a new developer runtime and cost-optimization platform, and Cloudflare is positioned at the center of this migration.
The key risks are also threefold. First, gross margin is already under pressure from the mix of developer platform, free-to-paid traffic conversion, and edge compute; the company must prove future improvement in unit economics. Second, the marginal slowdown in RPO and DBNRR cannot persist, otherwise visibility into high growth will be questioned. Third, neither Vercel nor the cloud providers will easily cede the agent application runtime to Cloudflare; developer experience and ecosystem mindshare will become an even harsher competitive battleground than network node count.
Therefore, Cloudflare should be tracked through “validation-based holding” rather than “pure narrative-driven chasing.” Bulls must acknowledge that it is indeed expensive, but also recognize that it is one of the few software companies connecting AI applications, Zero Trust, developer platform, and internet traffic entry points. Bears must acknowledge that gross-margin and competitive risks are real, but they also cannot reduce it to an ordinary CDN company. The real disagreement between the two sides lies in the metrics over the next 4 to 8 quarters.
If Cloudflare can approach Rule of 50 with real numbers around 2027, $305 is only a transitional anchor for platform re-rating. If it can only tell an Agentic Web story but cannot convert traffic into high-quality ARR and FCF, its valuation will return to the constraints of traditional high-growth software. The investment question now is not whether Cloudflare has an AI story, but whether the company can turn its position as an AI internet entry point into sustainable revenue, profit, and cash flow.