Good day, everyone, and welcome to the Cloudflare Q3 2022 earnings call. At this time, I would like to hand the call over to Mr. Jayson Noland. Please go ahead, sir.
Thank you for joining us to discuss Cloudflare's financial results for the third quarter, 2022. With me on the call we have Matthew Prince, Co-founder and CEO, Michelle Zatlyn, Co-founder, President, and COO, and Thomas Seifert, CFO. By now, everyone should have access to our earnings announcement. This announcement, as well as our supplemental financial information, may be found on our investor relations website. As a reminder, we'll be making forward-looking statements during today's discussion, including, but not limited to, our customers, vendors, and partners' operations and future financial performance, anticipated product launches, and the timing and market potential of those products, the company's anticipated future revenue, financial performance, operating performance, non-GAAP gross margin, non-GAAP net income or loss, non-GAAP net income or loss per share, shares outstanding, non-GAAP operating expenses, free cash flow, non-GAAP tax expense, dollar-based net retention rate, paying customers, and large customers.
These statements and other comments are not guarantees of future performance, but rather are subject to risks and uncertainty, some of which are beyond our control, including, but not limited to, challenging general economic conditions, including foreign exchange, inflation, rising interest rates, and other impacts of the ongoing COVID-19 pandemic and Russia/Ukraine conflict. Our actual results may differ significantly from those projected or suggested in any forward-looking statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future. We undertake no obligation to update these statements after this call. For a more complete discussion of the risks and uncertainties that could impact our future operating results and financial condition, please see our filings with the Securities and Exchange Commission, as well as in today's earnings press release.
Unless otherwise noted, all numbers we talk about today other than revenue will be on an adjusted non-GAAP basis. All current and prior period financials discussed are reflected under ASC 606. You may find a reconciliation of GAAP to non-GAAP financial measures in our earnings release on our investor relations website. For historical periods, a GAAP to non-GAAP reconciliation can be found in the supplemental financial information referenced a few moments ago. We would also like to inform you that we will be participating in the RBC Capital Markets Global Technology Internet, Media, and Telecommunications Conference on November 16th, and the Credit Suisse 26th Annual Technology Conference on November 30th. Now, I'd like to turn the call over to Matthew.
Thank you, Jayson. We had a strong quarter, even as the economic environment has continued to be challenging. We generated $254 million in revenue, up 47% year-over-year. Unsurprisingly, the slowdown in the economy we discussed on the last two earnings calls is starting to show up on our top-line revenue numbers. Even with those economic headwinds, this quarter marked a milestone for us, crossing through $1 billion in annualized revenue. Only 6% of public software companies achieve this milestone, so we're proud to have crossed it, but nowhere close to finished. We added 4,197 paying customers, for a total of 156,000 paying customers.
For large customers, those that pay us more than $100,000 per year, we added 159 new large customers, for a total of 1,908, up 51% year-over-year. Large customers now account for 61% of revenue, and our large customers keep getting larger. The number of customers over $500,000 in annual spend grew 88% year-over-year, and customers over $1 million grew 63% year-over-year. Even with inflation hitting some of our costs, our gross margin held strong at 78.1%, still above our target gross margin range of 75% to 77%. We achieved a record operating profit of $14.8 million, representing an operating margin of 5.8%.
We are confident we can deliver meaningful operating margins over time, but continue to plan to hold them near breakeven as long as we're able to deliver exceptional revenue growth. Our Dollar-Based Net Retention in the quarter was 124%, flat year-over-year and down from 126% last quarter. While there is some noise in that number based on when contracts renew, we will continue to be dissatisfied until it's over 130%, and we believe that it's still very achievable as we add seats and storage-based products like Zero Trust and R2. We are proud to have crossed through $1 billion in annualized revenue, but it has us thinking about our next milestones.
While there are economic challenges for every business in the near term, we know that the opportunity Cloudflare has ahead to the long term is massive. Even as we achieve $1 billion, we have penetrated less than 1% of our identified market for products we already have available today. That's why we're confident we're on the path to organically achieve $5 billion in annualized revenue over the next five years. Less than 1% of all public software companies reach the $5 billion milestone. While today's global economy will continue to present headwinds in quarters ahead, as we look further out, we are confident we have the products already in market to get us there. Crossing the $1 billion milestone is also an opportunity to reflect on our team.
It's a natural, normal process to have different leaders for different stages in a company's life. Earlier this year, Chris Merritt, who runs our sales team, reached out to me and Michelle to say that while he wasn't in a hurry, he thought it made sense for someone else to take us to the next milestone past $1 billion. Chris himself is a unicorn. He started at Cloudflare almost 10 years ago as our first sales hire. He grew our revenue from zero to $1 billion. I've tried to count the number of sales leaders who accomplish that and have come up with fewer than 10 across all the history of software. I wanted to give Chris the floor for a second to recognize him and all he's accomplished and helped us build at Cloudflare.
Thanks, Matthew. I remember meeting with Michelle all the way back in 2013 as Cloudflare was looking for someone to build its sales organization. It was very clear from that very first meeting that the opportunity Cloudflare had was just incredible. Fast-forward to present day, and I'm so proud of the team we've built that brings Cloudflare's products to market to solve real problems for our customers. It is a truly world-class organization doing amazing work. As Matthew said, I had a terrific run, and I decided the billion-dollar mark was the right time for me to transition out and bring in another leader for the next phase of Cloudflare's growth. I worked closely with the team to help identify the great leader we found to do that, and I'll continue to be involved to help with a smooth transition through at least the end of the year.
What a great 10-year journey it's been, and I'll always bleed the Cloudflare orange. Back to you, Matthew.
Thanks, Chris. We couldn't have gotten here without you. As Chris said, he worked closely with us over the last several months to identify the right person to lead our sales team going forward. The person we found is terrific. He understands enterprise sales from his time as a senior leader at Oracle, can help accelerate our Zero Trust go-to-market based on his experience in the identity and access management space, rocks the desires of developers as we turn Workers into a massive business, and recently led sales for Twilio, another software as a service company, which grew more than 50% organically compounded during his tenure to a $4 billion annualized run rate. Marc Boroditsky is uniquely qualified to take us to our next milestone and beyond. I wanted to give him the floor to talk a bit about why he joined Cloudflare.
Thank you, Matthew. I've been on the team now for a little over a week, and I couldn't be more thrilled. I was very fortunate to attend Cloudflare's recent customer day in San Francisco. In all my years at similar events, I've never seen more engaged customers of all types who are eager to do more with us as a strategic partner. Let me tell you what's especially compelling about Cloudflare is the breadth of solutions that are a part of our platform today. We don't need to go out and buy companies. We don't need to invent new technologies. I see a clear path to $5 billion in five years simply by selling what we already have in the bag to the customers that already know us. That's an incredible opportunity and what compelled me to join the Cloudflare team. Back to you, Matthew.
Thanks, Marc. We are excited for you to build on the great team Chris has put in place and further mature our go-to-market efforts as we sell more products to larger and larger customers. With that set up, let me tell you about some customer wins last quarter. A Fortune 500 technology financial services company signed a one-year, $2.8 million contract. They faced an increasing number of sophisticated cyberattacks. They compared us against nearly all of our competitors. While the competitors tried to offer lower pricing, it didn't matter. This company was so convinced that we were the clear technical leader that they paid a premium for our services. They see the value of our integrated approach and are now evaluating us to be their Zero Trust provider as well. A Fortune 500 pharmaceutical company expanded their relationship with Cloudflare.
They signed an additional $915,000 three-year deal, bringing their total contract over that period with us to $7.4 million. They're adopting our Data Localization Suite powered by Cloudflare Workers. This product allows customers to process data locally in the countries where their customers reside. These features are unique in the industry to Cloudflare and increasingly important to highly regulated customers like this one. A Fortune 500 European telecom signed a three-year, $1.2 million deal. The customer was moving more of their security services from on-premise hardware to the cloud. While they evaluated our security services as best of breed, the showstopper for them, again, was our Data Localization Suite. None of the other vendors they considered, including the hyperscale public clouds, had an equivalent solution.
We're seeing more and more EU companies adopting Cloudflare in order to meet the increasing data localization and data residency requirements becoming law in the region. A Fortune 500 retailer expanded their relationship with Cloudflare, signing a $442,000 deal and bringing their annual commitment to nearly $1 million. They are using Workers to build highly scalable functions across their e-commerce application. They're also using Cloudflare's network to route traffic between different hyperscale public cloud vendors they use. Being multi-cloud is a priority for them, and Cloudflare is the only vendor they see as being able to help them achieve their vision. They've started experiments with R2, our object store, and D1, our first database. While their spend is still modest, we think there's an opportunity, and they've expressed interest in making us one of their strategic vendors going forward.
A Fortune 500 life sciences conglomerate signed a $745,000 three-year deal. They use a range of our products, including Magic Transit, to better protect their on-premise data centers. They're handing traffic directly to our network, completely replacing their ISP. We've signed an MSA with them and believe there's a significant opportunity to expand across their other 20 subsidiaries. A Fortune 500 apparel company signed a three-year, $1.1 million deal. They bought our full set of security services as well as Cloudflare Workers. A fun fact is that my co-founder, Michelle, had an opportunity to be this company's CEO's chief of staff out of business school. Instead, she chose to start Cloudflare, and now they're a customer. A Fortune 500 consumer products company expanded their relationship with us, signing an additional $292,000 one-year deal.
That brings their total spend with us to nearly $1 million per year. They are using our Zero Trust product, and we worked with a large channel partner to win and service them as a customer. A Fortune 500 financial services company signed a $236,000 one-year deal. We believe this will be another example of how we can land with one product, sign a general MSA, and then expand over time. If you've been counting, that's a lot of Fortune 500 companies, and we're actually up to 32% of the Fortune 500 now using us. I see a clear path to nearly every Fortune 500 company using us for something in the next five years.
A big part of Marc and the team's job then is to expand those relationships and then get them to use us for everything. We aim to be the network for every Fortune 500 company. Not just the Fortune 500. In Q3, a large building materials manufacturer in Europe signed a $1.2 million 31-month expansion deal. They have broadly adopted our Zero Trust products across their 25,000 employees. They had been hit by a ransomware attack earlier this year that their existing email security vendor failed to catch. We included our Area 1 email security product as part of their Zero Trust solution, something no other Zero Trust vendor provides as a native integration. During our POC, we caught phishing messages that our other existing vendors missed.
They went from POC to live in two days and signed the deal a week later. They'd been a small customer previously, but turned to us for an integrated solution the minute they had another network security need, and we delivered. Finally, a large software monitoring company signed a $3.6 million expansion deal, bringing their annual spend to more than $5 million. They're a big user of Cloudflare Workers, processing seven trillion requests just in September. They are migrating more and more of their application from AWS to Cloudflare Workers for our performance and easy scalability. In a few weeks, we have our upcoming Developer Innovation Week, where we'll be announcing some incredible new Cloudflare Workers milestones, but I couldn't resist sharing a few here now. As of the end of Q3, we're up to 2.2 million unique applications running on Cloudflare Workers.
Cloudflare Pages, which is a product within the Cloudflare Workers portfolio, is up to 367,000 projects and has doubled since May. In September, we announced that R2 was now generally available along with our other generally available storage products, Workers KV and Workers Durable Objects. We are now storing over a petabyte of customer data, and before the end of the quarter, D1, our first database product, will be available in open beta. Increasingly, we're hearing about more and more startup companies that are skipping the hyperscale public clouds and building exclusively on Workers. Reflecting that trend, in September, we announced the Workers Launchpad funding program, in which 26 of the top venture capitalists collectively earmarked up to $1.25 billion in funding for innovative new startups building on Cloudflare Workers.
The funding program came about because VCs kept coming to us to do due diligence on companies they were considering investing in when more and more of their tech stacks were powered exclusively by Cloudflare Workers. From the Fortune 500 to the hottest new startups, increasingly, the future seems powered by Cloudflare Workers. I wanted to close by reminding everyone in the United States that we have an election next Tuesday. That makes this a time of heightened cybersecurity concerns for the country. Through Cloudflare's Athenian Project, we provide our services for free to any state and local officials who help oversee elections. Today, election authorities in more than half of U.S. states and most of the so-called battleground states are participants in the Athenian Project.
We are proud that we helped cyberattacks not be part of the story in the 2020 election, and we have had our team standing by, and they'll be available 24/7 over the next week to help ensure cyberattacks won't be part of the story for 2022 either. We'll do the thing we're best at. You, don't forget to vote. With that, I'll turn it over to Thomas. Thomas, take it away.
Thank you, Matthew, and thank you to everyone for joining us. As Matthew mentioned, we achieved an important milestone in the third quarter, surpassing a billion-dollar revenue run rate for the first time. This milestone is a testament to our enormous market opportunity, our ability to land and expand large enterprise customers, and the durability of our subscription-based revenue model. Turning to revenue for the quarter. Total revenue for the third quarter increased 47% year over year to $253.9 million. Area 1 Security, the email security company we acquired in April, again contributed less than 1% of revenue this quarter. While we are seeing foreign exchange headwinds and global economic uncertainty impact the business, we continue to have traction upmarket and believe we are very well-positioned in this environment.
From a geographic perspective, the U.S. represented 53% of revenue and increased 49% year-over-year. EMEA represented 27% of revenue and increased 51% year-over-year. APAC represented 13% of revenue and increased 38% year-over-year. APAC performance has improved meaningfully from last year, but we are seeing more price sensitivity and buying decision delays in the APAC region. Turning to our customer metrics. In the third quarter, we had 156,000 paying customers, representing an increase of 18% year-over-year. Similar to last quarter, we saw a higher level of churn in our pay-as-you-go customer base, primarily due to more customers shifting down to our free customer tier. We think there's a function of a more challenging macro environment. However, we are pleased to see these customers remain on our platform. Turning to large customers.
We ended the quarter with 1,908 large customers, representing an increase of 51% year-over-year, and an addition of 159 large customers in the quarter. We were pleased to see large customer revenue contribution increase again sequentially. We're also encouraged to see the quality of wins continue to increase across the Fortune 500 in a broad array of verticals, including consumer, retail, healthcare, life science, pharmaceutical, industrial, telco, and financial services. While sales cycles at the high end of the business have elongated, we continue to see our $500,000+ and $1 million+ cohort closing faster than top-line revenue. We also achieved a milestone of 75 customers larger than $1 million in the third quarter.
Our dollar-based net retention was 124%, representing a decrease of 200 basis points sequentially and consistent year-over-year. The decline was primarily driven by less net expansion. We have not seen elevated churn. As we mentioned previously, while we expect DBNR to continue to trend upward over time, we expect some variability quarter to quarter. We continue to target 130%+ dollar-based net retention rate given our momentum with large enterprise customers and the net expansion characteristics of fee-based solutions. Moving to gross margin. Third quarter gross margin was 78.1%, representing a decrease of 80 basis points sequentially. Network CapEx represented 13% of revenue in the third quarter.
We expect fiscal 2022 network CapEx to come in at the lower end of the 12% to 14% range due to the timing of purchases and inherent efficiencies in the network. Turning to operating expenses. Third quarter operating expenses as a percentage of revenue decreased 7% sequentially and 6% year-over-year to 72%. Our total number of employees increased 42% year-over-year, bringing our total number of employees to approximately 3,180 at the end of the quarter. We will continue to invest in the business. As we mentioned last quarter, we continue to pace hiring based on current market conditions. Sales and marketing expenses were $103.5 million for the quarter.
Sales and marketing as a percentage of revenue decreased 3% sequentially and decreased to 41% from 45% in the same quarter last year. Research and development expenses were $46.4 million in the quarter. R&D as a percentage of revenue decreased 2% sequentially and decreased to 18% from 19% in the same quarter last year. General and administrative expenses were $33.6 million for the quarter. G&A as a percentage of revenue decreased by 2% sequentially and decreased to 13% from 14% in the same quarter last year. Operating income was $14.8 million compared to an operating income of $2.2 million in the same period last year. Third quarter operating margin was 5.8%, an increase of 450 basis points year-over-year.
Overseas operating expenses benefited from the strengthening of the U.S. dollar, which contributed to the increase in operating profit. Turning to net income and the balance sheet. Our net income in the quarter was $19.1 million, or a net income per share of $0.06. Tax expenses for the quarter was $1.7 million. We ended the third quarter with $1.6 billion in cash equivalents, and available for sale securities. Free cash flow was -$4.6 million in the third quarter, or 2% of revenue, compared to -$39.7 million or 23% of revenue in the same period last year.
Operating cash flow was $42.7 million in the third quarter, or 17% of revenue, compared to $6.9 million or 4% of revenue in the same period last year. As stated previously, we continue to expect to be free cash flow positive in the second half of 2022. Remaining performance obligations or RPO came in at $831 million, representing an increase of 9% sequentially and 52% year-over-year. Current RPO was 75% of total RPO. Before moving to guidance for the fourth quarter and full year, I would like to reiterate our expectations in light of the uncertainty in the macroeconomic environment. While we saw foreign exchange benefit to operating expenses, we also saw FX headwinds to revenue as we offered concessions to offset the strength of the U.S. dollar internationally.
In the quarter, we observed an increase in our sales cycle and expect similar sales dynamics to continue, leading to longer lead time deal closures. We are cognizant of the increasingly cautious environment and have factored this into our outlook. Now turning to guidance. For the fourth quarter, we expect revenue in the range of $273.5 million to $274.5 million, representing an increase of 41% to 42% year-over-year. We expect operating income in the range of $12 million to $13 million, and we expect net income per share of $0.04 to $0.05, assuming approximately 343 million common shares outstanding, and we expect a tax expense of $1.9 million.
For the full year 2022, we expect revenue in the range of $974 million to $975 million, representing an increase of 48% to 49% year-over-year. We expect operating income for the full year in the range of $31 million to $32 million, and we expect net income per share over that period in the range of $0.11 to $0.12, assuming approximately 342 million common shares outstanding. We expect a tax expense of $6.1 million. Challenges remain in the current environment. We are confident in the continued growth of our business and the durability of our subscription model. Before closing, I would like to let you know that Jayson Noland, our Head of Strategic Finance and Investor Relations, is leaving us. This is happy and sad news.
Happy for him to pursue his first CFO opportunity at a pre-IPO software company, but sad to lose such an integral member of the team. I want to thank him personally for his leadership and partnership, and wish him great success in his next chapter. In closing, I'd like to thank Cloudflare employees for their continued dedication in delivering exceptional service to our customers, partners, and communities. As Matthew mentioned, now that we have reached a billion-dollar revenue run rate, we are setting our sights on the next milestones of $5 billion in five years. With that, I'd like to open it up for questions. Operator, please poll for questions.
Thank you, sir. Everyone, if you would like to ask a question, please press star one on your telephone keypad. Again, that is star one if you would like to ask a question, and we will go first to Phil Winslow, Credit Suisse.
Hey. Thanks for taking my question. One for Matthew, then a follow-up for Michelle and Thomas. Matthew, obviously, you've talked about the macro for a couple of quarters now. When you look across Cloudflare portfolio, obviously, it's broad, you have Zero Trust services, network services, application services, developer platform. Where have you seen the most impact, you know, to the business? And then conversely, what has actually held up the most? And then a follow-on for Thomas and Michelle. You talked about it being, you know, keeping your eye on hiring relative to revenue growth. You know, what are the puts and takes that you're seeing there trying to balance, obviously the long-term $5 billion target, but also the sort of the near-term realities?
Yeah. Phil, I'll start and then hand it off to Thomas and Michelle. I think that what we have been seeing, and I think we've been very transparent about talking about, is that the velocity of sales at large companies especially, and especially in getting new logos, is slowing down. It feels like everyone right now is measuring twice to cut once. You know, I think we started to see that as we've talked about on previous calls in December of last year. You're seeing some of that slowness in new business now flow through and hit our top line. What I think is continuing to hold up extremely well right now, and in fact, in some cases we're seeing acceleration, is in the security portion of our business.
While it is worrisome, the global conflicts that we are all watching in multiple parts of the world, that is putting more pressure on companies to make sure that their security is in a good place. I think that while, as I said last quarter, the macro economy is challenging right now, and we have said that I think consistently, for the last three calls, we do believe that we are very well-positioned, and I continue to say that I wouldn't trade places with any other CEO at any other company.
Great. On the hiring-
Thomas a short amount.
Yes.
Yeah. You know, you saw that our employee headcount grew 42% year-over-year in the quarter. I think we've been very restrained when it came to corporate functions and G&A expenses, but we have made sure that we hire for sales capacity in our go-to-market functions in a way that we are not hindering our potential and the opportunity that is in front of us. We try to be very balanced where we slow down, and we have been very strategic where we added headcount in terms of numbers, but also in terms of footprints from a regional perspective.
Great. Thanks for taking my question.
Our next question comes from Matthew Hedberg, RBC Capital Markets.
Great. Guys, thanks for taking my questions. Matthew, in your prepared remarks, you noted economic headwinds, that you've been talking about the last couple of quarters have showed up here. I wonder if you or if Marc's in the room too, can talk a little bit about perhaps what your sales force can do to kind of navigate these headwinds. Is it a different sales motion? Is it a different way to engage the customer? Just sort of curious on, you know, how sales organizations adapt to these headwinds.
Yeah. First of all, I don't think there's anything that has dramatically changed this quarter and at this time versus what we were seeing earlier in the year. I think the adjustments that we made in terms of our go-to-market strategy are actually things that we've made previously, and we've seen positive benefits from those changes. The nature of subscription businesses is that if you see slowdowns in the beginning of the year, they show up in your top line later in the year. The things that we did that I think have been successful and will continue to be successful is really focusing on how do we get to know the customers that already know us and trust us?
How do we sell more to those customers from the broad portfolio of products that we have? How do we make sure that they are getting all of the value from Cloudflare? One of the things that I think we're hearing over and over again is that as companies are thinking about how can they reduce their cloud spend, how can they rationalize it, how can they make sure that they are getting the most out of the IT dollars that they're deploying, over and over and over again, we are able to deliver services that help companies save money, get better performance, get higher reliability, get more variability in a multi-cloud environment, and make sure that they are secure.
As we look at our customers, they see us more and more as a strategic partner on making sure that they're getting the most out of every IT dollar they spend.
The, the-
Matt. Go ahead.
Sorry. I just wanted to put an additional comment on it. I'm just coming back from a customer trip in Europe, at a time where, as Matthew said, the security products are holding up nicely in light of all the security and threat concerns we see out there. Leaning heavier on the intelligence we have. We just launched a threat intelligence product, Cloudforce One, a couple of weeks ago. Leaning on this asset we have in terms of the intelligence and the insight we have is helping us, especially with opening up doors with new logos.
That's super clear. Maybe Matthew, obviously R2 is early, but it's great to hear the success already with a petabyte of storage. Can you talk about you know, what sort of customers you're seeing leverage these? Are these some of your biggest strategic customers? Are they just maybe a little bit of color on where you're seeing that usage.
Yeah. In the quarter, the usage was mostly still during our beta period. The users of that product have primarily been developers that are using it to build new services or small teams within larger organizations. What I think that we'll see now that it is out of beta as of the very end of the quarter is that you'll see much more large companies who are looking to figure out how they can reduce their cloud spend and make sure that they can have a multi-cloud presence, adopt our R2 services. We're talking to very large companies about moving more and more of their stored objects to where we can store that with R2.
One of the benefits is not only can we help them save money on the egress fees, but it allows them to then use those objects across any of the different cloud platforms they're using. By being that neutral third party, we can let people adopt a little bit of Amazon, a little bit of Microsoft, a little bit of Google, a little bit of SaaS vendors, and share that data across all of those different places. It actually is a use case that makes putting data in the network one of the things which is really valuable, and I think you'll, in quarters to come, see larger and larger companies adopt that as the object store for their company.
Super helpful. Thanks, guys.
Next up is Brent Thill, Jefferies.
Matthew, one of the key themes we keep hearing is this theme of consolidation that you're seeing in a lot of pockets of organizations, and many are saying that they could consolidate. Do you feel over the next year you can use that to your advantage? Is there a sales motion or an opportunity you're starting to see where you're getting, you know, wider enterprise license agreements to take on more and more solutions?
Yeah. Yeah, Brent. I think that, you know, we are extremely well-positioned to help companies ferret out any type of savings that they can find across their organization. The conversations that we're having are very much around how can companies consolidate their vendors into what are those critical vendors that provide services, and how can they really save money in the process of doing that. The fact that we've got as broad a portfolio of products as we do means that what we're seeing is more and more companies are adopting the complete Cloudflare network.
I think the way that that shows up in the numbers is the fact that, you know, our customers that are over $500,000 a year of spend, over $1 million a year of spend, are growing faster than our overall revenue growth rate and our overall customer growth rate. I think that's a good indication that the customers are doubling down and using more of our services. I think that's gonna make it a more challenging environment for those point cloud solutions that are out there, and that we will increasingly take share and help be that strategic vendor to become the network for our customers. Can I just quickly clarify with Thomas?
The slowdown that you're seeing, did you see that more pronounced in small and mid versus large, or did you see it across mid and large?
You see in each one of the segments you mentioned, you see some impact. You know, we talked about pay-as-you-go downgrading to free, staying our customer on the platform, but downgrading. We see elongated sales cycles at the very high end, in the very large customer cohorts. We see, you know, the expansion in the mid-market segment slow down a bit. Churn, they didn't churn off, but expansion was a bit harder. It really depends on what segment you look at.
Thank you.
Our next question today comes from James Fish, Piper Sandler.
Hey, guys. Thanks for the questions. Matthew, you highlighted that Fortune 500 retail win with Cloudflare as kind of that glue between the hyperscalers and you also said you see Fortune 500 penetration getting to a 100% over time. I guess how are you balancing that strategy of being that glue or fabric between the hyperscalers versus being that full infrastructure as a service offering alternative to the hyperscalers? How does that success of one or the other change your viability to hit that $5 billion goal five years from now?
Yeah, I think that our approach is very different than the hyperscalers. The hyperscalers sort of start from the inside and work their way out, and we are starting from the outside and working our way in. What I mean by that is, fundamentally what Cloudflare is a network, and we want to be the best network to connect anything online. To connect cloud to cloud to home, you know, home office, cloud to remote office, cloud to branch office. Anything that is having to be connected by a network, we want to be that network. There are things that make a ton of sense to live in the network itself.
For instance, a shared object that you're going to use across Google and Microsoft and AWS, supporting that with R2 makes a ton of sense because we're not going to charge you the egress tax to be able to access that across all of those different platforms. You're also going to, for some applications, want to make some parts of the application as fast and as scalable and as reliable as possible. Those parts can live inside of Cloudflare. Our strategy is not to completely recreate every single thing that the hyperscalers do. We wanna be the best network that is there, and there will be places at the margins where we absolutely will compete with them.
I think increasingly we're seeing that companies are able to build entire applications using the Cloudflare stack in a way which is much more modern and much more reliable. We're never gonna be the place that you can, you know, lift and shift SAP HANA. That's just not the way we're building. Instead, what we're building is for those applications that need to live inside the network for either the performance, reliability, compliance, requirements, and the data that has to live inside the network for those same reasons. We wanna be the network to be able to do that. I think regardless, you know, we see with the products that we have in market today, a clear path to getting to $5 billion of revenue, and that doesn't assume any M&A. We believe that is through organic.
organically that we can get to $5 billion of revenue in the next five years with the products that are in market today. I think that the hyperscalers don't have to fail for us to succeed. We actually see ourselves as much more of that glue between them. Whether companies wanna be multi-cloud or not, they all are. That glue is critically important. Again, I think we provide the only solution as we see companies that are trying to struggle with reconciling that increasingly multi-cloud world.
Got it. Thomas, maybe for you, is there any way to understand the impact or adoption of that monthly to annual conversion with enterprise specifically this quarter? You know, are customers actually looking for staying with shorter durations just given this macro uncertainty, or are they alternatively looking to lock in for longer on the infrastructure side? Thanks, guys.
Yeah, good question. As we said in the past, you know, the moving from monthly billing and contracts to annual is our biggest lever on our path to delivering free cash flow. In a world, especially outside of North America, where, you know, exchange rates are high, customers are more resistant to lock in. You know, we don't want to discount too much in order to lock in lower revenue in a world of difficult exchange rates. We have been more conciliatory, I think, to customers and partners in general in this environment and have not pushed as hard, you know, moving forward in this transition.
You know, it is still the biggest lever we have, and it's an opportunity that is in front of us, and it will materialize in our free cash flow numbers moving forward.
Our next question will come from Shaul Eyal, TD Cowen.
Thank you. Good afternoon, guys. Matthew, on Area 1,
When you've acquired them, I think you've indicated they can assist you in taking you guys deeper into the CISO community. How's that coming along thus far? Maybe any commentary about win rates versus Zscaler, maybe even Palo Alto that you flagged in recent quarters.
Yeah, sure. Area 1's team is amazing, and I think they've brought to us three distinct things. The first is a product which I think is a natural gateway to our overall Zero Trust solutions. The second is a world-class threat intelligence team, which we are now turning into a product both to sell to our existing customers and also as a great way to attract new customers and create some of the marketing around the threat intelligence that we do. The third is a really much deeper and more mature understanding of channel through some of their leadership that we've brought on board. Again, I think that has helped us mature what our channel strategy has been.
I think looking at Area 1 in particular, we're seeing particular strength in Asia, actually, around the Area 1 product. I think our sales team, especially in Japan, has done a great job selling the Area 1 product. We're seeing a lot of it. That's the straight email security product. Once we have got someone using the email security product, it's a very natural extension for them to turn to the rest of our Zero Trust product. I think in addition, the threat intelligence team has helped us win larger and larger customers. Being able to help customers understand if something goes bump in the middle of the night, what's going on, has been something that the Area 1 team again has really helped us with.
The channel, our channel strategy, you're seeing more and more of our deals, especially in the Zero Trust space, come through our channel. Our win rates against Zscaler and Palo Alto Networks continue to be very strong. Our product in that space competes extremely well with them. That is the challenge and the thing that I think we are continuing to work on is just increase awareness in the market. That's something where, as we were thinking about who is the right replacement for Chris, you know, Marc's background in identity and access management, both at Oracle and at Twilio, he really understands that market and I think is gonna help us increase the awareness that's there.
When a customer is considering going on their Zero Trust journey, if we're in that consideration, we love our win rates in that. Our job is now just to increase our awareness and go from the company that people might have known us for doing one thing to today a much more sophisticated and much more broad portfolio. And I'm excited as that grows, and I think that Zero Trust is very much gonna be the story of the next few years to come.
Thank you.
We will take the next question from Hamza Fodderwala, Morgan Stanley.
Hey, guys. Thanks for taking my question. Matthew, and perhaps Thomas as well, I wanted to dig in a little bit around the net expansion point, and you spoke a little bit about this already, but just to get more specific. You know, we're hearing from a lot of cloud service providers around rationalization. You know, Matthew, you spoke a little bit about how the costs there are getting you know, too high. As it relates to Cloudflare, are you seeing any of that rationalization as it relates to your usage and expansion? Obviously, you have a very different pricing model as a subscription-based company, and this is kind of where Thomas comes in.
How do you expect that to play out mechanically, over the next few quarters, as we likely see these expansion rates continue to be impacted? Thank you.
Yeah. I think that if you are a purely usage-based model, it is a place where people are looking for areas to save money. Similarly, if you are a seats-based model, as you're seeing some companies, you know, do layoffs or, at a minimum, not expand their seats, that is something that is challenging in the current environment. I think we are fortunate that today most of our revenue is not usage-based and not seats-based. While we are adding products that are in both of those categories, and we think that over time that will be an expansion driver for us, that today we're not seeing that downward pressure from people trying to rationalize or consolidate their bills.
I think the one place which Thomas referenced, where we are seeing some pressure, is actually with new accounts, because we bill all in U.S. dollars. That is putting some pressure, especially outside of the United States, and we are making concessions in order to accommodate what are the foreign exchange pressures that are there. Again, though, you know, it's less about our existing customers trying to figure out how to use less of us. In fact, if anything, we're seeing that they are trying to say, "How can we use more of you instead of using what are some of the other consumption-based alternatives which are out there?" I think we have been less exposed to that downward pressure than some of the pure consumption-based services that exist.
That was a very complete answer. I have nothing to add. I was gonna say, yeah, thank you for the clarity.
Next up is Sterling Auty, MoffettNathanson.
Thanks, guys. Matthew, in terms of thinking about the threshold of keeping the margins basically flat within that context of growing to $5 billion, is there kind of like a threshold growth rate that you think about? As long as you're over 30% or 35% or 40%, you'll keep it there, otherwise you would reconsider kind of the margin profile?
Yeah, I don't know that we have, you know, a specific guidance. I've always personally, and Thomas will probably slap me for saying this, but I've always personally kind of found the sort of idea of the rule of 40 to be pretty compelling. I think that we like that, and I think that would, if we're growing north of 40%, then I think that that's showing that we can continue to execute and deliver on the enormous opportunity that we have ahead.
I think we know that we have the levers to, when it's the right time for us, be a business that delivers very significant operating profits. While we see a total addressable market ahead of us that we only have, you know, less than 1% penetration on, we think that it makes sense to continue to invest in that market and continue to drive growth going forward. Today, you know, we're still living above the rule of 50, so I think we've, you know, we've got some time to think about that.
Makes sense. Thank you, guys.
Our next question today comes from John DiFucci, Guggenheim.
Thank you. I have a question for Matthew and then a quick follow-up for Thomas. Matthew, I just wanna make sure I understand your comments about acceleration in the security portion of your business. Security businesses have, so far anyway, generally held up well against the macro slowness. It sounds like that's continuing or even getting stronger for you, given your comment there. I wanted to make sure, in that the macro backdrop is really manifesting itself more broadly in the rest of your business. Is that correct?
Yeah. First of all, you know, I think we have been consistent in talking about the macro pressures now for the last three quarters. I think there isn't something that has dramatically changed since we started to warn that there were pressures in the macro space. What I think if we dig down a little further into the security business, I think especially in February of this year when we saw Russia invade Ukraine, a lot of security companies expected that would be a tailwind to their business.
What I think actually ended up happening was that tailwind did not materialize and that the threat that, you know, the Russians are coming, turned out to not be something which showed up outside of the Ukrainian theater. However, in the last several months and especially in Q3, we started to see an increase in cyberattacks coming out of both Russia and other parts of the world. That drives increasing adoption of products like Cloudflare's products at a very high velocity, so where we'll see close rates that, you know, you can often measure in hours or days.
I think that expectation of the war in Ukraine and other political conflicts around the rest of the world leading to more security business was something that I think a lot of the industry expected would show up in Q1 and Q2, and we actually saw it show up more in Q3. Generally, the overall macro environment hasn't changed substantially throughout this entire year based on what we're seeing. I wanna make it clear that we're not saying that we're seeing a big change. We have seen that there was softness in the macro economy since Q1, and we've been talking about it since Q1.
Yeah, you've been very clear on that, Matthew, so thank you. Thomas, just a quick sort of a follow-up to what Matthew was just talking about. You talked about when you gave the outlook, and you talked about your caution in that outlook. I just wanna make sure I understand what's implied in that outlook. Are you looking at sort of similar effects due to the macro backdrop, or are you expecting further deterioration?
You know, we are talking about a subscription-based model, so a lot of the things we see in the third quarter and we'll see in the fourth quarter are the impacts of when we started to talk about the macro climate going to change. When we give guidance for the fourth quarter, it's less the in-quarter impact of the business. It's just the flow-through of what already has happened.
I understand that, but do you expect to see the macro backdrop, the effects on your business show further deterioration, even if we can't see it, although we kind of think we try to anyway? Or do you expect it to sort of stay about where it is in the softness you've seen over the last couple quarters, I guess?
Well, we of course did not assume an improvement in the macroeconomic environment. With an outlook in Q4 and Q1, there's nothing that signals that it's going to get better anytime soon.
Okay. Thank you very much, guys.
Next up, we'll take a question from Andrew Nowinski, Wells Fargo.
Great. Thank you. I just wanna start with a quick, sort of follow-up to John's question. I was wondering if you could just provide any color around, maybe your pipeline of renewals for Q4 because I assume Q4 is usually, you know, pretty big in terms of renewals. I'm wondering if you perhaps changed how you're handicapping the likelihood of those renewals closing in Q4 given the lengthening sales cycles you're seeing. I have a follow-up.
Yeah. I don't think. Again, we have not seen an uptick in overall churn across the business. That has continued to hold very strong. We haven't changed how we've handicapped the renewal forecast.
Okay, thank you.
Keep in mind, you know, most of our revenue still gets billed monthly and not annually, so we don't have this, you know, massive renewal quarter in the fourth quarter either, at least not yet.
Got it. Okay. I just wanna also just dive a little deeper on the security and how security demand is holding up. You know, we heard obviously over the last few days, you know, Fortinet talking about how they're seeing sort of more normal spending patterns from customers where they're not ordering, you know, placing orders for firewalls twelve months in advance because the supply is starting to free up. I suppose you could view that negatively as sort of a change in the overall security spending environment. Could you also view it as a positive for Cloudflare because now customers aren't making sort of irrational purchase decisions and buying firewalls, whereas now they can actually evaluate and deploy a smarter solution like Cloudflare One? Just wondering how, kinda how you view that change that the firewall vendors are talking about.
I mean, I think that there's, you know, I think that you've had a series of head fakes from the hardware space for quite some time, going back to the Trump tax cuts that moved forward a lot of incentives on CapEx spending, the beginning of COVID where everyone was just scrambling to keep the lights on, and then the supply chain crisis which again made people place orders just to get in line for products that they may not eventually even want to have. It is in the grand course of history, you can't solve the problems of a distributed workforce, you can't solve the problems in the cloud by shipping a box or a virtual box. It just doesn't work.
I think that anything that gets the market back to being rational without any kind of sort of artificial incentives to continue to invest in hardware is definitely beneficial for Cloudflare and other cloud-based security solutions.
Great. Thank you.
Up next is Fatima Boolani, Citi.
Oh, thank you for taking my question. Matthew, one for you, and then Thomas, one for you as well. Matthew, wanted to ask you about a pricing strategy, pricing philosophy question. We heard a lot in your prepared commentary about the downshifting of customers or trade down from customers to some of your free solutions, which of course have better TCO in this environment. I'm wondering what's the rationale for you to maybe not, I guess, raise the floor on that so you can hold on to these paying customers? Just curious about how you're sort of thinking about that dynamic. Then I had a follow-up for Thomas, please.
Yeah. First of all, our pay-as-you-go business is a relatively small portion of our business. It's much less than 20% of revenue. I think that what we see as the value from that pay-as-you-go business is that those customers, whether they pay us something or not, end up being our biggest advocates and our biggest champions inside whatever large organization that they operate at. If you look at who are our largest customers, and you go down, you know, the top 10 customers, almost all of them came to us originally because some technical leader inside that organization used Cloudflare's pay-as-you-go services, fell in love with us, understood us, and was able to adopt us as part of that.
I think that benefit is so substantial to us that we always wanna make sure that we're treating those customers well. As Thomas said, while they may go from paying us $20 a month to, you know, not paying us something because gas prices went up, that isn't something that we're trying to optimize for. What we're trying to optimize for is that those customers love us, they understand us, and they take us to work. As they do, that's how we've been able to close so much of the Fortune 500. Behind almost every one of those Fortune 500 wins is a pay-as-you-go customer who advocated for us internally, and that is, you know, our secret sales force.
Fair enough. Appreciate you sticking to your ethos on that. Thomas, on the dollar net expansion rate discussion, appreciate you kinda shared some of the granularity as to where, you know, some of the pressures are coming from there. But I'm curious from a product pillar perspective if you can shed light on, you know, are you seeing expansion levels moderate within the application services bucket or the network services bucket? Just kinda curious to get a sense of, you know, what feature functionalities across your portfolio are more prone to that, you know, expansion velocity dynamic. Thank you.
I think the first statement to make is for us, this is a, it's a very true number. It's an all-in number covering our pay-as-you-go business, our mid-market, and our enterprise. As we just discussed over the last 50 minutes, different segments behave differently. We just talked about pay-go customers churning, often becoming free customers. That is something, you know, that hinders across the cohort expansion. We have seen exchange rate headwinds from a billing and contracting perspective in overseas accounts. So that is something that would be reflected in an expansion number. Then we talked about prolonged sales cycles at the very high end, in the very large cohorts. That is if you go back to the KPIs we shared, where a lot of growth dynamics are happening.
Those cohorts are growing in general significantly faster than our average growth rate. Any movement we have in terms of sales cycles in the very large cohorts is impacting DNR in the current quarter. This does not take away from the opportunity that is in front of us, and it falls into the logic that we always had when we talk about DNR. You know, we see a path forward to get north of 130%, but there will be movement around that number. It will not be a straight line that gets us there.
I appreciate that. Thank you.
Thanks, Fatima. Operator, can we take a question from one last analyst, please?
Absolutely. Our final question will come from James Breen, William Blair.
Thanks for taking the question. Can you just talk a little bit about the M&A environment? You know, I know you talked about getting to $5 billion organically. It seems with valuations coming down and given the cash you have, are there gonna be opportunities out there to maybe add product or some scale in certain divisions, around other companies? Thanks.
Yeah, Jim. You know, I think our different companies are built in different ways. If you look at, you know, Cisco, they were very much an M&A and acquisition machine. Whereas if you look at an Apple, you know, they do M&A, but it's usually for core technologies. It's not for products. I think we are much more like an Apple than we are like a Cisco. We've watched as some of the competitors in the space have really tied themselves up in knots building what is effectively a Frankenstein type solution through a series of M&A, and they don't get the same level of efficiency that we do.
I think that, you know, we will always be biased against M&A, and we will always have a very high hurdle rate to do any sort of a transaction, which isn't to say we won't do transactions. When we find great technologies, great teams, great ways to integrate like we did with Area 1, we will jump on that. As the valuations and multiples, especially in some of the private market, continue to fall, you know, we look at lots and lots of deals. I don't think that has changed that relative to other companies, I think we're gonna maintain a very high hurdle rate. We have very much optimized around internal development.
As Marc said in his responses, we believe we can get to $5 billion without having to build or buy any new products or companies that are out there. We think we've got the right products in the bag today, and it's just a matter of us continuing to execute on the go-to-market side.
Great. Thanks.
That does conclude our question and answer session. I'd like to hand things back to Mr. Matthew Prince for any additional or closing remarks.
Just wanna thank everyone on Cloudflare's team for delivering what has been, again, another strong quarter. We're proud of the fact that we're protecting the U.S. elections, and we're standing by to make sure that they go off smoothly. I also wanna specifically thank Chris for his nearly 10 years of service at Cloudflare and appreciate all that he's doing to transition and get Marc on board. To wish Thomas good luck in his new role as CFO signing all of those SEC statements, hopefully won't keep him up too much at night, and I know that he's gonna do an amazing job going forward. Thank you all for being investors. Look forward to talking again next quarter.
Ladies and gentlemen, that does conclude this conference. Thank you all for your participation.