Cyber Stewards

The vastness of the internet, as an entity, can be difficult to put into perspective. Cloudflare, however, has a clear sense of its scope, as it handles roughly 20-percent of internet traffic. To frame it with another stat: More than 70 billion cyber attacks are stopped by Cloudflare each day.

In this episode of Iconversations, Greylock’s Holly Rose Faith talks with Cloudflare Co-Founder, President, and COO Michelle Zatlyn about what it’s like to run a company that a massive constituent of users touch – often without knowing it.

“It’s been really amazing to help build this backbone of the internet — the infrastructure, the roads, the bridges that make everything work,” says Zatlyn. “You take bridges and roads for granted in cities, but when they don’t work, it’s really frustrating. We do that in the digital space.”

By that, Zatlyn is referring to Cloudflare’s raison d’être: cyber security, performance, and reliability to “make anything connected to the internet faster, safer, and more reliable.”

When Zatlyn and her co-founders, Matthew Prince and Lee Holloway, started Cloudflare in 2010, the tech landscape was a different place, one where many did not understand internet security threats in the way we do today. In that context, says Zatlyn, “I’ve learned that there are two ways to raise money early on. You either raise on traction, or you raise on a story. Cloudflare was very much in the latter camp. Revenue took a long time.”

In addition, the Cloudflare co-founders took an unconventional approach to recruitment and to public-facing transparency — both of which appear, now, to be at the bedrock of their success.

For starters, they saw only a 16-percent attrition rate during the so-called Great Resignation, half that of their tech peers. “We spend so much time recruiting upfront, aligning expectations. I have no secret sauce, except we’re deliberate in the recruiting process” says Zatlyn. Even at this point, with 2,500 people, Zatlyn and Prince spend 20-percent of their time recruiting.

“We want people to feel like they belong at Cloudflare,” she says. “We care about that. We want people to feel like: I can do great work here and my work matters.”

That care informs how they’ve always engaged with the public, too. “To build trust, you need to be transparent. We had to accrue trust on a daily basis. It seems like we’ve always had it, but it’s been 10 years of being really thoughtful about it — and it’s a fragile thing,” says Zatlyn. “We take it really seriously.”

You can watch the interview on our YouTube channel here, or listen at the link below. You can also find the episode wherever else you get your podcasts.

Episode Transcript

Holly Rose Faith:
Hi everyone, and welcome to Greylock’s Iconversations. I’m Holly Rose Faith, and I lead executive talent for Greylock.

Today, I’m thrilled to welcome Cloudflare Co-Founder, President, and COO Michelle Zatlyn. I’ve had the pleasure of working with Michelle at my prior firm, as they were an early investor in the company.

As many of you know, Cloudflare was founded on a mission to provide a safer, faster, and more secure internet. The company — which actually began as a class project with Michelle’s fellow Harvard classmates, Matthew Prince and Lee Holloway — has more than delivered on that goal. Cloudflare has mitigated some of the largest distributed denial of service of the past decade, and today blocks some 70 million cyber attacks per day. Michelle is also on the board of Atlassian, and is on the cyber security team at Aspen Institute.

Michelle, thank you so much for joining us today.

Michelle Zatlyn:
Thanks so much for having me. I’m so honored to be here. I used to come to conversations like this. I still do, and I learn so much from them every single time. And so I hope I can be helpful to some of your portfolio companies today.

It’s great to see you. Thanks so much for having me, and for all those warm, kind, and gracious words.

HRF:
Aww. Well, let’s dive in. You have a very interesting background as a tech-startup founder. Beginning with the fact that you didn’t even initially plan to go into technology as a career, and now you are running a company that is, essentially, the backbone of the internet.

Before we get into your personal history, let’s talk about the significance of Cloudflare for a few more moments. In this era of rapid advancement in internet technology, where does Cloudflare fit into everything?

MZ:
Yeah, that’s a big question. We could spend a lot of time talking about that, but I’ve gotten better at answering this question over the years. I make a joke about that, because there are a lot of founders who might be working on big ideas, and sometimes it’s hard to concisely consolidate, or articulate, what you’re doing. And so, I guess I make a joke, because I’ve come a long way.

So like, what is Cloudflare? At the end of the day, we make anything connected to the internet — and when I say anything, I really mean anything connected to the internet — faster, safer, and more reliable. We do cyber security, performance, reliability for anything connected online.

It’s interesting, when I first started Cloudflare — we’re about 11 years old as a company — it didn’t quite start with that sort of pitch. It was a little bit of: Hey, we’re helping democratize tools previously resolved for the internet giants, we’re going to supercharge your website. Hey, I’m building a cybersecurity, performance, reliability company.

I’d sometimes go to dinner parties, which we haven’t been doing very much recently, but when we used to get together, people would look the other way. They were like, “That’s so boring.” Eleven years in, we have over 27 million internet properties using our service, which is a lot. It’s about 20-percent of the web that connects to the internet through Cloudflare.

HRF:
Wow.

MZ:
That’s a huge responsibility, a huge privilege. Every day, we stop, as you said, over 70 billion, with a B, cyber attacks coming to our customers’ applications, workloads, websites. That’s just an astonishing number, and it gets stopped because of [our] technology, our teams of amazing engineers and product managers, and what they’ve built. We help make everything faster around the world, all the legitimate users trying to go to our customers’ sites, faster, safer, and more reliable, and we add reliability in.

It turns out, now that we’ve gained this scale and people understand better what some of these things mean, all of a sudden, people don’t run away from me at dinner parties anymore. They’re like: That’s cool. Tell me more. How do you do it? I didn’t realize there were so many cyber attacks online. Why are people doing it? Why is it so hard? Why, sometimes, when I go to some places online, it’s so fast, and others it’s really slow? Why, sometimes, can’t I get to where I’m going?

And so it’s been really amazing to help build this backbone of the internet — the infrastructure, the roads, the bridges that make everything work. You take bridges and roads for granted in cities, but when they don’t work, it’s really frustrating. We do that in the digital space.

The last thing I’ll say here, and I’m happy to go in any direction you want, is: Just 11 years ago, when we started to build Cloudflare, it wasn’t obvious exactly what we saw. We saw it, we saw the rise of cloud computing. So we were business-school students when we started to work on Cloudflare. AWS, at the time, the dialogue… there were a lot of headlines in media saying: Is AWS a fad or not? Like, a lot of people said: Real organizations will never use AWS for their workloads. Well, how wrong that ended up being.

HRF:
Wow.

MZ:
And so, when we started, we saw store compute going to the cloud, we saw applications, we saw companies like Salesforce, even Workday, growing really quickly ahead of us. We said, well, if storage and compute are going to the cloud, and applications are going to the cloud, the networking side — again, all the things that make the roads and the bridges — also have to go to the cloud.

And that’s what Cloudflare has built. We’ve built a globally distributed network that’s a cloud-based service that makes anything faster, safer, and more reliable that used to be done by hardware boxes and software.

HRF:
Well, I’d love to learn a little bit more about your background. So you and your co-founders, Matthew Prince and Lee Holloway, you started Cloudflare in 2010. Since then, it’s been instrumental in ushering us through what is arguably one of the most transformative periods of internet history. Let’s back up a little bit and hear how you decided to get technology in the first place.

MZ:
Yeah. It’s so interesting. I was doing my MBA at Harvard Business School. I’m Canadian. I grew up in a province called Saskatchewan, which is kind of the prairie province of Canada, so, maybe some of the middle-of-America equivalent, and there were not a lot of technology influences in my life where I grew up.

I come from a really close family, and in my family, my parents were very much: You have to study hard, you have to get good grades, and you can do anything you want in your life, but you can’t go to university in the province. You have to leave the province. You have to go see more of the world. You can always come back, but you have to go see more of the world. And so I was lucky.

My parents weren’t tech entrepreneurs. I was talking to a woman this morning, where both her parents were computer scientists. My family has a farming background. My dad’s a lawyer, my mom was a teacher.

Long story short, I ended up going to college outside of the province, I went to McGill in Montreal. I tell this story, because basically my eyes got opened to lot more of how big the world was. All of a sudden, I went from a small city in a very underpopulated province, to a much bigger platform within Canada. All of a sudden, there’s all these kids from Toronto and Montreal there, and they were really smart, by the way. And I was like: Whoa. All of a sudden, my good enough wasn’t good enough. So I had to stand up straighter.

I was competitive. I was used to being top of my class, I wanted to keep that. I just realized: Wow, the world’s a lot bigger, it’s a lot more competitive. And I got a taste of what else is there. So I got really hungry wanting to learn, [wondering] how else can I make an impact? Where else can I? You just go on this learning journey.

I ended up doing my MBA at Harvard Business School, and that was a whole other eye-opening. I thought I had seen the top in Canada, and then I came to the U.S., a much bigger country, to a much more competitive, very global program, and I just realized: My god, the world is a much bigger place than I realized, and I really want to make a dent in it.

And so, I was at business school, really looking [for]: What do I want to do after? I want to do something impactful. Harvard Business School is in Boston, and it was the first year the professors led a trip to Silicon Valley, and I signed up for it.

And so we came to the Valley in January of 2009 with a professor, a couple of professors, and they introduced us. We met venture capitalists, like you, Holly, and your partners, and we met early-stage entrepreneurs, we met late-stage entrepreneurs back in January ’09. I remember Mark Pincus was the big deal, he was a Harvard grad. Meeting him, it was a big deal.

So I was out here, and it really opened my eyes. You’d read about Silicon Valley, but here I was, spending a week here. It was Wednesday; we are down in Plug and Play in Sunnyvale. Some folks listening might know that, maybe you started your company there. It was three early-stage founders who’d been going through their ideas.

Here I was, a student doing my MBA, and I saw these entrepreneurs up close and personal. I walked out of the room, and I said to another classmate on the trip: If that person could start a company, so could I. I don’t mean it in a mean way. It kind of demystified it, like: That person’s not smarter than me or better than me. I could do this. It was really empowering.

It happened to be Matthew Prince [I said this to, who had] the best answer ever: “Of course you could, Michelle.” We, literally, in the hallway there, started to exchange an idea. This is how the conversation went. Matthew and I knew each other from class for a year and a half, and he’s like, “Of course you could, Michelle. Of course, you could start a company.” And he’s like, “And I know there is something there with Project Honey Pot.”

I said, “Matthew, you always talk about Project Honey Pot. What is it?” He’s like, “It’s a community-based project I started, it’s been around for six years, and we help track web spammers online. Small-business owners sign up, they put honeypots on their website, and we track bad behavior.” And I said, “OK, what do the website owners get?” He’s like, “Karma points.” I’m like, “Karma points?” “Yeah. We’re tracking the bad guys.” I was like, “OK. So, karma points, OK. What do you do with the data?” “Well, the data comes back to Project Honey Pot, and we go work with law enforcement agencies to take the bad offenders down.”

I said, “Doesn’t that take a long time?” He’s like, “Yes, years.” By the way, 80,000 small businesses had signed up for this thing. And I said, “Why does anyone sign up for Project Honey Pot?” I just couldn’t understand. I did not have a big background in this; I didn’t really understand the problem set. At this point, he got annoyed at me.

He put his hands up, “Michelle, one day, we want to use the security data to create a service that actually stops these things,” and that was the aha. That was the light bulb going on in the hallway, and the rest is history, where we started to work on this idea. It turned out that anything going online needs some cybersecurity protection, needs some sort of reliability.

You need to build the infrastructure, and we were just three really smart, passionate people saying: I think we can do this. That’s how I kind of took a very windy career path to get to where I am. What you can accomplish with a group of smart people, the impact you can have in the world, it has all the ingredients of what I wanted on this huge global scale. It’s so rewarding. I feel really lucky to get to do what I do.

HRF:
It’s an awesome story. Let’s go a little bit further. So, when you launched Cloudflare, there were a lot of different offerings and things to be excited about, but this was also during that time period, what we might know as the Great Recession, and there are a lot of unknowns about a lot of different things. What was the initial reception of Cloudflare? And then, following on that: How did you attract investors and customers?

MZ:
So, fast forward today: We’re 2,500 people, we’re publicly traded, we’re on the New York Stock Exchange, we did over $600 million in revenue last year, growing 50-percent. So that’s where we are today. But when you start — you only hear about the failures, by the way. All the data is like: Most companies fail, they don’t succeed. And so we have always been a very big, ambitious team and idea, which is so amazing.

Your question, What was the reception like?, it depends who I talk to. There are some people who loved that we were so big and ambitious. Their eyes lit up, and they were like, “I want to be a part of it.” But for every one of those conversations, I had nine conversations of: I don’t get what you’re talking about. Are you an expert in this? Or are any of you an expert? Doesn’t this already exist? You’re going to get crushed, and here are all the reasons it won’t work. I just share that because there are a lot of founders listening, or even early team members of early-stage companies.

The conviction you have to have to lean into an idea, it’s not like it’s obvious. If it were obvious, everyone would be doing it. Of course, some people who you talk to, it’s obvious to, and they get really excited — and that’s the thrill. That: Oh my god, you get it, let’s do this together. Come work with us, come partner with us.

But there were a lot of people who wrote us off as: This is never going to work, this is crazy, you’re for sure going to fail. It doesn’t feel good, but I almost think that’s a sign you’re onto something really big, that not everyone agrees with it. If everyone agrees with it, you probably can understand all the dimensions a little bit better. It’s almost too clever by half, is maybe what I’m trying to say.

For us, we got the first employees through our networks. There was somebody who was doing their PhD at the University of Santa Cruz, and his advisor left. He was doing a PhD in analytics. Turns out, if you’re going to power a big portion of the internet, data’s a big deal. You need analytics, you need someone to handle all that. And so his advisor had just been recruited away to Google, and being a PhD student without an advisor is not a good place to be. And so we used that to say, “Come put what you’re studying to use.” And he said, “OK, I’ll go see where this leads.” That was the first person we recruited.

The second person was a French systems engineer, C-level programmer. Because, again, when you’re going to build a global network that does all these things you do, you need to write a lot of low-level code. We found this person on LinkedIn, and he was employed as a web developer at another cyber security company, and we said, “You seem like you’re in the wrong job.” And he was. He’s like, “I’m only a web developer because of my visa status. It’s the only way I can get a visa. I’m a French engineer. I want to stay here.” And when we told him, “Hey, you can write C-level code, and we’re trying to help make anything connected to the internet faster, safer, more reliable,” he’s like, “Oh my god, I’d love to be a part of that.”

Those people were so excited to lean in and join the team and build and come to work every day to do this. Don’t get me wrong, I talked to a lot of people who said, “I don’t understand what you’re doing.” Or, “Come talk to me when you have a hundred million dollars in revenue,” which took many years, by the way. But that’s a little bit of what we experienced early on.

I don’t know. Again, I think that that’s really a sign you’re onto something really big, when not every single person gets it, but there are some people who do get it.

And then, on the investor front, which is, obviously, always top-of-mind for founders, I guess my point of view, or things that I’ve learned over the years, is that there are two ways to raise money early on. You either raise on traction, or you raise on a story. Cloudflare was very much in the latter camp. We did not have revenue very early. Revenue took a long time.

And so we really had to raise money on a story. The idea that we had this big, audacious goal. We kept making progress, we showed progress, but it wasn’t money. The progress wasn’t monetary, it was other progress. That was the way that we were able to end up raising some initial money, and then over time, more money.

Again, eventually, the revenue came, but that was not what drove investors early on. Having met many investors in my career at this point, I think you want to pick ones that align with what you’re trying to do, and, being honest about it, and I think that we are really lucky doing that at Cloudflare.

HRF:
So you have investors, you have a couple of employees, you’re starting to build out the start of the company. How did you think about attracting some of those earlier employees? Specifically, maybe something to build upon is: Are there any learnings you took away from that early-stage company-building around certain milestones? Or just tidbits that you think would be helpful to share?

MZ:
Yeah, for sure. Well, let me start by saying: You ask 10 smart people this question, you will get 10 different answers. There are lots of ways to be successful in life; let me just start with that. There are lots of ways to build a successful company.

My point of view on this will be different than some other very successful entrepreneur’s point of view, because, again, there are multiple ways to do things. But, for us, and we felt like this very early on: At the end of the day, you have nothing without a great team. So we really took getting great people to join our team incredibly seriously. By that, I mean it was part of Matthew’s, Lee’s and my job. We spent a lot of time involved in the recruiting early on.

As I reflect back, I think part of it was because we did not have a track record. And so I think you have to, for the audience listening, you have to be honest with yourself. Do you have a track record? We were post-MBA students who showed up in Silicon Valley with very weak networks here. That was like the promise of Silicon Valley: Come here. You can be anybody and show up here and have a chance to build something big. But you’re competing with the Facebooks and the Googles, who have a network. If you have a network, you call somebody, they answer your call. I called someone back 11 years ago, they were like, “Who are you? I’ve never heard of you before.”

And so I think, early on, we didn’t have as much of a track record. I think if I started another company today, it’d be different. I have a track record; I have a network. It would be different today. But back then, we didn’t.

So for the founders listening, who don’t have a big network or track record, I think one of the strategies we ended up employing that worked really well was that we were involved. What I mean by that is we reached out to people, we got on the phone with them, we did the phone screens. I will tell you: it sets you apart if [they’re] talking to a recruiter at another startup.

If you’re a candidate, an engineer, and you’re talking to the founder of one company, who’s so passionate about what you do — most founders are really passionate about what they’re doing, they have such conviction and passion, otherwise they wouldn’t be doing it — versus a recruiter at another startup, it just gives you a different dynamic. Again, you have to have the right job, it has to align, but it keeps you in the conversation. So now you can try and tilt the risk reward in your favor.

So that’s one thing, we were, and are, very involved. Fast forward to today: again, 2,500 people at Cloudflare, Matthew and I still each spend 20-percent of our time recruiting. 20-percent of our time. That’s two hours a day. Or a day a week.

HRF:
Wow.

MZ:
So much time. All of our hiring managers spend a lot of time. At first, it was us, but this evolved over time, of course. We have a recruiting team, they are amazing, but they partner with the hiring managers to get great people to join Cloudflare. It’s the hiring manager that’s responsible for hiring their team. They run the process, they partner with the recruiter, but: Someone’s coming to work for you and your team, you have to be involved.

It’s interesting, over time we’ve had a lot of senior executives join our team, and that’s not how most companies run their recruiting. Most companies just don’t [do it]; they outsource it to external recruiters or recruiting teams.

I’ve had several senior executives [say] I was not a believer of this model, but now I am, because the retention ends up being a lot higher. People join, and there’s a lot more alignment and fit, and they stay a lot longer. And so it’s been, I think, a good thing. That’s one thing that we did, that I think maybe will resonate with the audience; or two things, I guess, depending on how you count it.

The other point I’ll bring up, and, again, this was [back when] no one knew us — early on, it’s: How do you get awareness about what you’re doing? Or: How do you even get awareness around what you’re doing? You think, Oh, I’m going to hire a PR firm, and they’re going to do some marketing, or some PR. But the journalists don’t want to write stories about early-stage companies, because most don’t stick around. So it’s hard. There are niches, and there are things to do. And so it was [a question of], How do you build an audience and awareness without spending a lot of marketing dollars? Because we did not have a lot of money early on.

One of the things that worked really well for us, that I’m going to share with the audience, that has ended up helping with this talent/people side, is we started to write a lot. We built an audience. What I mean by that is we literally wrote a corporate blog. If you go to cloudflare.com/blog today, it’s a very well-read blog. In fact, it gets more views than a lot of media properties, and we don’t advertise on it. But the point is, we started to blog about technical problems we were having. By technical problems, literally, we had engineers saying, Here’s the code that I’m using, and people would, in the comments, help us decipher the problem with the code.

HRF:
Incredible.

MZ:
It would be very deep. We wouldn’t do that now. But back then, you could. When you’re a startup, you can do these things. You can have a personality. It turned out that there are developers around the world, there are engineers around the world that were reading about this, and we started to build. They loved to read our technical blog, and then they would apply to work at Cloudflare.

So, all of a sudden, when someone’s applying to work for your startup or your company, it changes the dynamics, versus you reaching out to them. It’s a different thing. They’ve expressed interest, and so then it’s about lining up the fit and making your expectations right, versus trying to convince someone to even learn about your company, to come and learn about the role.

For a long time ,not anymore, but for a long time, 50-percent of the people we hired applied through our website to work at Cloudflare, and that’s how we ended up hiring them. I remember when I shared that with other founders, they were like, “I don’t even read our resumes that come through our website, because that’s never good quality.” I think that that can become, again, a strategy you can use to help go find the right people, because the world is a big place. If you put out good content, people can help find you.

Now, on the flip side, we were lucky. Matthew, my business partner, is a great writer. Our employee number 20 at Cloudflare ended up being our CTO; he’s a very good technical writer. We had some very early teammates who were very good writers, and then it attracted more great writers. I’ve met some companies who are like, “I want to replicate the Cloudflare blog,” and they give it to their marketing team. And I’m like, “Our blog is not run by our marketing team.” And they’re like, “What do you mean?”Our blog is actually run by our CTO.

And they’re like, “That doesn’t make any sense. The engineers surely aren’t writing it.” I’m like, “They kind of are.” We have editors and we help, but it is by the team, for the team. And so I think you also have to know who you are, I guess. Don’t try and fake it, if you’re going to take that strategy. I think it worked for us because it was really core to some of the skillsets we had.

HRF:
Yeah. It’s almost like for founders, and others, just even executives, that they think about: What’s a unique strategy you could implement into your own organization? I see that as a very interesting takeaway. So putting the team in place in Cloudflare allowed you guys to really achieve considerable traction relatively early, and the company has continually expanded throughout its existence.

Walk us through some of the major milestones that you are most proud of.

MZ:
One of the things you said was traction early, so I just want to say a part of that, and then I’ll go through the milestones, because this is something that I try to share — insights that maybe you don’t always hear. Because, again, I’m sure folks that are listening listen to others, too. I feel like there’s some common advice you hear over and over again, and there are some things that I’m like, ”Why didn’t anyone ever tell me this?” Because as soon as I learned it, I was like, “I wish someone had told me this.”

It’s true, we did have traction early on, but it wasn’t revenue traction. I make that point in an important way, because what I think is interesting as founders or leaders at early companies is you get to pick the metrics that you measure traction on, and it doesn’t necessarily have to be revenue. Of course, revenue is the best one. But if you don’t have it, pick other metrics that move quickly, because that’s one way to help demonstrate traction. Of course, they have to be legitimate to your business.

And so, early on when we were setting up Cloudflare, we had a slide that opened every single board meeting, and it was the exact same five metrics that we got to pick. For those metrics, we picked ones that would change quickly, because we wanted to demonstrate traction. You have a lot of decisions on how to frame your business, and the ones [we chose] early on were examples of how many customers were using Cloudflare. But customers move slowly. It’s linear. One customer to one customer to one customer. And so that’s not a very fast-moving metric, usually. Sometimes it is, if you’re like Clubhouse.

The other metric that we ended up using was the number of page views that were touching our network. Because, again, we were showing that we were trying to make things faster, safer, and reliable. [With] customers, you go one by one, but customers come with different amounts of traffic to their web applications or websites, and that metric grew really quickly. Because if one customer had, call it a website with a hundred visitors, and then another customer showed up, and their app got a hundred thousand views or pieces of traffic, all of a sudden, that metric looked like it was growing.

It was an appropriate metric for us, because we had to make sure we could service that traffic, and that was really critical. We had three others. But that’s an example. No one told us to pick that metric. We picked it to help demonstrate the progress we were making and the traction, because we knew revenue was going to be a lagging indicator in our business.

So I share that, because I think for four years we used these same set of metrics. At some point, we started to have real legitimate revenue, and then revenue became one of them. It was actually revenue per employee, because we wanted to show the leverage in our business. But that was just something I wanted to share on the traction side, because I think that might be helpful to some folks.

So, some of my favorite moments. There are so many. There’s no better feeling than shipping a product that customers love, and talking to a customer and them being like, I love your service. You, literally, have saved our bacon. Or I’m meeting people in person. Sometimes people have hugged us saying, “I literally sleep better at night, knowing you’re in front of my infrastructure.” It’s moments like that, that what we do matters.

Back to why did I start this — I wanted to do something that mattered, I wanted to make a dent in the universe. I love that.

It’s not me, it’s never me. It’s the collection of people at Cloudflare who get up every single day to build these things and to work really hard to put our best foot forward. I always played sports, I love being on a team, I love the team aspect.

I think as a leader in a growing tech company, you can have those same aspects at work, and I love that. By the way, I’ve had a lot of jobs where that’s not the case. That’s not a given, but you can create that sort of environment. I think that those are some of my favorite moments. When we took our company public, that was so — I was so proud. How many people start companies and take them public? Very few.

At the time, we were the 210th tech company to go public at the New York Stock Exchange in 10 years. And I was like, we’re the 210th? Now, there’s the Nasdaq, so the number is bigger than that, but it’s not many. I remember going to meet all these public market investors, you’re trying to get them to become shareholders in your company.

By the way, if you raise money once, you’re going to raise money many times. I’ve, at this point, raised over, what is it, 1.5 billion dollars? It’s a lot of money. I’ve raised a lot of money between private and public shareholders. So if you don’t like fundraising, you just learn to get good at it, because it doesn’t go away. It’s not going to go away, so you might as well just learn the skill now. You’ll save yourself a lot of headaches.

I remember sitting in one of the public market investor’s offices in New York, this is before the pandemic. We did this stuff in person. It was interesting. I really like our venture capitalists, they are always rooting for our success. But we always thought of public-market investors as a bit, We don’t care about what you’re doing, we just want shareholder returns. So we were meeting these investors in New York and then, literally, the managing director looked at Matthew and I, and he said to us, looked us straight in the eye, and he was just like, “You two should be very proud of what you’ve built, because most founders never get to this seat.”

You’re there, you’re serious, I’m taking this really seriously, and I was just like, You know what? It really was nice of him to say that. I was like, I am proud. And so when we went public, we had 150 people at our team come to New York. There were current team members, we had former team members, we had our board, we had our families. Because, it turns out, it takes a village to build a company, both at the company and outside of the company. And then we had parties or celebrations in different cities.

I remember looking out at the sea of people on the floor of the New York Stock Exchange, and I was just like, this is such a proud moment for all 1,100 people, and I had this moment of: We would not be here without every single person showing up and caring and putting their best foot forward every day. Whether you were on the administrative staff, or customer support, every single person did something that allowed us to get to this point, and that just was a really amazing moment to celebrate as a leader. It was definitely one of those proud moments where I was like, Wow.

And then when the world needs you most. In the last years, you think of COVID as a public health pandemic — which it was, we all went through that. But when you couldn’t see people in person, everyone shifted to online, they all used online to connect and to do things. So what has been less reported is, basically overnight, the traffic online doubled.

When you are a service like Cloudflare, providing the infrastructure, it doubling in [a] week period was insane. And so it wasn’t just us, it was all the cloud companies. I look back and think: How many network administrators, IT engineers held the internet together when the world needed it most? Sometimes I think if COVID had happened 10 years ago, it would’ve been way rougher, because we wouldn’t have been able to stay connected in other ways. Not that it was easy, but I feel like people could connect to loved ones through video conferencing and whatnot. Ten years ago, I really don’t think it would’ve happened.

And so that was something, it was just a moment where I kept reading the news and being like: The world is a terrible place. Your friends are getting sick, your family’s getting sick, it’s so hard, you’re taking care of your kids. It was just a very stressful time. But I would go to work. I almost escaped reality by going to work, because the stuff we were doing mattered so much for people. That is a really good feeling, if you can create that. Or, for me, it was a really good feeling.

And then I can keep going on. The vaccine distribution, all those sites distributing the vaccine. Turns out, infrastructure can help. So we had something protecting all of them. We literally have videos of people whose jobs were vaccine distribution being like, “Thank you for saving lives.” I don’t know, it makes you weather the bad days, because there are, of course, bad days. I’m talking about all the good stuff.

There are a lot of proud moments over the course of my 11-year career at Cloudflare.

HRF:
Yeah. And just so many different aspects you guys have been able to touch and go through. There was something you said in answering that question, related to employees, and how important every employee in the company is to Cloudflare.

Right now, we’re in what people are calling “the Great Resignation.” People are looking for new roles, there’s a lot of movement happening in the market. We’re not seeing that as much at Cloudflare. You guys have a very low attrition rate compared to other companies in the ecosystem. Why do you think that is, and what are some of the attributes, when you think about working for Cloudflare, that make people want to stay there?

MZ:
Well, you’re being very gracious, Holly. Don’t get me wrong—

HRF:
No, I don’t think you’re being as impacted as other people. Where I sit, at least, I see movement of certain companies right now, where I’m like, wow, that company is losing a lot of people. I never have seen that with Cloudflare. But I’m just curious: What is it about the Cloudflare culture, or things that you do that make people want to stay? You don’t all have to share all of the secret sauce, because then people will start adopting that. But I think it’s helpful insight for others.

MZ:
Yeah, of course. I want to make this helpful to your audience. This is for the founders listening, or maybe leaders listening, because I don’t think it’s just founders that have to learn this lesson.

I remember early on at Cloudflare somebody telling me they were leaving, and I was mad. I was like, “What? You’re leaving? We’re not done yet. You can’t leave. Sorry, excuse me? We’re working our butts off. What do you mean you’re leaving?” And it was a surprise, and I was just very upset. I was mean to the person about it. I gave them a hard time, some version of what I said, I was just like, “How could you be going?”

I tell that embarrassing story because, again, it was definitely not me at my best. One of the hard lessons I’ve had to learn as a founder at Cloudflare is that the people you start the journey with are not the people you end the journey with. Sometimes it’s, they choose to leave the journey sooner than you’d like, sometimes you need to tell people “it’s time for you to get off this journey,” and both are very hard, by the way. I think that I’m still not perfect to this day, but what I’ve since adopted, I like it a lot better as a leader, so I’m just sharing it.

You read stories — I don’t know Michael Bloomberg, but you read about when someone left Bloomberg, he’d hold a grudge forever. So I’m not the only person to have this reaction of, “What do you mean you’re leaving? I’m going to exile you for my life.” Again, I don’t believe that.

I’ve now said, “Hey, thank you so much for everything you’ve done here. We wouldn’t be the company without you being here. I’m wishing you all the best in this next chapter. If I can ever be helpful, let me know.” [Some] people take me up on it, others don’t. Sometimes it’s happy they’re leaving, sometimes it’s sad they’re leaving. Sometimes we’ve made a mistake, sometimes they’re just fed up, and I’m like, “I wish you’d told me.” I think that lesson of “people you start with you’re not going to end with” was a hard lesson for me to learn as a founder, because I was just so loving what we did.

I like to share that, because I just think how you join companies and how you leave companies matters a lot as a candidate, and also matters as a leader — how people join companies and leave companies. I think it works both [ways]. It’s a dynamic in both directions. So I’ll start [with] that.

Now your question around [retention]. We have attrition. So, normally, our attrition is about 12-percent annually, which is low for a tech company. There are some other external metrics that show it’s 14, 15 and 16-percent. So we were always on the low end of annual attrition.

I think part of it was: success helps, strong momentum, big opportunity. This was leading up to going public, and then we were public, and so there’s liquidity and real wealth creation. All those things help. Those are all part of it. I think our mission is to help build a better internet.

There are a lot of jobs in the world. Someone’s working at Cloudflare, they’re getting recruited to go work anywhere. They literally could work at any single company in the world, if they work at Cloudflare. I strongly believe that. But they believe in what we’re doing. Because we spend so much time recruiting upfront, or aligning expectations, that’s when we’re at our best.

So now, during COVID, that 12-percent has ticked up to 16-percent on average, some teams are higher, but that’s it. I, too, have heard from many other tech peers, where they are seeing 25- or 30-percent annual attrition. That’s a lot of your team leaving. Great resignation is true.

I have no secret sauce, except for we’re deliberate in the recruiting process, so that there’s a strong alignment. Again, hiring managers are aligning. So it’s very clear why someone’s getting hired, who they’re going to work with, that. Again, I think why people leave companies is often their manager. But if the manager is very involved in hiring people, you kind of de-risk that. Now, [there’s] lots of movement inside of growth companies, so that’s not foolproof, but that’s that.

I think that we want people to feel like they belong at Cloudflare. We care about that. We want people to feel like: I can do great work here and my work matters. And so the other thing that we have a lot of process around or focus on internally is, what are we accomplishing as a team? And what are you doing as a team?

So I’ll give you an example of, up until very recently — I can’t do it right now, because we outgrew it, but for a long time — I would recruit someone, and they’d be like, ”Who makes decisions, and how do I know what needs to get done?” I think that’s what people get lost in.

People want to feel useful. You want to feel like you’re set up to do good work, and you can move the needle. And so at Cloudflare, we are very set up to make sure people feel like they are moving the needle, or can make an impact on what they’re doing. So if you’re a product manager, what products are you building? Are you shipping? How many customers are using it? If you’re in the customer support team, how many tickets, how many customers are you helping? What are we doing to make our processes better?

We are very, very focused on doing things and getting things done. So starting something, middle, and shipping it. So for years, ship, ship, ship, get things done. Start, middle, end. I have rolling thunder. We had so many different leadership terms. I used to be able to pull up a spreadsheet on a quarterly basis. Early on, it was every three weeks, and it went to every six weeks, and then we went to quarterly, with the 200 most important things going on at the company, who owned it, a link to an a Jira or Wiki page. Every week, whether it was green, yellow, or red, is it on track? Is it void, or is it delayed or at risk for getting done?

So we had this very strong muscle of: What are we doing, and are we getting things done? I think that helped with people [choosing] to stay, because they were like, “I’m doing things here, and my work matters and it gets celebrated.” In that spreadsheet, it wasn’t my name next to it, and it wasn’t even our head of marketing’s name. I remember executives always wanted to put their names. I’m like, “I don’t want your name next to it. Who on your team is owning this?” The idea was, it’s not the executive owning it, Who on your team owns it? Who do you have to go work with? And [that] was this muscle.

I think that it feels good to be useful, productive, contributing in this growth, and I think that has been hugely helpful to why people stay at Cloudflare, because they feel like My work matters. And it helps to weather some of those down days, where you’re like: Everything sucks, but my stuff, what I’m doing here, actually matters.

When you have 20-percent of the web touching your service, you can really make an impact at scale — and we’re still a relatively small team. Again, we’re not immune to it, but I think some things like that [help].

The last thing I will say on this, because I think it’s the last point, is that it’s stressful. One thing I saw, especially from a lot of executives — we were talking about this a lot last year, and now it’s everywhere. But Matthew, my business partner, at our all-hands — we have quarterly kickoffs talking about what we’re going to do, and then we measure ourselves at the end of the quarter.

In the summer, last year, in his opening remarks, he said, “We are going to lose some of our people.” He basically said what everyone was thinking and reading, and our executive team — we always do practice runs — was like, “You cannot say that, Matthew. You have to convince people why this is such a great place to be, you have to build up the opportunity.”

Matthew’s like, “That’s B.S. Everyone’s reading about a Great Resignation. We are not immune. I’m going to name it.” And he’s like, “Some of you are going to leave, and that’s going to be sad. I hope you don’t, I hope you stay, but some of you will, and that’s sad.” So he just named it, he did that twice. I think that just let some of the air out. That was not what the leaders wanted. The leaders wanted Matthew to talk about why everyone should stay. And he was like, “Some of you are going to leap, and we’ll be OK.” I thought that was interesting.

And then OK, what are we going to do to get everyone to stay? Again, of course, you want your team to stay, but our strategy was a little bit: Now’s the time to be the company to come to. And so how do we go get great people at other companies that you thought would never leave their job to come be part of what we’re doing here? We almost used it as a don’t play defense and keep everyone, it was more: How do we play offense and be the company that people are coming to?

[In a] management meeting, a lot of people were like, “That’s a stupid strategy.” They weren’t on board with it, but it started with one executive, and the executive I never would’ve guessed and said, “People who I never thought in a million years are returning my phone call, and they are interested in joining my team.”

It just took one brave person at that leadership team to say that, and then the next week, someone else had a story like that, and the next. And then pretty soon, the people who said this is a crazy strategy looked like dinosaurs. It’s like, maybe you’re the problem. Everyone got very on board with: We’re the company that people are coming to. It’s much easier when everyone lines up, but there was disagreement on what the right strategy was, and those are just some things that might resonate with the group.

HRF:
Yeah. Moving to another subject, when you say Cloudflare provides the backbone for 20-percent of the internet, I think of the subject of trust. Because, on a day-to-day basis, Cloudflare is largely behind the scenes, and yet, by the nature of what the company does, you guys have to talk very publicly about decision making, or any challenges the company has been dealing with. How do you and your co-founders figure out how to approach this?

MZ:
Oh, I love this. I think there’s something that Greylock really believes in. You are entrepreneurs and founders of responsible leadership. Being a leader is a huge privilege, it is a responsibility, and I take that really seriously, and Matthew takes it really seriously. Lee, our third co-founder, is extremely sick, unfortunately. It’s a tragic story. So he left many years ago. But Matthew and I are still running the business, and we’ve always taken this responsibility seriously. Frankly, I wish more founders would. Because sometimes you read about these things, and I’m just like, god, these are people’s livelihoods and customers. I think it’s a big deal.

We build infrastructure for the internet. Again, we have startups who are our customers, we have governments who are customers, we have 20-percent of the Fortune 1000 who are now Cloudflare customers, we have a ton of developers around the world.

Again, 27 million internet properties are users of Cloudflare, and every day, lots of new people sign up. When we started Cloudflare, I think, especially in cybersecurity, the way that you built companies was with a lot of fear, uncertainty, and doubt. It was called FUD. In fact, we were launching our company at TechCrunch Disrupt, which was the thing to do back then. I don’t think you would do that now, but that was the thing to do when I was starting my company.

We were trying to get awareness, and you practice your pitches before you go on stage. And so we actually came to Silicon Valley, I can’t remember whose offices. It wasn’t Greylock’s, it was someone else’s. But it was a bunch of VC’s who were there, the judges. These founders were practicing their pitches, and they were giving us feedback. So Matthew and I came in and we practiced our pitch. You get three minutes to pitch, three minutes of Q&A. Literally, afterwards, a bunch of the cybersecurity investors who, of course, were the ones who got to judge ours, because we had that element in our pitch, were like, “You guys need to have more FUD in your messaging.” Matthew and I were like, “But we don’t want to sell FUD.”

Our messaging was, give us [the chance to] supercharge your site. And they were like, “You got to make people feel the pain more.” And I’m like, “But that’s gross.” It was that situation. So, anyway, back to principle leadership: I think that we led our company a slightly different way, and we had some assumptions early on.

We thought it was important to have a face to the company. What I meant by that was: We were groups of people working on this. Because of what we were doing, we felt we sat in a very privileged place online, and that when it works, it provides a ton of value. Again, 80 billion cyber attacks were stopped every day because of the technology we built. It’s amazing, you can make things faster and safer. That’s all the good side.

The shadow side of that is: Are you like a big brother watching everything? That’s kind of sketchy. And so, early on, we thought it was really important to have a face to Cloudflare. So we showed up to things, we had public profiles. If you go to our team page today, it is not just the senior leader team, we have a picture of every single person at Cloudflare on that page. The point is: this is a service made by people for people, for companies, and we take responsibility, and we hear. I’m just trying to share some of our thinking. Updating that page is annoying. [People working on it are occasionally like,] “Can we just get rid of it? We’re so big now.” And we’re like, “No, keep going.” These are things that we cared about.

And then there were things that happened where: bad things would happen, sometimes there would be a security breach or whatnot. And you don’t have to talk about these things — in our space, the common approach was not to talk about it. We felt like to build trust, you need to be transparent. We believe it’s important.

And so we started to be really transparent about why we were building something, or, when something went wrong, what happened and what we were doing to fix it. We were very committed to being transparent, both internally with our team — we shared a ton of information, we still do to this day — but also externally.

The world has really changed in the last 11 years. Now so many more companies are more transparent. It was interesting how that was not the case, but we were trying to share why we made a decision, what we were going to do about it. That’s a big responsibility, but it was a choice. No one told us, I don’t even think it was conventional, but it was a choice that we made, and then you got to stick with it because there are implications in both ways.

And so I tell that story, because, to all of your founders: When I started Cloudflare, I didn’t really think of myself as a leader. I thought of myself as starting a company, in there every day, trying to make it happen. But you are a leader, and you can choose, and your choices can make an impact on how your business is run and the experience your team has and your customers have, and you should really take that seriously. I think that the world is craving leadership that’s authentic and principled.

HRF:
Yes.

MZ:
I think that, if that is something you’re interested in, lean into it, because you will get great people to work for you, they’ll stay, they’ll come, they’ll be like, I choose you over other things because of all these things, investors will back you because of that. It’s a choice, and we just took it really seriously. It comes back to [the fact that] trust was really important, based on what we did, and this was how we helped to accrue trust.

We had to accrue trust on a daily basis. It seems like we’ve always had it, but literally it’s been 10 years of being really thoughtful about it — and it’s a fragile thing. We take it really seriously.

HRF:
I want to get into a few audience questions, but right before we do that, I would love just a quick overview of Cloudflare’s main areas of focus for the next couple of years. What are you excited about, and what do you see as new opportunities of challenge?

MZ:
That’s great. Thank you so much, Holly. OK. Here’s another thing that I think we have a different point of view than other leaders on this question.

So, Cloudflare, we run this global network, we do performance, security, and reliability. By the way, you could build a company just doing the security side, and you could build a different company just doing performance; you could build a different company [around] reliability, but we do all three.

We help protect web applications, websites. We also help protect networking, which is a totally different buyer within an organization. And oh, by the way, we also do everything under zero trust, so employees accessing information, identity and access management — same platform we’re using. And then we are helping build the next compute platform under serverless. So we do a lot of things.

Sometimes the advice you get is “focus on one thing and go really deep,” and I think that that is a good example of how to get good traction, and traction matters. But you also have to make sure you don’t run out of time, because you want to grow for a long time.

Our strategy has been sustained growth for a long time, endured growth for a long time. So for the last five years, we’ve been growing our revenue 50-percent annually, which, there aren’t very many companies who have been doing that. That’s a rare set of companies that we sit with. A lot of people are excited about Cloudflare, because it feels like, wow, we’re set up, we’ve laid the seeds to grow for a long time. So when you look at where we’re going to invest in the next five years, it comes back to the strategy. We’re going to continue to invest in getting more customers to adopt the services we already have today.

We do a lot of things today, we have lots of customers, but we’ve barely penetrated the market. There’s so many other customers to get. I’m sure a lot of people listening today aren’t Cloudflare customers. Or, again, we have a bunch of the Fortune 1000, but not the rest. And so we’re going to continue to grow the number of customers using our service, for sure, based on what we currently do today.

But then we’re investing a ton in our product engineering teams to say: We are not out of ideas. We want to go build the next set of products that we can then go get into the hands of our current customers.

Today, 80-percent of our customers use four or more of our services, which is amazing. But then those new products that our teams are building also help us go get the net-new customers. So it’s like, get customers, solve their problems, use those insights to build new products that help us go get net-new customers and expand relationships with current customers.

If we just do that, we’ll grow for a long time, and so that’s really what we’re very focused on. It’s investing in the product engineering across our global network, and getting great people to join to help make this all happen. That’s how we’re thinking about it.

I’ve been in many of your shoes before, where people used to give us a hard time for investing across so many product areas. In fact, we had a management meeting like five years ago, where our chief security officer said, “Cloudflare is a mile wide and an inch deep.” And then his colleague is like, “Is that a compliment or a slight?” But it’s always been part of our strategy. We wanted to do a lot, because we want to have a big team and grow for a long time, and expand the relationships with the customers we have and go use it to get new customers.

I think, today, that makes people really excited about what we’re doing, and puts us in a good strategic position. But I say that story to founders, because sometimes the pressure is to do just one thing, and one thing really well. And that is an approach. But this is another approach that might spark some of you.

HRF:
Yeah. Well, jumping into a question: You’ve been in a unique spot, where you’ve had to add independent board members, and you now are serving on the board of Atlassian. Do you have any advice for founder/CEOs with regards to how to think about, or maybe how to approach, that independent board member slot?

MZ:
Of course. Just like investors, pick people wisely. It’s recruiting for your team, for co-founders, for life partners, for your investors and board members. Choose partners wisely. So yes, for the board, I think you want people who are excited about what you’re doing and believe in what you’re doing — and can add value in some way. If, at your gut level, you’re like, this person wants me to go left and I’m going right, I probably wouldn’t get them on your board, because it’s just going to cause a lot of friction, and you’re going to have to manage that.

HRF:
Yeah. Even if someone’s telling you, ”This is the best board member, you should add them,” — trust your gut. You know your company the best.

MZ:
Exactly. It’s easy to give advice. It’s easy for me to sit here and give you advice. You’re the ones that have to show up every day and run your company. So I think the people matter. I think one of the things that seems so obvious now, and there’s lots of great content around it, is: What kind of skills do you want on your board? Do you want the operating skills? Do you want the CEO mentor? So, someone who was a CEO at a company ahead of you to mentor. Do you want technical expertise? So, if you’re a really technical company, having some technical expertise on the board.

One of the skillsets we need on our board, which is atypical, is public policy experience, because there are a lot of rules changing around the world, and we operate as a global company, so we spend a lot of time thinking about public policy, we’re very invested in that. And so having someone with a European standpoint on our boards has been great. Those are some of the skill sets that it’s actually helpful to think about. When you talk to a good board member, the first thing they ask you, as candidates, is, “What are you looking for in a board member?”

And so you look more grown up and professional if you have a good answer. Oh, I’m looking for a board member that has great operating experience at scale ahead of where we are, and we’re currently at this many people in this much in revenue, but we’re hoping to grow to this. So I’m looking for someone to learn from who’s been ahead. Or, I want someone with a rolodex to the Fortune 500, because that’s the segment we’re going after next. The really good board members, they have choices. They want to know: What are you looking for? And so I think being able to succinctly answer that is great.

HRF:
Yeah. OK. One more question, and then, unfortunately, we’ll have to wrap up. I feel like I could keep talking to you forever, Michelle. You have so much knowledge and expertise.

But one thing I know that someone asked is: From the election to the pandemic to geopolitical instability, how do major events happening all over the world impact what you guys do at Cloudflare?

MZ:
On a human level, it’s hard. You’re all living all of those things. I literally said to someone on our team yesterday, I’m like, I’m so grumpy, I’m so tired. It’s been two years of chronic stress. You have flight-or-fight mode, but we’ve been in fight mode for two years, all of us have. All these events have been awful.

I didn’t realize quite this when I started Cloudflare, but it came back to wanting to make an impact. The internet is just becoming more important to our lives, not less important. Technology is becoming more important to businesses, not less important, and that’s part of this. There’s a huge groundswell. Things are changing, growing. Given all the events of the last two years, it’s been amazing to see how much the internet has played a role in helping solve some of those problems, keeping us together, keeping things going.

Again, our business happens to be right in the eye of that. I heard Satya Nadella speak recently, and he said, “It’s the golden age of computer architecture.” And I was like, It is. It is the golden age of computer network architecture, because there’s this huge shift from on-premise hardware and software to cloud-based services, and it’s still pretty early innings. There’s a lot more coming online, a lot more [with] how we’re connected.

These pandemics or crises that we have in the physical world, turns out were very connected to the internet world. It’s almost a whole ecosystem. I think sometimes people think tech is a fad. I’m like, it’s not a fad, it’s only becoming more important. So all of you that are working in it, you’re in the right place. What you’re building today is going to become really important 10 years from now, and that’s a huge responsibility.

It’s super fun. It’s also really hard work and tiring and stressful, all mixed up together.

HRF:
Well, Michelle, it’s been so great having you here with us today. Thank you, again.

MZ:
Thanks much for having me. Thanks, everyone. Good luck with everything.