The internet, faster and safer by default.

Cloudflare began with a request from its own users. In 2004 Matthew Prince and Lee Holloway built Project Honey Pot, a system that let any website owner track how spammers harvested email addresses. Thousands of websites from more than 185 countries joined. They liked seeing the attackers, but they kept asking for one more thing: do not just track the bad guys, stop them. A friend said the founders were building a firewall in the cloud, and the name Cloudflare stuck. By the founders' account the service went live on stage at a startup conference in September 2010, running in five data centers on three continents. It listed on the New York Stock Exchange on 13 September 2019.

One network instead of a rack of boxes

The problem it describes today is larger than spam. For years, the company says, enterprises strung together hardware boxes from different vendors to protect and speed up their networks. As those jobs moved to the cloud, stitching together a separate cloud service for each need brought its own latency, support work and overhead. Cloudflare's answer, in its annual report for 2025, is to consolidate behind one provider that runs in the cloud, which it calls a connectivity cloud: one network acting as a single control plane for security, performance and reliability across on-premises, hybrid, cloud and software-as-a-service applications. Increasingly, it adds, customers also build their own applications on that network.

The belief that set it apart was that protection did not have to cost speed. Early investors worried that sending a website through a security layer would slow it down, and the team became, in its own words, obsessed with stamping out latency. That choice shaped the network. Cloudflare says every service runs in every data center, that it operates in 348 cities and connects directly to more than 13,000 networks, and that 95% of the world's Internet-connected population is within 50 milliseconds of one of its data centers. It also argues that its incentives line up with its customers: it does not sell user data and does not aim to compete with them.

The web's new visitors are machines

Why now has changed twice. The first shift was the move of applications to the cloud, which made a room of hardware a poor fit. The second is AI. In their September 2026 letter the founders wrote that automated traffic passed human traffic in May 2026, earlier than they had forecast, and that it could reach 1,000 times human traffic within five years if trends hold. At a Seoul media session in August 2026 the company said AI agent requests on its network had grown at least 1,700% in a year. In February 2026 the CEO put the strategy in one line.

If agents are the new users of the web, Cloudflare is the platform they run on and the network they pass through.

Matthew Prince · Co-founder and CEO · Fourth quarter and fiscal 2025 results release · 2026-02-10

He described the business logic as a flywheel: more agents bring more code to Workers, the developer platform, and that code drives demand for the performance, security and networking services around it. The older products get a new kind of traffic to inspect, and the developer platform gets a new kind of user. Whether that loop earns as well as the old one is the question for the revenue chapter.

One sale day, four teams at work

Take an illustrative retailer preparing for a big sale. The web team routes the shop through Cloudflare so that caching and delivery absorb the spike instead of the shop's own servers alone. On the day, the same requests pass through security checks: the web application firewall, DDoS protection and bot management sort shoppers from scrapers and credential stuffing. Human judgement still matters here. Analysts tune the rules so real customers are not blocked, and in the one named Korean case, Olive Young's engineers said the first deployment needed extra tuning that Cloudflare engineers worked through with them, service by service.

Behind the shop, IT and security teams decide who may reach internal tools, and Cloudflare One applies those identity rules without a VPN. Developers can put request handling or a new feature on Workers without running servers for it. Each step belongs to a different team inside the customer. For Cloudflare that is the point: one network relationship can grow team by team.

For someone joining in Korea, this is the product to explain in plain words: a network in front of a company's sites, staff and code. Seoul has been one of its locations since 2012, and in August 2026 the company said it handles about 114 billion requests and blocks about 783 million threats a day in Korea alone. The work in Seoul is turning that traffic into contracts that reach more than one team.

Cloudflare sells three families of products on one network, through three doors. Small customers sign up on the web. Larger ones buy Enterprise plans from its inside and field sales teams or through channel partners: managed service providers, resellers, distributors and system integrators. At the end of 2025 it counted about 332,000 paying customers in more than 190 countries.

The front door: application services

Application services are the original business: content delivery, the web application firewall, DDoS protection, bot management and API protection for public websites and apps. Traffic reaches a Cloudflare data center first, rules decide whether each request is served, challenged or blocked, and cached content is served without touching the customer's own servers. The company describes network-wide threat intelligence as an input into these controls. Buyers are web infrastructure and security teams.

Act Two: access for staff, contractors and agents

Cloudflare One is the second family. It replaces the office VPN with zero trust access: each employee, contractor and, in the company's newest wording, AI agent proves who they are before reaching an application. The company says it delivers this full SASE service from 335+ cities. Buyers are IT and security leaders, and the sale is slower. On the May 2026 call the CEO said partners had been especially successful selling what he calls the Act Two products, which need a more consultative sale and careful integration.

The clearest named example in Asia is the Japanese company Fujitec. Facing a possible 32% rise in licensing costs from its incumbent vendors, it moved employees from VPN hardware to Cloudflare Access, covering 99% of eligible staff in Japan in about 40 days and all of them in about 45.

The developer platform, and a 2026 purchase

Workers is the third family: a serverless platform where developers deploy code to Cloudflare's network with a single command and no servers to manage, in JavaScript, TypeScript, Python, Rust and other languages. It is free to start. The founders say more than 7 million developers now build on the developer platform, against about 3 million the company cited in September 2025. In June 2026 Cloudflare bought VoidZero, the team behind the open-source developer tool Vite, for $164.2M, which adds open-source tools that web developers use to build their projects. Here it meets the large public clouds, which the company lists as competitors.

What one Korean retailer reports

Olive Young is the named Korean case. Before the change, its origin servers were overloaded during big sale events and influencer collaborations, scraping bots and credential stuffing raised database load, and a hub-and-spoke network on private lines made each new store harder to run consistently. In a proof of concept against other vendors, Cloudflare's real-time policy updates and low false positives came out ahead, and Olive Young chose its WAF and bot management. Its SRE engineer Taekeun Lee put the business case plainly: "Sophisticated scraping bots were a real business risk, causing price information leaks and database loads."

Cloudflare's case reports 25% better detection precision and mitigation time cut by more than 80%, from about a minute to near real time. Both figures come from the vendor's own story and reflect the customer's and vendor's measures. The next steps are plans: routing headquarters and store traffic over Cloudflare's network by the end of 2026, then Workers and AI crawler controls.

A Singapore case shows the same path. ComfortDelGro, a transport group in 13 countries, started with its booking services and reports bot-driven disruption cut by about 90% in the first months. It then added API protection and moved DNS for every business unit onto one portal. When it moved a UK subsidiary to Cloudflare in April 2026, the switch took under a week, against about four and a half months for the earlier provider's rollout.

The pattern across these cases is to land with a problem that hurts this week, such as bots during a sale, then expand into access, APIs and the network. That is the motion the Korea sales postings describe. All three cases are published by Cloudflare, so in an interview ask which Korean accounts have reached a second or third product.