28 added · 37 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
We currently protect more than 440 state and local election websites in 33 U.S. states, as well as election entities in six additional countries. • Cloudflare for Campaigns : Since 2020, the Cloudflare for Campaigns program has provided free security services to help candidates for public office and political parties in the United States defend against cyber attacks and election interference. • Project Cybersafe Schools : We launched Project Cybersafe Schools in 2023 as part of the U.S. government's Back to School Safely: K-12 Cybersecurity Summit.
(ii) to provide customers with the ability to build customized analytics for insights and intelligence to further optimize and secure their applications, such as monitoring for threats, understanding search engine crawler behavior and domain name system (DNS) query traffic, and analyzing any other real time data traffic; and (iii) to easily identify, block and control access from AI crawlers and AI agents and operators, a growing concern for content creators and website operators.
Initiatives We Support We also have launched various impact initiatives as part of our mission to help build a better Internet, including: • Project Galileo : Since 2014, we have provided free services to at-risk journalists, human rights defenders, and civil society organizations, at no cost.
The program now includes more than 3,000 domains operated by organizations in more than 120 countries. • Athenian Project : We created the Athenian Project in 2017 to provide U.S. state and local governments’ election websites with our highest level of security and reliability services for free.
(3) our developer-based solutions to 10 Table of contents build and deploy serverless and AI applications with scale, performance, security and reliability: and (4) our consumer offerings.
We also are committed to powering our operations with 100% renewable energy based on methodology developed by RE100, a global corporate renewable energy initiative, and setting near-term company-wide emissions reductions in line with climate science with the Science Based Targets initiative.
Our full suite of products consists of (1) our application services that help deliver security, performance, and reliability for any organization's applications connected to the Internet, including websites and application programming interfaces (APIs), and that also form the foundation of our newly announced efforts to allow content creators to monetize their work by controlling how bots, crawlers, and agents access their work;
(2) our secure access service edge (SASE) platform, which contains our suite of Zero Trust and workplace security services and network services solutions to help ensure traffic in and out of an organization’s network and devices is verified and authorized and data is protected and secured, as well as to securely connect data centers, cloud services, and branch offices to an organization with our Connectivity Cloud;
Our primary application security product offerings include: • Web Application Firewall (WAF) : Protects a customer’s Internet properties from common vulnerabilities like SQL injection attacks, cross-site scripting, and cross-site forgery requests, with no changes to the customer’s existing infrastructure, and also provides the ability to configure thresholds, define responses, and apply throttling rules across web applications and API endpoints. • Bot Management : Detects and manages undesired or malicious Internet traffic generated by malicious software programs called bots, while still allowing useful bots to access Internet properties through machine learning and behavioral analytics, and also includes Turnstile, our client side no-captcha alternative that can be deployed on any applications, including those that are not actively using our global network. • Distributed Denial of Service (DDoS) Mitigation : Protects a customer’s website applications, TCP/UDP applications, and networks and data centers alike, across network systems layers 3, 4, and 7 from DDoS attacks, which are malicious attempts to disrupt the normal operations of an application, targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. • API Security (API Shield) : Keeps customer APIs secure and productive with API discovery, integrated API management and analytics, and layered API defenses. • SSL / TLS Encryption : Manages encrypted secure socket layer (SSL) and transport layer security (TLS) web traffic to prevent data theft and tampering to improve security, as well as application and website productivity, and also provides with our Advanced Certificate Manager a consolidated certificate management experience with greater configuration for managing multiple certificates. • Client-Side Security (Page Shield) : Protects website visitors from customer-side attacks that target vulnerabilities directly in the browser environment. • Security Center : An actionable dashboard that provides insights into threats, risks, and configuration suggestions, acting as a security practitioner’s home page and summarizing insights from the all of our Application Security suite of products.
Zero Trust and Workplace Security Services These products shield users of a corporate network from attacks, inspect traffic for threats, apply privilege rules to grant access to the customer's data and applications, and help organizations connect, secure, and accelerate their corporate networks without the cost and complexity of legacy hardware. • Cloudflare Zero Trust Network Access : Enforces Zero Trust application access based on identity, including authenticating users accessing applications, seamlessly onboarding third-party users, and logging every event and request. • Cloudflare Secure Web Gateway : Filters all traffic crossing to customer employee devices to prevent malicious traffic reaching end-user devices, including inspecting and filtering DNS, network, HTTP, and 12 Table of contents egress traffic to enforce acceptable use policies, blocking risky web sites with custom block lists and threat intelligence, and enhancing visibility and protection across SaaS applications. • Cloudflare One Client (WARP) : Protects corporate devices by privately sending traffic from those devices to our global network, builds device posture rules, and enforces security policies anywhere. • Remote Browser Isolation : Runs a customer's browsers in the cloud as opposed to on-device, mitigating the impact of attacks. • Cloud Access Security Broker : Provides visibility and control over SaaS applications to help prevent data leaks and compliance violations. • Cloud Email Security : Protects users of a corporate network from phishing, business email compromise, and email supply chain attacks. • Digital Experience Monitoring : Provides administrators with comprehensive, real-time visibility into the performance and connectivity of end-user devices, applications, and networks • Data Loss Prevention : Inspects web traffic and SaaS applications for sensitive data like personally identifiable information (PII) and prevents exfiltration of this data with allow or block policies.
Compute • Cloudflare Workers : Allows developers to augment existing applications or create entirely new ones through a lightweight execution environment without configuring or maintaining infrastructure and to identify changes that impact end-user experience with first-party telemetry. • Cloudflare Workers for Platforms : Provides a managed execution environment for our multi-tenant platform customers where their customers can deploy and run their own code on our global network. • Cloudflare Pages : Allows front-end developers to quickly and easily build, collaborate on, and deploy websites.
We remain committed to extending our diversity and inclusion initiatives across our global workforce. 18 Table of contents We value diversity at all levels and are committed to promoting the advancement of leaders from different backgrounds.
No longer disclosed
During the 2024 election cycle in the United States, Cloudflare held more than 50 onboarding and support calls with state and local governments participating in the Athenian Project, and provided cyber threat briefings for more than 300 election officials across the country. • Cloudflare for Campaigns : Since 2020, the Cloudflare for Campaigns program has provided security services to help political campaigns and state political parties in the United States and around the world defend against cyber attacks and election interference.
In 2023, we committed to setting near-term company-wide emissions reductions in line with climate science with the Science Based Targets initiative (SBTi), and as required by SBTi, we expect to submit our proposed reduction targets in 2025.
Initiatives We Support In support of our mission, we have launched various initiatives to help build a better Internet, including: • Project Galileo : Since 2014, we have equipped at-risk public interest groups with a set of our products at no cost to defend themselves against attacks that would otherwise censor their work.
We allow any eligible campaign to access a variety of our security solutions, including web application firewall, and DDoS protection, as well as internal data management and security controls. • Project Cybersafe Schools : We launched Project Cybersafe Schools in 2023 as part of the White House's Back to School Safely: K-12 Cybersecurity Summit.
Changes in the senior leadership of our sales team, such as the departure of our former President of Revenue and the hiring of our new President of Revenue in February 2024 and subsequent changes to a number of the other senior leadership positions within our sales team, could negatively impact our ability to retain current members of our sales team.
In December 2022, we extended our Zero Trust security solutions to organizations under Project Galileo at no cost to further protect against security problems such as data loss, malware, and phishing.
To that end, we document and publish our company-wide direct and indirect emissions consistent with the Greenhouse Gas Protocol, and have committed to powering our operations with 100% renewable energy based on methodology developed by RE100, a global corporate renewable energy initiative.
The more than 2,900 recipients of services under Project Galileo include independent journalists reporting on repressive regimes, minority rights and arts groups in closed societies, and civil society organizations supporting democratic movements. • Athenian Project : We created the Athenian Project to ensure that U.S. state and local governments’ election websites have the highest level of protection and reliability for free through a variety of our security solutions, including Enterprise DDoS protection, web application firewall, SSL certificates, content delivery network, and Zero Trust security solutions.
Our full suite of products consists of (1) our website and application services to deliver security, performance, and reliability for an organization's websites, applications, and application programming interfaces (APIs), (2) our secure access service edge (SASE) platform, which contains our suite of Zero Trust and network services solutions to help ensure traffic in and out of an organization’s internal network and devices is verified and authorized as well as to securely connect data centers, cloud services, and branch offices to an organization with our Connectivity Cloud, (3) our developer-based solutions to build and deploy serverless applications with scale, performance, security and reliability, and (4) our consumer offerings.
This suite of products also includes analytics products to provide a customer with the ability to build customized analytics to provide insights and intelligence to further protect and accelerate their Internet properties, such as monitoring threats, searching for specific search engine crawlers, understanding DNS query traffic, and analyzing real time data traffic.
Our primary website and application security product offerings include: • Web Application Firewall (WAF) : Protects a customer’s Internet properties from common vulnerabilities like SQL injection attacks, cross-site scripting, and cross-site forgery requests, with no changes to the customer’s existing infrastructure. • Bot Management : Detects and manages undesired or malicious Internet traffic generated by malicious software programs called bots, while still allowing useful bots to access Internet properties through machine learning and behavioral analytics. • Distributed Denial of Service (DDoS) Protection : Protects a customer’s website applications from DDoS attacks, which are malicious attempts to disrupt the normal operations of an application, targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. • API Security (API Shield) : Keeps customer APIs secure and productive with API discovery, integrated API management and analytics, and layered API defenses. • SSL / TLS Encryption : Manages encrypted secure socket layer (SSL) and transport layer security (TLS) web traffic to prevent data theft and tampering to improve security as well as application and website productivity.
Advanced Certificate Manager (ACM) also provides a consolidated certificate management experience with greater configuration for managing multiple certificates. • Rate Limiting : Provides the ability to configure thresholds, define responses, and apply throttling rules across web applications and API endpoints. • Script Management (Page Shield) : Protects website visitors from customer-side attacks that target vulnerabilities directly in the browser environment. • Security Center : An actionable dashboard that provides insights into threats, risks, and configuration suggestions, acting as a security practitioner’s home page.