How does Cloudflare make money in 2027?

The outcome you should expect

If you are modeling Cloudflare as a revenue engine rather than a stock ticker, the outcome to expect in 2027 is a company in the low single-digit billions of annual revenue, growing in the low-to-mid twenties percent, with gross margins in the mid-to-high seventies and a revenue mix that is still majority application services but with a visibly faster-growing developer and security tail. Cloudflare reported roughly $1.67 billion in revenue for fiscal 2024, up about 29% year over year. Extend that at a decelerating but healthy rate — high twenties in 2025, mid twenties in 2026, low-to-mid twenties in 2027 — and you land in a $2.8–$3.7 billion range for fiscal 2027. That range is the honest one. Anyone quoting a single point estimate three years out is guessing with false precision.

The second outcome to expect is that the *shape* of the revenue changes more than the *size*. In 2019 Cloudflare was essentially a single-product company: reverse proxy, CDN, DDoS mitigation, WAF, sold as a subscription per site or per contract. By 2027 the revenue is arriving through four distinguishable motions. There is a self-serve subscription business (Free, Pro at $25/month, Business at $250/month) that is small in dollars but enormous in customer count and serves primarily as a funnel and a brand surface. There is an enterprise contract business where annual contract values run from roughly $50,000 to well into seven figures for the largest accounts, negotiated per customer, bundling application security with committed traffic volumes and support SLAs. There is a zero-trust seat business — Cloudflare One — priced closer to how Zscaler and Netskope price, per user per month, with the classic security-vendor land-and-expand pattern. And there is a pure consumption business — Workers, R2, D1, Queues, Workers AI — metered per request, per gigabyte-month, per million tokens, where revenue grows automatically as the customer's own product grows, with no salesperson touching the expansion.

The third outcome, and the one most relevant if you run RevOps at a company evaluating or reselling Cloudflare, is that net revenue retention sits meaningfully above 100% but below the peaks of the 2021 era. Cloudflare's dollar-based net retention ran near 124% at its high point and has settled into the mid-teens above par — roughly 110–115%. That is the number that actually explains how the company makes money: it does not need to win a proportionally larger number of new logos each year to grow, because existing customers spend more each renewal. Roughly speaking, if 112% NRR holds, the installed base alone delivers about half the annual growth target before a single new customer signs. New logos and large-customer graduation supply the rest.

Fourth: expect customer concentration to stay low and large-customer count to stay the headline metric. Cloudflare has disclosed something on the order of 197,000 paying customers, of which roughly 3,200-plus are "large customers" spending over $100,000 annually, and a much smaller cohort — a few hundred — spending over $1 million. The large-customer cohort supplies the majority of revenue while the long tail supplies almost none of it in dollars. This is the standard infrastructure shape and it means that when you read a Cloudflare quarter, the two numbers that matter are large-customer count and net retention, not total customer count.

What drives that outcome

Four mechanical drivers move Cloudflare's revenue, and they compound in a specific order.

Driver one: the free tier as an acquisition subsidy. Cloudflare gives away DDoS protection, CDN, DNS, and basic WAF at $0 forever. Tens of millions of domains sit on that tier. The marginal cost of serving one more free site on an already-built anycast network is genuinely small — the network is provisioned for peak attack absorption, and free traffic largely rides in the trough. What Cloudflare buys with that subsidy is threat telemetry (every attack against a free site trains the models that protect paying enterprises), brand ubiquity among developers, and a conversion funnel that costs nothing in outbound sales. The conversion rate from free to paid is low in percentage terms and enormous in absolute terms because the denominator is so large.

Driver two: land-and-expand across product families. The classic path is that a company arrives for CDN and WAF, adds Bot Management or API Gateway when scraping or credential stuffing becomes a board-level problem, adds Cloudflare One when the VPN renewal comes up, and adds Workers or R2 when an engineering team hits an egress bill or a cold-start latency wall. Each hop increases annual contract value by a meaningful multiple, and each hop is sold into a different buyer — the security team, the network team, the platform engineering team — which is why the account teams are organized around multi-buyer expansion rather than single-product renewal.

Driver three: consumption pricing that grows without a salesperson. Workers bills per million requests plus compute time. R2 bills per gigabyte stored plus per-operation classes, with zero egress. Workers AI bills per million tokens. When a Cloudflare customer's application gets more traffic, Cloudflare's revenue from that customer rises the same day, with no renewal event, no negotiation, and no incremental sales cost. This is the highest-margin growth in the business and it is why the developer platform matters strategically far beyond its current single-digit-to-low-teens revenue share.

Driver four: architectural cost advantage converting into price advantage. Workers runs customer code in V8 isolates rather than containers or microVMs. An isolate costs a few megabytes of memory and starts in single-digit milliseconds; a container costs a 128 MB minimum billing allocation and starts in hundreds of milliseconds. That density difference lets Cloudflare pack far more concurrent customer executions onto the same server, which is how it sustains mid-to-high-seventies gross margins while pricing under hyperscaler alternatives. Similarly, Cloudflare's settlement-free peering posture — it exchanges traffic with other networks largely without paying transit, because it brings useful traffic — is what makes zero-egress R2 a durable structural position rather than a promotion that expires.

Benchmarks and realistic ranges

Here are the numbers a practitioner can actually use, with honest ranges rather than invented precision.

Published list pricing. Free is $0 per zone. Pro is $25 per month per zone. Business is $250 per month per zone. Enterprise is custom — there is no list price, and in practice the range spans roughly $50,000 to several million dollars annually depending on committed traffic, product breadth, and support tier. If someone quotes you a single "Cloudflare enterprise price," they are describing their own contract, not a rate card.

Consumption pricing shape. Workers has a paid plan with a $5 monthly minimum that includes a request allotment, then charges per additional million requests plus a CPU-time component; the free plan allows a daily request quota that is generous enough for hobby and prototype workloads. R2 charges roughly $0.015 per gigabyte-month of storage, zero for egress, and separate per-million rates for Class A (mutating) and Class B (read) operations, with Class A meaningfully more expensive than Class B. D1 charges a small monthly minimum plus per-million read and write rows and per-gigabyte storage. Workers AI charges per million tokens with rates varying by model size — small open-weight models cost a small fraction of what large models cost, and the whole schedule sits well below typical hyperscaler managed-inference pricing for comparable open models. Treat all of these as directional; Cloudflare revises its published rates and you should read the current pricing pages before building a model.

The egress arithmetic, worked. This is where the R2 pitch either lands or doesn't, so run it explicitly. Take a read-heavy workload storing 100 TB and serving 1 PB of egress per month. On a hyperscaler charging roughly $0.05 per gigabyte at volume tiers, the egress line alone is on the order of $50,000 per month — about $600,000 a year — before storage. On R2 that egress line is zero, storage on 100 TB runs roughly $1,500 per month, and you add Class B operation charges proportional to object count: a workload with 1 KB average objects generates vastly more operations than one with 10 MB objects, so object size, not just byte volume, drives your R2 bill. The rule of thumb: R2 wins decisively when your egress-to-storage ratio is high and your average object size is large. It wins narrowly or not at all when you store a lot, read a little, and store billions of tiny objects.

The serverless arithmetic, worked. Take 100 million requests per month at 20 ms execution and 30 MB working set. On a container-based serverless platform billing a 128 MB minimum, you pay a per-request fee plus GB-second compute on memory you did not ask for — call it low tens of dollars per month, plus a cold-start tail on some percentage of invocations. On Workers you pay the plan minimum plus per-million-request charges and a CPU-time component, landing in a similar or slightly higher absolute range for this specific shape. The pure price comparison is close. Where Workers separates is at high volume, where the memory-minimum penalty compounds, and where the workload touches R2 or Workers AI inline — because then the data transfer between compute and storage is internal and free rather than metered.

Growth and retention benchmarks. Revenue growth: high-forties percent in 2019–2022, low-thirties in 2023, high-twenties in 2024, decelerating toward the low twenties by 2027 as the base grows. Gross margin: consistently mid-to-high seventies, which is high for anything touching physical network capacity and reflects the isolate-density and peering advantages above. Non-GAAP operating margin: roughly low double digits, with GAAP operating margin materially negative because stock-based compensation runs at a large share of revenue — a gap you must reconcile before comparing Cloudflare to a mature infrastructure vendor. Free cash flow: positive and improving, in the mid-teens percent of revenue.

Segment mix, approximate. Application services — CDN, DDoS, WAF, bot management, rate limiting, load balancing, API gateway, DNS — remains roughly half of revenue and grows in the high teens to low twenties. Zero trust and network security together sit in the mid-twenties to low-thirties percent and grow faster. Developer platform sits in the low teens or below and grows fastest, off the smallest base. AI-specific revenue is the smallest line and the highest-variance one; it is plausible that it is immaterial in 2027 and plausible that it is the fastest-compounding line in the company. Both are live scenarios and the honest position is to hold them simultaneously.

Risks, edge cases, and failure modes

Hyperscaler catch-up on price. The single largest structural risk to the R2 story is that AWS, Azure, and Google Cloud narrow the egress gap. They have already reduced or waived egress in specific circumstances, including free egress for customers leaving the platform under regulatory pressure in some jurisdictions. If broad egress pricing compresses, R2's headline differentiator weakens to "cheaper storage plus good integration," which is a real but far less dramatic pitch. Model R2 savings with a sensitivity case where the competitor's egress rate falls by half.

AI inference commoditizes faster than Cloudflare monetizes it. Edge inference on small open-weight models is Cloudflare's clearest AI wedge, and it is also the segment most exposed to price collapse. Token prices for open models have fallen sharply across every provider. If they keep falling, Cloudflare captures the workload and very little of the revenue. The counter-scenario is that inference volume grows faster than unit price falls, which is what happened to CDN bandwidth for fifteen years — a useful historical analogue, and one that ended with Cloudflare being fine.

SASE consolidation may favor security-first incumbents. Cloudflare One competes against Zscaler, Palo Alto's Prisma Access, Netskope, Cisco, and Microsoft's bundled offering. Cloudflare's advantage is that security and compute ride the same network, with straightforward pricing and fast self-serve evaluation. Its disadvantage is CISO relationship depth at the largest enterprises, and Microsoft's ability to bundle adequate zero-trust functionality into agreements the customer already signed. Expect Cloudflare to win more often in mid-market than in the Fortune 100, and expect the gap to close slowly rather than suddenly.

Net retention compression is the metric that would break the model. Everything above assumes NRR stays above roughly 110%. If enterprise infrastructure budgets tighten and customers optimize traffic commitments downward, NRR can slide toward parity — and because the growth model leans on expansion, a five-point NRR drop costs far more growth than a five-percent miss on new logos. Watch this number above all others.

Developer mindshare is not owned. For teams building on Next.js and React, Vercel holds strong default positioning. Cloudflare Pages and Workers are credible and improving, but "credible alternative" and "default choice" are very different revenue outcomes. The failure mode is that Cloudflare wins the infrastructure argument on economics and loses the framework argument on ergonomics, and the framework argument is usually decided by an individual engineer in an afternoon.

Compliance gaps in regulated verticals. Newer Cloudflare products, particularly on the AI side, trail hyperscaler alternatives on formal attestations for the most regulated buyers. If you are in healthcare, financial services, or government, verify the specific certification for the specific product before you build a procurement case; platform-level compliance does not automatically extend to every service on the platform.

The pricing-transparency edge case. Cloudflare's published rates are a genuine advantage in self-serve and mid-market — a buyer can model the bill in an afternoon. In competitive enterprise deals it can be a liability, because a competitor who bundles opaquely can construct a deal that looks cheaper on the summary page. If you are the buyer, force every vendor onto a normalized three-year total-cost model including egress, seats, support, and overage before comparing.

Concentration on a single network. Every product depends on one anycast network. Cloudflare has had public incidents where a configuration or control-plane fault degraded many services at once. That is a real operational risk for customers and a real reputational risk for the revenue model, and it is the strongest argument any competitor makes.

A practical rollout plan

If you are the RevOps or platform lead building a Cloudflare position — as a buyer consolidating vendors, or as a partner reselling the stack — here is a sequence that works and the checkpoints that keep it honest.

Phase one, weeks one through three: baseline the spend you are trying to displace. Pull twelve months of actual invoices for CDN, DDoS, WAF, object storage including every egress line, VPN and remote access seats, secure web gateway, and email security. Normalize to annualized cost per unit — per terabyte egressed, per seat per month, per million requests. Do not accept vendor-supplied summaries; go to the billing detail. Most organizations discover at this stage that egress and overage charges, not list subscription prices, are the majority of the bill.

Phase two, weeks three through six: run a bounded technical proof on the highest-value wedge. Pick one workload where the economics are unambiguous. For most organizations that is either a high-egress static-asset bucket (test R2) or a VPN population that hates the VPN (test Cloudflare Access). Do not try to evaluate the whole platform at once — multi-product evaluations stall on the weakest product. Set explicit exit criteria before you start: a target latency percentile, a target cost per terabyte, a target authentication success rate.

Phase three, weeks six through ten: model the three-year total cost with sensitivity cases. Build the base case at current published rates, a downside case where the incumbent cuts egress or seat pricing by 30–50%, and an upside case where your own traffic grows at plan. Include the engineering cost of migration — for object storage that is typically weeks, not months, because the S3-compatible API means most application code does not change, but data transfer time and dual-write cutover windows are real. Include the cost of *not* migrating: the compounding egress bill.

Phase four, weeks ten through sixteen: negotiate the enterprise contract with the consumption line explicit. This is where most buyers leave money on the table. Enterprise agreements typically bundle committed volume; you want the overage rate, the true-up mechanism, and the treatment of consumption products (Workers, R2, AI tokens) written explicitly rather than left to list pricing. Ask for the ramp: committed spend that steps up over the term rather than starting at your projected year-three volume.

Phase five, ongoing: instrument the expansion. If you are the buyer, set a quarterly review on actual versus committed consumption so you are not surprised at true-up. If you are the seller or partner, instrument the land-and-expand path deliberately — track which accounts have one product versus three, because the second and third product attach are where the margin lives, and they do not happen on their own.

Related questions

Is Cloudflare profitable in 2027?

On a non-GAAP basis, yes — operating margins run in the low double digits and free cash flow is solidly positive. On a GAAP basis the picture is much tighter, because stock-based compensation consumes a large share of revenue. Always check which basis a headline is quoting.

Which Cloudflare product line grows fastest?

The developer platform — Workers, R2, D1, and edge AI inference — grows fastest in percentage terms because it starts from the smallest base and bills on consumption. In absolute dollars, application services and Cloudflare One still add more revenue per year through 2027.

How does Cloudflare afford a free tier?

The network is provisioned for peak attack absorption, so free traffic largely rides in spare capacity. In exchange Cloudflare gets attack telemetry that improves paid products, developer familiarity, and a conversion funnel that requires no outbound sales spend.

Does zero egress on R2 actually save money?

Only for read-heavy workloads with reasonably large average object sizes. High-egress media, model weights, and asset delivery see dramatic savings. Archive workloads with billions of tiny objects and little read traffic can end up close to break-even once Class B operation charges are counted.

What single metric best predicts Cloudflare's revenue?

Dollar-based net revenue retention. Because expansion supplies roughly half of annual growth, a few points of NRR movement changes the trajectory more than a comparable miss on new-customer acquisition.

FAQ

What are Cloudflare's actual published prices?

Free is $0 per zone with CDN, DDoS mitigation, DNS, and basic WAF. Pro is $25 per month per zone, Business is $250 per month per zone, and Enterprise is custom-quoted with no list price. Consumption products bill separately: Workers has a small monthly minimum plus per-million-request and CPU-time charges, R2 charges per gigabyte-month of storage with zero egress plus per-operation fees, and Workers AI charges per million tokens by model. Rates change; read the current pricing pages before you build a model on them.

How much of Cloudflare's revenue comes from enterprises versus self-serve?

The large majority of dollars come from enterprise contracts and large customers spending over $100,000 annually, even though those customers are a tiny fraction of the roughly 197,000 paying accounts. Self-serve Pro and Business tiers contribute a small share of revenue relative to their customer count. The self-serve tiers earn their place as a funnel and a developer-brand surface, not as a revenue center.

Is Cloudflare a security company or a compute company?

Both, and the mix is shifting. Application security and CDN remain roughly half of revenue and the profit foundation. Zero trust and network security are the largest growth engine in absolute dollars. The developer and AI platform is the fastest-growing line and the strategic bet. By 2027 the honest description is an infrastructure platform that monetizes through security, delivery, and compute on one shared network.

Should a RevOps team model Cloudflare spend as fixed or variable?

Both, split explicitly. Seats and committed traffic behave as fixed subscription cost with an annual true-up. Workers requests, R2 storage and operations, and AI tokens behave as variable cost that scales with your own product usage. Modeling the variable line as fixed is the most common budgeting error, and it surfaces as an unpleasant overage conversation at renewal rather than as a forecast.

What would make the 2027 revenue picture materially worse?

Three things, in order of impact: net revenue retention compressing toward parity as enterprises optimize infrastructure spend; hyperscalers narrowing the egress pricing gap enough to blunt R2's structural advantage; and AI inference prices falling faster than inference volume grows, so Cloudflare captures workloads without capturing revenue. Any one of these is survivable; two together would visibly change the growth rate.

How reliable are third-party estimates of Cloudflare's segment revenue?

Treat them as informed approximations, not disclosures. Cloudflare reports total revenue, customer counts, large-customer counts, and net retention in its filings, but does not break out precise revenue by product family. Any figure attributing an exact dollar amount to Workers, R2, or Cloudflare One individually is an analyst estimate. Use ranges and say so.

Sources

• https://investors.cloudflare.com/ — Cloudflare investor relations: quarterly results, filings, and shareholder letters
• https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&company=cloudflare — SEC EDGAR filings for Cloudflare, Inc. (10-K, 10-Q, 8-K)
• https://www.cloudflare.com/plans/ — Official Cloudflare plan comparison and self-serve pricing
• https://developers.cloudflare.com/workers/platform/pricing/ — Cloudflare Workers pricing documentation
• https://developers.cloudflare.com/r2/pricing/ — Cloudflare R2 storage and operations pricing, including egress policy
• https://developers.cloudflare.com/workers-ai/platform/pricing/ — Workers AI per-token pricing by model
• https://blog.cloudflare.com/ — The Cloudflare Blog: product launches, architecture posts, and incident write-ups
• https://aws.amazon.com/s3/pricing/ — AWS S3 pricing, for egress and storage comparison
• https://aws.amazon.com/lambda/pricing/ — AWS Lambda pricing, for serverless compute comparison
• https://www.gartner.com/en/information-technology/glossary/secure-access-service-edge-sase — Gartner definition of SASE, for category framing

Related on PULSE

• How does Zscaler make money?
• How do zero-trust vendors price seats versus traffic?
• What is net revenue retention and why does it drive infrastructure valuations?
• How should RevOps model consumption-based vendor spend?
• What does a land-and-expand motion look like in infrastructure software?
• How do you build a three-year TCO model for a vendor migration?