Cloudflare Revenue Crossed $600 Million in Q1 2026

Cloudflare reported in its Q1 2026 earnings (January through March 2026, results published May 8, 2026) that revenue reached $612 million, a 24 percent year-over-year increase from $494 million in Q1 2025 and the first quarter in Cloudflare’s history in which quarterly revenue exceeded $600 million — a milestone that reflects the simultaneous expansion of Cloudflare’s three revenue vectors: the network security platform (DDoS protection, WAF, bot management, and TLS termination serving the majority of Cloudflare’s 7 million registered network domains), the Zero Trust SASE platform (Cloudflare One, combining Secure Web Gateway, Zero Trust Network Access, Cloud Access Security Broker, and Data Loss Prevention into a unified edge-delivered SSE architecture that replaces enterprise VPN and on-premises perimeter security appliances), and the developer platform (Cloudflare Workers, the JavaScript serverless compute environment, and the surrounding storage, database, and AI inference services that Cloudflare has expanded the Workers platform to include). Cloudflare’s Q1 2026 investor filings show 3,400 customers paying more than $100,000 annually, up from 2,900 in Q1 2025, with large-customer revenue representing approximately 70 percent of total Q1 2026 revenue as enterprises consolidating their security vendor portfolio onto Cloudflare’s unified edge platform displace point solution vendors in web application security, VPN, and secure email gateway — a consolidation dynamic that Cloudflare’s product architecture facilitates by delivering all platform capabilities through the same 300-plus point-of-presence global edge network, eliminating the backhauling latency that routing enterprise traffic through dedicated security appliances or centralised cloud security stacks introduces. Cloudflare’s non-GAAP gross margin reached 79.5 percent in Q1 2026, consistent with Q1 2025’s 79.2 percent, demonstrating that revenue growth is not requiring proportional capital investment in network capacity — a function of the interconnection and peering agreements that Cloudflare has negotiated with approximately 12,500 networks globally, enabling Cloudflare to exchange traffic with ISPs, cloud providers, and content delivery networks at zero or near-zero marginal cost per gigabyte rather than paying transit fees that scale linearly with traffic volume. Cloudflare achieved free cash flow of $75 million in Q1 2026, the second consecutive quarter of positive free cash flow following the FCF inflection in Q4 2025, confirming the operating leverage of a network security and developer platform business where incremental revenue from platform expansion flows at a higher marginal contribution rate than the fixed cost of the global network infrastructure that underpins all Cloudflare services. Fortinet’s Security Fabric revenue and firewall market position establishes the enterprise security architecture comparison: where Fortinet’s Security Fabric delivers network security through on-premises and private cloud-deployed FortiGate firewalls that inspect traffic at the enterprise perimeter, Cloudflare’s SASE architecture (Cloudflare One) delivers equivalent security functions at Cloudflare’s globally distributed edge — processing security inspection at the nearest Cloudflare PoP to the user rather than routing traffic back to enterprise-premises security appliances, reducing authentication and security inspection latency for hybrid-remote workforces whose traffic originates outside the corporate network perimeter that traditional Fortinet firewall deployments were architecturally designed to protect. Palantir’s revenue crossing $1 billion in Q1 2026 provides the enterprise AI platform context within which Cloudflare Workers AI operates: while Palantir’s AIP deploys AI agents against enterprise Ontology data graphs on dedicated infrastructure, Cloudflare Workers AI deploys LLM inference at Cloudflare’s edge PoPs for developer-accessible AI capabilities — allowing developers to run inference of Llama 3, Mistral, and Cloudflare’s own image classification models through a serverless API call to the nearest Cloudflare PoP rather than routing inference requests to centralised regional API endpoints, reducing inference latency for edge-deployed applications by distributing the compute to the network location closest to the end user who triggers the inference.

Cloudflare Workers — the JavaScript and WebAssembly serverless compute environment that executes developer code at Cloudflare’s edge PoPs within milliseconds of the end user’s request rather than in a fixed-region cloud data centre — had reached 5 million registered developers by end of Q1 2026, a developer base that positions the Workers platform as the largest serverless edge compute ecosystem by registered developer count ahead of AWS Lambda@Edge and Fastly Compute@Edge, with the developer count metric reflecting Cloudflare’s free-tier strategy of providing Workers compute, R2 object storage (zero egress fee), D1 serverless SQL database, and KV key-value store at no cost up to generous daily request limits — a strategy that converts developers into Cloudflare platform users at the free tier and then upsells the commercial Workers Paid plan ($5 per month for additional compute and storage) as developer applications scale beyond free tier limits into production traffic volumes. Cloudflare’s AI Gateway — the LLM API proxy that sits between developer applications and AI API providers (OpenAI, Anthropic, AWS Bedrock, Google Vertex AI) to provide caching, rate limiting, cost analytics, and request logging for LLM calls without requiring developers to modify their application code beyond changing the API endpoint URL — had processed 250 billion LLM API tokens through the gateway by end of Q1 2026, making Cloudflare AI Gateway the largest third-party LLM API observability layer by token volume. Datadog’s AI observability platform reaching 3,000 enterprise customers establishes the observability comparison: where Datadog’s LLM Observability monitors AI agent performance metrics (latency, token consumption, error rates, semantic clustering of failure modes) within enterprise ML engineering workflows, Cloudflare AI Gateway provides the network-layer proxy for LLM API calls that captures token-level cost and latency data at the API call boundary before the request reaches the AI provider — with the two products addressing complementary observability layers (Cloudflare at the API call level for cost and rate limiting, Datadog at the application level for AI agent reasoning quality) that enterprise AI engineering teams deploy together in production LLM applications. Gartner’s 2026 Magic Quadrant for Security Service Edge positions Cloudflare as a Leader in SSE for the second consecutive year, with Gartner’s evaluation noting Cloudflare’s global PoP density (300-plus locations providing sub-50ms latency to 95 percent of the world’s internet users), the comprehensive integration of SWG, ZTNA, CASB, and DLP within a single control plane interface (the Cloudflare Zero Trust dashboard) as competitive differentiators, while noting Cloudflare’s continuing development of CASB deep integration for Microsoft 365 and Google Workspace as an area where established SSE competitors (Netskope, Zscaler) maintain broader coverage of SaaS application API connectors. Microsoft Intelligent Cloud’s Q3 FY2026 revenue crossing $30 billion defines the hyperscaler partnership and competitive dynamic for Cloudflare’s developer platform: Cloudflare Workers applications can connect to Microsoft Azure services (Azure OpenAI, Azure Blob Storage, Azure Cosmos DB) through Cloudflare’s standard fetch API bindings, making Cloudflare an edge execution layer complementary to Azure’s regional cloud services — while simultaneously competing with Azure’s CDN and Cloudflare Front Door products in the content delivery and edge security segment where Microsoft bundles CDN and WAF capabilities with Azure application infrastructure that Cloudflare must displace as a best-of-breed alternative. Bloomberg Technology’s coverage of Cloudflare’s Q1 2026 $600 million quarterly milestone framed the result in the context of the security vendor consolidation theme — the enterprise IT budget dynamic where CISOs responding to procurement and operational pressure to reduce the number of security point solution vendors are allocating an increasing share of security budget to platforms that cover multiple security functions (network security, identity security, and cloud security) from a single vendor, with Cloudflare’s combination of network DDoS protection, Zero Trust SSE, and application security capabilities in a single platform billing relationship making it a consolidation beneficiary in the enterprise accounts where security vendor reduction is a budget priority. Cloudflare’s FY2026 guidance — revenue of $2.56 to $2.58 billion, implying 24 to 25 percent year-over-year growth — reflects management’s confidence that the SASE platform expansion (Cloudflare One enterprise seat additions from VPN displacement), the Workers developer platform maturation (commercial Workers Paid conversions from the 5 million free-tier developer base), and the AI Gateway and Workers AI adoption (enterprise developers routing LLM API traffic through Cloudflare’s edge) will sustain the mid-20s revenue growth trajectory that the $600 million Q1 2026 milestone demonstrates.

What Cloudflare Workers AI Reaching 5 Million Developers Signals About Serverless AI Inference as Network Infrastructure

Cloudflare Workers AI reaching 5 million registered developers by Q1 2026 — growing from approximately 2 million at the Workers platform’s AI capability launch in September 2023 to 5 million through organic developer adoption driven by the zero-cost entry point, the inference API’s compatibility with OpenAI’s standard request format (allowing developers to substitute Cloudflare Workers AI for OpenAI API calls without modifying their application code beyond the endpoint URL), and the latency advantage of edge-distributed inference for applications serving global user bases — signals that AI inference is following the trajectory of content delivery and DDoS protection in becoming a network infrastructure service delivered from globally distributed edge nodes rather than a centralised cloud service accessed over variable-latency public internet connections. The inference latency reduction that edge distribution provides is commercially meaningful for the class of AI applications — real-time customer service chatbots, content moderation pipelines that must evaluate user-generated content before it is displayed, AI-assisted search suggestions that must complete within the user’s typing cadence — where the 100 to 300 milliseconds of additional latency that routing inference requests to AWS us-east-1 or Google’s Iowa region from a user in Singapore, São Paulo, or Lagos introduces degrades the user experience quality that the AI capability is intended to deliver. Cloudflare’s structural position in this trajectory — operating the network infrastructure (BGP routing, DDoS scrubbing, TLS termination) that delivers internet traffic for approximately 20 percent of all websites, providing the edge network through which the serverless compute and AI inference that those websites’ applications run also executes — positions Workers AI as a service that can grow to infrastructure-level penetration within the developer base that Cloudflare’s network security business has already converted into platform customers, without requiring new enterprise sales cycles or customer acquisition beyond the existing security and CDN relationship that Cloudflare already maintains with the enterprise and mid-market organisations that represent the majority of the large-customer revenue contribution to Cloudflare’s $600 million quarterly milestone.

What Cloudflare’s $600 Million Reveals When You Write Plainly About What the Company Actually Is

Write clearly about what Cloudflare is actually building, because the description keeps getting tangled in jargon that obscures a genuinely simple story. Cloudflare sits between the internet and every website or application that uses it, handling the traffic before it reaches the server. That position — between users and applications, at scale, globally distributed — is the thing everything else Cloudflare does is built on. Network security came first because sitting between users and applications is exactly where you want to be if you want to stop bad traffic before it reaches what it’s targeting. Then the developer platform: if you’re already running code at the edge of the network for security reasons, running code at the edge for performance and developer tooling is the same infrastructure doing more work. The $600 million is not four separate businesses; it is one network position generating four different revenue streams.

The clarity problem in coverage of Cloudflare’s developer platform expansion is that it gets described as a strategic pivot — “Cloudflare is becoming a developer platform” — when it is actually an expansion of the same physical and logical position the company already held. A developer platform hosted somewhere else on the internet is a separate product that competes with AWS Lambda or Vercel on features, pricing, and ecosystem. Cloudflare Workers is a developer platform running on the same globally-distributed network that already handles Cloudflare’s security traffic, which means applications built on Workers inherit the latency and geographic distribution of the security network without paying for it separately. That difference — integrated vs. assembled — is what the phrase “developer platform expansion” consistently fails to communicate.

The plain statement worth making about Cloudflare’s $600 million is this: the company is monetising the same network position multiple times, which is a genuinely good business structure when it works. The risk is also plain: a network position that becomes less strategically central — because the internet’s traffic patterns shift, or because a different architectural approach to edge computing emerges — would affect all four revenue streams simultaneously, not just one. Cloudflare’s revenue diversification across security, performance, and developer tools is real. Its risk concentration in a single underlying network architecture is equally real, and should be named alongside the revenue figure rather than buried in technical caveats most readers will skip.