🚚 Welcome to GA Week

Welcome everyone to GA Week. I'm João Tomé and with me is our CTO John Graham -Cumming.

GA means Generally Available Products in this case, right John? Hello and welcome.

That's right. We're talking this week about products that have been in beta for some time, whether it's open or closed beta or some features that are just becoming generally available right now.

But everything this week is available to everybody who wants to use it.

So none of these things are in beta and I think there's lots of stuff coming this week which will be very, very useful to people.

About roughly five announcements per day throughout the rest of the week.

And again, this segment is to kick off the full week of announcements.

It's not new announcements in terms of products, but there are definitely new announcements for everyone in terms of everyone can start to make a use case of these products, right?

Yes, that's right.

In terms of the products, usually we don't have Innovation Weeks for generally available for GA.

Why in this case we had an Innovation Week to show all of those products that we already have available?

Well, you're absolutely right.

So Cloudflare has what we call Innovation Weeks, which is our weeks of announcements or other information coming out of Cloudflare usually themed around something.

It could be privacy, it could be serverless compute, it could be performance, it could be regional services around the world and there's all sorts of different Innovation Weeks.

And every year we have one really important Innovation Week, which is Birthday Week.

And Birthday Week happens around the September 27th time because that's when Cloudflare was born, so to speak.

That's when 12 years ago Cloudflare was originally released to the world, September 27th, 2010.

So we always do a week of announcements and those tend to be somewhat future looking things that might be going into beta or products that are coming very, very soon and also often things that are kind of a give back to the Internet.

So we did Universal SSL back in 2014 where we gave SSL to everybody for free.

That was a big deal.

We did unmeted DDoS mitigation. That was another thing that came out in a Birthday Week.

So we tend to announce interesting and perhaps somewhat surprising things in Birthday Week.

But this year, as you say, we're doing this GA Week, which has started on Sunday with a blog post about the general availability.

And the reason is, if you think about Cloudflare's growth over the last 12 years, we built a lot of products when we released it.

And, you know, at the beginning, the company was small.

We were doing a small number of products. And as it's grown, there is a tremendous amount of innovation going on.

Cloudflare actually has three separate innovation teams, all with executive leaders who are peers.

And those teams are producing stuff all the time. And what's happened is the company's got bigger.

There's more and more and more stuff coming out. And what we realized was that there was a tremendous amount of stuff that was really just about to be generally available.

So we packaged it all up into a week where we're going to show you what those things are.

We're going to show you what customers have been doing with those products during the beta period.

And we're also going to show you what the analysts think about Cloudflare, because obviously one of the things that's happened with Cloudflare is it's gone from being a startup into something which people rely on.

And the analysts should recognize that, too.

So loads of stuff this week that's becoming generally available to everybody.

That's interesting. In this case, for example, there's a lot of use cases.

Like you said, many different parts of the company are putting an effort to put some of those products generally available this week.

So what's the use case for different types of customers in terms of what they can benefit?

For example, APIs, bot management, DDoS.

What are the use cases in the sense that customers can probably take from this week?

Well, I mean, you're going to see a very wide range of products get announced that we had previously put into beta.

So if you go back and you can kind of guess by looking at things that were in beta.

So, you know, obviously we're introducing database functionality, we're introducing object storage, we're introducing a wide range of things around DDoS mitigation, around the WAF.

Across the range of products, actually, you're going to see a whole bunch of things become available.

So really, this affects every user of Cloudflare and every product of Cloudflare, because they're all getting some sort of updates and some sort of new things.

You know, today there's about five announcements.

And, you know, one of those is around a thing called Cloud Force One. Cloud Force One is our threat operations and research team.

And that's now available to everybody who wants that kind of analysis.

And they want additional assistance when they're dealing with problems.

So it's like threat data tooling, industry expertise.

And so we're coming out with various reports. And we're also making event data that you can integrate into a scene.

We can also do specific investigations.

We have sinkholes. There's lots of things we can do with Cloud Force One.

So that comes out. It's been announced already today. And we have also announced a change in how access control works, so that you can actually have roles that are tied to a domain.

The reason this is really important is that many of our customers are handling hundreds or thousands of domains within an account.

And they want to give control of those domains to specific people in their organization.

And so we've now scoped the roles down to the domain level, which really allows you a great deal of flexibility in how you allow access to different things and improves the security.

And there's more announcements coming.

So we've just announced five minutes ago that the WAF is now able to have a single configuration across an entire account for enterprise customers.

And so that means that often what happens with the WAF type situation is that someone will hear about a vulnerability and they'll want to know, am I protected everywhere in Cloudflare?

Or they'll write their own rule and they'll want to make sure that's protected against everything.

And that was actually quite hard to do before.

You had to go in and enable it everywhere. And now we can do it in an account level.

You can say the WAF now applies to everything in my system. All of this configuration gets sent everywhere.

And that really allows people to control a huge number of domains.

So those last two features are really around companies and customers who need to handle a very large number of domains in their account, which is quite a common use case.

That's interesting. And again, we are just starting and there's already a few things to talk about.

More to come for sure in different areas.

Also today, there's more announcements regarding DDoS, also a very important area.

A lot to talk about there in terms of simplicity, of learning a little bit, profiling the traffic, right?

In terms of a way to understand what's happening in terms of DDoS, right?

Well, I mean, so on the DDoS side of things, obviously we provide unmetered DDoS mitigation.

It doesn't matter what account plan you're on, whether it's free all the way up to enterprise, we will mitigate the DDoS attack for you of any size.

And if you look back through our blog, you will see that we have mitigated some of the largest DDoS attacks ever, both at the HTTP level and at the network level.

And these have actually tended to be against free customers.

So just proving what we said all those years ago, that we would protect you no matter what type of account you're on.

That's a great service. It works fully automatically.

It's fully autonomous, works across our entire global network.

However, for some customers who are very much on the high end, they want a lot of control over the DDoS mitigation.

And they want a couple of things. First of all, they want alerts when DDoS mitigation actually does something, because they want to be able to monitor themselves, what we are doing, make sure it's not affecting their traffic, understand what is getting blocked, what isn't.

So there's a new alerting piece of functionality that's going to come out.

And the other side of it is, although we have this incredibly powerful DDoS mitigation system, which has, as I said, dealt with the biggest DDoS attacks out there, sometimes you want to really tailor it to your specific situation.

I remember a very long time ago, a particular app that only ever received on its API, it only ever received requests from its own app with its own app's user agent, actually with a client certificate as well.

And they got a DDoS attack against the endpoint. And I remember the customer saying, you know, if you build a profile of what our normal traffic looks like, you would have known this is out of the ordinary.

And that was very true.

So what we're going to introduce today is called adaptive DDoS mitigation, where we will actually, for an individual customer, learn the normal profile of their traffic, where it comes from, what type of protocols are used, the load it looks like.

And then we will be able to apply mitigations very targeted if things step outside of that profile of the traffic.

So that just brings you another level of protection based on the data that flows through our network.

So, again, that's an add-on.

There's something I think is very interesting in terms of how technology works, how companies work, is you may have a very good technology, but there's always improvements to make.

And there's always new features to add, even if they're simple, automatic, and you don't have to do anything.

But you'll be and your business will be impacted by those changes, right?

Well, I think the thing is that as much as we'd love technology to kind of stand still and say, I finished my product, my product works, the reality is things don't stand still.

And that means that our customers are constantly innovating on what they're providing.

And they need us to be doing the same thing so that we're in there providing them with the services that will help them.

And you see this particularly in the Zero Trust world where companies are going through a massive transition, whether it's happening right now or they're planning it, which is to say the corporate network really doesn't have a special form anymore.

It doesn't make sense, this idea of the corporate network.

And why did that happen? That happened for a few reasons.

One is that the idea of the corporate network was great when all the applications were inside the corporate network.

But then we have SaaS applications come along and now people fundamentally need access to the Internet to get some of the applications they have.

And the other thing that happened was, you know, particularly with the iPhone and then with the Android platform, the mobile phone became a tool for work and you're using it from wherever you are.

And then you have the COVID came along, which changed the nature of work.

And so there were these long, continuous stream of things that affected the fact that the corporate network doesn't make a lot of sense anymore.

And VPNs tend to be quite difficult to work with.

So you have this Zero Trusting. So we obviously have a product line there with extensive set of facilities, and we're helping our customers work through their roadmap for how they want to move away from perhaps an older hub and spoke kind of castle wall style of networking.

So, yeah, I mean, there's always this stuff going on.

And, you know, you see it in protocols, you see it in performance characteristics, you see it across technology.

And so, yes, we're always shipping things.

And so we have GA week this week with a lot of things coming generally available.

But it's not you're going to have to wait another year for more generally available.

We're constantly pumping stuff out. It just happened there was a confluence of things.

And we said it makes sense to wrap it up and talk about all the stuff that's now available.

Makes sense. And again, this is before birthday week.

So just a few days before birthday week starts on Sunday. Birthday week, like you said, more about new products that we want to put available up there, but sometimes just beta, just sometimes just starting them.

And this is more what you can already have.

Everyone can already have in a sense. You talk about Zero Trust.

There's one day of this week in GA week for Zero Trust. I think it's Wednesday.

Also a bunch of announcements there in terms of what's available, what can you expect.

There's been a lot of talk in terms of, to your point, VPN usage. You're using your VPN.

Most companies have some trouble using them, at least as a user, you'll have problems because sometimes it's not that fast.

You're always going down.

It's not a very user friendly type of situation. Zero Trust comes to add more security, but also add some speed to that connection, to that user experience situation.

Yeah, I mean, you know, I think Zero Trust is a very strange name.

Zero Trust is the name that's caught on. It really means we're not trusting the network to have any special characteristics.

And, you know, I think that we will see a slow move towards this.

You know, some businesses are doing this natively.

That's perhaps startups might always feel like that and other businesses are moving their structure.

So there's a change going on. It's definitely a case that we're helping people work through those Zero Trust transformations.

The other thing is this week is not just about Zero Trust, right?

It's about performance products.

It's about storage products. It's about database products. It's about serverless products.

I mean, you're going to see a whole load of stuff come out this week for, you know, no matter what.

If you're a developer, there's different use cases there, too, in terms of what you do, right?

Developer day, I think it's Wednesday.

More generally speaking, how did the from beta to generally available type of situation evolve over the last few years in ColdFlare and what distinguished the company in a sense?

Well, I mean, I think the really big thing is that we were shipping more and more and more and more product over time.

You just end up with more and more products.

And so you end up with more things going to beta, more things coming to general availability over time.

I think that originally we didn't really have formal beta periods, partly because we just didn't have big enough customer base.

And so it wasn't really helpful because who was going to test it for you?

And then, of course, what's happened is that, you know, over time, we have built a very large customer base who wants to try out products.

And so one thing you're also going to see this week is you're going to hear from people using things in beta for real production workloads and how, you know, what their experience was and what they did with it.

And I think that's really important because, you know, when these things go into beta, we do have a really enthusiastic customer base on the free end or the paid end to try out products and help us make the size of that customer base.

It enables us to get things to be really stable when they go general available.

In terms of, like you said, beta now helps us test drive our products.

We also do a lot of dogfooding, so we ourselves test our products.

In the sense, did you saw real amazing improvements with those tests, even from customers, like a product really was turned around because of the beta period in the past year?

Oh, I mean, it's always the case, right? And the reason it's always the case is that the Internet itself has this incredible amount of heterogeneity, right?

It's just if you look at the variety of what's real on the Internet, it's very different from what you theoretically think it's going to be like.

So what happens is when you expose something to the real Internet, you have to deal with the incredible variety of things that happen into the variety of use cases.

And so what will happen is first of all, any bugs you have will get shaken out very quickly because the thing you're shipping will break in some weird way.

And maybe one part of the world or one type of application or one protocol or one time of day or whatever.

So you're able to fix that kind of stuff. And you also get the feedback from the customer about this doesn't work for me because I need to integrate it in this way.

Or why do I have to make three API calls to make it do this?

You discover what the real use cases are. So I think betas are incredibly useful.

One of the things that's funny about betas is you say, well, why didn't you do all that stuff up front before you ship it?

And the thing is, my experience has been it's almost impossible, in fact probably is impossible, to figure out exactly what you should do in order to get something perfect.

You have to actually show it to people and kind of have them say, wait a minute, that doesn't make any sense.

I need it to be like this or it doesn't work in this situation. So the beta is just an essential part of what we do, I think.

That's really interesting because in a way, you're learning new aspects to your own product in a sense.

Because you didn't tell that product to do this, but then there's a customer who is using this product this way.

And there's a new opportunity for the product itself in a way, right?

Yeah, I mean, I used to work in package software. So physical software where it was shipped on disk or on CD or DVD or whatever like that.

And the thing about that situation is that you install it on someone's machine.

And the varieties of ways it gets used are actually relatively limited.

You're able to test it on a variety of platforms.

You know what they are, let's say versions of Windows, for example.

You're able to test its functionality because you know what its functionality is.

And the world you're shipping it into is relatively static compared to the world of the Internet where there's constant change going on.

And an incredible flow of traffic coming in and use cases.

And I think one of the things that's really a bit different is that often when you think about, or at least when I think about package software in the past, it was somewhat limited in its extensibility.

So you had a package that you used and you used it in a certain way.

And any integration that happened was probably a massive integration project where consultants were involved and they got involved in a long, long, long project.

I think the opposite is happening really with SaaS type applications, with cloud type applications, which is that they are rolled out and then integrations happen without you even realizing it because someone uses your API to do a thing.

Whereas before it would have been collaborative in a way. And suddenly your API is being used and things are going to shake out very, very quickly in that.

The other thing is the timescales are much shorter because you're making a public API for something.

Your cloud has a very extensive public API for what it does. People are just going to say, well, I can do my integration myself.

I don't have to work with Cloudflare on whatever the integrations I want to do.

And those things create an environment where it's very difficult to predict all of the ways in which your thing is going to get used and all of the variety of use cases and traffic and things get thrown at it.

And that's why the betas, I think, turn out to be super important.

For sure. One of the things you mentioned in the blog post that kicks off GA Week in this case.

Let me just share it with everyone. Here it is. Welcome to GA Week.

One of the things you mentioned is that Cloudflare is now trusted by many customers that are even able to put their stories out there to explain a bit what the difference some of these products are making to their businesses in terms of saving money, saving their team's schedules.

Because if something is very difficult to do, you'll have to have more people.

Those teams will have more problems.

So it's not only about money. It's also about having motivated teams.

Oh, yeah. I mean, absolutely. I mean, I think there is a great deal of motivation about all these changes, all these products, all these things are being used.

And I think that what that does is it creates an environment where people are very enthusiastically adopting things.

So obviously that happens in the beta period. And it's going to happen after GA as well.

We're going to see another onrush of like, OK, it's ready to go.

Now I can actually use it. Exactly. And this week we are putting out some more case studies.

We have a dedicated page for case studies for a while now.

And some new case studies will also be posted in terms of getting those stories out there for others to see how can they use different products in a sense, right?

Yeah, yeah. You're going to see from our customers how they use it, how it all actually works.

I mean, I think that's clearly, you know, it's useful to hear about how the people use it.

And useful to hear about the size of the companies and the style of companies that are using the product because it is, you know, it is available.

It is here. And, you know, people can see that it's really getting used.

So I think that what I hope people get out of this week is, first of all, they realize these products are here and ready to go.

It may be the first time they're hearing about some of these products.

So, you know, dig in and hear about the things we're shipping because I think there'll be lots of interesting things to learn about.

Because it is hard for people to keep up with the product innovation rate at Cloudflare because it's so vast.

We put out so much product. So this is another opportunity perhaps just to read a little bit about, well, you know, what is Cloudflare doing and how does it, you know, how does it fit into my plans?

True. Another interesting thing also mentioned in the blog is some of those awards or tests that the analyst firms did like Gartner, Forrester, IDC.

Well, they recognize us as leaders.

That's just a recognition. But that also helps to take some of our very specific solutions out there for the others to see, to put to test, right?

Well, I think the thing about the analysts is obviously what the analysts are doing are they're servicing corporate clients who want to understand where technology is going or what technologies they should be thinking about using.

And so it's important for us to be recognized by them because they are doing a deep analysis to understand what's good and what isn't so good.

And, you know, over time what we've done is we, because of our shipping and iteration kind of model, we have shipped things, got it into the hands of, you know, in many cases millions of users and iterated, iterated, iterated to the point where, you know, you end up being best of breed in different, you know, we've done it in DDoS and WAF and bot management, et cetera, et cetera.

And so you're going to see us continue to do that for every product we ship.

Our goal is up and to the right to be the best of breed that everybody can use it.

We still have six minutes. I'm curious about this.

Paul Flair pushes a lot of products, sometimes in the, most of the times actually in the beta format.

There's sometimes this question, why push so quickly products?

And in a sense, I think you already answered, like when we put it out there, we will see better use cases, but problems, bugs, but can you explain a little bit to why we put so many solutions, products out there so quickly in a sense?

Well, in a way you sort of don't have any choice because the market is moving so fast and our customers who are trying to consolidate into a single pane of glass, how they manage, you know, their security, their performance for everything they put on the Internet.

We don't, you know, you need to meet that, meet that demand.

The other side of it is we want the feedback, right? What we're not trying to do is build something in an ivory tower and then announce it to the world.

We have a pretty good idea about what we want to build, but we also recognize that if we build something, the world will tell us what we've missed or we need to improve or what's broken.

And so getting it out early makes a huge difference.

And so I think that we have a tendency to ship, put it into beta, get the feedback, get real customers using it, and then, you know, obviously it can become GA when it's ready.

So I think that, you know, this is just a natural way to do things.

And I think it is more natural within the SaaS world to ship fast so people can, you know, get used to the platform and see what's coming.

And it's also part of a promise Cloudflare has, I think, which is that we're not done.

You know, we're not done with WAF and DDoS, for example.

We're not done with where we are with Zero Trust.

We are going to keep innovating very fast to meet the demands of our customers and of the market in general.

And I think that Cloudflare has, I hope, got a reputation that, you know, if you are in IT, you're a CISO, you're a CIO in a company, and you are wondering about some of these different technologies that are coming out.

What's happening in DDoS? What's happening in Zero Trust? What's happening in serverless?

You can come to us and we will understand it. We'll have an offering in that area, and we will be able to advise you that we're always going to be on the leading edge of these technologies.

We're not, you know, yesterday's solution.

And there's something about the network, the computer, the way Cloudflare started, actually, as a company, really in-depth in the company, in terms of how it innovates and also it uses its network, its fundamentals, to push many times much better than other players that are for many years in the market, in different markets.

Right? May that be Zero Trust, for example, where we don't have like 15 years of experience like other competitors, right?

Well, I don't know if any competitor really has 15 years experience in Zero Trust.

Zero Trust is true.

A lot of things. Zero Trust is an interesting example because we built it initially for ourselves.

And, you know, that was something we needed. And, you know, it was essential to us that we have that as part of our platform because we needed to use it ourselves.

In fact, we built it on our own software platform as well, on top of workers serverless platform.

And so that then became obvious that the rest of the world was probably going to want this.

And therefore we made it, you know, we made it available to everybody.

And so I think that we are going to we build stuff partly for ourselves and then realize that the rest of the world wants it.

We build very, very, very rapidly. And you're going to see that this week with the number, I mean, five announcements per day.

It's an enormous number of announcements.

And next week, there's birthday week for sure. Also for everyone to see.

And we got to this birthday week. Yes. Exactly. Just to wrap things up, we have still two minutes.

What do you expect in terms of feedback? Do you monitor feedback from customers when we put this announcements out there?

Oh, yes. I mean, I obviously I'm very active in various forums on Twitter.

And then the internal feedback we get via our customer support group, via customer success.

No, I want to hear what these things are.

And, of course, I also like to use our own products myself.

So one of the things that I do is I have actually more than one Cloudflare account that I pay for with my own credit card so that I can try out the different products and get the experience the customer has.

And sometimes I love it. And sometimes I'll give feedback to the team and say, hey, this is I don't like the way in which this is being put together.

So I think that it's really important to use our own products.

And all of my Internet uses is through Cloudflare, be it for my website, for Zero Trust, for video, etc.

So I think it's really that's something I really care about.

So I listen to our customers. I listen to the feedback that's in forums, on Twitter, etc.

And I also use the product myself. Exactly. And that helps to get a sense of the opinions, the feedbacks.

Even yourself, you have the feedback.

We're almost out of time. So let me just say to everyone, this is the start of GA Week.

Check in our blog all of the announcements, at least five per day until Friday.

And then after Friday, we'll have on Sunday birthday week. Exactly. Any favorite product before we go?

I'm not going to name a favorite product because, you know, if I say that, then every other team...

That's true. At least announce it. You know, no, I think I didn't want my favorite thing about this is what you're going to see.

Five announcements per day is that Cloudflare has a really wide range of products and that we are building the platform for the future.

And that's why we think we're going to be the fourth cloud.

And that's a wrap. Thank you so much, John.

Cheers. Good talking to you.