The Acquisition Process: Vectrix

All right. Hello, everyone. Good morning, afternoon, evening, whatever it is, wherever you are. Good to be joining all of you. And I've got a couple of friends with me today. And as you can probably tell from the title of the session, we're going to be talking about M&A, mergers and acquisitions. And so I know the M&A process can feel really opaque to founders, to their teams, to even a lot of folks at Cloudflare. So what we're hoping to do today is just shed a little light on how these things work from the perspective of both the founder, as well as from the perspective of an acquirer from the Cloudflare team. And so I'm joined by Sam Rhea, who's our director of product for Cloudflare Zero Trust set of products, as well as Jonathan Spies, who's our director of engineering for Zero Trust products, and Corey, who was the co-founder and CEO of Fectrix, a SaaS security company that joined Cloudflare by way of acquisition just a few weeks ago now. And I'm Mia, I'm on our special projects team, which is responsible for partnerships as well as M &A and corporate strategy. So we'll probably spend the next half an hour or so covering the three usual stages of an M&A process from the beginning, through the deal execution experience, and then a bit on integration. But before we dive in, Corey, do you want to just share a little bit about Fectrix, some background, what you guys were building and what you're building now? Totally. Yeah, thanks for doing this, Mia, and get some connect with everyone on this platform. So Fectrix was, ideally, we were aiming to help IT and security administrators solve their SaaS security problems. Well, what does that actually mean? It means we were helping them detect issues ranging from misconfigurations or shadow IT, data loss prevention, and other perhaps not ideal scenarios surrounding their data within the many SaaS applications they use. And so we did that through what we kind of labeled as a platform, a very easy to use onboard and access system that they could connect with their SaaS integrations and then be able to get visibility to start wrangling in all that was happening in those environments. So we were very early stages and starting to onboard more and more customers, but really integrating with the common SaaS applications that everyone knows and loves. Well, thank you. I'm sure, actually, at the end, I'll probably ask you to dive in more and tell everyone where they can learn more about Fectrix if these sound like problems that they're currently experiencing in their companies. But back to the topic of M&A. And so there's a lot of different ways that an acquisition process can start. Oftentimes, as the general public, you just see a press release come out and you have no idea how it started. So we'll just begin there. There's a lot of different ways you can meet a company. Sometimes, it's just completely serendipitously. You meet a great team. Other times, it's a bit more deliberate and intentional. And then sometimes, you might interact with investment bankers who are running a formal auction process. So Sam, since you've led the sort of product team through this acquisition, could you share a little background on what initially got us connected with Vectrix, what made us even think about the idea of actually acquiring this company, and just how we got connected? Yeah. So at Cloudflare, you mentioned our Zero Trust products earlier. We have a set of products that really obsess over solving the problems that enterprises have, keeping their own organization safe, and also performant. And the kind of magic of getting to build those at Cloudflare is that when Cloudflare launched over 10 years ago now, the company did not launch to BICDN or BAWAF or BDDoS mitigation. The company built a network, this really powerful distributed peered network that's now in over 250 cities around the world, on top of which you can build really incredible products like the WAF and the CDN and DDoS mitigation, and now the Zero Trust products. And all of those products to date have been focused on what can we do in our network to keep an organization safe. So how do we help people replace a VPN with something that gives them secure connectivity that you can apply rules to say, only these users from corporate devices in these countries with a hard key multi-factor authentication method? Or how do we use our DNS resolver to give people the ability to do DNS filtering? So if I click on a potential phishing link or even full secure web gateway features, just everything possible to keep an organization safe in our network. But one thing eluded us, because while we're really great at doing something that I think is kind of, it feels natural for us from over 10 years of investment, but it's a really hard challenge. We're really great at things with our network and building on our network where we were struggling with this kind of blind spot with, hey, some of the problems that our customers have, like Corey mentioned, consist of SaaS applications that are just data sitting at rest. This is not something that's flowing through our network. It's a configuration change I might accidentally make or a settings that might not be applied correctly. And so we as an organization, when we've acquired companies before, a lot of times it kind of fits into, great, this is a piece of technology that's really well-suited to our network. Our Xeraz acquisition is a really good example of that. They had built a product on top of Cloudflare Work, which is our serverless compute platform. So great, this is a way that we can expand how we can offer security in our reverse proxy in what is a pretty plug and play system and integration. But in this case, we looked at this and thought, you know what, this requires a level of depth and expertise and skills that we just would need to go invest a lot of time to create. This idea of scanning these SaaS applications, something that's happening outside of our network, running these services. And so that's kind of the background on the foundation of it, where it really became real and painful is like everything else in product management customers. Customers kept saying, we love your Zero Trust products. We're so excited about what you can do with security in your network. We've got this giant problem with the data at rest in our SaaS applications. Do you do that too? And we had to say, no, over and over again, to the point that I started to build a document of all the deals that we had to say no to. And initially we thought, you know what, that's just a space that we're not going to play in maybe. But over time, it became clear to us that customers really wanted a comprehensive Zero Trust vendor. They want one vendor to solve this kind of range of problems. And the fact that we were missing what became this core competency, and as this idea of what Zero Trust is has kind of evolved, it became a core competency. They were not willing to, and some customers were not willing to necessarily start the full journey with us without this feature set. And that really motivated us to start to look elsewhere to see, hey, are there really, really great organizations that do this today? And I know we'll talk about this somewhat else in this conversation, who kind of fit with who we are at Cloudflare and what we believe in and what we want to go build and how we want to help customers. That's really what started the kind of, I guess, search, you could call it. The thing that sort of jumps out at me of what you just said is we were very honest with ourselves about what we could do, what we could do fast enough, what we could do for customers today, and what the demand was. And I think that was a really important piece of this process. I think without that acknowledgement internally and the alignment internally that this was a gap we need to solve and then plug quickly, who knows how long it would have taken us to get to the right solution. So I think of M&A as a way to solve these problems. And if you're not honest with your own teams and with yourselves about the problems and challenges you have, it's hard to find the right solution and it's definitely hard to make the right acquisitions. Well, there's a lot more to dig in there. I guess one question for Corey while we're at it. I remember we got connected to you or we reached out to you and we're really excited that you took our call. And I remember the first conversation went really well. I guess from your perspective, maybe it was a little different. How did it feel when this company out of the blue reached out, wanted to learn more? Was it something where you were like, well, I don't know. I don't know what this is about, but you took our call. So what piqued your interest? Yeah, great question. It's definitely a balance and there's some very vocal schools of thought of don't talk to M&A and talk to M&A all the time, right? For me personally, there was two bits that made taking the call and saying yes to that a no-brainer. One was we were Cloudflare customers ourselves. And I had been in through previous roles for the past several years. So the immediate emotional reaction was humbly flattered. Of course, I'd love to meet some of the people behind products that I've been using for years. That sounds great. Any chance I can have one as a professional and two, if it can help Vectrex in any way, let's do it. And so that was the immediate reaction of like, okay, cool. And then to your point of kind of getting to know the folks, then it made sense of, oh, it did feel that way mutually. It's nice to share now kind of after the fact that, yeah, it was very exciting of like, okay, these people think like we do in the best way. Very, very customer focused, very, very customer driven. How are we helping customers was kind of the root of the call in those conversations. So it started out with, hey, we were a customer ourselves. We were a customer at Vectrex. I was a customer in all my previous roles. How cool would it be to actually meet some of these folks? And so that was the, okay, 30 minutes. There's a million things going on, but I think we can make 30 minutes for this. Well, one thing I'd love to actually double click on is, as you mentioned, there's different sort of schools of thought for an advice for founders of, should you take this call? Should you not spend time with corporate development teams? I've heard a lot of that as someone on our corporate development team, most of the time we're lucky and founders are willing to talk to us. And then every so often there's maybe a different reaction, but can you maybe just give a little bit more insight on sort of why there are those sort of two different schools of thought on this topic? Yeah. I studied both a little bit is because I was kind of determining through, one would be is it is a distraction. Is M&A going to help, talking to someone on the M&A side, going to help you build a better product for your customers? Maybe not, probably not. I don't know. And so it's, if you're not doing that, you need to be severely focused on what you're doing to help build a better product and make your customers happy. And that's a distraction. The other school of thought, which I like to some degree is it's a lot about relationships and not a who you know game, but a genuine, how are we going to make this better? And if there's an avenue to do it better together, you want to know who those people are. You want to get to know them as individuals, as who they are in their roles and who they are within their companies that they represent. And so those are kind of the two of start early, but don't let it become a distraction versus don't even tempt yourself because it can get you thinking about different things that aren't customer obsessed. And so that's the slippery slope, I think. So why the extremes are so, I would say vocal. I think taking it, my opinion and what we followed was it's a mix of both. You need to be very thoughtful about when you say yes, but when you say yes, you need to know what you're getting into and it's totally okay to say no. And we did say no lots of times. Yeah, that's totally fair. One of the things I try to tell friends who are founders in these positions is the nice thing about talking to a corporate development team, and it varies from company to company, but oftentimes the corporate development person might not be reaching out to you for some nefarious intention or wanting to acquire your company against your will and take it away from you. A lot of times they're just sort of kind of to a lot of the other parts of an organization. So there are a lot of times where I'll meet a team and they'll want to learn more about another Cloudflare product. And they'll ask, can I get connected to that product? And that's something I do more often than actually acquiring companies. A lot of times I'm just sort of a bridge for the outside world and Cloudflare. Thank you for sharing that. Jonathan, I have a question for you. So we had met Vectrex and you were on every single call from the beginning. From your perspective, leading the engineering side of things for Cloudflare Zero Trust, what were you looking for in those initial conversations? Yeah, good question. From the engineering perspective, the actually first thing I'm looking for is the people. Like, is the engineering team the kind of people that we want to work with that have the acumen to get it done, but also have the same values that we have in engineering at Cloudflare? We're looking for curiosity and ability to ship, and then also listening to customers and being able to change our technology for what customers need. So that's the number one thing. You can have the world's best technology, but pulling it into an ecosystem and integrating it is difficult without the right people. So that's one. And then the second thing on the technology side is, how well thought out is it? What does architecture look like that they currently have and why? What was the reasoning behind, this is how we built this? Are they throwing something together that will work? Or are they thinking about operating in the reliability and quality that we're looking for with the products that we offer? So really, that's what we're looking for. Are they hitting the primary functions and features that our customers are looking for? But also, how do they reach those goals? Is it expandable? Is it portable? Is it reliable? These are the types of things we're looking for in the technology that's been built. And so I know a lot of the feedback you had on the topics you just mentioned, they were sort of inputs for Sam in a lot of ways to just understand, can this company actually help plug the gaps that I mentioned before? Sam, I guess anything else you were looking for in just the sort of very early conversation? So was there anything that jumped out at you after we met Corey and his team? Customer obsession. And I think kind of the great thing about getting to talk to potential partners or folks who might want to join Cloudflare through something like an acquisition is that really, so many people that we have the opportunity to speak with share that. And that's really a blessing that we get to kind of know folks who kind of like us, wake up every day, focused on customer problems. But in the case of Vectrix, there were a few things that we really, just frankly, we were excited to hear in how they talked about that customer obsession. One was usability and time to value. I guess that's really two points, but with a lot of overlap. Cloudflare's DNA is in serving anyone, in democratizing the tools that previously were only available to the world's largest enterprises, whether that is our really robust free plan or the ways that we take features that have historically kind of been gated on, you got to pick up the phone or you need a contract, let you buy them with a credit card. And so when Corey and the Vectrix team were describing how much of a focus area it is for them to really serve teams for whom keeping security controls over dozens or hundreds of SaaS applications is just insurmountable because they are a small team. Like, oh yeah, they are thinking about the customers in the way that we think about customers, companies that have these hard problems to solve and either the best tools were out of reach, or the best tools required really intensive deployment and onboarding. And so when Corey and the Vectrix team mentioned that, we were just a light bulb moment, like, okay, wow. There's a lot of shared empathy for how we see, especially in the security world, the space of the customer problem. And then another thing that I think really beyond just that level of customer obsession, it's, and Jonathan mentioned this, it's curiosity. We at Cloudflare, I think, wake up every day, kind of all of us almost, somewhat, I know I feel it, kind of awestruck that, oh, wow, we get to build on this network today. What can we do? And what does that make possible for us? And when we started to kind of talk to Vectrix more seriously about an acquisition during the due diligence process, they weren't there to just say, yep, here's our technology, here's what it does today. Do you want it? They were whiteboarding out kind of ideas that, hey, wow, one plus one equals three if you involve Cloudflare and Vectrix. So really this idea of how do we, and they just exemplified this, how do we be curious about why joining these two organizations creates something that's, you know, some is greater than the part, something that's even better for the customer experience, as opposed to just a, hey, this is our Lego brick, do you want it? It was, look at all the things that we could build together that are possible by being part of the same organization. So those things, I remember both the conversation that was on Zoom when Corey was talking about their customer obsession, and then I remember being in a conference room in San Francisco, which is something I have not gotten to do a lot during the due diligence process, and kind of watching them talk about some of the ideas of what could be built next post-acquisition and thinking, okay, yeah, this team's fantastic. These are people I want to work with. Hey, I'm sure all of us actually probably felt that way. I remember very distinctly the meeting in San Francisco, and I had to join remotely when everyone started whiteboarding. I remember leaning in as closely as possible to my screen to be able to see what was on the whiteboard. I caught maybe some of it, and then I also asked someone in the room to take a picture, but it was just, when those sort of moments happen, you just, it feels great. It feels like you're already working together as one small team, right? Yeah. Well, so that, it's in general, I remember the early parts of our conversations with Corey and his team, it just felt like there was a very natural fit as just a team that we'd want to work with, as Sam mentioned, and a team with a product that was just sort of a perfect fit for Toppler. So in terms of an M&A process from there, this is where the, maybe some of the more boring parts of the process starts, and it's the sort of due diligence and all the deal execution, all that stuff. And I sort of think of this as, for anyone that's maybe bought a house, right? If you go through, you see the house for the first time and you're like, this is the right fit for us, the right size, the right architecture, the right style, the right location. But before you actually acquire or buy a house, you'd want to know, is the plumbing working? Are there leaks in the roof? And really just understand the foundation and what you're getting, right? And so what that ends up meaning in an M&A process is a lot of document requests, and for Corey and his team, uploading a ton of stuff. So I guess actually, Corey, for you, what was that experience like? I know it can be pretty overwhelming sometimes, but how did you sort of manage through that and make sure you're delivering the right information and doing that while also still balancing building and running a business? Yeah, it was a very fun time, is probably how I'll phrase it. We're only given 24 hours a day, and we were using most of those already. And so it was, okay, how do we do this? As a founder, I think how you do that is you need a good system. You need to be very organized. It wasn't like we didn't have things or needed to go find them. It was, okay, we're going to take A and share it, we're going to take B and share it. While you're able to do that, you still need to be thinking about your customers, right? These are two now thoughts that you have to maintain at the same time. So the first thing I kind of think about is what I recall is, one is, thank goodness we were organized, and I would encourage all founders to have all of your ducks in a row from obviously the legal side, the product side, the financial side, be very thorough in that regard. But also too is kind of do what you're going to say, follow through with what you say you're going to do. Hey, me and team, we will deliver this by this day, right? And so you want to set that kind of reputation up early while you're still able to commit and continue all of your things that you promised to customers. So I would say there's no easy way to say it's a very stressful time, but it can be managed and it can be done. So long as you have those two priorities in your mind of, we're not going to let customers down while we're doing this, and we're not going to be too distracted. And to do that, you need to be very organized well before you start, kind of the thinking of be prepared to be prepared. It's not like when you're starting a company, ideally you're not thinking about acquisition day one, you're thinking about building a great product. We were just organized and had everything in the right place, and that was essential. The second thing was kind of in that organization scheme of making sure that you have the right people set aside to do it, and that was their sole focus, right? So it became my full-time job to make sure this went as smoothly as humanly possible, and that we had everything together. I think if you start involving too many people or too few, it can become troublesome. So one, it's going to be tough. There's no easy way around it. Stay very, very organized and make sure that you do what you say you're going to do. And the rest is nose to the grind. It's one of those things. It's just, it is what it is, and you just do it. And you have to smile while you're doing it, because if you don't, you're not enjoying it, and it's not going to be a good relationship on the other side. The organization and the diligence from you and the team was very apparent for me. I've worked on deals where founders don't necessarily have their house in order and don't think ahead on some of this stuff, and it makes a really big difference. I guess, Jonathan, question for you. There's sort of a point Corey mentioned around distraction and having to build and grow a business. We sort of have the same challenge at Clothler as well, right? There's a business we're all helping build. Things are moving really quickly. You have a team of engineers that are working on a lot of stuff. How do you think about keeping your teams focused, but also pulling in the right people into the diligence process? Yeah, that's interesting, because one of the reasons we, like you mentioned earlier, one of the reasons we look towards M&A is to solve a problem either quickly or with different resources that we're looking for. We want to maintain that balance where you're not bringing too many people in. I normally assemble a small team to help me with the diligence that I trust to make great decisions, but I also trust to be able to balance their time well, but then I also let them set aside some time. I am going to lose a little bit of their productivity while we do this, but I think that in the end, with the right acquisition, the gains we get are so much worth the few hours a week that it takes to do this. I look to my senior engineer and maybe an engineering manager and security team, just grabbing one person kind of from each area. Very team effort, very collaborative amongst different teams to really focus on this. That's generally my approach. Yeah. I know you made a deliberate effort, too, for the folks that you pulled into the process. Most, if not all of them, were ones that Cory and his team interact with or work with or rely on a lot now. It's actually really nice to introduce those people early on in the process, so you get their impressions of the team, but also for Cory and his folks starting to get to know us through kind of working together in a way, right? That was something that I think we always tried to do on any acquisition process and something I'll keep nudging us to continue doing. Thinking about the deal execution process, it's just a lot of stuff, but once you get there and you get to the end and everyone is still really excited about each other, which they were, you get a deal done. That's a really exciting time, but I know every time I've gotten a deal signed or closed, there's this moment of excitement, and then very quickly it's replaced with a, oh, my God. Now we actually have to go make all of this stuff happen. Sam, you touched on the sort of reasoning and rationale behind why we started talking about metrics. Once the deal got done, that's probably where the hard work really began. Sam, for you, when you were thinking about welcoming Cory and his team to Cloudflare, how did you think about making sure that they were set up for success and that we could do all of the things that we're hoping to do going into this process? Yeah. The fun thing about Cory and the Vectrix team is, and I think Jonathan probably feels the same way, setting them up for success just removing any and all blockers that would get in the way of that. They've been, as a standalone group, obviously very successful. They know how to work together. They know how to build. For Jonathan and I, that meant two responsibilities. One, help them just understand the lay of the land, like, here's the wiki to read, and, oh, that's the person to talk to about the core data center and questions that you might have. Just being traffic directors, right? Then the second was just, if there were things that might get in the way or slow them down, and this is, I think, just true of manager responsibilities in any company, and that's, hey, how can we, Jonathan and I, go help bring collectively between the two of us nearly eight years of Cloudflare experience to remove whatever blockers getting in their way. I can say two things, though. From a customer and customer excitement perspective, this has just been thrilling. Growth makes anything feel a little less painful, and so how much customer feedback and interest in this has made that kind of recipe for success even more fun. Then the second thing is, and even bigger than that, the Vectrix team has just been cranking on making this integration move. I know in the next week, we're going to kind of share some more information about customers who have signed up, when they can start to expect to begin using it fully migrated over into the Cloudflare world, but I think for Shbiz and I both, we've kind of been looking at their progress, moving things over, and just thinking, oh, wow, this is amazing. We just need to get out of the way, really, at this point, so setting them up for success, just honestly, all it took was that. They've done all the hard work. Yeah, it's very apparent, I think, to everyone at Cloudflare how fast-pouring and say all of your teams have just been moving. Wow, this is really exciting stuff. Last sort of quick question before we wrap up is, I guess, one last trip down memory lane. What was the most memorable part of the acquisition process for each of you? Corey, maybe start with you. Sure. We kind of touched on it earlier. I have this burned in my skull the best way possible. We were fortunate enough to get to meet in person and in a safe environment. I'm so excited and glad that we got to do that, and I remember Sam, we were whiteboarding all day, and I think it was in the afternoon, and he started going, okay, here's what we could build together, and I think you were one whiteboard complete, and we had prepared a slide prior of all of our thoughts, and I was like, oh, man, and so he finished the thoughts, and I was like, let's just, so we pull up the slide, and there's a 90% overlap of the things, and I was like, okay, this truly makes sense. It couldn't be more clear to me, and so that was the first, like, this is so cool, like, just quietly sitting there being like, yes, okay, awesome, yes, and then be like, look, we think that, too. That was a really, really memorable moment for me, and we've continued that. We're going to build those things, so that's only going to keep going. Awesome. Jonathan or Sam? Corey stole mine, but yeah. Well, mine is similar to Corey's, but on the engineering side, we had this moment where we're looking for how quickly can we integrate this, and how will this fit, and we were, I was sitting with one of my lead engineers, and we were sitting with Matt from Vectrix on the call, and they were just going over the technology that they use, and how they use it, and my engineer and I were just looking at each other like, check, check, check, check, okay, this looks really good, so. Awesome, cool. Mine would be at that same meeting, we got to meet the whole team, and I'd obviously been, we'd gotten to know Corey and Matt pretty well during some of the early phases of due diligence, and Alex as well, but then getting to go spend some one-on -one time with most, or if not all of the organization, and thinking, wow, every person on this team is someone who, if they were just a candidate interested in Cloudflare, we'd be actively trying to recruit to come be part of our organization, and that was pretty special to me, to kind of have that experience getting to know the whole crew. As a corporate development person, that's what I love hearing, because it's the last thing I ever want is for us to do an acquisition, and have everyone be like, I don't know about these people, or quarantine, or a little suspect, but that would be the opposite of what happened here, so it's been really awesome working with you, Corey, and your team so far. Cool, thanks everyone for joining. I guess the last quick thing is, I think Sam teased some maybe upcoming announcements, but until then, if there's anyone who wants to learn more about Cloudflare Zero Trust or Vectrix, Corey or Sam, what's the best way to do that? Yeah, we'll add links to the beta sign-up in this list. We'll be rolling out the first invites literally within the next month or so, so people can have access to the product to get hands-on pretty quickly here, so you'll see those links in the description. Awesome, all right, thank you, all three of you, again, for taking the time out for this conversation. It's great to get to hang out. Yeah, exactly, we're just hanging out.