Cloudflare

These companies use the creative forces of capitalism to solve big problems—and do well by doing good.

<p>As one of the world’s biggest network-services companies, Cloudflare currently manages traffic for about 20% of the World Wide Web. And in the tug of war over intellectual property rights between AI companies and content producers—including news organizations—Cloudflare has sided firmly in the camp of the creators. Between September 2024 and July 2025, over 1 million Cloudflare customers opted to block AI crawlers—bots that harvest data and text to help engineers build AI models—from their websites, using tools that Cloudflare provided for that purpose. And on July 1, 2025, Cloudflare began blocking crawlers by default.
</p>

Change the World

These companies are built to exhibit resilience amid volatility—and deliver better-than-average growth in the long term.

The Future 50

The companies on this list are mobilizing the creative tools of capitalism to help solve social problems.

<p>More than 2,600 public interest groups in 111 countries are protected from digital threats by Cloudflare’s Project Galileo, which brings free cybersecurity services to vulnerable organizations. Now, in its 10th year, Cloudflare estimates Project Galileo blocks more than 95 million cyberattacks every day, and its client base has quadrupled in the last five years. After Russia invaded Ukraine in 2022, Cloudflare stepped in to help support Ukraine’s critical infrastructure through Galileo.</p>

Future 50

Overall Score

Sector

Change The World

Impact Segment

Prior Year Rank

Get insights into Cloudflare including business profile, stock information, news, and rankings from Fortune.

Cloudflare (NET): Company Profile, Stock Price, News, Rankings

legacy

cloudflare

Companies

Cloudflare | Fortune

Cloudflare (NET): Company Profile, Stock Price, News, Rankings | Fortune

Alexei Oreskovic

OpenAI’s Stargate puts on a Texas-size show

/2025/09/24/openai-stargate-puts-on-texas-size-show-oracle-murdoch/

Nvidia opens the funding floodgates

/2025/09/23/nvidia-opens-the-funding-floodgates/

Trump’s H-1B bombshell sends tech scrambling

/2025/09/22/trump-h-1b-bombshell-sends-tech-scrambling/

Meta’s got glass, and Intel’s got Nvidia inside

/2025/09/19/metas-got-glass-and-intels-got-nvidia-inside/

Jeff John Roberts

Google’s AI is the ‘worst’ for stealing content, says People CEO

/2025/09/11/media-industry-debates-solutions-ai-search-traffic-copyright-brainstorm/

https://fortune.com/2025/09/23/nvidia-opens-the-funding-floodgates/?itm_source=parsely-api

Trump's H-1B bombshell sends tech scrambling

https://fortune.com/2025/09/22/trump-h-1b-bombshell-sends-tech-scrambling/?itm_source=parsely-api

OpenAI's Stargate puts on a Texas-size show

https://fortune.com/2025/09/24/openai-stargate-puts-on-texas-size-show-oracle-murdoch/?itm_source=parsely-api

Meta's got glass, and Intel's got Nvidia inside

https://fortune.com/2025/09/19/metas-got-glass-and-intels-got-nvidia-inside/?itm_source=parsely-api

https://fortune.com/2025/09/11/media-industry-debates-solutions-ai-search-traffic-copyright-brainstorm/?itm_source=parsely-api

Andrew Nusca

Judge won't force Google to sell Chrome

https://fortune.com/2025/09/03/judge-wont-force-google-to-sell-chrome/?itm_source=parsely-api

Tech stocks slump as investors sour on AI growth

https://fortune.com/2025/09/02/tech-stocks-slump-as-investors-sour-on-ai-growth/?itm_source=parsely-api

What happens to the world’s largest media companies when the Big Tech spigot runs dry? As platforms tighten access and AI rewrites the rules of distribution, publishers face a seismic shift in how content is discovered. This conversation gathers leaders across technology, traditional publishing, and culture-defining entertainment media to examine how trusted brands can build influence, community, and lasting IP in a post-platform world where attention is fragmented and control is up for grabs.

Janice Min
Editor-in-Chief and CEO, Ankler Media 

Andrew Nusca
Editorial Director, Fortune Brainstorm 

Matthew Prince
Cofounder and CEO, Cloudflare 

Neil Vogel
Chief Executive Officer, People Inc. 

Bill Gross
Bill Gross, Founder, Idealab; Founder and CEO, ProRata.ai

Search Engine Zero: Who Controls the Future of Discovery

Conferences

Matthew Prince, Co-founder and CEO, Cloudflare Jennifer Tejada, Chairperson and CEO, PagerDuty Moderator: Michal Lev-Ram, FORTUNE

Brainstorm AI 2023: The Infrastructure of AI

OK. So on to the next session, when your organization's role is to keep your customers safe and protected. Implementing new technologies requires a secure foundation. It's incredibly difficult to unwind data once it's been integrated. And it's therefore very important for companies to protect their IP and trade secrets while putting guard rails in place to protect against bad actors as we were just talking about. So how do leading players deploy and harness the power of A I safely joining us now for a conversation on the challenges, strategies and solutions needed to build a strong A I infrastructure, please welcome Matthew Prince, co founder and CEO of Cloud flare which helps protect its clients by serving as a reverse proxy against web traffic. And Jennifer had chairperson and CEO for the incident response platform pager duty and they'll be interviewed by fortunes editor at large Nihal Lavra. Welcome. Um OK, so lots of talk about, um you know, concerns about ethics, philosophical kind of disagreements, um uh about A I but we're going to talk about nuts and bolts, which I know sounds very, very sexy. Uh but it is very important. So I, I wanna hear from both of you. You have so much, um you know, different perspectives, both internally your organizations, but also customers because the customer ba base that you support is, is very, very broad. So when it comes to infrastructure and deployment, what is, what are the top concerns that you're hearing and that you have today? And Matthew, maybe we'll start with you. No, I think the first is just access to it. Um We are still in a place where access to GP US is limited, although that limit is somewhat artificial. Um If you look at the big cloud providers, one of the things that the decisions they made early on was to make it expensive for you to move your data from one region to another or from one cloud provider uh to another AWS for example, marks up their transfer costs of data by almost 4000 times what their underlying costs are and what that is doing in the A I space is actually further artificially constraining access to GP US because there's GP U capacity across the different clouds at any given time. But getting your training set to those places is often very difficult. I think that's the first thing that we're hearing. I think the second thing which is starting to come up more and more and especially in the last 72 hours with the starting to internalize what the EU is doing around regulation is A I today is very much the infrastructure, 95% of GP U capacity for A I is being deployed in the United States. And I think that the rest of the world is waking up and saying, we don't want to make what they see as the mistake of the first generation internet where basically all the data cap back to the US, they want to not repeat that mistake going forward. And so whether you agree with that regulation or disagree with that regulation, I think more and more you're going to see that regulators are going to say, how do we make A I local and how do we make sure that we have some peace and some control over all of this innovation that's going forward? Sure, I think a lot of our customers are working through trying to find a path between research and operationally delivering products and services and changing the way their people work, looking for ways to keep strategies simple. But having to assess the capabilities you have within the organization, understand the uh data and security parameters with within which you need to work, training uh both your people uh and making sure that they're executing within guardrails. Uh but also not losing sight of the opportunity to really change the way they work. And even uh preparing your board members for dealing with some of the new issues that arise as a result of using generative A I in your work today. So there's the technology infrastructure. And then there's also how do we, how do we learn, how do we operate, how do we iterate whether you're a large company that is super conservative or a company that sees this as a game changer and is going to move really fast. So good segue to something that you've brought up before Jen, which is kind of this, you know, FOMO fear of missing out versus fear of jumping in or getting in. I'm not gonna say the acronym because it sounds too stupid but, but, but, but talk a little bit about that um that balance and sort of the pressures for, for both sides. How are organizations looking at it? Yeah, and we, we hear different things from different customers. Some customers are taking a path of um trying to enable every employee in their organization to get some practice and start finding ways to create efficiency and productivity within their teams to really embrace a culture of automation. Uh And then we see other customers who are saying uh you can't use generative A I within your team, you can't use it within the, we, we won't allow our employees to use your platform if you have it. And it's that um fear of the risk that is keeping them from some of the benefits of generative A I. And what's interesting in that case, when you take that risk, adverse stance, your employees can use it as an excuse it gets in, it becomes a convenient excuse for not moving as fast as maybe your competitors will move. And so, you know, what we advise our customers to do is find pockets where you can start test and learn and, um, understand some of the things that are going to work for you and some of the things that will not and then apply those against different use cases across your business. Matthew, you, uh, always have a, an interesting take on things. Um A and, and you've, you've talked about um sort of the, the share, the concern that a lot of the experimentation may not work out. So what's your approach to experimenting and, and what advice do you have for people in the room? You know, I, I um I think if we're all totally honest with ourselves, most of the people in this room, if they're doing anything in A I are effectively just lighting money on fire. Um And, and that's, are you guys happy to hear that? Um Sorry, uh Some of it will work, but the real challenge of A I is that the demo is easy, but production is incredibly hard. And so you're seeing all these incredibly flashy demos that people are, you know, selling their boards on selling V CS, on raising money on. But actually turning that into something that generates real value. That's where the gap is, what's here. And what I think is really tough about this space is we are so used to as product managers, as founders, as engineers working in incredibly deterministic systems, machines. When you tell them to do something are supposed to do the same thing every time you tell them to do it. And what I don't think we've gotten used to is that these are incredibly non determinist. In fact, they're by design non deterministic systems. And as a result, you know, in the security space, I try to understand all four corners of every application that we're securing. I want to understand what every input and every branch on the tree of the output that is impossible in A I. And so I actually think that as we think about this space, we're going to have to have different product managers that think about the space in a different way. We have to think about regulation differently. And how I've started to think about it is actually how we put the guardrails on A I look a lot more about how we put the guardrails on our people within organizations rather than the machines within organizations because A I systems actually behave unpredictably in the same ways that most of your employees behave somewhat unpredictably. Isn't that one of the most exciting aspects of this though? At the same time, the opportunities that that can present again, it depends on what you want. If you want, uh you know, a system where when you turn it on, it does the same thing every time and it's very predictable and it's solving a particular problem. A I is not very good at that. If on the other hand, what you want is a creative agent, then I can do that. Now, I think that then starts to get us down the path of what is a, I really good at A I is really good at replacing people and that's a very uncomfortable thing for us as a society to get used to. But that's what it's good at in a way that traditional deterministic machines haven't been as good at. They're much more tools whereas A I is in a lot of ways replacing it, potentially a lot of the creativity that we today rely on human beings to do. And as a result, it has different guard rails that you can put in place because it can say completely crazy things. Would you like to? I, I would, I would, I mean, I, we, we hear a lot of concerns about, oh my gosh is A I is A I gonna replace all the developers in the world is A I going to um take control over the world uh in, in some surprising and, and unknowing way. I mean, I'm generally very positive about the opportunity that, that generative A I and a more broadly um creates because a lot of what we see today and you heard Aaron Levy talk about it earlier that you still need a human in the loop to apply judgment and empathy and deep layers of context that a large language model can't today produce for you. And so um our belief is that as, as generative A I advances, yes, it's going to replace a lot of the toil and a lot of the meaningless less fulfilling tasks and jobs that we don't really like doing. But at the same time, it's going to create capacity for us to do more interesting things with human effort and human capacity and human context that we might not have been able to get to for many, many years. And so there's an acceleration uh that I think is really, really exciting, it needs to be monitored. So it's, it's another one of these technologies that you've got to have uh systems and automated instrument, instrumentation, tracking and managing. And you've also got to put your businesses in a position to respond to issues as they arise in real time. And so I think we also have to change the way we operate in order to support our teams and our people and our businesses and having success with A I. Um please raise your hand if you have a question for Jen and Matthew, um which we'll get to in just a second. But on the, on the, you mentioned toil and on the kind of experimentation side and trying to move forward with some, some innovative approaches, um At least when it comes to productivity maybe internally. Um you've talked about a a toil bucket and encouraging employees not to be confused with a toilet bucket. Very, very different. What is toil? So what's the bucket list of all the crap you hate doing as an employee? And can you apply some form of automation or a I to move that off your plate? Right? Like that's one interesting place to start. We started having this conversation because we found that employees that are closest to the business problem that understand the most about the business problem often come up with the most practical use case automation or for generative A I or A I more broadly, it's not necessarily the phd that, that does that it's somebody who actually is feeling the pain of the problem. Most founders start their company by having exposure to pain and agony that they want to make go away. So it's, you know, what is your bucket list for the toil and you know, the unfulfilling work that you'd like to never have to do again and start there? And there's remarkably a lot of it still around. Are you moving forward with? I mean, are any of these generating, like actual new processes, new ways? For sure. I mean, like some of the things that even we're doing within our own um products, one of the things that we're using generative A I to do is to draft the first version of the post mortem after a major incident which today takes multiple teams across multiple systems many, many hours times days to just capture what actually happened. What did we do? What did we learn? What remains to be fixed or changed? So this won't happen again. It's a very painful manual process that requires a lot of um you know, integration, coordinations between teams and now gender V I captures everything that went on in our platform and gives you the first draft within a few minutes. Questions for Jan and Matthew raise your hand if you have one. OK. I'm gonna ask you about uh another concern that's come up multiple times, which is vendor lock in. Can you talk a little bit about Matthew uh Matthew about your approach as a company? I know you've struck partnerships with so many different companies in the space. Well, you know, I think that um I think the good news is, this is a new space and that there's a lot of innovation. I think that right now um access to GP us is, is a lot of what's driving this, especially if you're trying to do things in the training space. Uh And the cost of that are just so, so, so enormous that it's very hard to compete with that if you don't have the capital uh to do it. I think over time, um You know, the great news is GPS are just silicon and over time silicon, we just watch time and time and time again comes down, down and down in price. I think the thing that we're trying to do is across the space, make it easy for data to move to wherever the resources are that need it. What I think is the biggest thing holding A I back is somewhat counter intuitive. I mentioned it already but the fact that you have to pay to take your data out of the big cloud providers, but you don't, they don't charge you anything to put it in even though that's a 4000 times mark up on what their underlying costs are costing the same amount to take the data out is put it in. And yet you have to pay that. That's actually restricting and locking people in. If I were a regulator, I would have one very simple regulation, which is the cost of taking data out should be the same as the same as the cost of putting data in. If you have that, we have a lot more competition in the space on different companies being able to compete with their individual models with their individual systems. And we wouldn't sort of have the sort of mediocrity of every different Amazon product which is out there. We'd have competition on every model. We'd have competition on every data storage layer. We'd have competition on all that space and you'd be able to mix and match and create better products. That's the best thing that we could do for the industry. That's what we're trying to drive forward. And I'm hopeful that more cloud providers will follow in our footsteps. And from your perspective, Jen, I think it's important to take a platform approach to this and, and create optionality for yourself in the future. Because to Matthew's point, we're very early and you can already see how one version of an LLM you know, surpasses another and then the next one leap frogs and the next one after that leaves, we're gonna learn a lot in the coming days, weeks, months and years. And we also learned a lot from cloud locking. And so creating optionality for yourself and taking more of a platform approach to this, I think gives you the most flexibility to apply the right technologies to the different types of problems you're going to try and solve because they don't have equal cost cases, they have differing degrees of difficulty in usage. Your people are gonna need different things to uh solve different problems. And so I think taking that platform approach and, and giving yourself the opportunity to sort of future proof uh where your business is going by working with a number of different partners. OK. And we have a question over here. Hi, I'm Anne Michael American Institute of Physics Publishing. And I really want to thank you both Matthew something that you said though really hit me and that was the idea that Oh, you're just setting your money on fire. And it was about scalability and I totally get that. Especially if you're seriously along the path, maybe where you are, where you're developing products, we're 100 and 50 people. And I think our primary use case right now is actually learning. So we are spending small amounts of money on, not what I think is on fire because we're going to ultimately have to pick between different providers of different services. And we can't be stupid when we do that. And so I'm just curious about where you see learning and education and being a smarter consumer because we're not going to build everything ourselves. Like where does that fit in? Yeah, I think again, I think that um if that's what you acknowledge you're doing, there's incredible value in figuring out how these systems work, figuring out where the edge cases are building those, those systems. But when I talk to some, you know, agricultural company and they say we're building our own LLM model. I'm like, mm probably not the best use of time. I, I do think that there is real value in education, getting people trained up on this. And I think especially making sure that we understand that the engineers, the product managers, that the people who are going to be using these systems in the future, understand that the difference between deterministic machines and non deterministic machines and both of them have a place and both of them have a use but they have very different parameters and one is actually, I think much more close to being like a huge manager of humans. I mean, I think A I systems in their non determinism almost act like human beings in a weird way. Whereas deterministic sort of the things we're much more familiar with as engineers have a different set of skills and a different set of constraints. My guess is that the education system is going to play a big role in making sure that we understand how to work with both of these tools in order to get the most out of them. Yeah. And I would just add to that, don't limit your ability to learn and the pace of your learning to just what you can do inside your own organization, apply a growth mindset. I mean, one of the things I've loved about being in Silicon Valley and being able to collaborate with people like Matthew, we compare notes on things all the time and we learn faster together, then we will learn individually on our own. And yes, you've got to be aware of competitive pressures and challenges, but at the same time, like, do you have to make every single mistake yourself? Do you have to learn everything the hard way? Can you apply that growth mindset and try and learn faster by learning together as a community? Um I, I'm guessing most of the people in the room. The, the investors here are not investing in agriculture companies that are building their own. Llm si, I think, but any other words of, of advice real quick, you know, I think it's, again, it's, we're in such early innings of this space. It's going to be interesting to see how it develops. I do think that fundamentally, we've got to think about whether it's the policy questions, whether it's the internal questions, thinking about how these systems work. They're not the solution to every problem, but they are a solution to a different set of problems that we haven't had before that we've often had to throw people at. And so I think that's going to open a bunch of possibilities, but it's going to require very different skill sets in order to make them 100% going, going to require very different skill sets and going to require a lot of practice. So you have to keep experimenting over and over again. You've got to give people the space and time to practice with different technologies and learn what they do and figure out the best path to take. And I think it's really easy to get somebody to try something once. But are they in it every day? Are they in it every week? Are they, are they really building a skill set around it? So do that without setting money on fire. Thank you so much, Jen and Matthew. Thank you for having us.

Francois Locoh-Donou, President, CEO and Director, F5 Matthew Prince, Co-founder and CEO, Cloudflare Ian Swanson, Co-founder and CEO, Protect AI Moderator: Polina Pompliano, FORTUNE

CEO Initiative 2023: Unlocking AI’s Potential…Securely

Higher 20 minutes. But the good news is we're coming back to AI, we've been hearing, we've been hearing through the whole day about the power of A I and how it can change the way that we work and live. But it's also important to dive deeper into one of the most important aspects of implementing AI which is doing it securely doing it responsibly. You know, even as we've seen this explosion in use of AI, we've seen that the number of attacks on companies and consumers and applications has been on the rise. And there are a lot of tech observers and insiders who believe that essentially AI security has taken a back seat to Ai's development and ai's implementation. And consequently, that's opened the door to bad actors from whom the threats include data theft and misuse, fishing, malware, the spread of misinformation, the risk of increased bias. So given all of these risks, how do companies deploy and harness the power of A I but still do it safely? I'm happy to say that joining us now for a conversation on the challenges and strategies and solutions around this question are three real renowned experts in the field. Uh Francois LOCA Duo is the president and CEO and director of F five. Matthew Prince is the co founder and CEO of Cloudflare. And Ian Swanson is co founder and CEO of Protect A I uh leading them in this conversation will be Fortune's Deputy Director of live events and the founder of the profile Paulina Pompano. Please welcome them all to the stage. What? Welcome back everybody. Um So I would love to start with all of your perspectives on briefly sharing your view on the current state of generative A I and also the biggest risk that you think business leaders here today should know about. That's why. Well, I I'll start, I think generally we heard this morning it's a general purpose technology that will impact every industry. I think the industries that will benefit the companies that will benefit or be impacted most in the short term are industries or companies that are digitally mature that have rich data sets and can move relatively quickly to take advantage of the new technologies in that spectrum. I think the industry that will accelerate probably the fastest unfortunately, is the cybercrime industry because cyber crime by definition is, is digital and it's largely actors who don't have to worry about, you know, ethical guidelines and safeguards and standards. And so they're able to move very quickly and we're seeing that already, we're pretty much every company here is already being attacked using A I for fishing for malware, uh for social engineering with bots to try and find a way through, through your data and your application. So I think that will accelerate significantly with general A I with the ability to emulate humans and create much more intelligent social engineering and fishing attacks. So better than those emails I get about Alan needing gift cards, they're gonna get, they're gonna get way better and way more intelligent. Matthew. No, I, I think that what Francois, um, outlined is, is, is probably the thing that in the short term is where the risk is. Um, but I'm actually pretty optimistic that we'll get past that. I think that the idea that we're verifying people by what we think are human traits is probably not a very good security implication in the first place like your banker shouldn't wire money just because you call up and you sound like you. And so I actually think that, yeah, that's gonna be a problem. We're gonna read some scary stories about, you know, parents that are tricked into wiring money to their, their kid who it sounds like is in, you know, some Mexican prison or something. But, you know, it turns out it was an attacker. You laugh but that, that's happened recently and, and there's going to be a bunch of those things and they're going to make scary headlines. But I actually think it's going to accelerate us getting away from that idea that we can tell who to trust simply by how they sound or what they look like or those things, I think the longer term challenges for the ceos that are in this room are going to be much more around. How do they take advantages of what A I brings? But they do it in a way which is responsible over the long term. And so what we're starting to see is a lot of times employees at company are using A I to get their job done without understanding that the minute that they send that data off to an A I engine, it's gone for good, right? And it gets incorporated into a way of thinking. It is imagine like a two year old and you accidentally swear in front of them and then for the next period of time, all they're doing is just saying the bad word over and over and over again. AI is exactly like that. You can't get the information back out of that. And that creates a real problem around trade secrets that creates a real problem around data, locality and data compliance around the world. Right now. If you're using an A I system and you're a European based company, you are sending it all back to the United States and it's not even something where if you send a DPR request and say, hey, forget that you can do it. It's embedded in a black box that is almost unforgettable. And so I think the thing that we're talking to our clients about is how do you make sure that as you're using AI you're doing it anticipating that you want to get those benefits. But at the same time, you want to understand what the risks are and make sure that you're only letting the data flow out of your company. That's actually something you want to flow out of your company. And let's talk about the current state. I've been a leader of A I and machine learning at some of the biggest companies in the world and A I I've seen for the last decade. Drive truly Digital transformation. Now, if it's the vehicle of trans of digital transformation, if anything generative A I is just speeding up that car on the highway and it's going super fast, what we are not doing are the basic maintenance, the basic safety and security checks on that vehicle. And so if I'm looking at where the risk is, the risk is really in the supply chain that we've seen. How are, how is A I being built? How are these models being built from the data, the foundational models, the open source libraries within the supply chain. So when we meet with customers, we ask two questions and I please take this back to your teams. I ask, how secure is your A I and how do you know? And how do you know is incredibly important because companies today don't have the capabilities or the ability to audit these systems and have visibility of their ai therefore it's really hard to build, to secure it. Wow, I love that. Um Francois, you said that the number of cyber attacks on companies and applications have increased dramatically to the point where cyber attacks are costing companies $8 trillion a year globally. I found that number absurd but in a crazy way, doesn't A I kind of arm the cyber criminals with tools that can now scale and what what are do companies need to allocate more capital towards security? Well, yeah, the the the cyber crime is the cost. The cost around the world are around eight trillion, which is the third largest economy in the world after the U and China. Uh A I will accelerate that. Um And uh it, it does arm Attackers with more tools and therefore it will increase the speed and volume of attacks, not necessarily the sophistication, but it allows Attackers that would be not sophisticated at all to be able to launch an attack. One of the scary facts, for example is that today somebody that wants to attack you with rent somewhere doesn't actually know, doesn't actually need to know how to code. But if you think about it, it is quite scary because those folks can actually go online and you know, buy tools, there are tools like fraud GP T you can buy for $200 a month and gives you a starter kit for attacking companies which went somewhere and exploiting vulnerabilities immediately. It doesn't mean that companies necessarily need to spend more money on, on cyber security. Uh But it, it means that number one companies to be, need to be using the tools that exist today. I see a lot of companies that don't actually use the current generation of A I. There are a lot of tools today in security for security control, for monitoring logs, for protecting against our attacks that use current generation of machine learning models to protect against these attacks. And too many times companies underestimate the sophisticated nature of their Attackers and therefore don't use those tools and get breached or under attack and don't even know it. And, and Ian, what are some of the inherent risks that generative AI presents if those inputs in the safety belt isn't there when you're first starting? So a couple of things, as we think about generative A I and A I under the hood, it's machine learning again. And when we talk about the differences in budgets that you brought up machine learning systems are different than all the other systems within your company. So as you're thinking about how do you protect your data, your infrastructure, your equipment, you need to think about how you're going to protect your A I. Now. What are some of those differences? The tools, the tools that developers and practitioners use to build models are different. And today, security vendors don't scan those tools with a way to build it detected vulnerabilities. Also the models and the supply chain. Now, when you brought up generative AI specifically, there's new types of attacks, one of them called prompt injection attacks. It's basically like a sequel injection attack where I can go in there and I can try to mislead the model to do something in a malicious way as a bad actor. Now, this becomes a lot more problematic when it's not just, you know, working with chat GPT to send me some information that, you know, is crapping an email. It's when we start to connect these systems to agents, agents that carry out tasks, that's where the real risk lies. And therefore, that's why we need auditability, visibility and security of these systems. And Matthew, how are we seeing this practically uh at Cloudflare? What measures are you taking to make sure that your company and the companies that you work with aren't victims of some sort of attack? Well, I think the, the the first thing and again, to be the optimist on the panel is, you know, the whole thesis of Cloudflare was that if we could get enough of the web behind us, if we could see enough information that we could feed that into what we frankly still are somewhat uncomfortable calling A I systems, but our machine learning systems that could find new vulnerabilities and stop them before they were attacked so that you get the benefit of being part of the collective. That is this cloud play. And what's been amazing in the same way that publicly we've all watched over the last 18 months as it seems like these A I systems went from jokes to, you know, writing sonnets, right? Which is pretty amazing. Um That same thing we've been watching internally where I remember about a year and a half ago, the first time our system found a vulnerability that no human had ever found before. And that went from something that was like, whoa, that's amazing to now, something that's happening on a very frequent and regular basis where we are often times in front of these vulnerabilities. And in fact, you know, have, have a number of those that were working with the industry in order to help clean up right now that we wouldn't have been able to find if it was simply humans that were out there. And so I think that the very value of this and the very value of using cloud services that you can have the benefits of all of the information use that with the algorithms because the winners in the A I space aren't going to, the algorithms are, are fairly, you know, trivial. They're, they're not, they're, they're the complexity, isn't there? The real thing that you need is to feed the algorithms with the right amount of data and in the security space every single day, cloud customers are safer because of the fact that being able to use these machine learning systems in order to protect everyone who uses our network. And, and again, that's where there are going to be some scary stories that are out there. But I actually think that the good guys thankfully do have more resources than the bad guys. We, we have more access to data than they do. And there are ways that we're going to be able to not in the short term, short term is gonna be a little scary. But over the long term, I think the world becomes safer because of A I not, not scarier. Have you ever gotten breached? Oh, yeah. There we are constantly under attack. It's hard to imagine a threat actor that that isn't going after us. But what I really like is that the way that our systems are designed, we have an employee fall for a fishing scam and make sure that even when that happens, there's a belt and suspenders that keeps them from being protected and that is in part with machine learning system. So I'll give you a very specific example. I'm in Washington DC right now. Earlier this morning, I was in New York City. We have an A I system inside of cloud flow that is checking all of our employees calendars to see where they are supposed to be and then automatically feeding rules back into the system where if I all of a sudden logged in right now to one of our systems, New York, it would simply, even if I had my user name and password and second factor authentication and used even my own machine because I'd left it somewhere behind. That would still not let me through our systems because we've been able to actually get smarter and more secure using the A I tools that we have internally and that we also then make available to all of our customers. Got it. Do we have any audience questions? No, everyone is sick of that. Um II I wanna ask Francois, how are you making sure that your workforce and the companies that you work with are up to speed and educated on protecting themselves from potential security risks? Well, so I think this is something every company out there needs to be doing, which is constantly training. Uh Our employees, Matthew mentioned earlier uh training our employee against fishing and always tempting our, our uh employees with fishing scam and see if they were doing that periodically or is it a one time training when they join the company? No, no, it's something that's on a constant basis on a very regular basis. We train and retrain uh against these attacks. We analyze uh employees who perhaps didn't get the training or fail for these attacks uh and go back and, and retrain them on a very, very, very regular basis. That's something that we do today against regular attacks. But we're starting to train our employees on A I literacy because we feel that that's going to be something that every company needs to do to upskill their, their employees and their knowledge to be able to both use the A I in the most responsible way and understand best practice, best practices for prompts. But also training engineers who are building these algorithms to know how to sanitize the data sets and you know, be able to build these algorithms responsibly, you know. And I think that the thing though that I would go even further on that is your employees are using A I, whether you want them to or not. And so the vast majority of employees are using A I and something like half are not telling their employers that they're actually doing it, they're using it for using it for their daily job to get, get work done. Because these are powerful algorithms. If you're having to write reports, you know, or you're having to generate code, it's a very safe place to or very productive place to be able to turn to. What's again scary about it is it's a two year old. And so once you take your company secret and you send it to the two year old, it's gone forever, right? And that bad word is going to get said over and over and over again. And so I think that part of the tools here is not just in training, but actually putting in place a lot of the, you know, almost like DLP systems that say, you know, again, if you imagine there's a whole bunch of support documents, you're probably fine with those going to the AI systems and those learning. That's great because that actually is, is teaching AIS about how your product works. That's fine. You might have some other secrets that you say we can use on AI systems, but they have to be run locally inside of the company. And then there are other things, you know, the sort of bad metaphor is the secret formula to Coca Cola. You may never want that to actually go into the go out. It's really tough because again, it's like the two year old, once these systems have learned something, it's not like a database row where you can go in and just delete it. Unlearning is actually this really fascinating area of A I research right now. And it's almost like a, like a movie. It's like the, you know, turtle sunshine of the spotless mind. Like we don't have that system to have these, these A I systems unlearn things. And what that means is that it's, it's actually a much bigger security threat for a company, even for insiders to make sure that as the data is leaving the systems that it's the right data that's approved to be used. And that means training for sure. But it also means implementing the technical systems that restrict it and thinking about the supply chain, Ian, were you going to add something? Yeah, I think education is critical. I meet with 10 to 12 chief information security officers every week and I was meeting one with a big Pharma company this past week. And he said, Ian, we're early in our A I journey. We're just now deploying A I. My response was no, you're not, you've been deploying A I for well over a decade as you look at drug discovery in every other facet of your business. But it's just now starting to get on to the table of the cyber security experts within the company. These systems again are different. We must educate how they're different and how we need to treat them differently in terms of looking for vulnerabilities, looking for exploits. And I would love to end on a very practical note, what are some tools that the business leaders here today can use to make sure that they're doing this responsibly and ethically other than promoting our own products? I think it's really just asking the simple questions and we heard it from Julie Sweet from accenture as well asking about who's in charge of responsible A I, who's in charge of security of AI who's in charge of the visibility, the auditability of these systems, just like your financial systems have a ledger, your A I systems need to have a ledger. And oh, by the way, I only know five companies on the planet that I've worked with and I've worked with thousands that actually have that capability. That's where I would start. I'm not about promoting my own products, cloud players. A I gateway gives you the tools to be able to control how data flows out of your systems. We're working with some of the largest companies in the world to make sure that they have control over that. We make it super easy for you to tag data and say here's where it goes and also control the budget that you have for your A I spend. Because the biggest thing that we hear is these budgets just blow up out of control in a way that even the cloud budgets seem seem relatively limited. Awesome, great note to end on. Thank you to our panelists for joining us today. Thank you. Thank you.

Deborah Liu, President and CEO, Ancestry
Ben Peterson, Co-founder, BambooHR
Matthew Prince, Co-founder and CEO, Cloudflare
Aaron Skonnard, Co-founder and CEO, Pluralsight
In conversation with: Phil Wahba, Senior Writer, FORTUNE; Co-chair, Fortune Brainstorm Tech 


Brainstorm Tech 2023: Behind The Growth Of Utah Tech 

Deborah Liu,  Ancestry
Ben Peterson, BambooHR
Matthew Prince, Cloudflare
Aaron Skonnard, Pluralsight
Phil Wahba, FORTUNE

Behind The Growth Of Utah Tech 

Deborah Liu, President and CEO, Ancestry
Ben Peterson, Co-founder, BambooHR
Matthew Prince, Co-founder and CEO, Cloudflare
Aaron Skonnard, Co-founder and CEO, Pluralsight
Phil Wahba, Senior Writer, FORTUNE; Co-chair, Fortune Brainstorm Tech 

Cloudflare

Cloudflare in Fortune Rankings

Cloudflare stock chart

Videos