V-Score Card

NET (Cloudflare)
V-SCORE:            3.37
VERDICT:            EMBEDDED
κ (conviction):     (3.37 − 3.0)⁺ = 0.37
GATE 1 (E>1):       PASS (E=4)
GATE 2 (A>1∨Σ≥12):  PASS (A=4>1; C+E+U=11<12 but A>1 saves it)
FAST SCREEN:        2/3 — proprietary data ✓, transaction-embedded ✓, regulatory mandate ✗

DIMENSIONS
  C (w=0.25):  3   Moderate domain encoding; security rules re-derivable in months given data; "best in world" bot detection is data scale (E), not crystallized cognition [10-K:L630; CEO Q4:L176]
  E (w=0.22):  4   330+ cities, 20%+ web traffic, CDN/DDoS c_ℓ=∞ for ≈40% of revenue; no regulatory mandate; developer platform (fastest-growing) has c_ℓ=moderate [10-K:L517, L991; CEO Q4:L71]
  U (w=0.18):  4   47 products, 4 Acts, 12+ workflows across security/network/dev/consumer; concentrated in tech departments, not cross-enterprise [10-K:L604-880]
  A (w=0.12):  4   4.5M developers, #1 Stack Overflow, 80% AI companies on network, agent traffic 2x in Jan 2026 [CEO Q4:L67-70]
  M (w=0.15):  4   DBNR 120% accelerating, RPO $2.5B +48%, 332K paying customers, 269 >$1M; GRR undisclosed; pay-as-you-go terminable at will [10-K:L6382, L1595; CEO Q4:L93]
  F (w=−0.06): 1   Free tier (millions), self-serve credit card, 2-week migration, API-first, config deploys in seconds [10-K:L1068; CEO Q4:L56, L60]

CALCULATION:
  Raw = 0.25(3) + 0.22(4) + 0.18(4) + 0.12(4) + 0.15(4) − 0.06(1)
      = 0.75 + 0.88 + 0.72 + 0.48 + 0.60 − 0.06
      = 3.37
  Gates: PASS · PASS = 1
  V = 3.37

REGIME CONTEXT (T=15w, 2025-12-16 to 2026-03-28):
  IR = α̂ / σ_idio = +2.42   (NOT significant: t=1.25, p=0.217)
  δ  = V − V_market = 3.37 − 3.0 = 0.37
  ρ_intra = 0.443 (discriminative — market differentiating within sector)

BASKET:             KEEP (κ > 0)
  w_NET = κ / Σκ = 0.37 / Σκ (minimum weight in basket)

Dimension Analysis

C — Compound Cognition: 3 (challenged down from 4)

The prior score of 4 conflated data-scale advantages with crystallized cognition. After adversarial challenge, the data advantage was reassigned to E where it belongs.

What's counted as C should survive this test: "If a frontier model had access to the same data, could it re-derive this knowledge?" For Cloudflare, the answer is mostly yes.

Decomposition of claimed cognition:

CEO says "we're the best in the world at sorting humans from bots" (Q4 2025 earnings, Line 176). The reason is data scale — they SEE 20% of web traffic. Give Google the same labeled dataset and they match it in months. The training pipeline is the moat (E), not the model architecture (C).

Comp test: C=4 requires "deep domain encoding, 1-3 years to re-derive." Synopsys (C=4) encodes semiconductor physics validated through decades of fab results. Veeva (C=4) encodes FDA regulatory workflows across hundreds of therapeutic areas. Cloudflare's domain — network security — is well-characterized, with hundreds of academic papers and multiple competitors (Akamai, Palo Alto, CrowdStrike) holding equivalent expertise. The depth is shallower.

C=3: "Agent re-derives core in months, loses edge cases." A frontier model with OWASP, CVE databases, and standard security literature re-derives 80% of Cloudflare's logic in months. The remaining 20% — rare DDoS signatures, exotic bot patterns, edge-case routing — takes longer, but that long tail is gated by data access (E), not crystallized insight.

Source: 10-K FY2025 Lines 630-635 (Bot Management ML), Lines 975-1007 (single software stack), Line 1246 (381 patents); CEO Q4 2025 Line 176 ("best in world at sorting humans from bots").

E — Irreducible Infrastructure: 4 (confirmed, with caveats)

E=4 holds today but c_ℓ is NOT uniformly infinite across the product portfolio. The original analysis claimed c_ℓ = ∞ for CDN/DDoS as though this covered all revenue. It does not.

Product-level c_ℓ decomposition:

Revenue-weighted c_ℓ: ≈35-40% at ∞, ≈25-30% at high, ≈30-35% at moderate-to-low. Blended c_ℓ is "high," not "infinite."

The growth vector problem: The fastest-growing segment is developer platform — "outsized growth" (CFO, Q4 2025 Line 89). Workers AI, R2, AI Gateway. These are the products with c_ℓ = low-to-moderate. As developer platform grows from ≈20% to potentially ≈35-40% of revenue over 3-5 years, the revenue-weighted c_ℓ declines. E=4 today could be E=3 by 2028-2029.

The switching cost paradox: CEO himself is the prosecution witness. "They were able to migrate massive Internet properties into production in just two weeks" (Q4 Line 60). The 10-K confirms pay-as-you-go customers "can terminate their subscriptions, or switch to less expensive subscription plans, at will with little advance notice" (Line 1595-1597). c_ℓ measures AI displacement resistance, not competitive switching — but competitive switching is finite and short.

E=4 rubric fit: "Petabyte-scale specialized infrastructure, no regulatory mandate." NET fits — 330+ cities, $726.8M gross server infrastructure, $315.6M annual capex, 13,000+ network interconnects, hardware encryption chips embedded in motherboards. The CDN/DDoS core genuinely cannot go local. But E=4 is a depreciating 4, worth re-scoring in 18 months as developer platform revenue share clarifies.

Source: 10-K FY2025 Lines 517-519 (330 cities, 13K networks), Lines 991-994 (encryption chips), Line 6936 ($315.6M capex); CEO Q4 2025 Lines 60, 71, 120; 10-K Line 1595-1597 (pay-as-you-go termination).

U — Ecosystem Breadth: 4

47 named products across 4 categories ("Acts"), 10 subcategories, serving security, network/infrastructure, developer/engineering, IT operations, content/marketing, and compliance teams. Cross-sell is explicit: "start with one product, expand over time" (10-K Line 583-584).

Capped at 4 by department concentration. NET serves predominantly tech-adjacent teams (security, networking, DevOps). It does not span Finance, HR, Operations, or Supply Chain the way SAP (U=5) does. 47 products is impressive breadth within a domain — U=4 is correct.

Source: 10-K FY2025 Lines 604-880 (full product taxonomy), Lines 888-891 (industry verticals).

A — Distribution & Discoverability: 4

4.5M human developers on Workers platform (CEO Q4 Line 67). Ranked #1 cloud platform in Stack Overflow survey (Line 68). API-first architecture: "anything a customer can do via our web interface can also be performed by our API" (10-K Line 1011-1018). Agent traffic on Cloudflare network more than doubled in January 2026 (CEO Line 70). Acquired Replicate ($57.4M, AI model deployment) and ASTRO (developer framework) in 2025.

Not 5 because agents encounter Cloudflare as infrastructure (pass-through), not as an intentional routing destination. CEO's claim that "agents have to interact with us" (Line 113) is about traffic interception, not about agents choosing Cloudflare. The 20% web share creates passive agent exposure, not active agent preference.

Source: CEO Q4 2025 Lines 67-70, 113; 10-K Lines 1011-1018, 9709-9749 (Replicate acquisition).

M — Ecosystem Gravity: 4

DBNR at 120% (Q4 2025), accelerating from 111% a year ago. RPO $2.496B (+48% YoY), 63% current. 332,466 paying customers (+40% YoY). 4,298 large customers >$100K (+23% YoY). 269 customers >$1M (+55% YoY). No customer >10% of revenue. Contracts 1-3 years, non-cancelable.

Not 5 because: (a) Gross retention rate is undisclosed — material gap; (b) No counterparty network effects — customers don't need other customers to be on Cloudflare (unlike SAP where suppliers/customers share the same ERP rail); (c) Pay-as-you-go customers can terminate "at will with little advance notice" (10-K Line 1595-1597).

Source: 10-K FY2025 Lines 6336-6383 (customer counts, DBNR), Line 897 (no concentration), Lines 1595-1597 (termination); Q4 2025 earnings Line 93 (RPO), Line 85 ($1M+ customers).

F — Ecosystem Friction: 1 (penalty — lower is better)

Near-zero friction. Free tier serves millions of Internet properties. Self-serve credit card signup with no sales interaction required (10-K Line 1068-1074). Configuration deploys globally "in seconds" versus competitors' "hours and require professional services" (Line 1016-1018). 4.5M developers on platform. Minimal professional services revenue. Government customer described being "shook by the simplicity" (CEO Q4 Line 56).

F=1 is correct and notable: Cloudflare's frictionless adoption is a genuine competitive advantage for growth, but in V-Score terms it means agents can also LEAVE frictionlessly.

Source: 10-K FY2025 Lines 513-516 (free tier), Lines 1068-1074 (self-serve), Lines 1016-1018 (instant config); CEO Q4 2025 Lines 56, 60.

Scoring Sensitivity

The most consequential dimension debates, with V and κ impact:

C is the swing dimension. Every point of C = 0.25 units of V = 0.25 units of κ. The C=3 vs C=4 debate is whether Cloudflare's knowledge is domain depth (Synopsys, Veeva) or data-scale advantage (which belongs in E). We score it as data-scale.

Regime Context

Factor regression (T=15w, primary model: NET ~ SPY + HACK):

Intra-sector correlation:

ρ_intra = 0.44 means this is NOT an indiscriminate selloff. The market is picking winners and losers within security/cloud: AKAM +32%, NET +3%, flat FTNT −4%, crushed ZS −42%. NET's relative outperformance (+3.2% vs HACK −11.2%) carries some idiosyncratic signal, but 58% of daily variance tracks the sector.

The γ = 1.9 warning: NET has nearly 2x beta to cybersecurity. In a portfolio context, every 1% allocation to NET is ≈1.9% of effective HACK exposure. Two cybersecurity names in the basket and you've tripled your sector concentration. This is the Paleologo Chapter 8 trap: great stock pick, factor exposure destroys the Sharpe.

Revenue Durability

Durable (≈65-70%): CDN, DDoS mitigation, DNS, Magic Transit/WAN, Zero Trust enforcement — functions requiring physical network presence. Per 10-K Line 6393, customers subscribe to network access, not software possession. All revenue runs on the physical network, but the durable core is where c_ℓ = ∞ or high.

Exposed (≈15-20%): Workers AI inference (c_ℓ → 0, commodity GPU), simple WAF rules (local ML replaces), commodity bot detection, AI Gateway (API proxy, open-source alternatives exist).

Mixed (≈10-15%): Developer platform lock-in (proprietary Workers runtime creates stickiness, but compute commoditizes), R2 (zero-egress is competitive advantage today, but storage is fungible), Durable Objects (proprietary state model).

Thermodynamic Summary

Cloudflare occupies a real thermodynamic minimum for CDN/DDoS — physics prevents intelligence from flowing local when content must be served from 330 cities at the speed of light. But this covers ≈40% of revenue. The fastest-growing segments (developer platform, AI Gateway) sit at higher energy states where intelligence CAN flow local or to competing clouds. The crystallized cognition (C=3) is moderate — Cloudflare's "knowledge" is mostly data-scale advantage dressed as domain expertise. What they know is re-derivable; what they have (the network, the 20% traffic share) is not. The moat is infrastructure, not insight.

At 33x P/S, the market prices NET as though all revenue sits in the thermodynamic minimum. It does not. κ = 0.37 reflects the honest assessment: EMBEDDED with erosion risk at the growth edges.

Conviction Weight

κ_NET = (3.37 − 3.0)⁺ = 0.37

w_NET = κ_NET / Σκ_j (across basket)

In the scored universe, NET at κ = 0.37 sits below every FORTRESS name (κ > 1.0) and most EMBEDDED names. For basket construction: minimum weight, included on structural grounds but not conviction-sized.

V(s) ⊥ r_sector(t). The +3.2% return over 15 weeks while HACK cratered −11.2% is regime context, not structural signal. IR = 2.42 at p = 0.217 is noise. δ = 0.37 is the structural story — the market's uniform discount during tech selloffs creates a small gap between NET's structural durability and market pricing.

Evidence Summary