Matthew Prince, CEO of Cloudflare, sells $147,366 in stock

Cloudflare reported Q4 2025 revenue up 34% year-over-year, with remaining performance obligations rising 48% and annual contract value up ~50%. Baird upgraded to Outperform (PT $260) and TD Cowen reiterated Buy (PT $265) after the results, while Cantor Fitzgerald remained Neutral amid valuation concerns (Price/Book ~50.96). CEO Matthew Prince executed a Rule 10b5-1 sale of 659 Class A shares on April 8, 2026 for $147,366 total; he still directly owns 406,315 shares. The company expanded post-quantum encryption across its SASE platform and deepened an AI SIEM integration with SentinelOne, supporting continued product-driven growth despite stretched valuation.

Analysis

Cloudflare’s move to bundle advanced cryptography and broaden telemetry ingestion is less about immediate revenue and more about raising switching costs across enterprise networking and security stacks. Over the next 6–18 months, expect higher retention and larger ACV deals for customers that adopt multiple Cloudflare modules, which will disproportionately hurt single-product vendors who rely on discrete appliance sales. SentinelOne stands to capture asymmetric upside from higher-volume, higher-fidelity Logpush feeds: better telemetry improves SIEM/model performance nonlinearly, which should increase marginal ARPU for telemetry consumers faster than raw unit sales of endpoint agents.

Valuation is the clearest vulnerability. The market is pricing multi-year operational leverage and AI-driven monetization into current multiples; a single quarter of execution miss or a general risk-off move could compress those expectations quickly over a 3–6 month window. Adoption of post-quantum standards and customer certification cycles is a multi-year process, so revenue realization is lumpy and susceptible to regulatory or interoperability delays that would decelerate the current growth narrative.

Tactically, the trade-off is between owning optionality on secular acceleration and protecting capital against multiple compression. The most attractive opportunities are defined-risk structures that capture upside from continued cross-sell and AI tailwinds while limiting exposure to macro-driven derating. Conversely, legacy CDN/Zero Trust incumbents and pure-play telemetry vendors without aggregation capabilities face margin pressure and are logical short or pair-hedge candidates if execution falters or multiples contract.

Key Decisions for Investors

• Long NET via a 9–15 month call spread (buy a 25% OTM call, sell a 60% OTM call) sized at 1–2% of portfolio notional. Rationale: capture AI/telemetry-driven compounding while capping premium. Target ~2.5x payoff; cut losses if spread loses 50% of premium or if quarterly RPO/ACV growth misses consensus by >5% sequentially.
• Long S (SentinelOne) equity or 6–12 month ATM call (size 1–3% portfolio) to play higher monetization of telemetry and SIEM integration. Target 1.8–2.5x in 6–12 months driven by incremental ARPU; stop-loss at -30% or reassess after two consecutive quarters of net retention decline.
• Pair trade (medium risk): Long NET call spread (as above) and short AKAM or ZS shares (size the short at ~50–70% notional of the long) to express growth vs legacy displacement. This reduces pure market-beta and profits if Cloudflare wins share while incumbents lose pricing power. Close pair if NET/AKAM spreads tighten by >25% or macro volatility spikes.
• Macro hedge / bearish protective: If concerned about multiple compression, buy 12–18 month puts on NET or construct a collar around existing NET exposure (sell near-term calls to finance puts). This protects against a 20–40% de-rating while retaining upside from product-led adoption.