Cloudflare to acquire Area 1 Security for $162M | Hacker News Reader

Cloudflare to acquire Area 1 Security for $162M

blog.cloudflare.com

149 pointsmarc__139 comments

This kind of makes sense.

Cloudflare is essentially a giant membrane / shield / firewall for your website (or network).

Area 1 could be argued as roughly the same thing but for email instead.

Cloudflare is likely expanding their play into this space for their security suite offering of managing every single thing in-and-out of an organization.

Personally, I hated the idea of Area 1 and relaying all private emails through someone else. We literally, to my knowledge of how it works, have clients updating their DNS MX records to all send through Area 1 versus their own private Gmail accounts!

But now that Cloudflare is taking over I do not really mind. Trust pays off.

I'm in the cloudflare email beta and it really just lets you forward emails, I'm guessing the functionality will be significantly expanded in the coming years!

Yes. That's the plan. Open Area1's incredible tech to everyone. Make phishing a thing you only read about in history books. One edit: months, not years.

Yep. I trust cloudflare more than Gmail actually. One isn't known for having algorithms delete accounts without human appeal.

It is much deeper than that. The incentives for advertisement are misaligned between the user and the service provider. Cloudflare is akin to Apple in this regard where privacy is feature, not a bug for their business model. Google can engage in their core advertisement business or they can provide cloud services and Business apps. Not both. It's like hiring a security guard that also has a second job of stealing what they're guarding.

well said.

> Cloudflare ... privacy is feature, not a bug for their business model.

They are literally a MITM service.

But to OPs point, their incentives are not aligned with advertising. Cloudflare is not incentivized to sell user data or misuse data for targeted ads or mining data.

If they start selling data they gather as a result of their product they will burn user trust and goodwill in a single day and seriously harm their business and brand. So they would never do it intentionally.

> One isn't known for having algorithms delete accounts without human appeal.

I once lost access to my Cloudflare account, and the only way to get support... wait for it.... required you to log into your account.

Why are companies doing this?

Same happened to me with PayPal. My 2FA was through Google Voice, and they blocked Google Voice so I couldn't authenticate. Now I refuse to use them. Recently I emailed a band to get an alternate payment option to buy a t-shirt just to not do business with through them.

> I once lost access to my Cloudflare account, and the only way to get support... wait for it.... required you to log into your account.

cc jgrahamc

> I trust cloudflare more than Gmail actually. One isn't known for having algorithms delete accounts without human appeal.

No, instead it's known for leaking private customer data (think authentication tokens and the like) onto the public internet [1]. Imagine if Gmail ever had a bug like that.

[1] https://en.wikipedia.org/wiki/Cloudbleed

I fear (potentially?) hostile agents like Google more than bugs.

Not sure why you think Google is a potential hostile agent, but not Cloudflare?

Did you just juxtapose "private" and "Gmail"?

I used to have domains whose MX records went to google, but I had no expectation that the mail would be private. "Just works" and "free" were powerful selling points. I was ok letting them analyze my email in exchange for providing the service.

Yes. You are right... but you missed my point of the service adding another layer between your exchanged messages. It could be any email provider.

Oooh, this could fill the missing gap in CF's email offerings ( they offer forwarding, but no smtp product ), hopefully while preventing abuse, yeah? Here's hoping this could lead to a full replacement product for google workspace captives

Will this work like the orange "proxy" icon for website DNS records, where I enter my Google MX records, click the orange cloud, and then Area 1 stands in between the web and google to stop certain emails? Or would this be more like a future use Cloudflare as my email inbox type of solution?

I'm eager to get away from Google for Business email but not excited about fastmail, etc.

Yes, the former. Think of it as orange clouding/proxying your email traffic.

After the deal closes, we plan to make it a single-click in the DNS dashboard (and elsewhere) to start filtering your email through Area 1's technology.

We'll talk more about plans in the near future on the Cloudflare blog.

Oh look, an acquisition I can be happy about!

Magic transit is a great product, but out of reach for some smaller organisations. SMTP protection is nearly, if not as important as HTTP protection.

I look forward to orange shielding MX records and keeping my inbound SMTP servers non-public facing (perhaps behind an Argo tunnel - if that's possible?).

Yeah, I'm more interested in being able to put a proxy in front of (hide) the true IP address of mail servers than the phishing protection. Personally.

Congrats to the Area1 crew. I've got a few friends who have been there for years. Hopefully this is a meaningful exit for most of them.

Hi friend, we probably run in similar circles. I know everyone seems pretty happy with it being Cloudflare as the acquirer vs some of the others ;).

It'll be really great to see how they integrate.

Ya although $162M is not that much, barely a mark-up from the last round

Well it's a 50% stock deal and Cloudflare's stock is a tad down from their high, too.

The whole SAAS sector have gotten killed lately. If Area 1 wanted an public exit via IPO they'd probably have received the same reduction in valuation. It's an odd time for an exit with how the market has been.

Total funding for Area 1 according to Crunchbase is $82M. Employees probably got next to nothing except retention bonus from Cloudflare.

Good thing employees get paid a salary

This now puts a HUGE target on ProofPoint. My guess: Akamai buys them in the next 12 months.

Isn't that the gross income they made last year. How can they afford this?

Very rough analysis using numbers that are probably wrong, so please don't kill me:

Cloudflare stock trades at a huge multiple of revenue. I'm guessing very roughly that Area 1 probably earns around $10M/yr based on their LinkedIn headcount of 96. Cloudflare trades at roughly 30x revenue. So Cloudflare just paid 16x revenue for Area 1 and it boosted Cloudflare's revenue by $10M, which to Cloudflare investors is worth $300M.

In other words, you'd expect Cloudflare's valuation will go up by $300M as a result of this acquisition, less the $162M that was paid to buy Area 1, for a net increase of roughly $140M or so.

I remember reading about Company A trying to acquire Company B for X in an all stock deal, but the deal didn't go through for some reason. A few years later, Company A bought Company B for 5X in an all stock offer, 5 times the original offer, and many people complained that Company A was vastly over paying. But between the first & second acquisition attempt, Company A's stock had increased by 7x, making it actually cheaper to pay 5x for the acquisition.

Is all revenue equally valuable? Or, perhaps even if that is not true as a rule, your approximation is still useful?

fyi: yearly revenues are 4 times higher for cloudflaire. Area one makes as much in a year that cf makes in a 1/4.

Cloudflare has been on the front page for how many days now?

I wrote about why: https://blog.cloudflare.com/why-we-are-acquiring-area-1/

That's a more interesting article, so I've changed the URL above from https://cloudflare.net/news/news-details/2022/Cloudflare-to-.... Thanks!

Really great and informative blog post, as usual, John. Congratulations!

Just imagine how much Area 51 Security would cost to buy.

/some jokes have to be made just to get them out of the way

Reply on news.ycombinator.com