Cloudflare’s 2025 Impact Report: Building a More Secure and Open Internet

Hello everyone and welcome to this week in net is the January the 23rd 2026 edition. It's our first episode of the year. We're already in 2026. So this week it's all about Clawflare's impact report that was published in December. I'm Dr. based in Lisbon, Portugal. And joining me is Patrick Dave from our impact and policy team. Patrick is also in Lisbon. Patrick will help us unpack some of the key findings of the report. Before we get started in this shorter episode than usual, uh, next week we will have a longer one more related to Iran shutdown and also DDoS attacks. But first, let's give a quick look of what's been happening on the Cough blog. We had two big acquisitions announcements. So Astro is joining Calfflur bringing the creators of the Astro framework in-house as we double down on making it the best option for content driven sites and also human native an AI data marketplace that turns content into structured searchable data is also joining Calfur. So expanding our developer and AI ecosystem. Hopefully in the next few weeks we're going to have an episode only about some of these acquisitions, some of this expansion of the developer and AI ecosystem. There's a lot to unpack there. Uh we also published in our blog a deep dive on a DNS incident that became far more interesting than expected. So uh our public resolver 1.1.1 made a small memory optimization that changed the order in which it returns certain DNS records. So that change exposed a decad's old ambiguity in the original DNS rule book. So some systems for example including parts of Linux and some Cisco devices relied on the old order and when it shifted they didn't hand it well. We've seen this over and over in our blog in recent years and also in our show. Uh in this case we've since proposed a clarification to the standards body to prevent similar issues in the future. So that was a very uh popular blog on hacker news. you should definitely read if you like uh these more technical blogs. From the event side, we covered the severe internet shutdown in Iran that began on January the 8th. So, it's almost two weeks of a very big country uh completely uh disconnected to the internet. There's has been some uh blimps of internet traffic uh since this Thursday. uh 15% uh was the top 15% of the usual traffic was what uh we saw for a few hours. Iran is mostly without the internet uh for political reasons. This is a government shutdown as discussed. We're going to talk about more on this topic next week, but there's a blog in our blog that covers the first days of this shutdown. Um, we also examined BGP anomalies observed in Venezuela during a period of heightened geopolitical tension of course with the operation uh US operation military operation uh that um brought uh Nicholas Madura to justice uh in New York about this uh specifically uh there was some indications that BGP and were related to the military operation and in this vlog from earlier this year we explained that that was not the case. Uh also more recently in the blog we explained how we mitigated a vulnerability in Coffler's ACM validation logic used for automated certifics issuances. So this is all about certificates. It's a very also technical blog that you can read about this specific vulnerability. So that's the roundup. Now let's jump into the impact report with Patrick Day. So Jo, as you know, Cloudflare has a really big and important mission to help build a better internet. So every year we do the impact report and and the the essentially the goal of that is to explain what we mean by that and all the ways that we're working across the company towards that mission. So everything from you know how we do technical standards at IATF and sort of the very basic fabric of the internet, how we do how we release privacy enhancing technologies, how we release our free services, how we support important and vulnerable organizations all over the world like human rights defenders and civil society organizations, how we protect democratic elections and political candidates. So it covers sort of the whole range of all the things we mean when we say that we're helping build Medit. This is our fifth version which sounds you know crazy to think about in hindsight. I think you know every year we do a little bit better job of reaching farther across the organization. I think the easiest story for us has always been to talk about our impact programs which are the programs that we run our team run specifically at Cloudflare. So project Galileo as I talked about the Athenian project where we protect democratic elections and so forth. I think what we've really tried to do is focus on sort of all the technical things that we do and explain what those mean in the context of the internet. So, you know, this year we talk about postconom encryption and open-source projects that we support and sort of we try to get a flavor of all the different things happening across the company, not just sort of the things that, you know, we work on in public policy or in impact or our free services, but really get as broad a lens as we can. And Cloudflare as you know puts out a lot of technical information about all the things we do with our products and services and how the internet works. I think the specific focus of the impact report is to explain to someone without a technical background why that's important. So we focus on democracy and human rights and startup innovation and sort of all those big global themes about development and and the internet that you know we try to make that translation from the technical to the real world and make it accessible for everybody. I started cloudflare six years ago. Uh and a lot of times when I would go and sort of represent the company or talk about project calleo, you know, the first question is always what is cloudflare? What do we do? And then you know the sort of the technical questions that stem from that about how the internet works and so forth. I find that not to be the case anymore. I mean I think I think in part because of how we've grown as a company and sort of the information we try to put out proactively about how things work, including the internet. It's it's a it's a totally different conversation at this point and it often is focused on sort of how we can move things forward rather than sort of the basics of how you know how our services work or how the internet works. It's interesting. There's a page we started last year that's kind of consolidating sort of all the things I talked about and how they're important to the principles of the free and open internet. And I think it's we did that page again this year with some a few small tweaks that you you probably have to be really in the weeds to pay attention to, but essentially, you know, themes that have emerged in the last 12 months about, you know, access to AI infrastructure or digital equity or making sure that, you know, the future AI ecosystem is diverse uh and not sort of overly concentrated in a particular country or a particular company. And so, you know, we've tried to I think the page looks very similar from year to year, but we've kind of shifted the principles that we've focused on as a company over that period. And so, I think that'll be sort of a cool way to track sort of how our thinking evolves over time or what are the sort of dynamic policy issues uh that the company has talked about in the preceding years. So, that's that's a way a part of the report where that's captured. You know, it's really cool. I actually there was a a message on LinkedIn that I didn't know was coming and we just sort of a colleague of mine who works on the impact team happened across but it was from sort of someone we had worked with to help protect the Muldovan elections. That's one of the things we read about in this year's report. We have a project called the Athenian project where we provide free cyber security services to election entities mostly in the US but we've sort of started to move sort of outside and around the world to help protect election commissions. One of the major sort of stories from the year was our work on the elections in Malddova which happened in the fall and Cloudflare was able to play a part in and helping protect that election infrastructure. We actually got a lovely note uh you know showing one of the pages of the impact report where that was discussed uh from someone we worked with in the prime minister Maldo's office just talking about you know our products and how they helped and so it's funny you know we don't do a lot of sort of proactive distribution of the report we kind of write it and make it available and and so it's cool when you sort of see it you know reflected back to you if somebody's taken a look at it including someone that we work with and think highly of and had nice things to say that was really cool one of the things we did during birthday week this year was sort of take some of the work that the company had done with publishers over the course of the year and helping them protect their websites and make that available for free through project Galileo. So I mentioned a couple of times what project Galileo is our largest impact program. We provide free cyber security services to human rights organizations uh over 3,000 organizations in 120 countries. So we made all those sort of AI monitoring tools available for over 750 journalist organizations that are protected under project Galileo. So they now have those same types of tools that were working with some of the largest media companies uh in the world. And so, you know, I think through that process and making that announcement and figuring out what types of services or whether it makes sense for sort of small independent local news organizations that participate in Project Galileo, I think we got really good feedback about how important it was for them to be able to understand how AI AI models were interacting with their websites and then sort of having the same types of tools that large organizations have to control that access and sort of protect their original reporting. That was that was a really cool uh story this year and something, you know, we were really happy to highlight. I I think just this week we started our tracker for things that we wanted to keep track of uh for our 2026 report. I think a couple of things. One, you know, we'll have midterm elections in the US. I mentioned the Athenian project. We protect uh state and local election websites and organizations in 33 states in the US as well as about 400 political campaigns uh through Cloudflare for campaigns. So that'll be a lot that'll be a busy work and I think you know one of the benefits of providing those services as you know is we're also able to track cyber attacks so we can see sort of patterns and cyber attacks uh on election infrastructure over the course of the year and making sure the public has access to that and we're transparent about it. I think that's something we'll definitely be working on. Um I think AI will continue to be a pretty big story. I think Cloudflare as a company is sort of developing more and more security tools to support sort of AI applications and so forth. I think we're always looking for ways that we can provide those to the nonprofit community and make sure that you know those organizations that need that type of technology can have access to it even if they don't sort of have the resources to pay for it. I think everybody at this point has a pretty intuitive understanding of how important the internet is in our lives. I think what we try to do with the impact report and I hope comes through to those who are taking a look at it is how important sort of the decisions that are made about the internet from the technical all the way through to sort of the global policy discussion are as important to things like democracy and human rights and sustainability and all those sort of and global development all those sort of big themes that I think we connect to in our everyday lives just understanding how sort of the smaller pieces of how the internet functions are relevant to those broader discussions we try to do. You know, I don't want to be overly ambitious with what we do with report. But that is something we spend a lot of time thinking about. How do we make sure that the deeply technical things we do are understandable to as broad an audience as we can, including those who are sort of following policy debates or in the free and open internet, etc. Make sure they have all that information.