Name: Deep dive into 2025 Internet trends: A Cloudflare Radar review
Uploaded: 2026-01-21T04:46:07.251Z
Duration: 1 h 28 s
Description: Deep dive into 2025 Internet trends: A Cloudflare Radar review

Transcript for "Deep dive into 2025 Internet trends: A Cloudflare Radar review": Hi. Hi, everyone. Good morning. Good afternoon. And welcome to our Cloudflare live webinar. My name is Eric from Cloudflare marketing team. In today's webinar, we will deep dive into twenty twenty five Internet Trends, a Cloudflare readout review. Before we get started, here are some quick housekeeping notes. First, on the right side of your screen, you will see a Q and A box. Please feel free to submit any questions there at any time during the session. Our speakers will address your questions at the end of the webinar. Second, in the document box on the right side of your screen, you will find some downloadable materials and links that can help you support you to understand the topic better. And please join me to welcome our speakers today. The first is Ben Merrill, vice president of marketing at Cloudflare APJC. Second is welcome, Nan Hao McGraw, our field CTO of APAC APAC and Japan at Cloudflare. Hi, Last but not David Belson, head of data insights at Cloudflare. Welcome, and thank you again for joining us. Let's get started. Over to Ben. Thank you, Eric. And good morning, good afternoon, good evening to everybody. It's an absolute pleasure to spend some time with you today. We're gonna go through and introduce ourselves to make sure you know who we are, and then we're gonna hand over to our experts, David Dawson, to give us a run through of the latest report. By way of introduction, my name is Ben. I lead the marketing team here in Asia Pacific. I'm based in Singapore. Been at Cloudflare for four years, and we I've asked everyone to share an insight because we're talking about insights today. And so the insight that you wanna see today from another report that Cloudflare produces, our impact report, is that in 2025, we donated $19,000,000 worth across the company of services to help people connect better, to help people who needed our protection, our cybersecurity services, our training. That's a cool fact about Cloudflare that I like. Nan, why don't you introduce yourself? Yes. Hi, everyone. I'm Nanhal McGuire. I'm the field CTO for APAC, at Cloudflare. So I'm very excited here today because, obviously, here, we're gonna do a little bit deep dive in terms of what happened in 2025, what we have seen through our, you know, Internet data, through our cyber data, through our platform. And I'm here really just to bounce ideas, share insights with everyone. And, hopefully, after the end of the webinar, you will feel you will feel that you you learned something that you didn't know before, and you'll have a fresh plan for your 2026. Very good. How about you, David? What's the what's your role, and what are you what's an insight about Cloudflare that you'd like to share with the group? Hi. Thank you, Ben and and, Minh. Hi, everybody. My name is David Dawson. I am the head of data insight at Cloudflare. So I have responsibility for Cloudflare radar. So I've produced the last four year review reports. And I my my I I would say my interactions with radar go back to before I was working at Cloudflare. About fifteen minutes after I saw the press release, LaunchLink Radar, I emailed John Graham Cumming, who was the popular CTO at the time, with a whole pile of questions and suggestions, and I think eventually wore him down. And a little bit more than a year later, he reached out to me and brought me on board to to to work with the radar team. So I'm I'm excited to be here again. Thank you. I I love that. I think so. So, Pepper, so questions and suggestions, you might end up working at Cloudflare is the lesson there. David, you mentioned RADAR. We're gonna share a data around RADAR's year in review. Can you just tell us very briefly what is RADAR and and who uses it and and, you know, what what's the. latest from. RADAR? So so Radar is Cloudflare's I call it a portal, I guess, that includes all sorts of perspectives on what's happening on the Internet. So I sort of like to jokingly say, you know, if it's happening on the Internet, it's on our radar. But we are it's based ultimately on anonymized aggregated data. I call it data exhaust, basically, which is derived from the usage of Cloudflare services. And we cover things like traffic, attack trends, connection quality data from our speed tests, routing information, outage tracking, and even DNS and domain data. And then, you know, we we we've constantly expanded it over time. And over this last year, over 2025, we added a a dedicated page for AI insights since those are becoming more and more critical, a dedicated directory for verified bots, so expanding the the bots insights that we already had, a page that provides DNS information at a a TLD or a top level, domain level. It's like .com or .jp. And we transitioned certificate transparency data from a stand alone site and integrated it into RADAR. And a lot of this now also found its way into the twenty twenty five year review. Yeah. And I think on on an ongoing basis, I mean, a lot of defenders and IT architects and people who are thinking about how to architect their own, their own networks and cloud infrastructure, protect their companies. They're using radar, right, to stay abreast of current trends and to see what's happening in terms of, you know, you say attacks and attack patterns. It's. an incredibly useful tool from a, you know, from a security and an IT perspective. Yeah. Absolutely. Yeah. So I think the the subject or the the structure of today is we're gonna hand over to you in a second, and you're gonna run through some insights from the twenty twenty year in review. And then Adam and I will come back, and we'll talk a bit more about some country level information because one of the best things about radar is that you can see what's happening across many of the the filters and and and variables in your country. We'll we'll do some of that q and a afterwards. I would just say at the beginning, you know, one of the reasons that we can do this is 20% of the web is is or or or somehow. interacts with and processes, protects, delivers, you know, around 20% of the web. So the the the data is is incredibly valuable and and and verified, if you like. And the number of times we've been at some sort of presentation, we've been physically with a a customer or a group or people talking about radar, and somebody who knows a lot about their own domain has agreed with our statistics. I was talking to the head of a of a of an IP company here in the region who said, yes. They're a mobile telephone company, and they said, yes. The the statistic we had around mobile and desktop usage was exactly what they see as the head of the country's telco. good to hear. yeah. We we absolutely it's it's alright. So, David, I'll hand over to you. Maybe if you could just give people background to the year in review. As you say, Sure. this is your fourth, I think, annual year in. review. So what is it? Why do we do it? And then take us through top level findings, and then and I will pop back and join you after that. Yeah. Absolutely. So so the year review kind of as it says, we we look back over the the prior year to provide sort of an aggregate perspective on what we've seen across a number of metrics. You know, radar is essentially a a real time tool. So you can look at something, you know, over the last day, over the last couple of days. But, you know, when we start looking at much longer time periods on radar, we we aggregate at a more course level, and we lose some of the granularity. So your review kinda brings that back around and allows us to look at various metrics, either either a daily granularity or weekly granularity and and see how did this metric change over the course of the year. In part, it's also used as a little bit of a, I'll call it, a proving ground for certain metrics. There have been several metrics that we've started on your review and then brought into radar. Similarly, like we did this year, we'll take some of the new metrics that we've included on radar and aggregate them at a, you know, on a yearly basis on on your review. So, you know, we the site is available if you go to radar.cloudflare.com. There's a banner at the top of the page there right now that will link you right to the year review. So let's let's and so and one other thing to mention is that we also publish companion blog posts. So we've published an overview blog post that looks at sort of all the metrics that are in there, and then we also publish a popular Internet services blog post. So it looks more specifically at, as it says, the the Internet services, you know, that we we cover in the in the site. So let's jump into some of the metrics that we cover. We'll we'll take a look at them at a global level. And then I think that when Ben and Nan come back, we'll drill down live into some of these metrics at a more specific country level. So one of the lead metrics on your review, excuse me, is is looking at Internet traffic growth. So based on the traffic that Cloudflare sees across our platform, how do we see that changing over the course of the year? So last year, it grew by just under 20%. And what we we saw was that it it you can see on this the the graph here, it it sort of was sort of flat through through late April as compared to baseline. So so for this metric, what we do is we take an average of the second week of the year. So the week after New Year, letting everybody get back to work, and we take the average of traffic for that week, called out the baseline, and then compare the rest of the year to that baseline. So you can see that that through the first few months, traffic was, you know, up a little bit, but essentially flat. There was some growth in in May, and then that kind of maintained itself through the summer. And then in late August, we saw traffic grow significantly again. And then that reached a nearly 20% growth rate for the through the November. And, you know, the the graph we see here is very consistent with the the growth that we've seen over the past several years as well. The numbers will will differ from year to year, but, ultimately, the patterns tend to be very, very similar. So as I mentioned, we do a popular Internet services blog post that provides an overview and and drills down a little bit deeper on some of the categories that we have for this particular metric. So this metric is based off of aggregated anonymized data from our 1.1.1.1 DNS resolver. So we we we published some of this on the radar domain page, and then we aggregate it together over the course of the year. So overall, you know, at a global level, most popular services have been pretty consistent over the last several years with with Google in the lead at number one, Facebook, number two, and then Apple and Microsoft. So owing largely to their operating systems and their software coming up third and fourth. Other social media sites, including Instagram, YouTube, and TikTok are the top 10. AWS and Amazon as a shopping platform are also there. And then WhatsApp, the meta owned messaging platform rounds out the the top 10. So you can see this is, you know, basically an overview of what you know, if you if you look at what are people doing on the Internet, it's largely this. So we added generative AI as a category, I believe, for the first time in 2024. And this category, the rankings here, I've seen a little bit of movement over the last two years. But, you know, not surprisingly, chat g t ChatGPT and OpenAI topped the list as the most popular generative AI service as seen through our our DNS data. Claude from Anthropic, number two. Google Gemini is a a new entrant this year as is Grok, and I believe as is DeepSeek as well. So there's definitely some movement within this metric over the over the over the last year and just because it's such a dynamic such a dynamic area with with new entrants all the time. Cryptocurrency remains a popular metric as well or a popular category. This is, you know, I think a little bit less dynamic, a little bit less volatile, but but Binance and OKX and Coinbase have been near the top or at the top for the last several years and continue to top the list. So here we see, you know, a number of exchanges. We see a number of informational sites, you know, ticker sites, and things like that. So cryptocurrency also, I think, tends to be a bit dynamic and and changes rankings change from and and the the constituent sites or constituent services change from year to year. Financial services. So Stripe is number one. You know, probably not surprising given that they are behind the scenes of a lot of popular applications that, you know, you have to pay for. The Asia Pacific based Alipay is number three. PayPal, Newbank in Brazil, number five. So, you know, they're based in Brazil, but but see enough enough usage that that's popped them into the top 10. And then you've got also Banco Banco de Brazil, so another another Brazilian financial services provider at the top 10 as well. And then even things like Google Pay where you know, so so you're using your your phone, and then you've got things like Binance and OKX and and other cryptocurrency platforms that are part of the the top 10 here. So one of the other things we we look at, and that comes up a lot on radar, is bot traffic. So for the last couple of years, we've also been tracking where bot traffic is coming from. And we find the couple of, you know, key findings here. One is that it comes from countries in large part with high concentrations of cloud regions. So, you know, The United States is responsible for, I think, about 40% of global bot traffic. And and just as a reminder, you know, not all bots are bad. You know, a lot of the positioning out there around bots is that they're bad. They're scrapers. They're, you know, they're they're they're, you know, generating attack traffic and so on. But remember that there are a lot of, you know, what we call good bots or or verified bots or Cloudflare Parallels. And these are bots that are, you know, for instance, Cloudflare's browser rendering acts as a bot. You've got performance monitoring bots. You've got, you know, all sorts of other things that that are, you know, search engine crawlers. So so all sorts of other automated tools that that, you know, are bots as well. So The US, as I mentioned, has about 40% of globe global bot traffic last year. And then Germany, Singapore, Netherlands, Ireland, China all have, you know, multiple cloud regions, and and we cite we see them among the top 10 as well. And then when we look at it at an autonomous system level, so what providers, what autonomous systems are are driving that traffic? You know, we see Amazon and Microsoft and Google as well as some other cloud providers up there at the top of the list, you know, generating the largest shares of of bot traffic. So I think Ben is back, and we were gonna have a little. bit more of a group discussion on some of the others some of the the next couple slides. Thanks. Hi, David. Yeah. I read a question or a comment actually while you were presenting that before we do anything else, was gonna ask you a gentleman called Steven, I think it's Steven Gillies, was commenting when you were talking about the the usage, the different apps the different sites. Excuse me. So. he said it was fascinating. He would have thought so this is why he had Google and Microsoft and so on. He said, fascinating. I would have thought we'd see some of the chat AI services in there, and I suspect I suspect they were covered under the next tab where you have the Gen AI. But can you just talk to I I know how you how we choose what services go in there, what subset we're looking at? Maybe just go into a bit of the data behind what you're showing there. Sure. Yeah. So, you know, this is based on data from our Quad one, the DNS resolver. So you can you know, user can either download the QuadOne app or configure their their DNS resolvers locally to to use QuadOne. And, basically, we have this is there's there's some and so this is not simply request volume based, so that is a large a major input into this ranking. But there's also some other what am I trying to think of? Some other factors that go into it. Like like, what we're doing here is we're we're identifying sets of host names, cohorts of host names, and domain names that are part of each service. So so for Google, you know, you'll have, you know, google.com, the search engine, then you'll have, you know, mail.google.com, and you'll have, you know, maps and and so on. You know, Facebook's a little more limited. You know, you probably there you have, you know, facebook.com and fbcdn, things like that. So, you know, it may be the case that I think my my perspective, I think, is that the the chat services are getting more popular, but I think that they're still not as popular as a lot of these other services. So I think, you know, obviously, we're not capturing data from everybody on the Internet in that respect, you know, which is just the Quad one users. But even if you consider them sort of a representative subset, I think you're still seeing more users that are that are making use of Google services, you know, using Facebook and and so on than are using, you know, ChatGPT or or Perplexity or whatever. You know? That may shift this year. You know? Who knows? You know? As these services become more powerful, more capable, more popular, you know, we may see, you know, WhatsApp drop off the bottom and ChatGP take its place. You know, it'll be it'll be interesting to to take a look at that in November, December. It's really interesting, and that's one of the reasons why we do this. First of all, we would publish, Right. and second of all, we would talk about it because it does show that there is news and hype and there is reality. And, yes, you know, there is a tremendous amount of increase in usage of certain services, but it doesn't mean that the existing order has changed yet. There's obviously. there's you know, the the the graph, there'll be an inflection point where one overtake the other. But you know? And and, actually, just remember that within the blog post within the the popular Internet services blog post, there is a discussion on how those services like ChatGPT and so on rank overall. So they didn't make the top 10, but my recollection is that, you know, at least one of them broke, I think, the top 40 or top 50 this year. So they are definitely, you know, and and it was probably in the hundreds last year. So they're definitely moving up the list rapidly, but I think it's gonna take a while for them to eclipse something that's in the top 10. Very good. And that seems to have helped to clarify what Steven was asking for. He's active in the chat there. Thanks, Steven. If anyone else has got. any questions, please please throw them our way. I think now I wanna go on to one of those, topics that never goes away. Anyone that's been working in cybersecurity for long enough has seen this like a greatest hits. DDoS, is the, is the attack that keeps on attacking. So, David, why don't you summarize kind of what we learned from a global perspective? And Nan and I probably got some questions for you about this. So this this slide absolutely terrifies me. You know, I I've been in the industry long enough. I was working at another provider before I was at Cloudflare, and remember when we were very excited to be serving a whole gigabit of traffic. And I think we probably all went out for beers that day or something. You know? And I look at this this this this slide and look at just the the absolute growth of DDoS attacks over the course of 2025. And you can see that they they kind of come in waves. And, you know, we see that in terms of of the peak sizes from a Terabits, we'll we'll look primarily at the Terabits one Terabits here. You know, started out the year, I think the the peak that we've seen was around, I wanna say, around three terabits or so. And that was pretty it grew a little bit in January, pretty consistent for a while, and then grew in steps over the course of the year. And then in, like, late September, holy cow, we just got absolutely our custom you know, we we we we deflected, you know, some absolutely massive massive attacks, you know, that we're targeting our customers. And and, you know, that grew through I think through the October and into November, it was about 29 I think record was 29.7 terabits. And then in late November, we got hit with an even bigger one ending in the year at 31 terabits. So, you know, if this slide, you know, doesn't frighten you, it it it should. You know, DDoS. attacks are are getting bigger and bigger and bigger. The most the most sort of interesting thing, David, we've done this webinar in September. We'd have all been really, like, wowed and sort of scared by that that step. You can see Right. from the September. Right. Right? And just because we split the ruler a little bit along, and then up comes this, you know, this monster that dwarfs everything. I. hate to. ask you, but I do see is there a limit to this? Are we is this are we gonna look at this chart this time next year and just is this this attack gonna slide back down and be dwarfed by what comes next, is this? do not wanna see I don't I do not wanna show the slide next year being 60 terabits. You know, that that is not gonna be a good thing. No. I you know, is there a practical limit? I don't know. I think that, you know, you know, these sorts of attacks, you know, based on what we've seen, are are being driven by things like compromised Android TV devices, compromised IP cameras, things like that. So, you know, I think as long as there's unprotected devices out there, you know, we're probably gonna continue to see growth. But but, you know, I think something has to give. Either the ISPs need to be more aggressive at at just, you know, cutting off services from offending customers. You know, maybe that's a little bit drastic, you know, or we you know, there just needs to be a much broader educational campaign that that that takes place that says, you know, hey. If you've got any of these devices on your network, you know, rip them out, throw them out, you know, get them offline, and and, you know, just just stop clogging the Internet with with, you know, garbage and chat traffic. Yeah. I think you're right. And and, of course, the increase in Internet usage sort of speaks to the fact that increased capacity means there's more capacity to be used for the various purposes. Right. Yeah. I think, you know, for for for several years, we were seeing these these big attacks coming from cloud providers, you know, because they have just, you know, absolutely massive capacity. So it's easy to spin up a a v p you know, a a VPS or or a handful of them, you know, launch an attack, tear them down, and and disappear. But I think what's happening now is that, you know, as end user connections are getting bigger and faster, you know, and and as devices are not getting any safer, apparently, the attackers are getting smarter and and using you know, building bot armies ultimately out of these compromised devices. Yeah. You totally there's anything to do with oh, sorry, man. I was just gonna say, do think there's anything to do with the summer months being quiet? Is everyone at the beach at that point? Because the attacks were early in the year and late in the year. Good question. There is actually maybe maybe it points to who's doing them. I. do actually think the the speed in terms of the the volume that is is going to progress much, much faster. You can actually see from the trends, you know, the first half of the year, it it takes a long time to reach to a certain speed. As we go through, you know, we were pretty much getting updated and and and attacked with bigger, higher volume again and then again on a monthly basis through the second half of the year. And when it gets to November, it is kind of like actually, I think in real reality term, to to be able to strike something at that at that volume in such short period is actually require a lot of effort and capacity and and resources as well. So in 2026, I wouldn't be surprised to see these attacks are getting bigger much, much faster. So if it takes three months for them to, let's say, double the speed, I would say, by the end of last year, it takes only, you know, a very small amount of time. So now we probably see it weekly. This could be the trends as well. So, David, unfortunately, think next year, the graph will be will be much more consistent and stable in terms of the speed. will continue to go up into. the right. Yeah. Exactly. It's it's it's a Moore's Law for attacks. I'm relatively confident we'll get to 60. I mean, it's not really great, but it probably will happen. We'll we'll have to see. our audience is responding. Steven, again, says plea is is quoting you, David. Please stop. connecting household appliances to the Internet. Yeah. Your toothbrush is a is a is. a source of a I am I am. of the you you see it online occasionally in certain certain areas. You know, I I am of the the mind that, you know, every pretty much everything in my house is dumb, if it's possible. And, you know, if my printer makes a weird noise, I shoot it. You know, the the that that's her old joke. But, yeah, it's you know, so much is connected to the Internet now that really doesn't need to be. And I think that's in part you know, it's it's sort of a joke of, yeah, my fridge is part of a botnet, but it's like, it may be. And that's you know? And and and to be to be fair, it's not only, think, residential devices. You know, what we're finding also is. that there are a fair number of offending devices that are connected to corporate networks. Yeah. Yeah. Yeah. Agreed. I. I think it's all down to the I think this is a hot topic when it comes to AI, when it comes to all those kind of automations as well. It's all down to your balance. You know? What is actually your attitude towards using those kind of. thing? Are you more driving efficiency, innovative, or are you more, you know, on a conservative side, you you want to be traditionally more secure, you know, making sure your data it's all about how you actually balance what's what's the right level for you individually, and that's to your. individual household as well as, you know, your personal, you know, day to day, but it also apply to bigger organization as well. So your company, fundamentally, what's your business objective? How are you gonna achieve that by adopting the right approach? I think that's something that we will continue to see in 2026, a very much a top priority for any organization to really think. about. Are you doing the right thing? Is it the right balance for you? No. Absolutely. Absolutely. And then I think we'll we'll I'm gonna I'm gonna jump off of that and show another slide, another graph that also going up into the right. But this one, we actually wanna see go up into the right, and and this is post quantum encryption. So so Cloudflare has been, you know, working with post quantum since, I think, 2017. So just as a refresher, you know, there's a great deal of concern that some future quantum computers will be powerful enough to break the the TLS encryption that's being used today. And people are talking about, you know, harvest now decrypt later, that there are, you know, nation state actors or other bad guys who are just, you know, vacuuming up all this Internet all this encrypted Internet traffic, sticking it, you know, in a data center somewhere or a number of data centers. And then when what they call q day comes, they'll be able to decrypt all this encrypted traffic and find, don't know what. You know, your Amazon order from seven years ago, you know, when you bought that Internet connected toothbrush that Ben has, you know, things like that. So what we've been doing is building and integrating post quantum encryption into our platform. And then as the browser vendors have been turning it on you know, integrating it into the the the clients and turning it on by default, we've seen post quantum support continue to grow. So it's basically doubled across 2025. So started the year just under '25 just under just under 30%. It was around 27%, and then grew through March, kinda plateaued, you know, between March and September. And then that big jump at the end there is when all of Apple's OS 26 updates came out. So iOS 26 and Mac OS 26 or whatever. And Safari turned on post quantum encryption support by default. So over the course of several days, you know, if we we filtered it down to just Safari, we saw some really big jumps. And I think we saw enough traffic here, obviously, that drove that post quantum encryption support, statistic from I would say it's about 37% up to 52%. And I was looking at it earlier today, and we're now up over 60%. So this is really, you know, fantastic move news, and we definitely wanna see this this this metric continue to grow, and we wanna see this graph continue to go up into the right. And, you know, next year's webinar, I wanna talk about how it's at 90% or 95%. I wonder if what's it is good news. And I was poking around, in preparation for the webinar looking at different countries. And, of course, because this is a browser level and because it's an OS level, they're relatively consistent on there. There's one country that's 54%, one's 52%. But. generally speaking, the infrastructure layer improvements have pulled everyone up. But. it still leaves half the traffic, you know, not quantum post quantum ready. Right? So you you don't you then. hope that maybe there are more I mean, maybe it's an Android or maybe there's more OS changes or more browser changes need to happen to to give the number boost. But then they're still gonna be a lot on individual systems and other vendors and, you know, other OSs. to to help get us to 90. that's definitely part of the issue is that there are, you know, either older browser versions that are being used out there, older, like, older Android devices that just do not support TLS one three or or don't support, you know, the current versions of the browsers where where PQ encryption is is built in. And then you've got, you know, some some volume of requests also coming from embedded devices and refrigerators and, you know, those sorts of things like that that, you know, you you probably the the upgrade cycle the software upgrade cycle for refrigerators and washing machines and things like that is probably fairly infrequent. So we didn't ship with PQ support. It probably will never have it. Yeah. So so. I. I agree. I think I think when, you know, this year the past couple of years, especially last year, people start trying. You can see the trend, you know, towards the end of the the year. There's a a a, I would say, a spike in terms of the the the adoption. But I do actually think in 2026 with more infrastructure being deployed on a global scale, we are going to see the transition from just talk about it to actually starting to implementing the solution. So, hopefully, I think next year when we sit here, look at the graph, it will look much, much better. But I I do think there is also globally, there is a very much a level of inconsistency. Because the end of the day, a lot of people still are with the mentality. Yes. It's gonna hit us. Once it hits us, it's gonna be hard. But will it hit us, you know, in terms of this type of technology is still very, very expensive? Who's actually going to to actually utilize such such technology to to actually do any damage? I think there's a lot of debate on, you know, who should be more prepared or which industry, what type of, you know, what type of organization should be more prepared than other. But but for sure, 2026 is gonna be a year that we see more post quantum readiness. Yep. I mean, to get philosophical for a second, we all know that q did you call it a q day, David? Q day. Yeah. That's what that's what the industry calls. it. Love that. it. We we know that we know that q day will happen. We don't know when it will happen. So you can sort of assume it will happen tomorrow, and then you're at least moving towards readiness. Right? You shouldn't. assume that you shouldn't assume that it's in months or years because it literally could happen at any time. Right. Right. And and, I mean, and, frankly, the you know, on the server side, you know, you you have, you you know, know, services like Cloudflare, where it comes, you know, baked in. So so in many cases, for, at least for the the data that's that's transiting the Internet, you know, there isn't necessarily a lot of effort that a provide that a a a customer, an enterprise has to put in. You know, moving their services behind something like Cloudflare, you know, they get that that post quantum for free. You know, this is, of course, the discussion of, you know, what are they doing at the origin? You know, what are they doing for their data at rest? You know, obviously, you know, hopefully, like, services companies are are taking the lead there and are actually implementing this. You know, I don't I'm not too worried about, you know, my my household appliance company, you know, encrypting the the, you know, the data at rest with with post quantum. You know, if years from now, somebody wants to decrypt it all and find out that, you know, I I'm low on, you know, low on catch up, like, you know, seven years ago, like, great. Okay. Whatever. But, yeah, hopefully hopefully, the the industries that, you know, have critical data like post like like medical, like financial services, like government, you know, that they're all taking this seriously and and implementing it on the the the the infrastructure side. Right. Gotta keep us. going, David. I think we got one more. finding. One more. Yeah. And then so this is something we we've talked about a little bit, but is is, you know, AI traffic, AI bot and crawler traffic. And, you know, this is becoming a a a growing part of the Internet traffic that we see, the request traffic that we see. You know, so one of the things we added to RADAR in 2025 was perspective on relative traffic volumes from the various crawlers. And in this particular case, we do consider Googlebot and Bingbot to be AI crawlers because they're they're dual purpose. So they they crawl for both AI model training as well as the the the classic search engine indexing. So you can see here that, you know, Googlebot far and away eclipses the the traffic volume, the request traffic volume as compared to the other AI crawlers. You know, you can see it sort of grows through the first three or four months of the year, gradually drops off into the summertime, and then slowly grows through the end of the year. You know, next most most active were were GPT bot and Bingbot and Cloudbot. And then just, you know, really, if you I think if you added up all of the other AI bots together, I think you you basically come up with something that, on average, is is very close to the share of Googlebot. And then on the the AI insights page on Radar today, you can look at the share of traffic between the classic AI bots and what we call the dual purpose bots like Google bot. Yeah. It's amazing. Amazing to see Google bot, you know, all the talk we have of the shift towards from from search engine to answer engine and and the change in behavior and how we all feel personally about using, you know, the the different LLMs more, Right. Google still being dominant. And in fact, Google's seeing a massive growth in its search business driven by a lot by the the AI answers that it delivers there. But I think Google search business was up to the 16%, you know, year over year last quarterly results that that it produced. So this is, you know, sort of interesting. And, I think, as ever, what we've seeing to overlay this with one year from now, Yep. what what that looks like, how the bots have behaved, and and how the callers have changed. Yeah. Very cool. Absolutely. Now? Yeah. So I I share the the the same view. And and to me, I've just recently published an article specifically about the bot dominating Internet trends. So from my perspective, for example, you you look at the Google bot, what we consider, you know, through our own Cloudflare bot management platform, we we count this as a verified bot. So Google Google bot itself is roughly about 25% of all of the verified bot traffic globally currently. But the thing is, you actually consider them as bad bots? Because, traditionally, I think people have this kind of thought that they consider all bot traffic a bad. It's. not necessarily the case anymore. I think we shouldn't actually differentiate them in terms of, are they all bad, or we treat them all bad, or they're good. I think it really is depends on the reason why the bots are used. For example, for Google bots, you can't really block them because if you block them, for one, your Gemini won't work anymore. There's no learning anymore. There's no real real real kind of intelligence in your AI agent anyway. And for two, it does search, you know, it does serve as a search engine index as well. So there are certainly reasons or purposes certain times and, you know, both serve for legit reason. And it's also times, obviously, for the bad ones, you know, coming actually maliciously. So I think it's going to be very interesting for most of the organizations anyway. Even for personal use, let's have a shift in terms of our our mindset, our mentality to say, actually, they are bad towards to actually, I don't care about who access it anymore. The who is no longer so important. It's more about why. Why are they here? What are you. actually using for? I think that's going to be a very, very important shift in terms of the bot dominating. At the end of the day, we all know we're no longer in a human to human Internet scenario. We're not even a human to machine anymore. We're changing very, very fastly towards your machine to machine kind of Internet environment. And that's the reality everybody should, you know, come to a realization to to start adapt to. Right. Yeah. Absolutely. So think, we're, now we wanna transition to some. some live get Let's do it. demo always feels? like an edgy moment, but we're gonna go live now. And David's. gonna Let's see. his view of the, of the year go. in. in review. Share. Okay. First thing I was gonna ask you to do, David, one of the areas we did we talked about greatest hits and and DDoS being that perennial kind of attack, vector that we see. The other one is email. And before we get into the country data, was just gonna ask whether you would scroll down and just show us the, the email. I think it's the middle tab on email. It shows us the attack types through through emails. Yes. Top email reps. There you go. And what's interesting is that it's a busy one to look at, but those if you what the what's going on here? Actually, David, you tell us. You're the you're the architect. Yeah. So, I mean, what this looks at is, you know, based on the the Cloudflare email security offering, you know, that they they do an analysis on every message. And, you know, for those that we determine to be a threat, we we classify the various threats that we find the various threat categories, basically, that we find within the message. So what we found, you know, last year was that over half, so 52% of those emails that we categorized as malicious contained as a deceptive link. So, you know, what does that mean? It may say, you know, it it looks like it's an email coming from, you know, something like like something I got today from the US government that says, hey. Your passport's gonna expire within a year. You know, click here to to do an online renewal. And so my immediately, my my, you know, antenna went up, and I was like, I probably should I you know, not gonna click on anything in that, but I'm gonna go look at my passport and then go right to the state department site and figure it out if it's real, you know, figure out if I need to renew it or whatever. But, you know, it would it would present itself within the email message as something, you know it would say, you know, click here to do your passportrenewal.state.gov. But behind the scenes, it would take me to a phishing site or or some other malicious you know, some other site that tried to download malware into my machine or something like that. So deceptive links are, you know, by far the the the most popular threat that we see in these malicious emails. We also see identity deception and brand impersonations. These are both very similar where, you know, I get an email that looks like it's coming from you, Ben, but the reality of it is that it's actually coming from an attacker, but they've made it look like it made it sound like it's coming from you and, you know, asking for, you know, Apple gift cards or whatever the the scam of the day is. You know, similarly, brand impersonation, you know, where they send an email that looks like it came from Cloudflare, and maybe it's telling you that, you know, here's your latest usage report. And you click on it, and it actually takes you to a phishing site. So so the the the the attackers are getting smarter, and the what they're what they're doing to try to deceive users is is also getting smarter and more advanced. And it and the top three, all of those are are really psychological, threats. Right? Links and. identity and brand that is trying to trick you, into. doing something else. On the one hand, you got the DDoS attacks, so the server side DDoS driving higher and higher, so it's machine to machine. On the other hand, you've got the, you know, the the the trying to the old very, very old school, sleight of hand tricks like the magician in the street trying. to get you to take an action that is gonna be detrimental to to to what you do. Really, really interesting. Right. And they're and they're preying on the trust. yeah. You know? So I trust this brand. Of trust. this person, and they're trying to exploit that. I asked you for gift cards ages ago. No wonder you haven't sent them to me. You thought it was a trick. The before we go any further, actually, and before we go into country level detail, a really good question from a gentleman, I think, called Mirko Smolik, and he asked or Mirko, excuse me. Is it back to your previous present slide, David, or you can look on the tab here about the bots? Mirko says, I guess it's not possible to tell what the Google bots are crawling for. Right? It's like providing data for search results or to train their AI model. So do we know which which bot is doing what on the on the on our reports? So we so, unfortunately, for Google bot, we don't know. Because when they when they make a request, they're just presenting user agent string that says Google bot. And we we verify that it's coming from the right set of IP addresses. But once they retrieve that web page or that, you know, whatever it is, that file, we don't know what they're doing it behind the scenes. What what they're doing assuming what they're doing with it behind the scenes, whether they're using it for training or search indexing. You know, whereas if you look at, you know, GPT bot, you know, they that's a that's a single purpose bot, and we know that they are using that to train chat GPT. But then, you know, that's a good example here of of we look at just GPT bot, and then also they have three bots that they use. So they have GPT bot for for the LLM training. They have chat GPT user. So that's a bot that goes out in response to the user action. And then they have o a I what's called o a I search bot, and that's a bot that that effectively does crawling for, I guess, the the equivalent of a search engine within ChatGPT. So so there are some. well be what we call well behaved platforms that are using multiple distinct bots for multiple distinct purposes, and you have other platforms that are that have multipurpose single bots. Yeah. But great. A really good question. Thank you. Thank you for that, Mirko. So my offer to anyone on the call, we've got maybe ten minutes left. We'll ask David some questions about country data. If you've got questions that you'd like to answer live with David, I mean, you can play around with the tool for yourself, first of all, Yep. so you can enjoy finding out all the data. That's really the idea of this is to get you all enabled on that. But while the author of the report and while the the architect and the leader of radar is on the call, you can ask him any questions you've got like, like Mirko and like Steven. So please keep those questions coming in. What I was gonna ask you, David, was what was interesting to me, first of all, when we show radar, everybody is living or in a country. They're interested in that country, so it's really cool to see. And when we look at the amount of the increase in Internet traffic globally, it was something like 20%. Is that right? Was it 19? 19%. Was looking for. 19%. There it goes. It's on the screen right now. If you could just go to Singapore for a second and show me that stat for Singapore, the Internet, traffic growth, it from memory, it was somewhere around. the 50% mark. Yep. Is that right? 53%. Isn't isn't that wild? You think that everybody who wants to be connected is. You think that everybody has got the most devices they'll ever have, and yet there can be a 50% increase year over year in the usage of the Internet in a hyper connected country like Singapore. Blows. my lines. there and so I think, you know, what's what's happening is they're they're finding more, you know, more more to do online there. It it's interesting actually to compare it to last year where, you know, it's sort of arguably similar growth through, like, June. And then for some reason, last year in June, it dropped off. And then yeah. Whereas in this year, June, it it it accelerated the growth. So there there's something that happens in Singapore in June that that obviously was very different last year than it was this year. Well, it's usually school holidays, but, maybe school holiday behavior is different now with some with I don't know if they're doing more online, but who knows? We had a lot of general election. So that was be it. one of the one of the key reason we we we do actually see a lot of attention, you know, a lot of Internet sort of media attention got generated. People feel that they should be more connected, more you know, stay on top of what's going on. Mhmm. Super good. We've got another question that's coming online here. John Coates says hopefully, it's a simple question. Our customers are start ups and scale ups. So clearly, John is in a company that is serving customers, growing their businesses. Is there any data that classifies the target size and scale of the target, specifically around MSP? They're looking at how to drive their customers to Cloudflare. Interest. I'm not sure exactly what that means, John. Maybe we could ask for some little clarification. But is there anything we'd look at in terms of the the size and scale of different hosts or or MSPs and and maybe ISPs, David? Yeah. Not really. I mean, I think the closest we get to that would be when we break out things like attack traffic at a in in industry or vertical level. Yeah. So we're not specifically breaking out though, you know, size or scale there. So, you know, from our perspective, if a customer you know, a three person shop that, you know, calls themselves financial services is going to you know, in in that analysis, be counted just the same way as Visa or Mastercard or, you know, PayPal or or, you know, anybody you know, much much larger company. Yeah. That's fair. While you're on that, actually, do you wanna just pull up? My next question was gonna be around verticals. Could be a good pivot just to show some of the vertical traffic that we can see, and then we can compare a couple of different countries. They're. attacked most attacked verticals. You can do it for any country. You could do worldwide, Oh, or you could do Singapore. actually, let me just. go in here. So sorry. It was it was it was slow to catch up. Most attack verticals. Here we go. Is it you can just explain what that is? First of all, what. that's showing us, then we can compare a couple of countries. So what we're looking at here is so so when we see a layer seven, a a web based attack targeting a customer, what we do is, I mean, we know obviously that that customer x y z was being attacked. And then within their customer records, we have insight into what vertical and what industry they're part of. So as I was mentioning, you know, let's say, you know, if PayPal was a customer and they were getting attacked, you know, that would be a notch in the financial services industry here or, excuse me, finance. So what we're looking at here is the global the worldwide view is, you know, in aggregate, you know, what were the verticals that were most attacked. When we look at it from a a country level so let's say, let's pick Japan. Let's see what we come up with there. There we go. Sorry. This is taking okay. Yeah. There you go. go to Japan. Alright. So Japan, you know, it's a very similar list. Some people in society are are also Yeah. it was also the the most attack vertical targeted by attacks from Japan. So so to be clear, at a country level, these are the attacks that are originating in a given in the selected country. Yeah. In in a given country against the industries in that country. Right? Yes. Exactly. So so, Yep. you know, for for attacks coming from Japan, they're primarily targeting organizations or sites and people in society. Those are largely, like, civil society type organizations. A lot of organizations that are ultimately protected under project in fact. Yeah. And then also targeting things like gambling and games and and, yeah, computers and electronics and things like that. And then if I compare that to Singapore again, where I'm standing today, you career know, and education is at the top. Then it's computer electronics, and people and society is third there. So you do get a sense of the country. by country differences across different different verticals. Yep. Absolutely. Cool. Yeah. I'm just I I selected Singapore. There we go. Was waiting for it to catch up. Here we go. Just gave us a clarification. Thank you, John. You're a partner. Thank you very much for being a good partner with Cloudflare. And I think if you wanted to, like, take the conversation further, you know how to get a hold of me on hand. So please please do get in touch. We'd very happy to talk more. Nan, what other questions have you got for for David around country data? I think I'm actually just interested to see in terms of the current situation and, what what's David's view based on the data that we receive? How what's your prediction, I suppose, next year, the the the key changes that we will be seeing. What are the trends you feel that you're gonna see the most change? Obviously, we talked about post quantum. We've we talked about little bit about AI, the crawler situation. Is there anything else that you feel, you know, you will see you expect some kind of level of change? Maybe it's from the geolocation's perspective as well. Yeah. I, mean, I think, you know, we'll see. I think Starlink traffic continue to grow and continue to, you know, show up in in more and more countries. I think there'll that's becoming a a more and. more Right? Starlink. This year, we're? tracking the Starlink traffic. We we're starting to track the the data. Okay? Yep. Yeah. We've had that for last couple of years. I think it was I I think it it doubled over the last year. So I think that will will certainly continue to grow. You know, I think that there are some some metrics that I think are are that have reached kind of a steady state, you know, things like iOS versus Android and and, you know, mobile versus desktop. You know, I think that you know, I think there I'm trying think of what else would be significantly different next year. I think, like we talked about earlier, the attack traffic sizes, you know, that will unfortunately continue to grow, But, hopefully, it won't grow quite as aggressively as as this year. But yeah. I think before any you know, before I would say before I wrap up, one of the things I wanted to point out on the webinar is that, you know, this year, we launched a an internationalized version of your review. So we are now supporting or it now supports the the 14 different languages that radar is available in. So you can go and you can select a given language and the whole interface, I guess, converted to that language. And you can also this year, we also built in sharing. So you can you can click the little share icon. I may have chosen the wrong one here because it's taking a while to render. But you can click the share icon, and it will give you the ability to download, copy, or or embed that particular graph for your own use. Great. Yeah. That that was actually the language power is one of the feedback we received last year, if you recall. So it's actually. really great to see that we've we've put that. in this year. was very important for me to have that in there this year. Amazing. Thank you. Very cool. We have got two minutes to go, and I'm just gonna say thank you, David. That's super cool. Welcome. My prediction, I think, now would be that we're just gonna see massive shift around some of those Gen AI and bot, graphs where we've seen what's what's, you know, what what's what we can see on the Internet from from their usage. And I think I think our collective, you know, whatever prayer, folk, wish is that the DDoS graph doesn't get anything. That one stays where it is. So, David, any last words from you as we as we wrap the session? No. I just I'm I'm really excited to be back and and have the opportunity to talk about radar and the year review. You know? And if you have any input or any questions, thoughts about metrics that you might wanna see on radar, you can reach out to us via email, radar@cloudflare.com. You can also follow us on social media. We're on x. We're on blue sky. We're on Mastodon. So we post about Internet outages that we see. We also post about various metrics that are present on radar. So you can you can contact us on those platforms as well. Or just. have a play. yourself. Go on to Rida. Have. a play. Absolutely. Yeah. I will. Yeah. Of course. Yeah. Yeah. Go. and enjoy the. year and review yourselves. It's all available. We'll share the link. If not, Eric has already shared the link in chat, I think. Thanks for all the questions. Really good to hear from you all. It's a lovely interactive section. Keep the questions coming in. And I think on behalf of Nan and David, I'll say, Eric, we'll let you, close the webinar. Thank you. Thank you, everyone. So thank you for your attendance. Today's webinar, especially for those joining from India, we have quite a lot of registrants from India. I know it's quite early there, so we don't expect everyone to join. So as always, we were the the webinar will be available on demand for the review in the same link, and we will organize another semi live session in the future, in a very near future to replay this. So if you want to you have any questions, reach out to us. Thank you, everyone. Thank you, David. Thank you, Ben, and thank. you, Have a good day. Good. Thank you. Bye. Thanks, everyone. See. you. Bye.