$FSLY Deep Dive — Agents at the edge · in Muse's path, not yet in the numbers

An independent tester sent Meta's new Muse agent to websites he controlled 738 times, and whenever the agent had to open a browser and click around, the visit arrived from $FSLY's network. Our reading: Fastly is in the path of consumer AI agents, management says it is being paid for it, and the money is still too small to see in a $739M year; what makes this worth owning is the machine-traffic business underneath, which is growing whether or not Muse ever shows up in a filing.

Start here. A web page is a set of files stored on a computer called a server, and a request is the short message a browser sends to ask for one of those files. A content delivery network, or CDN, is a fleet of servers placed close to people that keeps copies of popular files, so a request travels a few kilometres instead of across an ocean. An edge cloud is the same fleet taught to do more than hand out copies: it can inspect each request, block the malicious ones, run small programs and decide where the request goes next. A proxy is a server that makes requests on someone else's behalf, so the website sees the proxy's address rather than the true sender's. An AI agent is software that does the browsing for a person from a computer in a data centre, and it needs a proxy to reach the web. Everything below is about who owns those proxies and what they are paid.

For twenty-five years the thing a CDN moved was human attention: pages, pictures and, above all, video. The industry priced it by the gigabyte, because bytes were the cost. That is now changing underneath the price list. Fastly says machine-generated traffic crossed half of all requests on its network in July and August 2026, and that AI traffic grew 6.5 times faster than human traffic from January to May. Cloudflare told its own investors that more than 50% of the traffic crossing its network in the second quarter was not human. Two of the three large independent edge networks now serve more machines than people.

Machines consume the web differently. An agent booking a table reads a menu page, fills a form and leaves; it does not stream a film. So requests explode while bytes barely move. Fastly's CFO put a number on it at a conference on 15 September: machine-to-machine requests are "almost half of the total request traffic that we see overall, but it is still a very small portion of gigabytes transferred." That single sentence is the investment question. If the new traffic is paid by the gigabyte, it is a rounding error. If it is paid by the decision (is this agent allowed in, whose credentials does it carry, which address should it leave from), it is a new product line.

Meta's Muse, launched on 8 September 2026, made the question concrete. Muse runs each user's agent on its own computer in Meta's cloud, and a separate program called Sentinel approves every network request before it leaves. Somebody has to carry those approved requests out to the open web, and the first public evidence says Fastly is one of the carriers. That is the shift, and it rewards whichever edge network owns the paid control points on machine traffic. We think Fastly has more of them than its price list suggests.

$FSLY runs one of the few independent networks that can inspect, secure and relay machine traffic at the edge, and agents may become the next major demand driver after video.

Technology advantage: run security and custom code on the same servers that deliver the traffic, with a privacy relay already used by "several of the largest internet vendors" (10-K).

What that lets it sell next: per-request products (bot and AI bot management, API security, the AI Firewall and AI Runtime Control launched 21 September) toward a 2029 target of $1.1–1.3B revenue.

Why now: machine requests passed half of Fastly's traffic this summer, and public tests show some Muse browser use routing through Fastly.

The one risk that matters: growth is concentrating in ten customers who can move traffic quickly.

Muse's training side is covered in our $INOD deep dive.

Fastly was founded in March 2011 by Artur Bergman, a Wikia engineer who wanted a CDN that developers could program and purge in milliseconds. It listed in 2019, bought the web-security firm Signal Sciences in a deal announced in August 2020, and spent 2021–2024 losing money while growth slowed to 7% in 2024. The independent CDN field thinned over the same years: Edgio, the third US independent, went bankrupt in 2024, which management now calls "a very rational pricing environment with really rational players since the exits." Today Fastly reports three product lines. Network Services is delivery, billed mostly by usage. Security is the web application firewall, bot management, DDoS and API protection. Other is Compute (customer code on the edge) and Observability.

Revenue growth has broadly re-accelerated and margins have improved, although growth did not rise in every successive quarter. Annually, revenue was $433M in FY22, $506M in FY23, $544M in FY24 and $624M in FY25, with growth of 22.1%, 16.9%, 7.4% and 14.8%; GAAP gross margin moved 48.5%, 52.6%, 54.4% and 57.1%, and the GAAP operating margin improved from −56.9% to −19.1%. Management guides FY26 revenue to $732–746M, 18.4% growth at the midpoint. Quarterly, revenue grew 8.2% in Q1'25, 12.3% in Q2'25, 15.3% in Q3'25, 22.8% in Q4'25, 19.7% in Q1'26 and 23.3% in Q2'26, while GAAP gross margin climbed from 53.2% to 63.3% and the GAAP operating margin from −26.4% to −7.9%. Stock compensation is still the gap to profit: Q2's GAAP operating loss was $14.4M against non-GAAP operating income of $27.0M.

Two cautions sit inside that margin line. From 1 January 2026 Fastly stretched the assumed life of its servers from five years to six, which cut Q2 depreciation by $2.9M; on the old life Q2 gross margin would have been about 61.7%, still a record. Cash and profit also tell different stories. In FY25 GAAP net income was −$121.7M while operating cash flow was +$94.4M, because most of the loss is stock compensation, a cost paid in shares rather than cash (diluted shares rose 26.6% from 2021 to 2025). The quarter is thinner: Q2 operating cash flow was $39.3M, but capital spending of $35.8M left free cash flow of $3.6M. The company still guides $40–50M of free cash flow for the year. We read the peers the same way: Akamai grew revenue 5.4% in FY25 while spending on its own compute build, and Cloudflare grew 29.8% while posting a −9.6% GAAP operating margin, but agent-specific profit is not disclosed separately; company-wide profitability cannot establish the economics of agent traffic.

Security is the part of the business that is leading, and delivery is still the part that decides the quarter. In Q2'26 Network Services earned $133.9M (73.0% of revenue, down from 77.2% a year earlier) and grew 17%; Security earned $41.7M (22.8% of revenue, up from 19.7%) and grew 43%; Other earned $7.7M (4.2% of revenue, up from 3.1%) and grew 69%. Of the $34.6M added year on year, delivery contributed $19.0M (55%), security $12.5M (36%) and Other $3.1M (9%). The reason delivery still matters is that one soft delivery quarter moves the stock more than three strong security quarters: when Network Services grew only 11% in Q1'26, the shares fell 38.2% the next day.

Fastly's product is a programmable network, and the moat is that one server does five jobs. Each point of presence is a dense cluster of servers peered with internet exchanges and cloud regions. The same machine terminates the connection, checks it against the web application firewall and bot rules, runs customer code in WebAssembly ("microsecond code execution times", per the 10-K), serves from cache or fetches from the customer's origin, and streams a log line within seconds. Because the security and the code sit in the same box as the delivery, a customer that buys one tends to buy the next: the share of customers using four or more Fastly products rose from 7% to 30%, the chief product officer told investors on 22 September. The company says the network has 622 terabits per second of connected capacity, 65% more than in Q3'24, bought with infrastructure capex of about 10% of revenue across FY23–FY25.

The privacy relay is the product we think the Muse evidence points to. Fastly's 10-K describes an Oblivious HTTP relay that "provides fast, reliable separation and isolation of end user data, while passing along non-identifying requests to the business server" and says it serves "several of the largest internet vendors." Asked on 22 September whether Fastly benefits from consumer agents like Muse, the CEO said it does, "across delivery and security, including privacy capabilities for agents," and the CTO added that hyperscalers and consumer brands building server-side inference and consumer agents "mention us, and we are part of that." On the Q2 call the CEO had already said the company had "seen increase in our privacy suite of products related to agentic workloads."

A privacy relay changes what a website sees. The request leaves the agent's machine, enters Fastly, and exits from a Fastly address, so the site learns neither the user nor, in the strict version of the protocol, the operator's internal network. That is exactly the pattern Odd Diligence logged, and exactly the pattern a forward proxy on Fastly's network would also produce. The address cannot tell the two apart; what separates them commercially is that a relay is a sold product with its own price, while a proxy on a CDN contract is bytes.

The roadmap is aimed at the per-request side of machine traffic. On 21 September Fastly launched AI Runtime Control (routing and spend control for companies calling AI models), an AI Firewall (protecting AI applications) and API enforcement for agents calling enterprise APIs; the CPO described Compute and AI Runtime Control as a pair, where cheap edge logic handles most queries and only "the rare case" goes to a large model. In Q2 it partnered with Skyfire, whose agent identity and payment credentials run on Fastly Compute, and its AI Bot Management already routes scrapers to TollBit's paywall. At Investor Day the company showed 11 times growth in MCP traffic this year and seven times growth in AI model files served in one month, with the footnote that "requests reflect network activity, and do not represent unique users or revenue."

Management's 2029 model asks for revenue of $1.1–1.3B, a 14–21% compound rate from the 2026 guide, with non-GAAP gross margin of 67–71%, non-GAAP operating margin of 20–22% and free cash flow margin of 12–15%. An analyst at the event pointed out that the growth range sits slightly below what the company is doing today. We see room for management to exceed the targets, but that is our interpretation rather than a guaranteed floor, and we read the gap between those non-GAAP margins and GAAP (stock compensation ran almost 20% of revenue in the first half) as the main thing the next three years have to close.

Spending follows the same line. Capex is planned at 10–12% of revenue through 2029, and management says almost all of it expands the network rather than maintaining it. Other revenue, mostly Compute, reached $7.7M in Q2 and grew 69%. The privacy suite has no disclosed revenue, which is the gap the Muse question falls into.

Fastly's place in Muse's outbound path is supported by two independent sources. On 10 September, Arkose Labs' Kevin Gosschalk wrote from first-hand testing that Muse's cloud egress "routes through large infrastructure providers. Fastly is one we identified." On 23 September Odd Diligence published 738 controlled tests from self-built websites: 37.0% of visits came from Cloudflare addresses, 29.3% from Fastly, 19.4% from Meta and 14.4% from AWS. Browser navigation came from Fastly in 100% of his tests, API and curl calls from Cloudflare in 100%, and web search was split four ways.

What the evidence does not show is exclusivity or a contract. Clinton Stark had Muse's browser read a header-echo page on 22 September and it reported the exit address 104.28.208.216, a Cloudflare address. We checked it: the address sits in Cloudflare's registered 104.16.0.0/12 block but outside the ranges Cloudflare publishes for its CDN proxies, which is what an egress service looks like rather than a website's CDN. Both companies appear to run egress for Muse's browsers. The defensible statement is narrower than the headline: every browser test in one person's sample left through Fastly.

We audited the method as far as the public record allows, and three things matter. First, the four counts (273, 216, 143 and 106) sum to exactly 738, so each "test" was logged as one visit, although a real browser task makes dozens of requests: the shares are shares of tasks, not of traffic. Second, curl calls cannot run JavaScript, so if the analytics were a JavaScript tag, the curl rows came from server logs. A site behind Cloudflare that logs the connecting address instead of the forwarded one would record every server-side hit as Cloudflare, so the 100% Cloudflare result for curl is exactly what that error would produce. We do not know that it happened, and Muse's Spaces site builder deploying to Cloudflare (Wes Bos found this) is an innocent explanation for part of that share. Third, a tester who asked for more browsing would have reported more Fastly.

The test that would settle it is cheap: an origin server with no CDN in front, a header-echo page that returns the connecting address, its autonomous system number, reverse DNS, the encryption handshake fingerprint and any Via, CDN-Loop or Fastly headers; then the same browser, curl and search tasks across several accounts, regions and days, with requests, sessions and tasks counted separately. An address inside Fastly's published CDN ranges (19 blocks at api.fastly.com/public-ip-list) would point to the site's own CDN or a plain proxy; an address outside them but registered to Fastly would point to a dedicated egress service, the privacy relay being one candidate. The address alone would not establish the product or contract. We could not run it ourselves, because it requires a Muse account.

The money is where the story gets smaller. Fastly processes more than 5 trillion requests on an average day, and Q2 Network Services revenue was $133.9M, which works out to roughly $0.29 of delivery revenue per million requests. That is a rough aggregate proxy, not a quoted customer tariff. Our illustration: an active user running five browser tasks a day at about 200 requests each makes about 365,000 requests a year, eleven cents to Fastly at delivery prices. At that rate $10M of revenue needs close to 100 million daily users all routed through Fastly. The same $10M needs only about 9 million users if the relay is priced at ten times delivery per request, which is why the product matters more than the traffic. TMT Breakout reached a similar range and recalled that Piper sized Apple's whole iCloud Private Relay at $40–74M a year across three CDNs in 2021.

Incremental revenue must be measured against what guidance already assumes. The FY26 guide of $732–746M was set on 5 August, five weeks before Muse launched, but timing alone does not prove management excluded anticipated agent revenue. Muse revenue is not separately disclosed and must not automatically be added on top of the guide. Fastly's ten largest customers were 37% of Q2 revenue and grew about 48% year on year; everyone else grew about 13%, by our arithmetic from the disclosed shares. In Q3'25 the CFO had pointed to customers outside the top ten growing 17%. Growth has narrowed back into the biggest accounts, and the 10-Q warns that their minimum commitments are "relatively low compared to their expected usage."

The mispricing runs both ways. The market paid for Muse as if it were a new top customer, when the arithmetic says a few million dollars unless the relay is priced richly; and it underprices the durable part, since this is the first time management has tied a sold privacy product to consumer agents, and security plus Other already produce 45% of the growth.

The operating team is new, and its record so far is the re-acceleration. Kip Compton became CEO in June 2025 after eighteen months as chief product officer and seventeen years at Cisco; Rich Wong joined as CFO in August 2025 from Benchling; Scott Lovett joined as chief revenue officer in August 2024 after leading sales at Imperva and web security sales at Akamai. The founder, Artur Bergman, is back as CTO. Under this team revenue growth went from 12.3% in Q2'25 to 23.3% in Q2'26 and the GAAP operating margin improved by 17 points. That is a real record, but it is fifteen months long, and it was set in a market with one fewer competitor.

In the management table, guidance means the published company outlook; CPO, CFO, CRO and CTO mean product, finance, revenue and technology leadership.

Pay and selling are worth watching. The 2025 Summary Compensation Table shows $6.8M for the CEO and $8.6M for the CFO, almost all in stock, and insiders filed dozens of Forms 4 and 144 between August and September 2026, including 77,046 shares sold by the CTO's trust in September.

What forces a thesis change: a Q3 print (4 November is the original memo’s expected date, still requiring an official company announcement) with Network Services growth below 12% and the top-ten share still rising, or any disclosure that the privacy suite is priced like delivery. On the other side, a disclosed privacy or agent revenue line, or a replicated test showing Muse egress from Fastly's non-CDN address space across accounts and regions, would upgrade the Muse evidence from path to product.

The stock is roughly three times its year-ago level and remains news-driven. It closed $24.96 on 25 September 2026, down 6.45% from $26.68, above its 50-day average of $23.76 and 200-day average of $19.58. The week moved +14.9% on 21 September with the AI Firewall launch, −4.9% on Investor Day, and +13.7% on 23 September after the Muse post, when it reached $31.33. It then fell −10.0% on 24 September and −6.45% on 25 September. The latest close is 20.3% below that $31.33 high.

Options positioning proxy: the 26 September refresh uses Tradier greeks timestamped 25 September 20:00 UTC and prior-session open interest. Net GEX is about +$146M, call wall $27.50, put wall $17.50 and max pain $20. The strike-profile sign change is near $25; the separate modeled gamma-flip field is $8. These are different calculations, not interchangeable support levels, and open interest does not identify actual dealer holdings.

Implied volatility: the latest stored near-30-day ATM IV is 89.43% (snapshot dated 26 September), equivalent to about ±25.6% over 30 calendar days under square-root-of-time scaling. This is a volatility estimate, not a predicted price band.

Level to watch: $23.50–24, near the $23.76 50-day average and late-September breakout area. A sustained break would weaken that technical setup; it would not by itself prove the operating thesis broken.

At the 25 September close of $24.96, Fastly's equity value is about $3.98B on 159.3M shares. Using $330M of convertible-note principal less $337.5M of cash and securities gives enterprise value of $3.97B, excluding lease debt: 5.37× the $739M FY26 revenue-guide midpoint and 6.36× FY25 revenue of $624M. Refreshed provider-reported enterprise values imply EV/FY25 revenue of 5.31× for Akamai, 7.69× for F5, 19.57× for DigitalOcean and 57.03× for Cloudflare; provider debt, lease and share-count conventions are not identical to Fastly's simple bridge above. FY25 growth was 5.4%, 9.7%, 15.5% and 29.8%, respectively. Fastly and Cloudflare have no meaningful positive GAAP P/E. The refreshed five-year chart places Akamai at 41.1×, the 96th percentile of its own range, and F5 at 35.3×, the 88th percentile.

The peer table uses EV and GAAP; fiscal-year operating figures are unchanged, while market values use the 25 September close.

The original 24 September workbench model counts stock compensation as a cost and runs ten years because growth has not normalised. It takes the FY26 guide, then 17% growth in FY27 fading to 4% by FY35, GAAP gross margin rising from 63.2% to 68% and the GAAP operating margin from −9.6% in FY26 to 17% by FY35, reaching 7% in FY29 against management's non-GAAP 20–22%. On a 10% discount rate, the perpetuity method gives $4.69 a share and an exit at 29 times FY35 EBITDA (the median of Akamai, F5 and DigitalOcean) gives $18.36; the two are 3.9 times apart, and the gap is the finding: the cash a GAAP-costed Fastly throws off supports a fraction of the price, and the rest is a bet on the multiple a grown-up edge platform earns. The 8.3% perpetual-growth reverse calculation belonged to the original $26.68 price; it has not been recomputed for $24.96 and is not a current-price result. Operating assumptions and the original model outputs are retained in this refresh. The original audit showed no fails and three warnings we accept on purpose: the two methods disagree, working capital is seeded from the cash-flow median because inventory is not tagged, and the 21% tax rate is a statutory default because Fastly's losses make its filed rate meaningless.

The scenarios value the business at the end of 2027 on FY28 revenue and roughly 189 million diluted shares, with both convertible notes turned into stock. Bull: about $1.06B of revenue at 6.5 times, about $38 a share, if the privacy and AI products are disclosed and priced per request and the top-ten share holds. Base: about $1.00B at 5 times, about $27, with the 2029 plan on track and Muse worth a few million dollars. Bear: about $0.91B at 3.5 times, about $18, if a large customer moves traffic, delivery growth drops below 10% and the multiple converges on Akamai's. We weight them 25%, 50% and 25%. Against $24.96, bear/base/bull price changes are −27.9%, +8.2% and +52.2%; the weighted $27.50 is +10.2%. These are total price changes to end-2027, not annualized returns or present fair values. Muse sits inside these ranges rather than on top of them: $10M of it would be 1.4% of the $739M FY26 midpoint, $25M 3.4% and $50M 6.8%, and 1.2%, 2.9% and 5.8% of our $865M FY27 estimate.

Fastly's machine-traffic platform remains the investment case, with Muse an additional opportunity. At $24.96, the original $27 base scenario is 8.2% above spot and the weighted $27.50 is 10.2% above; the refreshed street mean target remains $27.90. The bull case still needs a disclosed per-request product. The memo's stance remains hold, add in stages below $24 near the 50-day average and prior breakout, and add further on a Q3 print showing privacy and security carrying growth while the top-ten share stops rising.

(h/t Odd Diligence, Arkose Labs, Clinton Stark / Stark Insider, TMT Breakout and Elliot's Musings for the testing and sizing work. Operating figures rest on Fastly's filings and Investor Day materials. Market prices, technical levels and options refreshed 26 September 2026 using the last completed session, 25 September.)

Refresh sources: Fastly Q2 2026 results, company releases, FSLY price history. Peer EV and analyst targets: Yahoo Finance, retrieved 26 September 2026. Options: Tradier via the app snapshot, timestamps stated above.