There’s a pattern in the channel that repeats every few years. A vendor builds a partner program that’s genuinely good at training advisors, the advisors get smart about a new technology category, and the carriers who didn’t invest in that training wonder why their partners are suddenly selling someone else’s product.

Cloudflare’s PowerUP program is doing it again. And the DQ Channels analysis published last week laid out exactly how.

I want to talk about this from two angles. First, what Cloudflare is building and why it works. Second, what it tells carriers and vendors about what they’re getting wrong.

What PowerUP Actually Does

PowerUP is structured around four partner tracks: Manage (MSPs who build and operate Cloudflare-based services), Resell (solution architects integrating the Cloudflare stack), Distribute (regional distributors), and Consult (strategic advisors doing architecture reviews without service overhead).

That segmentation alone is more thoughtful than most partner programs I’ve seen. The usual approach is a single program with tiers based on revenue. Hit $500K, you’re Gold. Hit $2M, you’re Platinum. Cloudflare instead asks: what do you actually do with our technology? Then it builds a track around that.

The reward model is where it gets interesting. Cloudflare uses what they call the “Three Cs”: Capacity, Capabilities, and Coverage. Capacity rewards scale. Capabilities rewards technical depth, things like post-quantum encryption and multi-channel phishing defense specializations. Coverage rewards market reach.

The Capabilities metric is the one that matters most here. It means a mid-sized partner with deep Zero Trust expertise can earn higher-tier benefits than a larger partner doing surface-level resale. That flips the traditional volume-based model and creates an incentive for partners to actually learn the technology.

Why Vendors Invest in Advisor Education

Here’s the view from the vendor side, where I spent a decade.

When you’re a vendor trying to grow through the channel, you have two options. You can pay partners to sell your product (SPIFFs, MDF, rebates), or you can invest in making partners competent enough to sell it without constant hand-holding. The first approach is faster. The second is more durable.

Most vendors choose the first approach because it produces results in the current quarter. Run a SPIFF, see a spike in deal registrations, report the pipeline to the board. Danny has written about how those SPIFFs often work in practice. The 21-day window, the impossible qualification criteria. SPIFFs buy attention. They don’t build competence.

Cloudflare chose the second approach with PowerUP. The Cloudflare University embedded in the program provides technical enablement and demand generation support. They’re training partners to understand Zero Trust architecture, AI-driven threat detection, and platform security at a level where the partner can lead customer conversations without needing a Cloudflare SE on every call.

That investment costs more upfront and takes longer to produce revenue. But the partners who come out the other end are self-sufficient. They can sell, deploy, and support Cloudflare solutions without leaning on the vendor’s pre-sales team for every deal. For a vendor trying to scale, that’s the difference between growing through headcount and growing through leverage.

What Carriers Should Learn from This

Here’s where I put my former carrier hat on.

When I ran partner strategy, our biggest frustration was security. Partners were increasingly being asked about security by their customers (network security, endpoint protection, cloud security, compliance). Our partners didn’t have the training to answer those questions with confidence. So customers went to someone who could.

The carriers who invested in security training for their partner base did better. The ones who assumed “our partners will figure it out” lost deals to vendors like Cloudflare, Palo Alto, and CrowdStrike who were actively making partners smarter.

Cloudflare’s PowerUP program is producing advisors who can have informed conversations about Zero Trust, SASE, and AI-driven threat detection. Those advisors are going to show up in carrier sales situations and steer customers toward Cloudflare’s solutions because that’s what they know. The carrier’s security offering, which might be perfectly adequate, loses because the advisor isn’t trained on it.

This is a training gap, not a product gap. And it’s self-inflicted.

The carriers investing in advisor enablement are the ones whose programs Grace Tanaka has covered in our partner programs explainer. The ones who treat partner training as a cost center rather than a competitive advantage will keep losing security conversations to vendors who invest more.

The Self-Serve Play

One detail from the DQ Channels analysis that deserves attention: Cloudflare launched a Self-Serve Agency Program in beta. It gives smaller MSPs and digital agencies a multi-tenant dashboard and centralized billing so they can manage multiple client accounts without drowning in administrative overhead.

This is the kind of operational investment that doesn’t make headlines but changes adoption curves. Small agencies and MSPs are the fastest-growing segment of the channel. They’re also the most resource-constrained. Giving them tools that reduce administrative burden directly increases how many Cloudflare customers they can manage, which directly increases Cloudflare’s market penetration without Cloudflare hiring anyone.

I’ve watched carriers spend millions on partner portals that partners hate because they were designed by internal IT teams, not by people who understand what a 12-person MSP actually needs on a Tuesday morning. Cloudflare’s self-serve approach suggests they talked to those MSPs first. That matters more than the feature list.

The Bigger Picture

Cloudflare isn’t a traditional channel company. They started as a direct-sell, developer-focused platform. Their move into the channel through PowerUP represents a bet that partners can extend their reach into enterprise markets more efficiently than a direct sales expansion.

That bet is working because they’re investing in the right thing: making partners genuinely capable, not just commercially incentivized. The distinction matters. A partner who sells Cloudflare because the SPIFF is good will sell someone else next quarter when their SPIFF is better. A partner who sells Cloudflare because they’ve built a practice around Zero Trust architecture and the PowerUP program made that possible will stick around.

For carriers watching this, the lesson is uncomfortable but clear. Your partners are being trained by your competitors. And the partners who get trained by Cloudflare, Palo Alto, and Fortinet aren’t coming back to sell your bundled security product just because you put it on the rate card.

Invest in making your partners smart. Or watch someone else do it for you.