Rubrik, Inc. (RBRK)

Executive Summary / Key Takeaways

• Rubrik has completed a radical business model transformation from hardware-dependent perpetual licenses to a pure-play SaaS subscription platform, with subscription ARR reaching $1.25 billion and growing 36% year-over-year, creating a high-quality, predictable revenue stream that now represents 96% of total revenue.

• The company is successfully expanding beyond traditional data protection into a comprehensive cyber resilience platform, integrating data security posture management (DSPM) and identity resilience with AI-powered recovery capabilities, which is expanding its addressable market and driving net retention rates above 120%.

• While Rubrik remains unprofitable with a -41% net margin, the unit economics show dramatic improvement: subscription gross margins hit 81% and subscription ARR contribution margin turned positive at 9%, up 1,800 basis points year-over-year, indicating a clear path to profitability as the business scales.

• The stock trades at a premium valuation (15.0x EV/Revenue, over 400x EV/FCF) that prices in continued hypergrowth and margin expansion, making execution critical; any slowdown in subscription ARR growth or failure to achieve profitability targets would likely result in significant multiple compression.

• Key risks include an ongoing DOJ investigation related to government contracts, intense competition from both legacy vendors and cloud-native players, and the challenge of completing customer migrations to RSC without causing dissatisfaction that could impact retention rates.

Setting the Scene: The Cyber Resilience Imperative

Rubrik, founded in December 2013 as ScaleData and headquartered in Palo Alto, California, has evolved from a converged data management appliance vendor into a cloud-native cyber resilience platform. The company operates at the intersection of two powerful secular trends: the inevitability of cyberattacks and the enterprise shift toward AI adoption. This positioning matters because it transforms Rubrik from a discretionary IT spend into a mission-critical security infrastructure provider.

The cybersecurity landscape has fundamentally changed. Enterprises now operate with an "assumed breach mindset," recognizing that prevention alone is insufficient. This shift creates a durable demand driver for Rubrik's core value proposition: rapid recovery from cyber incidents. The company's Rubrik Security Cloud (RSC) platform, launched in fiscal 2023, bundles data protection, data security posture management , and identity resilience into a single Zero Trust architecture. This integration is not merely a product feature; it addresses the critical gap in most security stacks where data protection and threat response operate as siloed functions.

Rubrik's transition to subscription-based RSC represents a complete business model overhaul. By February 1, 2022, the company ceased offering perpetual licenses entirely. By the end of fiscal 2024, RSC constituted a majority of total revenue. This matters because it replaces lumpy, upfront hardware sales with predictable, high-margin recurring revenue. The financial implications are profound: subscription revenue grew 55% year-over-year to $297 million in Q2 FY2026, while legacy maintenance revenue declined 61% to just $2 million. This mix shift is the engine driving Rubrik's improving economics and is expected to be largely complete by the end of fiscal 2026.

The competitive environment remains intense. Rubrik faces legacy data protection vendors like Commvault (growing at 18% with established profitability) and private competitors Veeam and Cohesity that dominate market share in certain segments. Cloud hyperscalers offer native backup tools that commoditize basic workloads. Yet Rubrik's 51% revenue growth significantly outpaces Commvault's 18%, suggesting the company is gaining share through differentiation. Management's claim that they win "the vast, vast, vast majority of deals" against both legacy and new-gen vendors reflects a competitive moat built on architecture, not just features.

Technology, Products, and Strategic Differentiation

Rubrik's preemptive recovery engine represents a fundamental architectural advantage. Unlike traditional backup vendors that treat recovery as a reactive process, Rubrik's platform continuously pre-calculates clean data states before attacks occur. This capability is crucial as it reduces recovery times from weeks to hours, a performance difference that wins deals in regulated industries where downtime costs millions per hour. A Fortune 50 pharmaceutical company and a major North American oil and gas operator selected Rubrik specifically for superior recovery times, demonstrating how technical architecture translates into pricing power and customer lock-in.

The integration of Data Security Posture Management (DSPM) into RSC creates a platform effect that competitors cannot easily replicate. DSPM deals nearly doubled quarter-over-quarter in Q3 FY2025, and DSPM ARR grew over 300% year-over-year in Q1 FY2026. This transformation is significant, positioning Rubrik as a comprehensive data security platform rather than just a backup vendor. When customers can rapidly enable DSPM from their existing RSC instance, the incremental value proposition strengthens retention and expands wallet share. The urgency is amplified by AI adoption: as enterprises deploy Microsoft 365 Copilot , they must ensure sensitive data remains secure, making DSPM a critical enabler rather than a nice-to-have feature.

Identity Resilience represents another layer of differentiation. With 90% of Global 1000 companies using Active Directory and identity systems becoming prime attack targets, Rubrik's ability to orchestrate recovery of both Active Directory and Entra ID (MSFT) in a hybrid cloud manner is unique. The solution gained over 200 customers in just two quarters, with orchestrated AD Forest Recovery reducing recovery times from weeks to under an hour. Addressing this is vital, as identity system compromise makes data recovery exponentially more complex. By addressing this critical pain point, Rubrik creates a new revenue stream while deepening its strategic importance to customers.

The Predibase acquisition for $109 million in July 2025 accelerates Rubrik's evolution into an "AI company." Predibase's infrastructure for operationalizing open-source AI models enables Rubrik to launch Agent Rewind, which helps customers undo AI agent mistakes without full system rollback. This initiative is important, as it positions Rubrik at the forefront of enterprise AI adoption, addressing the "hallucination" risk that limits AI deployment. While still early-stage, this initiative could expand Rubrik's TAM beyond cybersecurity into AI governance and data management for generative AI applications.

Financial Performance & Segment Dynamics

Rubrik's subscription revenue of $297 million in Q2 FY2026, growing 55% year-over-year, demonstrates the success of the business model transformation. The 81% gross margin on subscription revenue highlights the inherent profitability of the SaaS model once scale is achieved. This compares favorably to Commvault's 81.5% gross margin, suggesting Rubrik has reached competitive cost structures despite its smaller scale. The 5 percentage point improvement in subscription gross margin year-over-year reflects operating leverage as the customer base expands.

Material rights contributed approximately 7 percentage points to subscription revenue growth in Q2, a non-recurring benefit from customers exercising or forfeiting subscription credits during the cloud transition. While this boosted near-term growth, management expects these benefits to significantly decline after fiscal 2026. This creates a headwind to reported revenue growth in FY2027, making the underlying ARR growth rate more important for valuation. Investors must distinguish between this one-time accounting benefit and sustainable business momentum.

Subscription ARR reached $1.25 billion, growing 36% year-over-year, with cloud ARR of $1.06 billion growing 57%. The divergence indicates customers are rapidly migrating to fully cloud-hosted solutions, which generate higher long-term value than hybrid deployments. Approximately 1.40 percentage points of ARR growth came from transitioning maintenance customers to subscriptions, a tailwind that will disappear in FY2026. This implies that core new business growth is actually stronger than the headline 36% suggests.

Customer metrics reveal healthy expansion dynamics. The average subscription dollar-based net retention rate remained above 120%, and customers with $100,000 or more in ARR increased 27% to 2,505. This demonstrates that existing customers are not only staying but significantly expanding their spend, reducing customer acquisition costs and improving lifetime value. In a competitive market, retention above 120% indicates strong product-market fit and switching costs.

The subscription ARR contribution margin turned positive at 9% for the twelve months ended July 31, 2025, an improvement of 1,800 basis points year-over-year. This proves the SaaS model's unit economics are working. While Commvault operates at a 5.5% operating margin with positive net income, Rubrik's path to profitability is clearer when contribution margins are expanding this rapidly. The company generated $90.88 million in free cash flow for the six months ended July 31, 2025, compared to $69.14 million in the prior year, showing improving cash conversion despite operating losses.

Rubrik's balance sheet provides strategic flexibility. The company holds $1.52 billion in cash and short-term investments after repaying its $328 million credit facility and issuing $1.15 billion in 0% convertible notes due 2030. This move eliminates interest expense (which decreased after repayment) and provides dry powder for acquisitions or investments. The convertible notes, paired with capped call transactions , minimize dilution risk while preserving financial flexibility.

Outlook, Management Guidance, and Execution Risk

Management raised full-year fiscal 2026 guidance to $1.227-1.237 billion in total revenue, reflecting 38-40% growth. Subscription ARR guidance of $1.408-1.416 billion implies 29-30% growth. This demonstrates confidence in sustained momentum despite the challenging macro environment. However, the guidance includes approximately six percentage points of benefit from material rights, up from prior expectations of "a few percentage points." This implies underlying revenue growth of 32-34% when adjusted for one-time benefits, still robust but more moderate than the headline figure.

Q3 FY2026 guidance of $319-321 million revenue represents 35-36% growth, with management noting that Q3 will contribute 21-22% of full-year net new subscription ARR. This seasonal pattern indicates Rubrik's business is becoming more predictable, with Q4 historically strongest. The company expects subscription ARR contribution margin to be seasonally lowest in Q3 at approximately 6.5% before improving in Q4, reflecting investment timing rather than structural deterioration.

Management's decision to align sales compensation with annual rather than half-yearly plans could impact deal timing. While management states the change has not materially impacted performance in the first half, the full effect will only be visible by year-end. This introduces execution risk; if sales teams struggle with the new compensation structure, net new ARR growth could disappoint in the second half, particularly in Q4 when seasonality typically drives strong performance.

The company expects minimal revenue contribution from material rights in fiscal 2027, creating a known headwind. Investors must model a 6 percentage point drag on revenue growth next year, making underlying business momentum critical. If Rubrik cannot accelerate core subscription growth to offset this decline, the stock's premium valuation will be difficult to sustain.

Risks and Asymmetries

The ongoing DOJ investigation, which began with a grand jury subpoena in October 2023 related to potential government contract violations, remains a material overhang. While Rubrik is cooperating and the indicted employee is no longer with the company, the investigation's outcome is uncertain. Any finding of wrongdoing could result in fines, contract cancellations, or debarment from government contracting, directly impacting the 55% of revenue that comes from public sector customers and damaging the company's credibility in regulated industries.

Customer migration initiatives carry execution risk. Management's efforts to accelerate RSC adoption by enforcing deadlines and replacing refresh rights with subscription credits could backfire if customers perceive the transition as coercive. The company acknowledges that "if customers do not utilize Subscription Credits before expiration, it could lead to dissatisfaction." Rubrik's 120%+ net retention rate is a key pillar of its valuation; any deterioration in customer satisfaction could slow expansion and increase churn, undermining the subscription model's economics.

Competition is intensifying on multiple fronts. Commvault's transition to SaaS is gaining traction with 22% ARR growth and established profitability, while private competitors Veeam and Cohesity maintain market share leadership. Cloud hyperscalers are bundling basic backup functionality that could commoditize the low end of the market. Rubrik's premium pricing and growth depend on maintaining technological differentiation. If competitors replicate Rubrik's integrated DSPM and recovery capabilities, margin pressure could emerge, slowing the path to profitability.

The company's AI initiatives, while promising, face significant risks. Generative AI tools pose potential legal liability, limited IP protection, data leakage risks, and regulatory uncertainty from evolving laws like the EU AI Act. Management acknowledges that "AI tools may not protect confidentiality of prompts, potentially leading to data leakage." Rubrik's enterprise AI strategy requires customers to trust its platform with sensitive data. Any security incident or regulatory setback could derail this emerging growth driver.

Valuation Context

At $69.32 per share, Rubrik trades at an enterprise value of $13.33 billion, or 15.0 times TTM revenue of $886.5 million. This compares to Commvault at 4.9x revenue, though Commvault grows at 18% versus Rubrik's 51%. The valuation premium embeds expectations of sustained hypergrowth and margin expansion. With TTM free cash flow of $31.3 million, the stock trades at over 400x EV/FCF, a multiple that leaves no room for execution missteps.

Rubrik's balance sheet strength provides a cushion. The company holds $1.52 billion in net cash after the convertible note issuance and credit facility repayment, representing 11% of enterprise value. This funds 2-3 years of operations at current burn rates and provides strategic optionality for acquisitions. Unlike many high-growth SaaS companies, Rubrik has no debt covenant risk and minimal interest expense.

The path to profitability is becoming clearer but remains distant. While subscription gross margins of 81% approach Commvault's 81.5%, Rubrik's operating margin of -30.5% significantly lags Commvault's (CVLT) +5.5%. The 1,800 basis point improvement in subscription ARR contribution margin suggests the gap will close, but the stock's valuation assumes this happens within 2-3 years. Any delay in reaching breakeven could trigger a severe re-rating.

Conclusion

Rubrik has executed a remarkable transformation from hardware-dependent backup vendor to cloud-native cyber resilience platform, creating a high-quality subscription business that grew subscription ARR 36% to $1.25 billion while generating positive free cash flow. The integration of DSPM and identity resilience into a single platform, combined with early-stage AI initiatives, positions the company to capture a growing share of enterprise security budgets. This strategic evolution expands Rubrik's addressable market beyond commoditized backup into higher-value, stickier solutions.

The investment thesis hinges on two variables: sustaining 30%+ core subscription ARR growth as material rights benefits fade in FY2027, and converting improving unit economics into GAAP profitability within the next two years. The stock's premium valuation offers asymmetric downside if execution falters, but the company's technological differentiation, 120%+ net retention, and $1.5 billion cash position provide multiple paths to value creation. For investors willing to tolerate execution risk and the overhang of the DOJ investigation, Rubrik represents a rare combination of business model transformation and market leadership in the critical cyber resilience category.