Executive Summary / Key Takeaways

• Rubrik is establishing itself as a leader in the emerging cyber resilience market, moving beyond traditional backup and recovery to offer a Zero Trust Data Security platform critical in an era of inevitable cyberattacks.
• The company's differentiated Rubrik Security Cloud (RSC) platform, uniquely combining Data Security Posture Management (DSPM) and cyber recovery with an AI-powered preemptive recovery engine, is driving strong customer adoption and high win rates against both legacy and new-gen competitors.
• Rubrik is demonstrating robust financial performance at scale, highlighted by accelerating subscription ARR growth (38% Y/Y in Q1 FY26 to $1.18B), strong subscription revenue growth (54% Y/Y in Q1 FY26), and significant improvements in Subscription ARR Contribution Margin (8% LTM Q1 FY26 vs. -11% Y/Y).
• Strategic expansion into high-growth areas like Identity Resilience and long-term initiatives like Annapurna for secure GenAI data infrastructure position Rubrik for continued market opportunity expansion.
• While navigating the complexities of a SaaS transition and macroeconomic factors, Rubrik's raised FY26 guidance signals confidence in sustained growth and a clear path towards profitability and positive free cash flow ($65M-$75M guided for FY26).

The Dawn of Cyber Resilience: Rubrik's Platform for an Assumed Breach World

In an increasingly interconnected digital landscape, the question for organizations is no longer if they will face a cyberattack, but when. This fundamental shift has elevated cyber resilience from a niche concern to a top strategic priority, moving beyond traditional prevention and detection to focus on rapid recovery and maintaining business continuity in the face of inevitable breaches. Rubrik, Inc. is at the forefront of this transformation, positioning itself not merely as a backup and recovery provider, but as a Zero Trust Data Security company on a mission to secure the world's data.

Rubrik's journey began in 2013, evolving from early data management solutions to the comprehensive Rubrik Security Cloud (RSC) platform. This evolution reflects a deliberate strategy to address the changing threat landscape and customer needs. Initially offering perpetual licenses for Converged Data Management (CDM), the company strategically transitioned to a subscription model and shifted its focus to cloud-native and SaaS data protection, culminating in the launch of RSC in fiscal 2023. This platform represents the core of Rubrik's offering, designed with Zero Trust principles to secure data across the complex tapestry of enterprise, cloud, SaaS, unstructured data, and identity providers.

The strategic pivot to RSC and a subscription-first model, while impacting near-term revenue recognition due to the shift from upfront to ratable revenue, has been instrumental in establishing Rubrik's position in the burgeoning cyber resilience market. This market is characterized by a demand for solutions that can not only protect data but also ensure swift and clean recovery, a capability Rubrik highlights as its key differentiator.

Technological Differentiation: The Preemptive Recovery Engine and Integrated Security

Rubrik's competitive edge is fundamentally rooted in its unique technology architecture, centered around the Rubrik Security Cloud and its AI-powered preemptive recovery engine. Unlike legacy backup solutions or bolt-on security tools, RSC is a natively integrated platform designed for an assumed breach world.

The core technological differentiator is the preemptive recovery engine. This engine continuously and automatically scans all protected data and identities across a customer's entire IT ecosystem. By pre-computing metadata and applying AI and machine learning directly to business data, the platform can:

• Precalculate "green" recovery points: Identifying clean, malware-free states for rapid restoration.
• Determine the scope and time of infection: Providing critical context during an attack.
• Assess the sensitivity of impacted data: Enabling prioritized recovery and response.
• Perform malware hunting and quarantining: Preventing reinfection during recovery.

Rubrik emphasizes that other products struggle to deliver these capabilities natively, often relying on bolt-on tools that make cyber recovery times significantly longer (claimed to be up to 100 times longer by Rubrik). Rubrik's ability to transform recovery from weeks or months to under an hour for critical systems like Active Directory is a tangible, quantifiable benefit highlighted by management and in customer wins.

Building on this foundation, Rubrik has expanded its platform capabilities:

• Data Security Posture Management (DSPM): Integrated into RSC (following the Laminar acquisition), DSPM provides visibility into sensitive data exposure and reduces the attack surface. Rubrik is the only vendor offering integrated DSPM and cyber recovery, providing a complete cyber resilience solution before, during, and after an attack. DSPM deals nearly doubled quarter-over-quarter in Q3 FY25 and DSPM ARR was up over 300% year-over-year in Q1 FY26, indicating strong market traction. The urgency for DSPM is further amplified by the adoption of Generative AI, as organizations need to manage data sensitivity and user access before feeding proprietary data into LLMs.
• Identity Resilience: Addressing the rising threat of identity-based attacks targeting Active Directory and Entra ID, Rubrik's identity recovery solutions enable hybrid cloud recovery while preventing malware reintroduction. Orchestrated AD Forest Recovery, now generally available, automates a process that could take weeks into potentially under an hour. This is a key area of lateral motion investment for Rubrik, expanding its addressable market.
• Cloud and SaaS Protection: RSC provides a single policy engine and security control across diverse cloud and SaaS applications (including AWS (AMZN), Azure, Google Cloud (GOOGL), Oracle Cloud Infrastructure, M365, Salesforce (CRM), Jira). This consolidation capability, combined with fast recovery and the ability to drive significant cloud cost savings (customer examples cited 24% to 40% TCO or hard cost savings), is a major driver of customer adoption and expansion.

Looking ahead, Rubrik's innovation engine continues to explore new S-curves. Rubrik Annapurna, a multiyear initiative announced with AWS, aims to position Rubrik as the secure data infrastructure platform for Gen AI applications. By leveraging the data and metadata already managed within RSC, Annapurna intends to provide secure data access and embedding for building trusted Gen AI apps, addressing a critical need for AI trust and responsibility. While early, this initiative demonstrates Rubrik's ambition to stay at the intersection of data security and AI.

The "so what" for investors is clear: Rubrik's differentiated technology provides a significant competitive moat. The native integration of cyber recovery and DSPM, powered by AI, addresses a critical and growing market need that legacy and many new-gen competitors struggle to match with bolt-on solutions. This technological advantage translates directly into high win rates, the ability to command premium pricing for advanced editions (like Enterprise Edition, adopted by about half of new customers initially), drive expansion within the existing base (additional security functionality contributes over 30% to NRR), and capture market share in emerging areas like identity and secure GenAI data.

Competitive Landscape: Outpacing Rivals in a Transforming Market

The data security and cyber resilience market is intensely competitive, featuring a diverse set of players ranging from large legacy data management vendors to cloud providers offering native tools and emerging point security solutions. Rubrik's main competitors include established data management and protection vendors like Commvault (CVLT), Veeam, Cohesity (which recently acquired Veritas's data protection business), and IBM (IBM). It also competes with cloud and SaaS data management vendors and specialized vendors in areas like DSPM and identity security.

Comparing Rubrik to key publicly traded competitors like Commvault, Pure Storage (PSTG), and NetApp (NTAP) reveals Rubrik's position as a high-growth disruptor. While competitors like Commvault and NetApp have larger installed bases, broader product portfolios (in some cases), and generally stronger profitability margins (Commvault TTM Gross Margin ~82%, NetApp TTM Gross Margin ~70%, vs. RBRK TTM Gross Margin ~76%) and free cash flow generation (NetApp TTM FCF ~$1.2B, Pure Storage TTM FCF ~$350M, vs. RBRK TTM FCF ~$36.8M in Q1 FY26 LTM), Rubrik significantly outpaces them in growth rate (RBRK Q1 FY26 Subscription Revenue growth 54% vs. recent reported growth rates of 6-18% for these competitors).

Rubrik's core competitive advantage lies in its integrated platform and AI-driven capabilities. While competitors may offer components of data protection or security, Rubrik's ability to combine cyber recovery, DSPM, and increasingly, identity resilience, on a single Zero Trust platform is a key differentiator. Customer wins frequently cite Rubrik's superior recovery times (RTOs), ease of use, and integrated security features as reasons for choosing Rubrik over both legacy incumbents and other new-gen vendors. The Cohesity-Veritas merger is seen by Rubrik as potentially creating opportunity by causing uncertainty among Veritas customers who may look for alternatives. Similarly, acquisitions by large SaaS vendors (like Salesforce acquiring Own) are viewed as validating the importance of SaaS data protection while reinforcing the need for a single, consolidated platform like Rubrik's across all applications, not just one vendor's native offering.

Rubrik's go-to-market strategy heavily leverages channel partners (VARs, GSIs, MSPs), with a vast majority of sales flowing through them. Strategic technology alliances (with Microsoft (MSFT), Google Cloud, AWS, Mandiant, Okta (OKTA), Pure Storage, etc.) are also crucial, enabling co-engineered solutions and expanding market reach. Management notes increasing engagement with VARs and GSIs driven by customer demand for comprehensive cyber resilience solutions.

While Rubrik's higher R&D investment and operational scaling costs contribute to its current unprofitability compared to more mature competitors, these investments are seen as necessary to maintain its technological lead and capture market share in the rapidly evolving data security landscape. The focus on improving sales and marketing efficiency and leveraging the growing renewal base is aimed at closing the profitability gap over time.

Financial Performance: Growth at Scale with Improving Efficiency

Rubrik's recent financial performance underscores its strong market momentum and increasing operational efficiency. For the three months ended April 30, 2025 (Q1 FY26), Rubrik reported total revenue of $278.481 million, a 49% increase year-over-year. Subscription revenue, the core of the business, grew even faster at 54% year-over-year to $265.661 million, representing 95% of total revenue. Maintenance revenue continued its expected decline (down 59% Y/Y), while other revenue saw an increase (up 11% Y/Y), primarily driven by professional services.

Subscription Annual Recurring Revenue (ARR), a key metric for the subscription business, reached $1.18 billion as of April 30, 2025, growing 38% year-over-year. Net new subscription ARR was a strong $89 million in Q1 FY26. Cloud ARR, reflecting adoption of RSC and other cloud-based subscriptions, grew 60% year-over-year to $971.546 million. The company maintained a strong average subscription dollar-based net retention rate of over 120%. Growth in larger customers was also robust, with customers contributing $100,000 or more in Subscription ARR increasing 28% year-over-year to 2,381, representing 85% of total Subscription ARR.

Profitability metrics show significant improvement. Gross profit for Q1 FY26 was $217.998 million, resulting in a gross margin of 78%, a substantial increase from 49% in the prior-year period. Subscription gross margin specifically rose to 80% from 57% year-over-year, benefiting from lower prior-period stock-based compensation and improved support efficiency, partially offset by increased hosting costs associated with SaaS growth. Operating expenses decreased significantly year-over-year, primarily due to lower stock-based compensation expense related to the IPO in the prior period.

A key indicator of operating leverage, the Subscription ARR Contribution Margin, improved dramatically to 8% for the last twelve months ended April 30, 2025, compared to -11% in the prior-year period. This improvement is attributed to growing scale, higher sales, and increasing efficiencies across the business, particularly in sales and marketing.

From a liquidity perspective, Rubrik ended Q1 FY26 with a strong cash position, with cash, cash equivalents, and short-term investments totaling $762.1 million. The company also had $322.821 million in noncurrent debt as of April 30, 2025, primarily from its Amended Credit Facility. Free cash flow was positive $33.3 million in Q1 FY26, a significant improvement from negative $37.1 million in the prior-year period (or negative $16 million adjusted for IPO payroll taxes). While cash flow can fluctuate due to seasonality and changes in payment terms (a modest headwind from increasing annual/consumption payments), the company's improving operating leverage supports its path towards sustained positive free cash flow.

Outlook and Future Trajectory

Rubrik's management has expressed confidence in the company's trajectory and the continued strength of the cyber resilience market, reflected in their raised guidance for fiscal year 2026. For the full fiscal year ending January 31, 2026, Rubrik expects Subscription ARR in the range of $1.380 billion to $1.388 billion, representing year-over-year growth of 26% to 27%. Total revenue is guided to be between $1.179 billion and $1.189 billion, implying 33% to 34% growth year-over-year. This revenue growth rate is expected to outpace ARR growth partly due to tailwinds from the cloud transformation journey, including nonrecurring revenue from material rights.

The outlook anticipates continued investment in research and development to drive innovation, particularly in core platform capabilities and emerging areas like identity resilience and Annapurna. Investments in go-to-market are also planned to capture opportunities in specific regions and verticals and scale new initiatives.

Profitability is expected to continue improving, with non-GAAP Subscription ARR Contribution Margins guided to approximately 6% for the full year FY26, building on the significant progress made. The company also expects to generate positive free cash flow for the full year, guiding to a range of $65 million to $75 million. This outlook signals management's commitment to balancing strong growth with increasing profitability and cash generation.

Seasonality is expected to return to a more normalized pattern in FY26, with the second half contributing more to net new Subscription ARR than the first. Quarterly Subscription ARR Contribution Margins and Free Cash Flow are also expected to show seasonality throughout the year.

Risks and Challenges

Despite strong momentum and a compelling market position, Rubrik faces several risks and challenges. The rapid growth experienced makes it difficult to forecast future results, and the expected fluctuation and potential moderation in revenue growth rates due to the SaaS transition and timing of customer migrations/Subscription Credit usage could impact performance.

Achieving and sustaining profitability remains a key challenge, as the company continues to invest heavily in R&D and sales and marketing. While operating leverage is improving, costs are expected to increase in absolute terms.

Competition is intense, with well-resourced legacy and new-gen vendors vying for market share. Rubrik must continuously innovate and effectively communicate its differentiated value proposition to maintain its high win rates and avoid pricing pressure. Reliance on a limited number of contract manufacturers for compatible hardware and third-party cloud providers for hosting also presents operational risks.

The company's reliance on channel partners means their performance and strategic priorities can impact Rubrik's sales. Attracting and retaining skilled personnel in a competitive talent market is crucial for both innovation and sales execution.

Macroeconomic uncertainty could continue to impact sales cycles, potentially leading to longer closing times and a higher mix of annual or consumption-based payments, which can affect cash flow timing. Furthermore, as a data security company, Rubrik faces heightened risks related to product performance, potential defects, and security incidents affecting its own systems or those of its third-party partners, which could severely damage its reputation and business. The ongoing DOJ investigation related to a former employee also presents potential financial and reputational risks.

Finally, the dual-class stock structure concentrates voting control with Class B holders, limiting the influence of Class A stockholders and potentially affecting stock index eligibility.

Conclusion

Rubrik is strategically positioned at the nexus of data security and AI, capitalizing on the critical and growing need for cyber resilience in a world where cyberattacks are an inevitability. The company's core investment thesis is built upon its differentiated Rubrik Security Cloud platform, which uniquely integrates AI-powered cyber recovery and DSPM capabilities, providing a compelling value proposition that is driving strong customer adoption and market share gains against a diverse set of competitors.

Recent financial results demonstrate robust growth at scale, particularly in subscription revenue and ARR, coupled with significant improvements in operational efficiency and a clear trajectory towards profitability and positive free cash flow. Strategic investments in expanding the platform's coverage across applications and data sources, including emerging areas like identity resilience and the long-term vision for secure GenAI data infrastructure with Annapurna, underscore Rubrik's ambition to capture future market opportunities. While competitive pressures, operational complexities related to growth and the SaaS transition, and macroeconomic uncertainties present challenges, Rubrik's technological differentiation, strong execution, and positive outlook, including raised FY26 guidance, suggest it is well-equipped to continue its growth trajectory and solidify its position as a leader in the vital cyber resilience market.