Rubrik Q424

Rubrik went public almost a year ago, and now has 4 earnings reports under its belt. Their Q425 results back in March were phenomenal, bolstered by that outperformance in Q3 [paid], as well as a repeat of some of the non-recurring tailwinds.

• Revenue growth again accelerated, having gone from +29% to now +47% over the last year.
• FY26 guidance was initially set at +31%. This is well above the current guides from other next-gen security players, showing how important resiliency & data security has become.
• Cloud ARR continues to shine, growing +66.9% to now be over 80% of Sub ARR – after adding a record +$107M in net new.
• Sub ARR growth is a more muted +39%, as self-managed subs continue to transition to cloud hosted (cannibalization). Mgmt noted it also had a +2pp from license to sub transitions as well.
• They continue to make massive strides in profitability, and swung positive in Sub ARR Contrib Margin and TTM FCF way earlier than expected (said would be in FY26 last Q).
• They are now at a Rule of 44 in TTM FCF.

Q425 results

• Revenue was $258.1M, accelerating to +47.5% YoY, or a strong +9.3% seq. They beat their sandbagged guide (-1.1% seq) by 10%.
• Subscription revenue was $243.7M, growing +53.6% or +10.0% seq.
• Q1 was guided to +39.3%, or a weaker +1.1% seq.
• FY26 was guided to a strong $1161M in revenue, for +31% growth.

CEO in remarks: "The fourth quarter was an exceptional finish to what has been a milestone year for Rubrik. This quarter, we once again exceeded all top line and profitability guided metrics.

... We continue to be very confident about our business and our leadership of the cyber resilience market. Therefore, we are guiding fiscal 2026 numbers ahead of the consensus."

The CFO noted again that like Q3, Q4 growth was goosed by non-recurring revenue, and their Other revenue line again ticked up after declining continuously over the past 2 years. Unfortunately, he didn't provide any further details on specifics – but it sounds exactly like what they saw in Q3. Later commentary noted it was ~4pp of revenue growth, and suggested it will continue into FY26, so clearly boosted the guide a bit.

CFO in remarks: "We also saw higher nonrecurring revenue, which was accounted for as material rights related to our cloud transformation, which contributed a few points of growth this quarter."

... Later in Q&A: "The Q4 revenue growth benefited for about 4 points of nonrecurring upfront revenue from material rights to the cloud transformation. And we expect that to continue in fiscal '26 as well, a few points of growth and that's adding further tailwinds to revenue."

We don't have the 10-K yet (for revenue breakouts by geo, as well as RPO), but last Q was strongest in APAC & US and weaker in EMEA. That looks to have improved in Q4, as International revenue accelerated from +35% to now +47% this Q. They still have a lot of room to run internationally in EU & APAC, and new EU regulatory compliance frameworks like DORA are already driving success there.

• Subscription ARR is now at $1092.6M, growing +39.4% or +9.0% seq. Slides noted that this had a 2pp benefit from their ongoing license/maint to sub transition.
• Cloud ARR is now at $876M, growing +66.9% or +13.9% seq – after adding record +$107M in net new (+$351M for FY24). Cloud is now over 80% of Sub ARR.
• FY26 was guided to $1161M in Sub ARR, for +24.5% growth. (This suggests Cloud ARR will be over 30%.)

This implies a net new Sub ARR of +$267M for FY26, a step down from the +$308M seen in FY25. The CFO basically admitted it was a sandbag later in Q&A (as his first ARR fiscal year guide as a public company), plus how that 2pp tailwind from their license to sub transition will be lessening over time.

The CFO also noted that net new ARR will be stronger in the 2H, with a 40/60% distribution. Q1 will provide 24%, implying Q2 will be weakest (16%). This implies net new ARR of +$64 and +$43 over the next 2Qs.

CFO in remarks: "Let me now provide some context on our outlook for FY26. We remain confident about the strength of the cyber resilience market and demand for our differentiated offerings. We believe these drivers alongside our strong and consistent execution will deliver strong subscription ARR growth ahead. ...  We continue to expect higher net new subscription ARR in the second half of the year versus the first half. ... Currently, we expect the first half to comprise approximately 40% of the full year net new subscription ARR with Q1 specifically contributing approximately 24% of full year net new subscription ARR.

... In fiscal '26, we expect revenue will continue to see tailwinds from our cloud transformation, including a few points of growth from nonrecurring revenue due to material rights."

Beyond the licence-to-sub transition that is still lingering, there is also the transition of (self-managed) subs to (fully managed) cloud. The difference between TTM net new Sub ARR and Cloud ARR gives us a glimpse that $16.6M in Q4 net new and $42.6M of TTM net new Cloud ARR was from this.

They continue to make huge strides in profitability, though remain non-GAAP profitable – and very far from GAAP profitable. Their custom KPI to remove license/maint, Sub ARR Contrib Margin TTM, swung positive, as did TTM FCF margin.

• Gross margin rose +2pp to 79.7% (near their record of 80.2% right before IPO).
• Op margin rose +33pp to -11.3%, with TTM rising +22pp to -24.4%. (Yes, TTM margins nearly halved over the past year.)
• Sub ARR Contrib margin rose +14pp to 2%, swinging positive.
• FCF margin was a record 29.2%, with TTM rising +6pp to 2.4%, swinging positive.
• They are hitting Rule of 40 TTM. They hit Rule of 77 this Q from that strong FCF, finally making Rule of 40 TTM rise from 31 to 44 sequentially – vs being at Rule of 1 last year!

CFO in remarks: "[For Q1,] we expect non-GAAP subscription ARR contribution margins between 4% and 5%. ... I'd also like to note some seasonality in subscription ARR contribution margin due to the quarterly timing of net new subscription ARR and operating expenses. Specifically, we expect Q1 contribution margins to be up from Q4 before moving lower in Q2 and Q3, then proceeding higher in the fourth quarter. For free cash flow, we expect Q1 and Q4 to be our seasonally strongest quarters and the first half to be approximately breakeven."

... Later in Q&A: "We improved our subscription ARR contribution margins 1,400 basis points year-over-year and the guide for fiscal '26 will indicate further improvement ... The key leverage areas of efficiency came from our big investment areas in sales and marketing and R&D. Out of the 1400bps in margin, 1200bps approximately came just from sales and marketing. ... Productivity is a key driver of sales efficiency. As Bipul has talked about, we are investing in multiple different levers from a product perspective and more products to sell drives greater productivity. We're also investing in enablement to make our reps and sales team more productive in the messaging around cyber resilience.

I will also add that there's a natural leverage we're getting on a model at scale, which is the growth in renewals. It's still a minority of our revenue and ARR base, but fairly efficient from an investment perspective in our market and our product areas."

We don't have much history to judge seasonality, but it looks like the seasonally strong sales in Q3 then brings seasonally strong FCF in Q4-Q1, while profitability becomes muted into Q1-Q2. (This is why I watch the margin trends over the TTM instead of quarter-by-quarter.)  

Mgmt notes that Q1 will see contribution margin spike up to 4-5%, fall back in Q2-Q3, and overall hit 4.5-5.5% in FY26. That seems a sandbag too, especially if subscription renewals start to kick in.

TTM op margin should improve drastically next Q, as they lap the weakness here in Q1 after IPO – so will hopefully give us an idea next Q of when it might eventually swing positive. I also expect the newly positive TTM FCF to continue to grow from here.

• Customers>$100K grew +29% to 2246, from a strong +161 net new. (Q4 looks seasonally strongest here.)
• ARR of large customers grew to 84%, implying large customers are growing ARR faster at +46% vs +39% overall.
• Customers>$1M grew +64% to 162.
• NRR remained over 120%.
• NPS is reported at >80 (top tier in customer satisfaction).

Their success in $100K customers is likely mostly from new customers landing with large deals at this point, until they see the benefit of 3yr contract cycles starting to renew later in FY26. Despite deal sizes rising, NRR remains over 120% as customers expand RSC over more cloud systems (VMs, containers, app stacks) and data stores (databases, unstructured data lakes, and SaaS apps like MS365).

Product moves

I previously covered [paid] the big moves from Microsoft Ignite and AWS re:Invent conferences in November and December – including their subtle shift in their Annapurna product in AWS (and soon Azure) to turn their backup data lake into a data delivery platform to AI engines.

• In December, they announced that DSPM was now a native capability within their RSC cloud platform - coming in early 2025. I am guessing they lose the "Laminar" brand (the company they acquired) now that it is a native capability within RSC.
• They are now FedRAMP authorized at Moderate level, opening them to Federal markets. They heavily focused on SLED (state & local gov agencies and education) in their last Public Sector Summit in October.
• They introduced a new Turbo Threat Hunting capability atop their existing Threat Hunting module to speed up backup recovery from hours to seconds.[This is using some hashing techniques to scan for the last clean backup before a malicious file edit (such as ransomware) appeared.]
• They are opening a big new India HQ in mid-2025 in Bangalore that will house product mgmt, R&D, cust support, and recovery ops. (They also have an R&D presence in Israel from the Laminar DSPM acquisition.)
• GigaOm noted Rubrik as a leader in DSPM.
• They revamped their existing Active Directory identity backup & recovery features with a new Identity Recovery capability in February as a new standalone offering. This allows admins to more easily restore organizational identities if Entra ID & AD domains are compromised – especially helpful for larger orgs.
• They have a new partnership with Pure Storage, integrating RSC tightly with Pure's native backup and snapshot features. They are pushing this as a way to help back up unstructured data (and ultimately deliver it to AI engines via Annapurna).
• They heavily expanded their cloud resiliency features in RSC this month, adding support for Oracle Cloud (OCI), Red Hat OpenShift (containers), PostgreSQL databases, developer code repos (Azure DevOps and GitHub), and Microsoft Dynamics 365. This included a new Cloud Data Risk Posture module, a CSPM-like module that auto-scans cloud environments for data sources.

Rubrik has been turning their focus from a boring backup & recovery product into a complete data security platform (Rubrik Security Cloud, or RSC) over on-prem, cloud, SaaS to protect app stacks (VMs, containers), databases, and pools of unstructured data. I like to see them adding support for more common databases (Postgres) and developer code (GitHub) here, as well as supporting a new cloud (OCI). And their DSPM sits over all of that, as the posture scanning tool to find and classify sensitive data across all those data sources.

CEO in Q&A :"And as GenAI acceleration is happening within the enterprise, we believe that DSPM is a critical piece of that puzzle - to be able to secure the data before the data is fed into models or RAG. .... Just to give you an example, a financial services organization added DSPM this quarter for Microsoft Copilot. Essentially, our DSPM empowered them to quickly and securely adopt Copilot, and realize the full productivity gains that they anticipated from Copilot.

And that's the story that we believe is going to be critical. As businesses adopt AI, they need to understand security of the data, they need to understand sensitivity of the data and ensure that only the right data is delivered to the right user."

Rubrik will benefit as organizations try to unlock more value from data with AI, especially from SaaS and unstructured data (videos, images, audio, documents). Rubrik makes it easy to oversee your entire data estate in a secure and governed way (over on-prem, cloud, and SaaS apps) – and will ultimately allow customers to push data into AI engines right from the RSC platform (backup data lake) in their coming Annapurna product.

The CEO commentary shows they are deepening their focus on identity protection, as well as the opportunities with Annapurna. And the CEO gave clear signals that the coming Annapurna will be moving from AWS (Bedrock) into Azure and GCP from here.

CEO in Q&A: "And if you think about the fundamental risk to the data comes from the user interaction with the data, both -- user could be human or nonhuman identities. So that's why we are also focused on building the next S curve around identity-related theft and whether it's Active Directory or Entra ID. And we are seeing interesting momentum in that market. We launched the first identity recovery product about a year ago, and it had a very significant traction. And then our recent ... release has like really proven that we are on the right track with respect to the identity.

So around cyber resilience, we continue to focus on data security, identity security and delivering cyber recovery and the risk posture. And then we also have this other unique opportunity because we have all of the customer data and plus the governance and security and integrity on the data. And our Annapurna platform is that how do we leverage this data lake, the next-gen data lake that we are naturally creating to deliver cyber recovery because we have the source of food for the data to power customers AI applications. And that's where we are actually iterating and figuring out what is the product market fit.

... Our success today is a result of the work that we did 4 or 5 years ago, where we built a platform that was futuristic, where we took the market risk and built a purpose-built platform for cyber resilience. And we are thinking about what do we do on Annapurna and all of these other new vectors of growth so that 4-5 years from today, we still have a high growth curve."

Later in Q&A: "We are early in Annapurna. We are still doing market discovery, discussions, figuring things out. And as I said before, Annapurna is the next 3-5 year strategy for us. And it is one of those initiatives that we do to ensure that we have continued growth and success in the next horizon as we create the next S curve. And we see opportunity for Annapurna all across multiple clouds, including Azure and GCP as we continue to kind of build out the capabilities and figure out the product market set."

More posts coming soon on Axon, the identity security landscape, CyberArk, and NVIDIA's GTC announcements.

-muji