Hi Multis
Rubrik (RBRK) reported its fiscal Q1 2027 results (yes, they are a year ahead of the calendar) on June 4, but I hadn’t written about them yet. The stock dropped after the earnings, but that was not that surprising. It had already run up close to 90% from the April lows before the earnings.
Six days later, management held its first Analyst Day in Las Vegas, and after that, the market reacted positively. Of course, I include the additional insight I got from that day in this article.
Let’s start with the results.
The Numbers
Subscription ARR (annual recurring revenue): $1.57 billion, up 32% YoY. Net new subscription ARR of $103 million.
Subscription revenue: $374 million, up 41%.
Total revenue: $387.1 million, up 39% and beating the consensus by $20.75 million. That’s 5.7%, strong for a revenue beat.
Non-GAAP EPS: $0.16, versus the consensus of -$0.03.
Subscription NRR: approximately 120%.
Customers with $100K+ in subscription ARR: 2,946, up 24%. Larger customers now make up 88% of subscription ARR. Customers spending $1 million or more grew over 50%.
Cloud ARR: $1.39 billion, up 43%, now 89% of subscription ARR.
Non-GAAP gross margin: 82.9%, up from 80.5% a year ago.
Free cash flow: $74 million, more than double last year’s $33 million. FCF margin came in around 19%, up from 12%.
For companies growing so fast, it’s always good to look at the Rule of 40. If you add revenue growth and FCF margin together, the sum should be above 40 to be a strong company. Rubrik has a Rule of 58. That’s very strong.
Rubrik started as a backup and recovery company, first with hardware, then in the cloud. When you were attacked by ransomware, you can simply turn back the clock to the second before the hack. From there, it also expanded into identity security and, more recently, into securing the AI agents that enterprises use on their own systems.
With its new offerings, Rubrik is positioned where it should be: at the intersection of cybersecurity and agentic AI. A while ago, some believed that Anthropic’s Mythos model would end the company, but that’s definitely not the case.
But back to the past, because there’s something you should understand there. Rubrik used to sell physical boxes bundled with software. Customers got a free hardware upgrade every few years as part of the deal. Rubrik has been moving away from that for a while now, toward selling pure cloud software subscription, Rubrik Security Cloud, or RSC.
The old hardware bundles left behind a small accounting trace, though. Customers who gave up their right to a free hardware refresh got a cloud credit instead, and when they use that credit, it shows up as a one-time bump in revenue. Rubrik calls this “material rights.”
Material rights are shrinking fast, from $13.4 million a year ago to $8.5 million this quarter, and that shrinkage makes the reported revenue growth look softer than it really is. If you leave it out, then revenue grew 43%, not 39%. That’s even stronger.
At the Analyst Day, CFO Kiran Choudary said cloud ARR is now 89% of subscription ARR, up from roughly 60% a couple of years back, and much higher than the 80% long-term target Rubrik gave at its IPO.
He expects it to reach around 90% within four to six quarters and then to stay stable. For regulated and self-hosting customers, the legacy solution is still the best way to secure their data.
Source Analyst Day slides
I heard some investors claim that rising prices for servers, HDDs, flash, and DRAM are a problem for Rubrik. Founder and CEO Bipul Sinha denied this on the earnings call:
Rubrik has no real impact from the hardware market dynamics... the enterprise data protection part of our business is a relatively smaller part of our business now.
Rubrik doesn’t own the servers in a customer’s data center, nor does it own the cloud infrastructure. It mostly sells software. This reminds me of Cloudflare. Just like Cloudflare, Rubrik stays asset-light, without the huge capex spending. In these times, this is an overlooked competitive advantage.
The gross margin has now gone up five years in a row: 70% in FY23, then 77%, 78%, 82%, and 83% this quarter. And free cash flow margin nearly doubled in a year, from 12% to 19%.
This shows that the growth is combined with efficiency.
On the Analyst Day, the company also gave long-term targets.
These look all very good, although the “low single digits” for share dilution is a bit too vague for me.
“The Cybersecurity Industry Is Dead”
That title is a direct quote from founder and CEO Bipul Sinha on the Analyst Day. His logic is that the old industry was built to prevent and detect attacks from human hackers using human identities. That world doesn’t exist anymore. Attackers use AI models that find vulnerabilities at machine speed, and a growing number of the “employees” in companies are AI agents, not humans. That means that a compromised agent isn’t a stolen password; it’s an insider attack. So:
You can’t respond by human speed, which is at best 10 bits per second, to an AI attacker, which is going million to billion bits per second. You will be out of business.
For a few weeks, the story was that this powerful model would kill the cybersecurity industry. But that’s very uninformed. It will definitely kill companies that still work in the old way, but the best have already adapted to AI and they will not be obsolete, but even more crucial.
Rubrik turned its own platform into an agent called Rubrik AI. It continuously monitors, builds a recovery runbook before an attack happens, and only brings in a human for the final yes or no. Chief Product Officer Anneka Gupta demoed this live at Capital Market Day, walking through a fictional ransomware attack in a Microsoft 365 environment in which the recovery plan was already built by the time the IT admin logged in.
Obviously, the cybersecurity market is not dead. Management put a $125 billion 2029 TAM (total addressable market) on the table for Rubrik.
Big TAM numbers often make me sigh deeply, but in this case, I think this is not outlandish.
Rubrik’s track record of how quickly each new product category has scaled after launch is also convincing.
Co-founder and CTO Arvind Nithrakashyap calls this the platform’s “complementary network effect”: each new product makes the existing ones more valuable, so the adoption compounds.
This is the breakdown of the revenue.
Chief Business Officer Mike Tornincasa runs the incubation team internally called Rubrik X. Products that came out of his team have grown at roughly 100% CAGR over five years, versus around 50% for the company overall, and now make up more than 40% of total company ARR.
To me, this also answers the question of how Rubrik can continue to grow so fast. At this scale, most slow down. Rubrik doesn’t.
The newest product from the Rubrik X team is Rubrik Flex. It’s a single contract that gives a customer access to the whole platform, and they can spend their commitment across whatever products they want. Announced at the Analyst Day. We have seen similar products at CrowdStrike (Falcon Flex).
The first Flex deal was a Global 2000 insurer that signed a contract for $6 million per year and over $30 million in total over five years. They started with three products and have room to grow into the rest.
Below:
The $50 million business Rubrik built from scratch in barely a year (and how it recovers customers 100x faster than Microsoft!)
Why "AI controlling AI agents" is the answer to the Mythos bear case
Five Selling Rules for Rubrik,
If the stock is still a buy after running 90% from the April lows.
And of course, much more.
Don't want to miss opportunities like this one again?