At this conference. I may, if it's not webcast.
I have to keep up with you.
I have been outdone, with even despite my trying. So welcome to day four of this conference. How's it been for everybody? Been good? Amazing, right?
Yeah.
And I'm gonna be so depressed at 12 . I mean, this has been such a high, to see us all come together. Thank you for investing your time with us. And, and, the stars of the show, Rubrik, I have to tell you that, Bipul, when I first met you, it was 2013 , I don't think you had a PowerPoint presentation, but you had a whiteboard. I don't know if you remember-
It was a long whiteboard.
You had a big whiteboard, and I said, "Can you tell me what you do?" And you said, "Okay, so let me take this whiteboard." And, 11 years later, you're now a public company, and we had you at our fireside chats when you were a private company, at our private software company conference, and it was just... It's been just so fulfilling to follow you, your idea, your company from a very, very early stage. So I cannot tell you how gratifying it is to see you guys, as a public company, to be able to host you on stage here. So with that very long preamble introduction, welcome to the conference officially.
Thank you.
Kiran Choudary, also welcome to the conference.
Thank you.
Kiran’s, I should say, Kiran, welcome back to Goldman, 'cause you used to work at Goldman in software banking. So glad to have you back as well.
Thank you.
We'll get to questions for Kiran in a second. Bipul, give us your background. How did you start this company? What was the aha moment that led to the founding of this technology?
First of all, Kash, thank you so much for this opportunity, and thank you so much for being a believer in Rubrik from early days when we had literally no employees and just an idea on the whiteboard. My background is, Bipul Sinha, Co-founder, CEO of Rubrik. My background is, I'm an engineer turned venture capitalist, turned entrepreneur. There are very few of us who went from engineering to, starting and running a company, now as a public company. That is, definitely gives me some advantage to think about technology, how technology trends are, and also being a venture background, it gives me the ability to see where the new, shoots are emerging and where the market could move in the three to five years from today.
Because of the two things, when I was in venture capital, I felt like I'm not utilizing everything that I have, and I'm too young to be a VC and sit on the boards and take the companies public. So I decided to leave venture capital to start Rubrik. The opportunity I saw was that there's a way to transform this old and dilapidated backup and recovery market into a data security platform to deliver cyber resilience. With that vision, I left Lightspeed, where I was a partner, to start Rubrik. Our goal was to build a company that is lasting longer than my professional life and career. We wanted to build a generational company, an enduring institution.
The core of the enduring institution was about innovation, delighting our customers, driving agenda of the market forward, transforming the market as opposed to getting transformed by the market. We are still on that journey, still early. I mean, in my mind, companies' lives are in decades, and we just finished our first decade, and we are entering a new decade as a public company, but it's still very early of what's to come in for Rubrik.
So tell us. I know that you had a few pivots during your course as a private company. I don't know if you invented the category cyber resilience. Did you? Or, it doesn't matter. But tell us what this new category is that you created or helped create.
When I started to think about Rubrik and how we're going to transform backup and recovery, what occurred to me was that whereas human error and natural disaster doesn't happen every day, but the cyber disasters are happening every day, but the architecture of the backup and recovery, classic legacy platforms, was not built for cyber, but this was going to be the biggest use case, and I bet the whole company on that thesis. That's why we combined the different software, hardware platforms to create a brand new software, conceptually, to deliver to this new market, and the analogy that I thought about was that if you look at the cell phone market, it went from texting and calling device to an internet device, from BlackBerry to iPhone.
I felt like the backup and recovery market was in the BlackBerry stage, whereas they were not using or not delivering the cyber resilience, cyber recovery, as the future. So I started to kind of move the whole company, whole idea around, around cyber. And five years ago, when I first time I called Rubrik as a cybersecurity company, most of the market laughed at me because they thought that I'm doing it for IPO or I'm doing it to kind of increase the valuation. And then the cyberattacks and ransomware attacks started happening.
And we are the only platform purpose-built to deliver cyber recovery, cyber resilience from scratch. And that has led to our success and growth in the marketplace. If you look at, we are the first cybersecurity company to go public in three years. If you consider us as a backup and recovery origin, then we are probably the first company to go public in 10 years, and we have really redefined this market.
Where do you want the company to be in five years? Whatever timeframe you choose to, longer term.
It's hard for me to say where Rubrik goes in five years, because we have this unlimited ambition for the company. We see tremendous opportunity for Rubrik because the real estate that we sit on, which is data, and data security, and data availability, and making sure we deliver data to the right user on the right platform at the right time for the right duration, it opens up a lot of discussion for us.
Whether we'll be 20x bigger company, 30x bigger company, 10x bigger company, I can't predict. We are doing everything possible today to take advantage of every opportunity that is in front of us. That is my fundamental belief, that in an uncertain market, when you can't know what is ahead of you, because we are at the edge of innovation, you continue to maximize opportunity, and today will become tomorrow and creates the future.
So to understand the future, sometimes you have to also understand, many times, history and lessons. Why did that backup and recovery market not live up to its potential in your view? What were the shortcomings?
See, what has happened is that if you look at the history of the IT industry, the IT industry has evolved through technology shifts. The big technology shift in backup and recovery was 25 years ago, when it went from the tape device to a disk-based device. That was the beginnings of the Data Domain, and that really had a major shift in the market. What happened was, that shift from tape device into disk device really eliminated the need for backup software to be a separate entity. The innovators of that time, 25 years ago, didn't go far enough to reimagine the new world. When I looked at it in 2013, I said, "It's almost too late, but still nobody is doing it.
So why not go all the way and transform the whole architecture, not having, like, two or three or different products to do one thing?" And that one thing is also not being done right, because done in an old architecture, because it's not solving the cyber issue. So how about we combine the metadata systems, the data systems, and since you combine the metadata and data together, can you build the cybersecurity capabilities right into that same system, the data threat engine, to really create a new platform purpose-built for cyber resilience? And it was a bold move, because when we first went to customers, customers said: "What is this? This sounds like a black box. Because I used to schedule jobs, I used to have storage systems, I used to have backup system.
Now you are giving me one system where I don't need to schedule jobs. Are you going to take my job away? I don't know how to manage this." And we lost some bank deals in the early days of the company because they could not imagine that such a system will scale to petabytes and petabytes of data. Because it was like we are giving them five-year-out thinking. And sometimes it's hard for people to reconcile what they know versus what it is, which is from the future. And once the cyber attacks started happening in 2018, 2019, then folks realized that we are the only game in town with this unique architecture, purpose-built for this reason. And that's why now every vendor in our space is building their website as cyber resilience, but nobody has a platform.
It's rare to see a company get to the billion-dollar type revenue run rate in such a short span of time. So tell us about that journey. What were the obstacles you faced, and how did you get to be where you are today, and then we can talk about the future and the challenges and the opportunities ahead.
One thing that I have a firm belief in, that whatever has happened in the past doesn't need to repeat in the future. So when we started Rubrik, we had this firm belief that we could be the fastest-growing software company ever. Even if it is B2B, even if it has the friction of hand-to-hand selling, we could be the fastest. And we are eight and a half years selling right now. We crossed $900 million subscription ARR, and we are projected over $1 billion for the end of this year as our guide. It shows the ambition of this company. So but to get to this ambition, you have to train your people to also open up their minds. So in the early days, what we did was, we said we'll not have like small goals.
So if you look at the Rubrik's trajectory, it was TCV, but first half a year of selling Rubrik, we sold $5 million. First full year of selling Rubrik, we sold $47 million. Second full year of selling Rubrik, we sold $168 million. Third year of selling Rubrik, we sold $350 million. There's no other company that grew at this pace, because what we did was, we programmed the company to have this unlimited ambition, where we wanted to build fast, innovate fast, and take it to market fast. But when you do that, you run into, operational infrastructure issues. We didn't have the proper management, proper, operationally managing and tracking business, because age-wise, we were still five-year-old, but, state-wise, we were a teenager in the marketplace.
Then we had to quickly build the operating infrastructure of the company and how we manage company metrics and responsibility, accountability, coordination. And so that we had to do in 2019 to fit the company for the next phase of growth, and that was painful. I mean, we had to take a lot of people out of the company. We had to reimagine our management team, reimagine our practices, because our speed of growth was far outpacing company's infrastructure to support that growth.
Kiran, to loop you into the conversation, you know, how would you describe the market opportunity ahead? You know, what are the drivers of the market and really an ocean of competing priorities right now?
Obviously, as Bipul shared, the market is pretty significant, and it's continuing to evolve. I will also say that we are fairly under-penetrated in the market today, right? You know, at the time of our IPO, we talked about having 6,000+ customers, but we sized the market as being 60,000+ . We are still less than 40% in the Fortune 500. And even within the customers we have acquired, including customers who are several million ARR, we are less than 50% penetrated.
When you look at those statistics in the context of this large market, which we are evolving, we have a lot of room for growth here, right? The market is large, the company's ambitions are high, and we are under-penetrated. So it comes down really to us, as Bipul talked about, is execution. It is just the operational discipline. It's growing the business, growing efficiency, hitting the targets, holding people accountable, and the operational metrics and discipline around it, so that's what we are really focused on.
Backups is largely a brownfield opportunity, right? So how do you incentivize customers to migrate from legacy solutions?
Our customers are naturally incentivized because they want to keep their business as continuing operation. And the last several years of cyberattack and ransomware attack has proven that what cyberattacks used to be, denial-of-service attacks, and the website goes down, you can bring that back up. But in this new era of cyberattack, it's more destructive. It can bring your whole business down. I was in Vegas day before yesterday, and I was staying at Cosmopolitan, and they are still taking the... Their screen looked like mainframe because of they are still not fully recovered.
So think about, like, they have to make phone call to figure out if the room is available or not. That's a massive drag to the business, and this is after how many months? So what we do really matters, and it is not a discretionary thing. It's not that your website is down, you can bring that back up. Your whole business will be wiped out and gone, and what is the cost of that, so obviously, this particular incident has brought even more awareness in the eyes of board members and CEOs because they saw this as a preview to what could happen if it is a real cyberattack.
Any, since you mentioned it, I had not planned on asking, but any customers that you happen to serve that did better and recovered very quickly?
Many, many customers. In fact, when this particular incident happened, I got a call from George, and we decided to go, like, go together and help our customers, and we helped hundreds of customers. We got, like, tens of love letters from our customers saying, "We could keep our hospitals up and running and keep delivering patient service because of you guys. Our prior solution would have been a different case." And we helped, like, from oil and gas companies to healthcare, hospitals, to insurance companies all over the place. In fact, in our earnings call, we gave one example. We had so many examples that we could be talking about that the whole earnings call.
So your sales pipeline must have gotten a bit of a boost after this.
I mean, look, this is really early-
Not to be crassly commercial about an incident that was massively disruptive, but just to help your customers forestall such... And I think one of the things you've always talked about is we are not a security company. We're not gonna pretend to try to prevent an attack, but you're gonna get attacked, and we're gonna help you get up and running very quickly. That's the-
We are definitely seeing anecdotally a lot of, like, discussion and interest. We are not numerically seeing in the data yet. It's early. But look, I mean, if you look at our last quarter, we see no negative disruption because of it. Because whereas a lot of other companies saw their pipeline stall or decision get stalled, we had no such issue, and we continue to see a strength in this market. I mean, that's why we are so confident about our guidance. We actually raised our ARR guidance by over 5% for the rest of the year, and new ARR guidance is because cyber resilience continues to be the number one topic, and we are clearly winning this market.
Not many companies raised guidance. Many of them left it unchanged, and the big debate among investors was the magnitude of the raise for the year was lower than the magnitude of the beat, and so the second half guidance actually went down. There were many interpretations of how negatively people viewed the guidance. And that in that landscape, your clear beat and raise was definitely a positive. So I want to dig a little bit deeper into the technology for my benefit, primarily, and for people who are here and listening to the webcast. How would you describe the architecture? Why is it so unique, and what gives you the confidence, therefore, that there is durable competitive advantage in this architecture? Because as you've rightly pointed out, you've got competitors that also claim that they have durable competitive advantage. Help us sift through all this.
I mean, our story is no different than many generations of disruptive companies that came in with a new architecture purpose-built for the use case, and really evolve the agenda of the market. If you look at, like, Rubrik Security Cloud, we took seven years, six to seven years, to build from scratch the Rubrik Security Cloud. Everybody else in our market space, when they talk about cloud, it's a lift and shift of their legacy software that is now human-powered and providing cloud service, not Rubrik. It's a purpose-built platform. From day one, our idea was to combine the metadata system, which is backup software, sold by Commvault, Veritas, Veeam, Cohesity, and storage software, which is sold by EMC, NetApp, as well as Cohesity, combine those two systems, so the metadata system plus the data system in a single software.
And when you combine the metadata system and data system in a single software, what you get is self-describing data, because data understands the metadata, and application, and user, and context. And we use that intelligence to natively build data threat engine in the same software. So as we are pulling data from production system, we are applying AI/ML to understand attack, to understand the scope of the attack, to understand point of infection, to do the data classification, to look for known threats. Our integration with Mandiant is, again, another feed that will give us intelligence about newer and newer attacks that we can look for in the data.
Mm-hmm.
While we are pulling the data out of the production system. As a result, what Rubrik does is everything that you need for recovery is pre-calculated in the Rubrik system, as opposed to legacy system, where they have 10 or 15 different partnerships and third-party software that is now scanning data post the impact. That is the difference between whether you are up and running in a day or down for weeks, or in some cases, months. Architecture matters when you are delivering cyber resilience.
Just because you're calling yourself a cyber resilience company and checking the box and on the messaging, doesn't mean that you have the real platform. Because if you look at our growth rate, and if you look at our scale with which we are operating and the number of customers we are helping, it clearly demonstrates the strength of our platform and the resonance that we are getting in the marketplace.
Kiran, you've had an established career at Oracle, Goldman, Atlassian, and now Rubrik. So what are the key learnings that have helped you inform your approach to being a public company CFO?
Yeah, I've had the fortune of working at some strong franchises. Almost all my career I've spent in software, even at Goldman, Kash, the software banker. I think a lot of learnings, even though the business models and the individual end customer base is different, right? I think it's really, some things Bipul alluded to, is when you're at a company with the kind of ambition we have, there's a lot of balance you need between near-term execution and long-term as well, right? That directly translates into my role and my team's role, is make sure the near term is secure with the right level of investments and the execution muscle. But also, we are investing to the future, three to five years out, with the products we want to build, the markets we want to be in.
So that when we get to that stage, we have those growth levers, right? So that's a key focus. I think, building durability, durability in a business is really critical. For us, it is clearly product and platform. So right from the vision to implementing these different, I would say, snowballs in terms of product investments, which get to fruition over time, to keep that differentiation way ahead is critical. And then I would say, you know, the companies I've worked with, they're all durable software franchises, and one thing which is common is, at scale, durable software franchises are very profitable in addition to growth, right? So that's the journey we are on as well, is over time, with the growth and the scale, generate meaningful level of profitability. And the last thing I'll say-
I would like to describe Goldman as a solid franchise. Durable franchise. I agree.
And the last thing I'll say is, you know, as Bipul talked about, vision can be all talk. You've got to deliver and execution, right? So, we're day in and day out focused on that, and that's a key part of my role as well, because it's a very cross-functional role. And end of the day, we are a numbers-driven business, so I have to drive that, discipline in the business. That is, something developed over time at these companies, but also, train ourselves to do better every day.
So, Bipul, what... you hired an engineer to be your CFO. That's very rare. How does an engineer with a master's degree in engineering get to be a CFO? Is this job too easy for this guy? He must be like, "This is just numbers, man. It's not even technology." This is very...
Crazy part about my career is, I'm an electrical engineering undergrad, and I did software engineering for many years. I have over 30 patents in distributed computing, some of the hardest part of software ecosystem. Then I did my finance MBA at Wharton.
Was it easy or tough?
It was relatively easy. In fact, in fact, I remember my finance professor called me and said: "What do you do?" I said, "I'm Director of Engineering." He said: "Leave your job and go to Wall Street, because you are uncanny about looking at numbers." And I was acing all these courses. So the thing is that when you look back at your career, many things that you do that seem at that time not important or not beneficial, but everything kinda comes together. And that's why our partnership, Kiran and I, are so strong, because both are engineers, and both have... I mean, obviously, Kiran is financial expert, and I'm somewhat literate. So we understand each other.
Although your course is at war.
So we understand each other, like we understand what is important-
Yeah
to build a durable business. Obviously, as an entrepreneur and as a founder and somebody who has this outsized drive, obviously I'm pushing to ensure that we can grow and take care of this or take advantage of this market opportunity. And Kiran is my partner who is, like, keeping me centered about making sure that profitability is my number one focus, ensuring that we responsibly t ake advantage of this market opportunity to build a long-term company.
Yeah.
That's why this partnership is important, and that's why we worked so well together-
Mm-hmm
Is because we both understand each other from technology perspective, and we both understand each other from finance perspective.
Yeah.
The two pillars of where we are today.
Mm-hmm
Are really important, because financial is the underpinning of the business that we're going to create.
Yeah, that's. I'm glad you said that, because it's very easy to find CEOs not have their CFO up on stage with them while doing a Q&A discussion like this. And so the fact that you're partnered together is, it's a good thing. And I also think as an engineer, being a former engineer myself, being a little biased, being a CFO, you're able to better relate to the aspirations of the business. So Kiran, you've been through all these successful, profitable software franchises. What are the things that you learned from working at Atlassian and Oracle? Oracle, you are an engineer at Oracle, right? But Atlassian, you are in finance.
Yep.
What are the financial principles that have inspired you from these places that you could see yourself applying to Rubrik? Tell us about the financial discipline that you bring to bear from your experience.
Yeah, the financial planning, you know, you can think about it as a financial process, is really, you know, a strategic planning process in the company. You have to involve everybody. It's about who we are. It starts with the reiterating of the mission, to where are we headed, starting from what are we going to build, how are we going to go to market, what's our business model? And then that translates to, you know, actually numbers. And, you know, a lot of times, it appears that the financial plan is what drives the business, but I really think the financial plan is a reflection of the strategy and the mission of the business. And that's what I've learned from working on these companies is, you know, start from there, right?
You know, where do you want to be in five, ten years? And then what do you get done in the next few years to work towards that mission? And then what do you need to invest in that? What are the results you want to get? And then that becomes the operating rhythm of the company. You're measuring yourselves every week, every month, every quarter, every year, right? And that's really, I think, what I've learned in my previous roles as well and what we are doing here. The one thing I've also learned in my career is you can't just take something and apply it because you've done it 5x before, right?
The world is evolving. What we were as a company five years back, in terms of the markets we are going after and, and the customers we're going to serve and the buyers, is evolving. So similarly, in my role, I can't just take everything I've learned and apply it just as is. That will not be good. So you take things you learn, try to apply it to the current business, and there are some new things you learn on the job as well, right? So, and that's really how I operate.
What metrics and goalposts should we, as investors and analysts, be looking at to gauge the progress of the company? What are the KPIs?
Yeah. So the metrics, you know, these are metrics we've talked about in our journey to be a public company, and we report every quarter. We are a high-growth software business, focus on the top line would be ARR. Subscription ARR is a key top-line metric. I also think it's the best indicator of the business, but it also happens to be the metric you need for Rubrik, given our cloud transformation, right? Very few companies disclose ARR, even fewer to guide an ARR. We do that. So that's the best measure, I would say, in terms of top-line growth, and then understanding the drivers which drive that, right? The customer acquisition, which is best represented by 100,000+ count, the NRR we report, cloud ARR, which is the majority of our subscription ARR.
Those, I would say, are the key top-line metrics. In terms of profitability, software businesses, gross margin, ARR contribution margin, which is a proxy for operating margin and the free cash flow, but I think given where we are at the stage of business, subscription contribution margin is the best indicator of operating leverage, and then the last thing I'll say is, you know, we are a product company, and the business of serving our customers, NPS is a really important metric. We report that as we do our independent surveys, but it's an important metric from inside the business that really reflects, you know, are we building the best products? Are we making our customers successful?
I do believe we have a question from the audience.
Yeah, quick. Yeah, I have a quick question. Today, I mean, and you've got a lot more runway because there's a lot of cooperation with data everywhere and also operational data. But more and more, isn't the important data going to be in the modern data stack in Databricks or Snowflake? Would love to get your thoughts on that architecture going forward in the next five years or so.
There are two issues when you run an application. One issue is that, can you keep this application up and running? And how do you ensure that this application or this service never goes away? Whether it's your booking system, whether it's billing system, whether it's your, if you're a hospital, then how do you admit patients, all of that. We are in the business of availability of that application and making sure that in case of a cyberattack or any kind of disruption, that service is up and running.
Then you have these other data platforms that pull the data from the production system and transform the data to be able to query data for business intelligence, and that could be Snowflake, could be Databricks. But they are a secondary storage or secondary data copy that is done for analytics, and they periodically pull data from production. They can't recover the system, because they don't have the untransformed data, and their ability to restore is a different science altogether, because they are organizing the data to be able to query the data. We are organizing the data to be able to keep the businesses up and running, so it's a completely different thing.
Having said that, we have the unaltered data across all the applications in the business, plus the data security built into it, which is classification of the data, sensitivity of the content, governance of the data, all built into it. So in the world of generative AI, where the database structures don't matter because it's all about interpretation of the data, who has the data and is the data secure and it has integrity matters. So that is a great leveler of all the technology.
In the minute that we have, I have a question for you each. One, for you, Bipul, thoughts on Salesforce acquisition of Own Data, increase the competitive landscape or not, and Kiran, finally, free cash flows.
So very quickly, it's very positive for our strategy. In fact, it validates our strategy because we have been educating customers, saying that for every SaaS app, you need cyber resilience. And some customers ask me this question that, "Hey, will Salesforce not do it, or will Microsoft not do M365?" That question is forever answered by Salesforce buying a backup recovery company. So that's actually very positive. But Salesforce is one of the 20-30 apps that we secure, and when the cyberattack happens, customers are not going to turn 30 knobs to recover because they are already so distressed. So consolidation is the name of the game. Consolidation of the cyber resilience across all applications is the name of the game for our market and for any customer serious about cyberattacks. So we believe that the messaging and acquisition is positive for us, and it validates our strategy.
Okay. So on free cash flow, I guess the question is the path to free cash flow?
Path to free cash.
Obviously, as I said, it's one of our key profitability metrics. You know, in a software business like ours, some of the durable franchises we've talked about, they all generate free cash flow over time, and that's our goal as well. We've been working hard at this. Obviously, the scale we have with the strong growth margins and improving operating margin, subscription contribution margin, we are on that path. In fact, we guided to cash flow positive for the second half. There's a lot of opportunity here as we scale the business. Two areas we're very focused on is sales and marketing and R&D, key areas of investment. Both of them, we improved significantly in terms of contribution margin year over year, over the last year.
We improved our contribution margin by 1,600 basis points in Q2, taking out the one-time impact of the IPO taxes. Over 1,000 of that came from sales and marketing, where we are focused on increasing productivity of our apps. If you can increase productivity with multiple products and better enablement, you can produce more with less, right? Lowering the cost of acquisition, more targeted marketing. Then, you know, we are getting a natural leverage with scale, too, through renewals. Still a very small part of our business, minority, and, you know, high-retention business.
The software we sell, as renewals grow, it's a very high-margin business as well. Then R&D, we are leveraging our global footprint, world-class talent in Bangalore, in particular, to grow and deliver world-class products, but at a much more optimal cost structure as well. As the operating leverage business and the growth grows and the top line scale grows, naturally, it'll drive free cash flow in the business.
Love the answer. Love the detail there. On that note, thank you, Bipul and Kiran. Let's give a round of applause.