Barclays Tech Conference. My name is Saket Kalia . I cover software here at Barclays. Absolute honor to have with us the management team from Rubrik. We have Bipul Sinha, CEO, as well as Kiran Choudary, Chief Financial Officer. We also have, in the back, Melissa Franchi, Head of Investor Relations. So we've got about 30 minutes together. Let's spend the first 20 or 25 minutes just doing some fireside chat, which I know is gonna be really fun, and then we'd love to make this interactive, so any questions just put up your hand, and we've got a mic runner in the back, so maybe with all of that as a starting point, Bipul, Kiran, thanks so much for being with us here today.
Our pleasure. Oh, thanks for having us.
Absolutely. You know, it's funny when last year you were here as a private company, so just very happy to see Rubrik here as a public company. Hopefully the first of many times here at the Barclays Conference. So you just completed your IPO back in April, very successful IPO. So maybe for the folks in the room who haven't had the pleasure, Bipul, can you just maybe give us a brief synopsis of Rubrik's business and the market you compete in? And Kiran, maybe you can offer us some financial highlights from the quarter you just reported last week.
So Rubrik is a data security company. We help businesses ensure business continuity against ransomware and other cyber attacks. So think about the history of cybersecurity. It has traditionally been focused on prevention of attack. And our thesis is you can't prevent the unpreventable. You need to have a cyber resilience strategy so that you are still up and running even when a successful cyber attack or breach happens to you. We are actually replacing backup and traditional backup and recovery products and transforming that into a data security platform to deliver cyber resilience. So we are in a replacement market, competing against legacy or legacy-like architectures. We have a very unique product that combines cyber recovery and DSPM on a single platform. And as a result, we are winning the vast majority of deals against competition.
Absolutely. Good starting point. Kiran, maybe?
Sure. We just reported our Q3 fiscal year 2025 results, and we are January fiscal year, right? So we're very pleased to report that we crossed $1 billion in ARR. It's a big milestone for the company.
It is.
We just crossed our 10th year birthday earlier this year. In terms of other metrics, our revenue growth was 43% year-over-year, subscription revenue 55%. We run the business from an operating leverage perspective on subscription ARR contribution margin. We're at -3%, over 1,100 basis points improvement from last year. We generated about $16 million in free cash flow.
Very helpful, guys. Very helpful overview. Bipul, maybe we can talk a little bit about the perception of the, you know, the quote-unquote backup industry. A lot of people think about backup, and they think of data replication, right? Having a spare copy of your data in case of an outage or someone mistakenly deletes something, right? That type of use case. But backup is becoming a little bit more of a security or CISO-level security priority as, as you've seen. What are some key drivers of that shift?
First of all, what has happened is that the cyber attack has changed in nature. It used to be a bored teenager sitting in the basement of their parents and showing middle finger to large corporations by doing denial of service attack, bring the website down, those kinds of things. But with the advent of crypto, Bitcoin, anonymity over these transactions, plus the digital transformation that has happened in the last five years and the ubiquity of data has really changed the cybersecurity game. Now whether it's nation-state actors or cyber criminals or financial criminals, they are going after the data as the core vector of attack. And they are encrypting data and asking for ransom against that data.
And this has changed the focus in terms of the customers from purely prevention of attacks to really making sure that their data is available and they can run their businesses so that hospitals can admit patients, banks can continue to dole out money, kids can go to school even when they are breached, the schools are breached. And that change required a change in the technology of backup and recovery because backup and recovery is not just needed for human error recovery or natural disaster recovery. It is now needed for cyber recovery. But cyber recovery is distinct from the old backup and recovery. And what Rubrik did was we created a unique architecture purpose-built to deliver cyber recovery. And we changed the use case of the product for this market.
Just like iPhone changed the use case of phone from calling and texting device to an internet device, Rubrik transformed backup and recovery from backup and recovery for human error or natural disaster to a cyber recovery, cyber resilience platform, and we are very unique in that aspect, and that's what has propelled Rubrik to a cybersecurity company being in the center of cyber resilience, and we are really creating the future of cybersecurity, which is truly the data security.
Absolutely. Definitely came through when we spoke to customers. A lot of CISOs involved in the purchase decision, so it makes a ton of sense. Kiran, maybe for you, can you just help contextualize where Rubrik kind of fits into the industry compared to other players out there? Maybe the way to delineate that is how much of your business comes from larger enterprise customers like Fortune 500, Global 2000? And also, how long is sort of a typical sales cycle for those types of customers?
Yeah. So as Bipul described, our product, strategy or what we provide is securing data across all different locations, whether it's in the cloud, within SaaS applications, whether it's in an enterprise, and whether it's structured or unstructured data. That gives us a very large market opportunity to execute towards. But where we focus from a customer-based, customer-sized perspective is truly in the enterprise. I would say mid-enterprise to the very largest, Global 2000, Fortune 500, Fortune 100. And in terms of our metrics we should report, we focus on the customers of scale, and that's the metric we report. That's the 100,000-plus customer count.
And that continues to grow well at 30% plus. We are well over 2,000 now. In terms of your sales cycles, for the complex high-value product we provide, our sales cycles are fairly short. It's about four months on the average, 120 days, but that is the average. And we have closed Fortune 100 transactions in weeks, and it's also taken more than a year, right? But the average is about 120 days.
Got it. Got it. Very helpful. Bipul, maybe, maybe just on that topic of the, of the industry at large, I mean, you know, this has been a market, and you referred to it earlier, this has been a market that's long been dominated by the likes of Dell EMC, Veritas, IBM. And, and those vendors are now considered legacy in this part of the market, in, in the data, data protection market. When you talk to customers, and I know you spend a lot of time with customers, when you talk to customers that want to switch off of legacy technology, which vendors are you typically displacing the, the most? And, and, and how much more share is there to go, right, in terms of, in terms of this disruption?
See, the backup and recovery market is as old as computing, and Veritas was built in 1983, and that's how old this industry is. That's how old these technologies are, so the dynamics of our market is similar to the ServiceNow ITSM dynamics. ITSM was a legacy platform, HP, BMC were supplying the software. ServiceNow came in and transformed the legacy ITSM into a business workflow platform to deliver digital transformation because that was the need of the hour. Rubrik did something similar.
We went after the legacy backup and recovery, transforming that into a data, a security platform to deliver cyber resilience and cyber recovery, then what happens is that whenever there is a transformation of the legacy platform, and we are an equal opportunity replacer. We are replacing Commvault, Veritas, EMC. We see it, we kill it.
Having said that, whenever there is a transformation, if a project, all the legacy vendors also come in and say, "We do this, we do that, we have a similar capability." They have all copied our message over time. But when the customers see Rubrik side by side, vast, vast majority of deals in a competitive side-by-side comparison, we win, is because we have a unique platform that is purpose-built for cyber recovery, and that combines not only cyber recovery but also data security posture management. And that unique architecture allows us to continue to innovate, deliver the fastest recovery to our customers, and give them the peace of mind that they can confidently do digital transformation without worrying about their services being down due to cyber attack.
You know, if we look back at last quarter's, last week's earnings call, one of the most interesting things I thought was the customer examples that you were giving. Almost all of them were talking about how you were backing up Azure or Salesforce or some sort of cloud product. And you know, I know that those, you know, a lot of the public cloud companies, right, like the AWSs or Azure of the world, have native backup tools or capabilities that they've built into the platform.
I think a lot of investors have rightfully questioned, like, "Hey, do you really need backup when the cloud is so pervasive and is such an incredible fallback?" I mean, I guess maybe the question is, how do you think about sort of the value proposition of using Rubrik to back up cloud data, right, instead of their native cloud provider, if that makes sense?
If you look at an average enterprise, they have three clouds and 10, 15, maybe 50 SaaS applications, and then they have on-premises, enterprise applications. And when the cyber attack happens, attackers are not thinking about SaaS versus cloud or GCP versus AWS or on-premises. The attack could happen in multiple of these places all at the same time. So if the customers have to turn 30 different knobs to be able to do cyber recovery, they'll never be able to recover. So everybody is looking for a single policy-driven, single control plane for data security and cyber recovery across all of their data.
And that's why they are switching to Rubrik because we have Rubrik Security Cloud as a single platform, single policy engine to orchestrate data recovery, cybersecurity, cyber resilience across all of the data estates irrespective of the locality of the data. That reduces the customer's risk. That delivers fastest recovery uniformly across all apps. You don't have to worry about how is my data retained in AWS versus GCP versus Azure versus SFDC versus M365 versus Oracle Database and SAP in their enterprise systems. You don't have to worry about it.
Single pane of glass, basically.
It's a single pane of glass, single control engine, single data threat engine. So if a threat actor is poking around with your M365 and the same threat actor is poking around with your SAP on-premises, we can real-time correlate the threat.
Got it. Kiran, maybe for you, I'd love to talk about just, I mean, the growth that you have from your existing customers. Can you just give us a little bit of insight? First of all, remind us what the net revenue retention here is, right? 'Cause I think that was a standout number last quarter. Can you just give us some insight into how much of that growth kind of comes from existing customers maybe adding more applications and data, right, to Bipul's point around sort of the breadth of coverage versus cross-selling your customers? Something I want to talk about a little bit more, right, which is security. I mean, I think, again, I think it was a very healthy NRR number. Talk to us a little bit about some of the drivers behind it.
Yeah. So we have a land and expand model, which is fairly common in SaaS software businesses. What makes it really unique in terms of our model is we have multiple different categories of land products across cloud, SaaS, enterprise, and unstructured data. In addition, DSPM is our fifth land product as well. And then each of these can be expansion vectors as well. So when you look into the NRR dynamic, the three contributors are obviously, in addition to a very strong gross retention rate, it is the data could grow. And when the data grows, your relationship with Rubrik grows. And then the new workloads could be brought under management as well. You start in the cloud. You want to now protect the SaaS application. That is application growth or application-related data growth.
The third vector, which you identified, is the security, data security application growth on top of that. They're all mutually reinforcing. You can go in different cycles around this, but they all, you could start with SaaS, go to cloud, and then you could add data security. You could start with cloud and data security, and then you could add a SaaS app. So they're mutually reinforcing that way. About a third of our NRR comes from the security applications, and that's something we have broken out. It grew for about a quarter last year. So that is growing in terms of contribution. The other two vectors are meaningful contributors, but we have not broken them apart, the other two-thirds.
Got it. You know, I think that's an interesting segue just into the there were two aspects of security here, Bipul, if you think about it. There's cyber recovery, right, backing up in a ransomware situation, for example. But then there's using the data that you look at and layering on more security on top of that, the data security. Talk to us about sort of the adoption that you see from customers, the willingness of customers to think about you as a vendor, not just a backup vendor, but also a data security vendor.
Our fundamental true north is cyber resilience and the basic assumption of cyber resilience is that you will get attacked. You can't prevent the unpreventable and if you assume that you will get attacked, how are you preparing for that attack, so you have to do three things. You have to understand data risk, that where is my data, what is the sensitivity of the data, who has access to the data, so that is the risk piece, then you need to understand data threat, which says who is doing actively poking around with my data. Is there a illegitimate access on the data by a legitimate user, which could be a credential compromise or dark web, somebody bought something from the dark web and now actively poking around and attacking.
And then the third piece is cyber recovery, that once the attack has happened, how do you recover and get back into business quickly. So if you think about these three distinct things, they are data risk, data threat, and cyber recovery. DSPM is our big product for data risk, data threat, and cyber recovery is our core. So what we do is we sell the DSPM separately, standalone, or we combine DSPM plus Enterprise Edition, which is a full cyber recovery together in a complete product. But the biggest observation here is Rubrik is the only cybersecurity company that has access to the business data. There's no other cybersecurity company that has access to the business data. When a cybersecurity company talks about data, they talk about syslog, access log, machine log, Splunk kind of data, not the core business data.
Our opportunity to make sure that this data is secure and what is happening to this data, if we continue to kind of enlighten our customers, we have a tremendous opportunity to continue to build the data security vector. We recently launched Annapurna, which allows us to open this data with the security built-in for businesses to use this data to build generative AI LLM applications in a secure and trusted way because everybody is just struggling with what if I send this data to LLM or AI app and then wrong people will have access to the wrong data. We are solving that in the input side of the equation at the origin. That's where it is solved because LLMs are so complex that you can't correlate input and output security.
So in many ways, we are at the heart of the most important real estate in the B2B, that is data. And opportunities are many. So we are not opportunity constrained like any good business. We need to ensure that we continue to keep the focus and true north on cyber resiliency, data, data security, data availability, data platform, data management, and continue to evolve ourselves.
Absolutely. You know, I want to come back to the AI part of the story here in a second. But, Kiran, maybe for you, I mean, I think we shifted to selling Rubrik Security Cloud around two years ago, if I remember correctly. And to Bipul's point, you sell different tiers based on what, whether a customer just wants, you know, straightforward sort of cyber resilience, if they want to layer on more security on top of that. Can you just talk to us about the different pricing tiers and what trends you're seeing in terms of customers adopting one versus the other?
Yep. So our core product offering, as you said, is Rubrik Security Cloud, and that could vary across different data as you're securing, but the offering is the core platform is Rubrik Security Cloud. Now within that, we have three additions or bundles at scale, which we have launched over the past few years. The basic is Foundation, which gives you basically zero trust data protection, immutable data.
It's already a big step up with any legacy product we are replacing, and then as you work your way up the tiers, the next is Business Edition, which gives you ransomware remediation, and then full cyber recovery is Enterprise Edition, so Enterprise Edition is the most advanced tier right now we have in the market at scale. That's about an 80% premium on list price to the Foundation tier. And in terms of adoption trends, obviously, as Bipul talked about, it's quite a bit of awareness about cyber risk around data. So, Enterprise Edition is almost half our new customers are directly landing on Enterprise Edition.
Right. Right, right, right. Bipul, I want to come back to, you know, to the AI part of the story here. And then, I mean, I think you touched on it a little bit, but maybe I'll ask the question a little bit more directly. How does AI become a revenue opportunity for Rubrik going forward?
We are an ambitious company, and we think about our business in three ways. So number one is whatever is working for us, how do we amplify that and supersize that? The second piece is that the things that we have incubated in the past, and if they are at a point that to be scaled, then how do we scale that? And then the third part of the equation is how do we create new products and services and find product market fit and discover pricing so that three to five years down the line, they become significant? So if you look at the cyber security capabilities, data security capabilities that we are selling Enterprise Edition today, we started working on them in 2016, 2017 because some of these visionary products take time to do market discovery, understanding, and we want to be a long-term company.
And so if we have to figure out today what we are going to do today that creates growth three to five years from now as we are enjoying the cybersecurity growth today. So Annapurna, which is our AI effort, is in that direction. So, so it is not at a point that we can even think about that as a model, as a revenue model. We need to discover the market. We need to educate the customer. We need to understand pricing, and we need to find product market fit messaging. So there's a lot of work ahead of us. But the opportunity is significant because everybody in the generative AI world is struggling with responsible AI, trusted AI, having the right data access to the right user.
How do we bring all the business data together in a single catalog, single platform to deliver it to the Gen AI apps? Because Gen AI apps are data hungry. And Rubrik is the natural next generation data lake with data security built into it. And we are doing reverse ETL to recover an app. We are opening another door on the same data.
Yep.
For generative AI through creating an embedding factory on top of our secure data.
So interesting. Kiran, maybe we can just shift over to some financial questions. I would love to talk a little bit about the subscription transition story here, which I know is a, you know, a fun discussion. Can you just remind us what stage we were in for this transition? And what are some of the milestones in the transition that we should look forward to?
Yeah. I'll clarify the two pieces within this transition. So the first is, you know, back in the day, about six, seven years back, we used to sell perpetual licenses, and there was a maintenance stream associated with that. Obviously, we don't sell that now for several years. So we're converting that legacy maintenance stream into subscription. And you're moving basically revenue from maintenance revenue to subscription revenue. That is largely behind us. We disclosed through the IPO process and S-1 and the past earnings the contribution to growth. And this past quarter is about two points of growth. And we believe that is close to done. In fact, in the modeling points for next year, we said we are not assuming any further benefit from that.
Now, the transition, which is still continuing, and we are reaching towards the end of it, but still have more to go, is within subscription itself, converting term licenses to cloud licenses or SaaS and this is what we launched in a significant way in August 2022 with the launch of Rubrik Security Cloud. Really pleased with the progress we have made so far. In terms of the contribution from SaaS, it's well over 70% of our total subscription ARR is cloud ARR, but as we have shared, our long-term goal is 80% plus, so we are approaching that and we'll give you an update when we achieve that milestone, but very pleased with where we are.
Yeah. Absolutely. You know, I'd love to the other part, I think, of the story we were talking about before, really what's been, I think the most surprising thing to me has been the margin story here as well, right? And, you know, we have a metric, ARR, subscription ARR contribution margin, which kind of strips out some of the noise from that transition. Can you just maybe help us understand what's driving that big improvement in contribution margin that you're seeing? And right, and really from a business perspective, financial perspective, and what it's going to take to get to break even next year?
Yeah. And that metric, you and I had discussed before we got into the IPO process. So thanks for all the help.
Of course.
In thinking through that, but that's our key operating leverage metric. We think about it as a proxy for operating margin and a leading indicator as we move through the cloud transformation because we go through a period where revenue was depressed, so it kind of depressed our operating margins. But contribution margin is the best way to look at it as because we run the business on ARR, and very pleased with the progression to date. Every each of our public quarters we reported stronger progression in ARR contribution margin versus the previous quarter as well as previous year. This most recent quarter it was - 3%, about 1,100 basis points up year-over-year, and this is not things we could just turn a light switch on and get the margin benefit. These were things we have been working hard at internally for years now.
I would say when I focus on the key investment areas, one is R&D and sales and marketing for software businesses. In terms of R&D, we have a global talent platform now, primarily India supplementing Palo Alto, and we hire world-class talent there. It was an investment which Bipul and the co-founders made very close to founding of the company. And today we hire more of our new engineers there than in Palo Alto. And that'll continue. So we get great talent for innovation while still getting some cost leverage as well. And then sales and marketing, which is the bigger area of investment, multiple I would say drivers for that in terms of the improving efficiency, in terms of the cost of acquisition, much more targeted in terms of marketing, in terms of driving productivity up for reps.
We are focused on delivering new products and also shaping the organization where we add. We shape the ratio so that when we add reps, we don't add as much resources around the reps as well. And then I'll also point out that we get some natural leverage in our model from the growth and renewals. Renewals is still a minority of our business, but it's very efficient. We don't have much incentives around renewals, and it's a fairly sticky business. And as it grows, it drives more sales and marketing leverage as well. So we expect some of these to continue. But at the same time, we give some modeling points for next year where we have said we expect to be break even or better on ARR contribution margin.
Absolutely. Absolutely. It's been great to see. Bipul, I want to, I want to ask you a competitive question, so you've got a competitor out there, right, Cohesity, that just closed the acquisition of the data protection business of Veritas, which, you know, which has been a share donor in the past and arguably continued, you know, continues to be so. The question is, how do you think this deal will impact the market as a whole, and how could it maybe impact the new business that Rubrik might otherwise be getting from these legacy customers looking to make a switch?
Look, not only Veritas is a share donor to Rubrik, but also Cohesity is a share donor to Rubrik. And, and if anything, this transaction we see, more positive for us because Veritas is a single product company, and they don't have a high leverage in their account. They are not like 10, 15 products and try to cross-subsidize. And if that single product is acquired by some other company and they are asking customer to switch the product, then customer will naturally think, "What else exists out there in the marketplace?" And, that will open up more opportunity for us, shake many of their customers loose. And so overall, we see that as positive. We have a strong, unique platform, and our win rate against both Cohesity as well as against Veritas is vast, vast, vast majority of deals that we win.
There is no comparison when it comes to side-by-side product. In terms of like opportunity, we see more opportunity with this. Obviously, for obvious reason, the customers will continue to. The two companies merging will continue to make noise that is so great. In the history of Silicon Valley, I've never heard, and I have used. I'm a capitalist. I used to be a venture investor. I've never seen a 10-year-old company buying a 40-year-old company and suddenly become a very successful company. Financial engineering don't create innovation. It's good to have excitement in the marketplace. We are changing this marketplace, transitioning this market. People are trying to merge with each other to survive, and we'll see how it goes.
Absolutely. And this is a big market as well, right? And there's plenty of share gains to be had from others as well. Bipul, maybe the question I'd like to ask you and one of the ones that we're trying to ask for in a lot of our sessions is, I know you spend a lot of time with customers. How do you sort of feel about the health of spending in this data protection area in calendar 2025? Just sort of feeling on the ground, if you will.
Look, I mean, the Rubrik has this fortunate situation to have this secular market trend around cyber and cyber recovery. Cyber attacks are not abating. If you think about the new administration, it's going to be a very business-focused administration. A little bit of a deregulatory effect in the business will lead to more business investment because the top line will have, will be healthier. And when your businesses expand, you have more data in more places, more cyber attack, industrial espionage, IP theft.
So if anything, we believe that Rubrik is positioned well in the right market. Obviously, like any other business, we'll be very prudent in terms of where we invest and how do we create ROI from our investments. Again, as I said, I'm a capitalist. I love cash flow. I love profitability. We are here to not only capture the market opportunity, but really create a long-term profitable business, and we'll make sure that we have the right balance of capturing the market opportunity and trying to fast grow as fast as possible while ensuring that we have a profitable growth along the way.
I couldn't think of a better way to end that session on that. So with that, let me thank Bipul and Kiran. Thanks so much for being with us here today.
Thank you, sir.
Was it okay?