Okay. All set.
All right.
Okay. Excellent. Well, hey, good morning, everyone. Welcome to day one of the Barclays Tech Conference. My name is Saket Kalia. I cover software here. Honored to have with us the team here from Rubrik. We've got Bipul Sinha, CEO.
Don't let it go downhill from here.
Bipul Sinha, CEO, as well as Kiran Choudary, CFO. We've also got Head of Investor Relations, Melissa Franchi, somewhere here in the back. Yep.
Yes.
There in the back. Just to frame today's time, we've got about 30 minutes together. Let's take the first 20 minutes or so and do some fireside chat, which I know is gonna be fun with these guys. But then, listen, there's a lot going on with the business. We'd love to make it interactive. If you've got any questions, just pop up your hand and we'll get a mic runner going around. So maybe with that, Bipul, Kiran, thanks so much for being with us here today.
Thank you.
Wouldn't be a tech conference without you.
No, I know.
You know, maybe just to start off with you, Bipul, I think an increasing number of investors are familiar with Rubrik. But maybe for those that aren't, can you just give us a brief description of Rubrik's market opportunity? And Kiran, maybe just to follow up on that, can you just give us some of the financial highlights from the last quarter that you were most proud of?
Hi everyone. Good morning. My name is Bipul Sinha, co-founder, chairman, CEO of Rubrik. I'm an engineer turned venture capitalist turned entrepreneur. There are not too many of us in Silicon Valley. We started Rubrik with this vision to really deliver Cyber Resilience, cyber recovery to every company and government around the world because cyber disaster was the number one disaster for any business, and it threatens the fundamental existence of the business, and then over time, we evolved into a full-fledged data and identity Cyber Resilience platform, and now we launched a whole new product suite, a completely new platform called Rubrik Agent Cloud, which is in beta, which is around securing and accelerating agentic work adoption within enterprises and organizations.
Essentially, give our customer confidence that they will understand how many agents do they have sanctioned and unsanctioned in the company, what the hell are they doing, do they have guardrail with respect to what is allowed and not allowed for them, and should they misbehave either because of hallucination or cyber compromise, can we undo or rewind the agentic action. So essentially, Rubrik as of today is the security and AI operations company, and our goal is to deliver Cyber Resilience as well as AI acceleration to every organization around the world.
Such a helpful starting point, Kiran. Maybe some of the financial highlights that you wanna make sure we all have as sort of a.
Sure. So again, thanks for having us here, and good morning, everybody. So in terms of the highlights and we just reported last week and we had a very strong quarter. The two things I wanted to highlight specifically were we had a record quarter in net new ERR, $94 million, which resulted in $1.35 billion of ERR, growing 34%, which is strong growth at scale. And then in terms of profitability, we measured profitability in terms of subscription ERR contribution margin. We improved quarter-over-quarter and significantly year-over-year to over 10%. And then we had a record free cash flow quarter over $75 million plus this quarter. So some of the highlights there. All of this with strong net new ERR, net retention rate of 120% + and strong customer growth as well.
Yeah. Absolutely. There was a lot to really be proud of last quarter. Bipul, I wanna zoom out a little bit on the industry with you, kinda getting right into it. I mean, this has been a market that's been long dominated, right, by the likes of Dell and Veritas and IBM Tivoli, which are, you know, now quote-unquote legacy players in this market. On your last earnings call, I think one of the most interesting takeaways was you talked about the bookings from legacy displacements actually accelerating, so maybe the question is, can you dig into what's causing that? And I think relatedly, talk about how much more legacy displacement is there to go?
And speaking specifically just in the Cyber Resilience piece, there's a lot to talk about in the other pieces, in the other two pillars, but in Cyber Resilience piece specifically.
I love legacy because it's a very meaty market that you can go eat into. Because if you look at the history of Silicon Valley and history of large companies, you will be hard-pressed to find one company in the enterprise space that became massive by creating new markets. Snowflake went and replaced legacy Teradata and others. If you look at CrowdStrike, they went and replaced legacy antivirus. And that is where the large companies are created because you have existing buyers, existing budget, existing cycle, and do you have a magical differentiated unique product that you bring to this game? And Rubrik has been winning because we purpose-built Rubrik Security Cloud Platform to deliver complete Cyber Resilience. At the time when we went public, we said we are operating in a $50 billion market. This was before identity. So and we are just over a billion.
So we are not even scratching the surface. We are very, very early in this market. This is a massive market because any pro, any company and any government with any application or data of any significance is a potential Rubrik customer, if not already a Rubrik customer. So it's a large market. What happened was we really disrupted this market with this new cyber recovery, Cyber Resilience angle. And whenever you disrupt the market, existing players run for shelter. And what you saw in iPhone and Nokia was Nokia was acquired by Microsoft. Same thing, similar thing happened here where Cohesity and Veritas merged to survive.
And all the customers of Veritas heard that, "Hey, we'll have two product lines and two engineering teams, and all your roadmaps will be managed and maintained." But you can't take $2.5 billion in debt, and this whole merger is to preserve and create synergy with 90% overlap. You can't maintain two things. So now the customers, and this is all anecdotal, but they're now these Veritas customers and other legacy customers are realizing that's not tenable. And that's the reason that we are seeing increased pipe build and increased success in Q3 because of legacy replacement.
Excellent. Excellent. Kiran, I, I wanna move to you for a second. I mean, you know, we've talked about sort of Rubrik Security Cloud or RSC, which I think makes up almost 90% of, of the total ERR of the business, but there's also an on-premises business here, which has been shifting to SaaS. It feels like that shift is accelerating a little bit, and you correct me there if I'm wrong. I think we saw just a little bit of a, a bigger decline in on-prem, ERR these last couple of quarters. Maybe the question for you is, how do you think about the path of that on-prem ERR, and, and when does that maybe start to stabilize a bit?
Yeah. Absolutely, so I'll give you a little bit of background on the cloud as cloud as well. We started our cloud transformation in a significant way, if you recall, three years back with the launch of Rubrik Security Cloud. And the vision was really to secure all data regardless of where it's at, within private data centers, cloud, native cloud applications, SaaS applications, unstructured data, all from the Rubrik Security Cloud Platform running in the cloud, and when we started this journey, you know, at that time, we felt like 80% of sub-ARR becoming cloud is a good long-term goal because there's obviously a healthy opportunity of customers who prefer not to be in the cloud and can completely self-host. We were surprised by the pace of progression. And as you pointed out, we are in the high 80s as a percentage of cloud.
So, one part, the significant part of the cloud growth is obviously new business from new customers or customers expanding into cloud workloads. But obviously, the non-cloud ERR also was a contributor because as customers migrated from the on-prem world to the cloud managed world, the data could still sit on-prem, but cloud managed world, they moved into the cloud ERR bucket. So, that's the reason why it's declining and continues to decline. And we believe that, it's hard to predict exactly, but it should decline for a few more quarters because we feel cloud ERR can run a bit more as a percentage of sub-ERR beyond where it is right now. But at the same time, there's a healthy base of customers who prefer to still self-host. And we feel once it stabilizes, it should grow from there.
Yep. Absolutely. Bipul, maybe to come back to you, I mean, we've talked about Cyber Resilience being a big market. We've talked about sort of the legacy displacements picking up there. And that's really the first pillar of the business. I wanna touch on the second pillar a little bit, which is around identity protection. I think the other interesting takeaway from the earnings call was we said that's now a $20 million ERR business, I think just after three quarters of being generally available. And you correct me there if I'm wrong. Maybe the first question is, what pain point is that solving, right? We think about identity and we think about IDPs, right? But this isn't exactly that. This is identity protection . But relatedly, historically, the spend, historically, the spending there has been relatively small in this identity protection space.
Why do you think that's maybe changing now?
So identity has become a huge, a huge attack vector. Attackers are not hacking in anymore. They are logging in. They are behind firewall, behind VPC. And identity compromise has been, and if you go read Scattered Spider or Brickstorm or every new attacks that are happening, it's all identity-based attacks. And these attacks are very insidious because they are bypassing traditional EDR. They are encrypting VM level. And so they are like very smart attackers are now using identity as a vector to do massive, massive damage. And this is a trend that we have been observing. So that the ground zero for identity is your Active Directory, your Entra ID, your Okta, and other identity systems. And customers need to protect those identity systems. And that's the market that we focused on.
What is very exciting for me as a founder CEO of Rubrik is we organically built a product from scratch without any acquisition and took it to GA in December last year. So we are literally selling for three quarters. We are in the middle of the fourth quarter. And in three quarters selling, after the end of the second quarter, we said we have over 200 customers in the Identity Recovery business. That was the first step, the version one of the identity solution. And then in July, we launched identity resilience, which is the next tier of identity solution above Identity Recovery. And in just Q3, we more than doubled, which means that now we have more than 400 customers in the identity solution overall. And the new identity resilience business, we sold in one quarter 65 transactions.
And what is also very exciting is not only we are about $20 million ERR in overall identity solution, 40%, four zero, of customers that adopted our identity solution were net new to Rubrik. And what we are running into in this market, and that's what we anticipated, is there is a legacy replacement also in this market. And you'll see in my life, legacy is very important. I always love to go after markets that are understood and budget is allocated so that you can take the line item and swizzle that into something magical. And that's what we did. So we are replacing Quest. We are replacing new gen vendor, called Semperis. There's a lot of white space because now the understanding of the identity-based attacks have become common, and customers are more and more focused on identity.
So overall, very early days, obviously a lot of work for us to do to scale this whole identity resilience pillar of our business, but very, very exciting market.
Yes. Very much early days. Kiran, I wanna go back to the on-prem topic of conversation a little bit, and what you said is a little bit of this decline or a lot of the decline that we're seeing in that on-prem ERR base is conversion. Can we just talk about the economics of a conversion? You know, is it one-to-one or is there an uplift as an on-prem customer moves to SaaS because, you know, a little open-ended, right?
Yes.
How do you think about those?
There's no real uplift. The goal, and what we are trying to achieve when we start the cloud transformation was customers who are comfortable using the cloud, which is the vast majority of the customer base today. We want them to successfully move to the cloud and see value because that's where the most innovation from our side would be, so we didn't wanna make it about a price increase and made it easy to move and reduce friction, so if you're moving to a comparable feature set, there's no real price increase there. Obviously, if you're upgrading as part of the change, right, you're gonna have a new license or subscription. It's an opportunity to sell more capabilities, and if that's the case, obviously there's a price uplift because you're getting more value, but if you're moving to a similar feature set, there is no increase.
Got it.
As a philosophy, we are a premium product company. We charge premium pricing for our product, but we do not willy-nilly charge our customers for things that doesn't create extra value for them, so if they manage their platform on SaaS, it's the same data protection solution that they are using, and we don't believe in charging for it. In fact, in many ways, from the early days of Rubrik, we never charge based on application sources or data types, so legacy platforms will charge more for Oracle Database and less for VMware. We never did that because our goal is to provide our customers full understanding and predictability of their data protection posture, their identity resilience posture, simplicity, not just in the product but in the buying process, and everyday use and expansion is equally important for us.
Well, I was gonna say, right, with over 120% NRR, right, like we don't necessarily need the price. There's so much more that we can cross-sell them as well as data growth naturally, right, to kind of grow that spending. So I think that philosophy makes sense. Bipul, we talked about cyber zones. We talked about Identity Recovery and Resilience. I wanna touch on the third pillar here, which is a growing AI story. You know, I think we announced Annapurna just about a year ago. And now we've got Agent Cloud for monitoring and rewinding the changes that agents can make. You know, this is really kind of a, you know, a third act, right, like that is maybe several years out.
But maybe the question for you is, how big of an opportunity is this in your view, Bipul? And most importantly, why do you think Rubrik has a right to win in this space?
If you boil everything down, Rubrik is about data, identity, and applications. That's what we are selling, the Rubrik Security Cloud, to deliver resilience for both data and identity. What we realized was that we are, by our nature, a secure data lake. So what we did was we created this Annapurna platform to give this data to our customers. But what we were realizing was that our customers are not programmers. And so if giving them a technology is not very helpful to them, we need to give them a solution that they can deploy and use because we are selling it to the IT department. So we started to think about what is a great middleware solution in AI that can change the game for us.
And we came across this company called Predibase, which they were doing model fine-tuning and GPU virtualization to reduce the cost of inference by multiplexing different models on the same GPU. And we saw that company and said, "Voilà, I mean, this is really, a very interesting long-term strategy for us." And the whole market was confused that why are we buying a model infrastructure company? If you look at the cybersecurity industry, the whole industry, nobody has a model infrastructure or model engineers. They typically buy AI security, which is the same security software applied to AI. But fundamentally, it's rethinking operations of AI. Nobody has expertise because cybersecurity companies, you go there, authenticate, get a token, and then roam around. They have no idea, cybersecurity companies, what you are actually doing. But Rubrik sits at the intersection of data and security.
And that's where we saw Predibase being the operational platform. So we convinced the founder. It took me nine months to convince him to sell the company because the company was getting very interesting traction. And then bring that inside and reformulate that platform as Rubrik Agent Cloud. And Rubrik Agent Cloud is about securing and accelerating agentic adoption at a scale. What does that mean? First of all, everybody wants to understand how many agents do I have sanctioned as well as unsanctioned. So we give you the agent registry. Then we tell you what these agents are actually doing because we are in the operational path, and we are telling you what actual operations these agents are doing. So we have the observability. The second piece is governance. So think about it.
You hire an employee, you give them a handbook saying that, "Hey, don't harass people. Don't go to the left side of the building because that's an executive suite." So these are like general purpose guidelines. How do they enforce a general purpose guideline across the whole agentic landscape? And then the third layer kick is, how do you enforce a specific guideline for a specific work, agentic work? If somebody's in marketing, do this and not do that. So we created this whole framework about creating guardrail for agentic work. And Predibase had model fine-tuning. So if the agents are not responding with the right answer, you can actually increase the accuracy by taking data. Again, Rubrik has the data to fine-tune the model.
And then finally, agent could still misbehave because somebody sitting in North Korea could compromise your agent and run your customer refund process a million times and make you bankrupt. How do you find out what is happening and undo those actions? So we provided a rewind button. So our view is that for agentic work in the enterprise, you need actually an infrastructure platform that sits at the intersection of security and operation because for every call that agents are making, you need to dynamically authorize whether it's allowed or not. And so we build this whole end-to-end platform. So we have a very big long-term vision, very, very early days for us. We are still in the beta. Our first release is not too far in the future. We are getting very, very positive and encouraging feedback. I'm a capitalist. I don't like encouragement.
I like dollars, so we don't have dollars yet, but we're very, very excited about this opportunity.
Well, you're sitting with a very sympathetic crew. So, Kiran, maybe for you, you know, the sales force Compensation Model, I think changed this year. I think we moved from a six-month quota to an annual quota. Can we just touch on, 'cause that's just been a little topical, and of course, any change is something that's worth highlighting. Can you just talk about how it's changed the seasonality of net new ARR, if at all, and how we should be thinking about that seasonality going into Q4?
Yeah. So obviously, we made that change earlier this year. It was a long time coming. We had looked at other companies at a billion-plus ARR scale. We had hired leaders who had worked at, operated at that scale. And annual model is more something we are more familiar with at that scale. We didn't wanna do it the year we went public last year. It's a big change. So we waited that. We finished the first year, crossed a billion ARR, and then launched it this year. And it's progressed pretty well. If you look at the three quarters in terms of results and how it's gone down in terms of adoption within the sales team, it's been pretty strong. But we'll have to finish the year up to have our first internal data set in terms of how it affects linearity.
But so far, it's been pretty good. And really on the back of that is we raised the net new ARR guide for Q4.
Absolutely.
I'll add one thing, please. Obviously, we are a public company, and quarter after quarter, everybody obsessed about how we are doing. But the way we run our company is on annual basis. So we plan net new ARR annually, and then we see how the quarter turn out because, you know, deal dynamics, things go slip, come forward, backward. And that's why we always focus on yearly ARR number. And that's one of the reasons that we switched into the yearly number for the sales team because we wanted to align how we run the business internally with how we compensate the sales team.
That's a great perspective, and it makes a ton of sense. I wanna move to some questions just around ARR and revenue, kind of broad brushes for the year. But before we do that, any questions here from the audience? One there in the back, if we can just move the mic over.
Great. Can you guys hear me okay?
We can.
Excellent. First, congrats on the good execution. It's impressive. As we sit here today and you're talking to your customers about budgetary dollars available going into 2026, what is your thinking with respect to more budget, about the same, less budget? Just love some high-level color.
So as I said on the earnings call, or one of the interviews that I did, we are in the very unique part of the cybersecurity market, which is around Cyber Resilience. And we are not seeing any change in the demand environment for our product or our market. The issue is that the customers around the world have spent a lot of dollars in the prevention and detection solution. And going from one prevention detection to the next prevention detection, from one firewall to the next or one other solution to the next, maybe the best change there will be was 2%-3%. But not having Cyber Resilience and not ready for cyber attacks and to recover from it and having a cyber attack, recovery solution is like 10, 20, 30% shift in their posture of cybersecurity strategy.
So this is the most exciting market we believe in the cybersecurity space. We are still scratching the surface, and it's a, it's a large market with very large latent need. Obviously, our job is to continue to educate this market, educate customers, educate, educate executives. But, we believe that, we have a lot of opportunity. We are not opportunity constrained, if I can say that.
Any follow-ups here? Maybe going on that point, Kiran, maybe for you. I don't wanna spend the last few minutes on accounting dynamics necessarily. I think a lot of us understand the material rights point. But you've been very clear from the beginning of the year, right, that material rights impacts the revenue comp, right, for next year. It does not impact ARR. But you gave some really helpful broad brushes in this call in terms of how to think about the relative growth rates between the two, conceptually, right, but so maybe just for the benefit of everybody, can you just remind us what you've said as we sort of fine-tune our models going into next year?
Sure, Saket. So as a reminder for everybody, we've said this many times, we run the business on subscription ARR. That's the primary metric in which we measure growth, momentum, incentivize our employees, and obviously celebrate that, as well as we cross milestones. At the same time, revenue is a key line item in the P&L. So we wanted to provide some more perspective in terms of the accounting nuances related to the late stage of the cloud transformation we have successfully progressed over the past few years. You know, one of the earlier questions was on the Rubrik Security Cloud launch a few years back. As part of that, we also exited the legacy commodity hardware business we were in. And, you know, we didn't build hardware.
It was something from partners we would provide and package to customers to drive fast growth as a newcomer into the market, but once we started our cloud transformation, it didn't make sense for us to be in the business, but when we exited that business, we also wanted to do right by our customers, and those customers who had purchased in the past, thinking they would get some free hardware and hardware-related incentives when they were to renew at a certain term length, even though it was not a contractual obligation, we wanted to give them some credits in lieu to make the transition or transformation more easier.
And that is accounting-wise dealt with as material rights, which is basically revenue is carved out, put on your balance sheet, and at the time of renewal, the those credits expire or get used, and the revenue is released from the balance sheet into the revenue base. So for a while, it was a headwind to revenue growth. And then in the past five quarters, so it's been a tailwind. And, you know, we have disclosed every quarter the impact we are getting from material rights. But we've been more explicit as of the recent quarter in terms of even calculating the math on the normalized growth rate without the material rights. But, given that it's a significant headwind, tailwind this year because most of the release is happening, just mathematically, it'll be a headwind next year. And we wanted to give the guardrails.
We're not providing guidance this last week, but we'll provide that after the quarter ends. But we mentioned that reported revenue growth will lag ARR growth by a few points. But when you normalize, which is the clean way to look at it, as you would expect, it would be ahead of ARR growth. So just thinking about that because we were looking at, it's complicated. It's nuanced. As people were modeling it from analyst community, investor side, we wanna just provide that clarity for you.
Absolutely. Take a look at our note for some of the estimates that we put around it. Hopefully, if that can be helpful. In the last minute or two that we've got here, I wanna wrap up here with Bipul. You know, Bipul, visionary CEOs like you tend to think about acts two and three earlier than most, right? And so, as we think about sitting here together again next year at this time, right, what are some of the milestones that you wanna be talking about with Identity, with Agentic, as we kinda go through the next year? Open-ended question.
We always think about a year in three things, right? Top-line growth, innovation, and profitability. And these are the three things that are consistent for our company because you can't just grow top-line and not have profitability, or you can't just milk your existing product and not innovate. So we always think of this trifecta. And we are focused on that trifecta internally. We'll continue to be focused on that trifecta externally.
Couldn't think of a better way to end right there. Bipul, Kiran, thank you so much for the time. I appreciate it.
Thank you, Saket. Thank you.
Of course.
Thank you.