Rubrik, Inc. (RBRK) Earnings

Management highlights

### Market Context & Strategic Positioning - The rise of agentic AI has created a new cybersecurity reality: AI-powered autonomous attacks can breach systems faster than traditional detection/prevention tools can respond, and agentic AI running business workflows can cause catastrophic damage if compromised. Prevention and detection alone are no longer sufficient; cyber resilience (preemptive assessment, real-time guardrails, and fast machine-speed recovery) is now the fundamental cybersecurity requirement for the AI era. - The Mythos AI attack model was a major industry wake-up call that has accelerated customer demand for cyber resilience solutions, directly driving the upward revision to full-year guidance. Rubrik has invested in agentic cyber resilience capabilities for years and is uniquely positioned to address this new market need. - Rubrik has partnered with Anthropic's Project GlassWing to gain early access to the Claude Mythos Research Preview, to develop capabilities that help customers prepare for AI-powered breaches. ### Product Portfolio & Platform Advantages - Rubrik operates a unified platform with two core solution suites: Rubrik Security Cloud for cyber resilience, and Rubrik Agent Cloud for trusted AI transformation. The platform leverages complementary network effects, where each new product increases the value of all existing products, creating increasing customer stickiness. - Rubrik Security Cloud (RSC) aggregates time-series data and metadata across on-premises, sovereign cloud, public cloud, SaaS, and identity environments, giving it unmatched enterprise context. Its proprietary preemptive recovery engine pre-calculates clean recovery points before an attack occurs, enabling record-fast recovery that competitors cannot match. RSC continues to win large legacy displacement deals from fragmented point solutions. - Identity resilience products are gaining strong momentum, extending Rubrik's reach beyond traditional CIO/CTO buyers to CISOs, and disrupting the legacy identity protection market. The segment benefits from rising identity-based attack volumes. - Rubrik Agent Cloud (RAC) is a comprehensive AI operations platform designed to govern agentic AI, providing unified visibility into all sanctioned/unsanctioned agents, real-time policy-aligned guardrails, and a "rewind" capability to undo destructive agent actions. RAC leverages AI technology from Rubrik's Predibase acquisition to power its Semantic AI Governance Engine (SAGE), the first purpose-built real-time governance engine for autonomous agents. Early proof-of-concept projects are already converting to production deployments with regulated enterprise customers. ### Operational Performance Highlights - Rubrik achieved a record Q1, exceeding all guided top-line and profitability metrics. Key highlights include 32% YoY subscription ARR growth, 41% YoY subscription revenue growth, a 120% subscription net retention rate (NRR), 500+ basis points of YoY improvement in subscription ARR contribution margin, and $74 million in Q1 free cash flow. - The cloud transition is nearly complete, with minimal remaining material rights revenue from the transition expected in coming quarters.

Guidance

- Management raised full-year fiscal 2027 guidance based on strong Q1 execution and increased market demand for cyber resilience driven by AI-related risks. - For Q2 FY27: Expected total revenue of $395 million to $397 million, representing 27% to 28% YoY growth. $3 million to $4 million of Q2 revenue will come from remaining cloud transformation material rights. Non-GAAP subscription ARR contribution margin is expected to be 11% to 12%, and non-GAAP EPS is expected to be 3 to 5 cents. - For full-year FY27: Expected subscription ARR of $1.854 billion to $1.862 billion, representing ~27% YoY growth. Expected total revenue of $1.638 billion to $1.648 billion, with ~$17 million of total revenue coming from remaining cloud transformation material rights. Total revenue growth, when normalized for material rights, is expected to outpace subscription ARR growth. - Full-year FY27 profitability guidance: Non-GAAP subscription ARR contribution margin is expected to be approximately 14%, non-GAAP EPS is expected to be 25 to 35 cents, and free cash flow is expected to be $293 million to $303 million. - Management plans to continue targeted operational investments: accelerating R&D for cybersecurity and AI innovation, and expanding go-to-market capacity in high-ROI regions and verticals, with a specific focus on scaling the newer identity resilience and Rubrik Agent Cloud offerings.

Segment performance

Rubrik reports financial performance across its core business segments: 1. Subscription Business: Total subscription ARR reached $1.57 billion, growing 32% year-over-year. Net new subscription ARR hit $103 million, a Q1 record. Cloud ARR (included in total subscription ARR) reached $1.39 billion, growing 43% year-over-year, and now accounts for 89% of total subscription ARR as the cloud transition nears completion. Non-cloud (self-hosted/on-premises) ARR stabilized this quarter after sequential declines during the cloud migration period, and is now expected to see mild growth driven by demand for sovereign infrastructure solutions. 2. Identity Resilience: The identity segment grew 38% sequentially quarter-over-quarter, reaching over $50 million in subscription ARR in Q1 FY27. 3. Geographic: Total revenue was $387 million, growing 39% year-over-year. Revenue from the Americas grew 38% to $279 million, while revenue from outside the Americas grew 43% to $108 million. 4. Customer Segments: Customers with $100K or more in annual subscription ARR reached 2,946, growing 24% year-over-year, and contribute 88% of total subscription ARR. Customers with $1 million or more in ARR grew over 50% year-over-year. 5. Profitability: Non-GAAP gross margin hit 82.9%, up 240 basis points year-over-year. Trailing 12-month subscription ARR contribution margin was 13.2%, up over 500 basis points year-over-year. Free cash flow reached $74 million, up from $33 million in the year-ago quarter.

Risks & headwinds

- AI-powered autonomous attacks increase the potential for widespread operational disruption and financial loss for customers, raising the stakes for effective cyber resilience, but also increasing demand for Rubrik's solutions. - Agentic AI running business workflows introduces new risks of unauthorized data access, data leakage, and unintended destructive action that require new governance capabilities, which Rubrik has built into Rubrik Agent Cloud. - Geopolitical trends and data sovereignty requirements may increase demand for on-premises/self-hosted solutions, which Rubrik is positioned to accommodate after the stabilization of its non-cloud ARR. - Actual results may differ materially from forward-looking guidance due to market and competitive changes, which are detailed in Rubrik's SEC filings.

Analyst Q&A

• Q: How are current hardware market dynamics impacting Rubrik's customer buying behavior and business? /

  A: As a software-only company with a diversified portfolio that is now majority cloud, SaaS, and identity solutions, Rubrik sees no material impact from hardware market changes. On-premises data protection is now a relatively small portion of the business. Sales cycles have remained stable over the past several quarters, and management remains confident in its outlook based on current pipeline and platform momentum. Customers bear hardware costs for on-premises deployments, and most already have long-term contracts with server vendors, so hardware price changes do not impact Rubrik's financial performance. Cyber resilience is now a top non-discretionary priority for enterprises, outweighing any incremental infrastructure cost concerns.

• Q: With AI increasing cyber risk, will cyber resilience become a larger enterprise budget line item, and how will Rubrik's role evolve as enterprises adopt agentic AI? /

  A: Cyber security strategy has already shifted from a focus on prevention and detection to a core focus on cyber resilience, and AI-powered attack models like Mythos have drastically accelerated this shift. Analysts like Gartner now confirm cyber resilience is a mandatory requirement for the AI era, as AI-powered attacks make detection nearly impossible. Rubrik launched its preemptive recovery engine two years ago, which calculates clean recovery points before an attack occurs, enabling AI-speed recovery when a breach happens. Post-Mythos, customer interest has surged, with Bipul Sinha holding 140 CIO/CISO meetings in Q1, up 50% sequentially. Rubrik is positioned as the category creator for agentic cyber resilience, shifting from a "backup insurance" role to a core operational foundation for safe AI adoption.

• Q: Multiple vendors claim they will be the AI control plane for agentic AI. Why is Rubrik positioned to lead this market against competitors like ServiceNow? /

  A: Many competitors only offer partial capabilities, such as observability or posture management, but comprehensive agentic security requires end-to-end functionality: monitoring, real-time guardrails, and the ability to undo destructive agent actions (rewind) to restore systems to a clean state. Rubrik offers the only comprehensive platform that delivers all three core capabilities. For example, a US financial services customer adopted Rubrik Agent Cloud this quarter because it addressed their core concerns: the ability to roll back harmful actions from compromised or hallucinating agents, which no competing point solution offered. This end-to-end comprehensiveness is why Rubrik is winning early production deals.

• Q: What is the competitive landscape for Rubrik Agent Cloud, and why is Rubrik's approach resonating with early customers? /

  A: Early in this new market, vendors are approaching AI agent governance from many different angles: observability, identity, posture management, and shadow IT. However, customers consistently report they do not want to stitch together multiple point solutions for full agentic security. Following the pattern of cloud security, where platforms won out over fragmented point solutions, Rubrik offers a single end-to-end platform covering observability, identity posture, real-time security, and rewind. Combined with AI governance technology from the Predibase acquisition and Rubrik's legacy recovery capabilities, Rubrik has the most comprehensive solution in the market, which is driving early deal wins.

• Q: Why was on-premises ARR stronger than expected this quarter, and how should we expect non-cloud ARR to trend going forward? /

  A: After sequential declines during the cloud migration period, non-cloud ARR has now stabilized, and is expected to see gradual growth going forward. There is a small but steady demand for self-hosted solutions from government clients, three-letter agencies, and other industries. Additionally, growing demand for sovereign infrastructure driven by data locality and geopolitical trends in Europe and the Middle East is boosting demand for non-cloud deployments. There may still be minor quarter-to-quarter volatility from remaining small-scale migrations, but the multi-year trend for non-cloud ARR is now upward.