Rubrik, Inc. (RBRK) Earnings Call Transcript & Summary

It is so quiet. We are going to raise the entropy with this young man, the best-dressed CEO in tech at this conference.

Are you gonna sing for us?

I may if it's not a webcast.

I have to keep up with you.

I have been outdone even despite my trying. So welcome to day 4 of this conference. How has it been for everybody? Been good? Amazing, right? I'm going to be so depressed at [ 12 ]. I mean this has been such a high to see us all come together, and thank you for investing your time with us. And the stars of the show, Rubrik. I have to tell you that, Bipul, when I first met you, it was 2013. I don't think you had a PowerPoint presentation, but you had a whiteboard. I don't know if you remember.

I had a long whiteboard.

You had a big whiteboard and I said, "Can you tell me what you do?" And you said, "Okay, so let me take this whiteboard." And 11 years later, you're now a public company. And we had to, at our fireside chats when you're a private company or a private software company conference and it was just -- it's been just so fulfilling to follow you, your idea, your company from a very, very early stage. So I cannot tell you how gratifying it is to see you guys as a public company to be able to host you on stage here. So with that very long pre-ample introduction, welcome to the conference officially.

Thank you.

Kiran Choudary, also welcome to the conference. Kiran's a -- I should say, Kiran, welcome back to Goldman because you used to work at Goldman in software banking. So glad to have you back as well.

Thank you.

And we'll get to questions for Kiran in a second. Bipul, give us your background, how do you start this company? What was the aha moment that led to the founding of this technology?

First of all, Kash, thank you so much for this opportunity, and thank you so much for being a believer in Rubrik from early days when we got literally new employees and just an idea and a whiteboard. My background is -- Bipul Sinha, Co-Founder, CEO of Rubrik. My background is I'm an engineer turned, venture capitalist turned entrepreneur. There are very few of us who went from engineering to starting and running a company now as a public company. That is -- definitely gives me some advantage to think about technology, how technology trends are and also being a venture background, it gives me the ability to see where the new shoots are emerging and where the market could move in the 3 to 5 years from today. And because of the 2 things when I was in venture capital, I felt like I'm not utilizing everything that I have. And I'm too young to be a VC and sit on the Board and take the company's public. But I decide to leave venture capital to start Rubrik. And the opportunity I saw was that there is a way to transform this old and dilapidated backup and recovery market into a data security platform to deliver cyber resilience. And with that vision, I left Lightspeed where I was a partner to start Rubrik. And our goal was to build a company that is lasting longer than my professional life and career. We wanted to build a generational company, an enduring institution. And the core of the enduring institution was about innovation, delighting our customers, driving agenda of the market forward, transforming the markets as opposed to getting transformed by the market. And we are still on that journey, still early. I mean, in my mind, company's lives are in decades. And we just finished the first decade, and we are entering a new decade as a public company. But it's still very early of what's to come in for Rubrik.

So tell us -- I know that you had a few pivots during your course as a private company. I don't know if you invented the category cyber resilience, did you or -- it doesn't matter, but tell us what these new categories that you created or helped create.

When I started to think about Rubrik and how we're going to transform backup and recovery, what occurred to me was that whereas human error and natural disaster doesn't happen every day, but the cyber disasters are happening every day. But the architecture of the backup and recovery classic legacy platforms was not built for cyber. But this was going to be the biggest use case, and I bet the whole company on that thesis. That's why we combined the different software, hardware platforms to create a brand-new software conceptually to deliver to this new market. And the analogy that I thought about was that if you look at the cell phone market, it went from texting and calling device to an Internet device from BlackBerry to iPhone. And I felt like backup and recovery market was in the BlackBerry stage, whereas they were not using or not delivering the cyber resilience, cyber recovery as the future. So I started to kind of move the whole company, whole idea around cyber. And 5 years ago, when I -- the first time we called Rubrik as a cybersecurity company, most of the market laughed at me because they thought yet I'm doing it for IPO or I'm doing it to kind of increase the valuation. And then the cyber attacks and ransom attacks has started happening. And we are the only platform purpose-built to deliver cyber recovery, cyber resilience from scratch. And that has led to our success and growth in the marketplace. If you look at -- we are the first cybersecurity company to go public in 3 years. If you consider us as a backup and recovery origin, then we're probably the first company to go public in 10 years, and we have really redefined this market.

Where do you want the company to be in 5 years, whatever time frame you choose to longer term?

It's hard for me to say where Rubrik goes in 5 years because we have this limited ambition for the company. And we see tremendous opportunity for Rubrik because the real estate that we sit on, which is data and data security and data availability and making sure we deliver data to the right user on the right platform at the right time for the right duration, it opens a lot of vistas for us. Whether it will be 20x bigger companies, 30x bigger company, 10x bigger companies, I can't predict. But we are doing everything possible today to take advantage of every opportunity that is in front of us. And that is my fundamental belief that in an uncertain market, when you can't know what is ahead of you because we are at the edge of innovation, you continue to maximize opportunity. And today will become tomorrow and create the future.

So to understand the future, sometimes you have to also understand -- many times understand history and lessons. Why did that backup and recovery market not live up to its potential in your view? What were the shortcomings?

See, what has happened is that if you look at the history of IT industry, the IT industry has evolved through technology shifts. And the big technology shift in backup and recovery was 20, 25 years ago when it went from the tape device to a disk-based device. That was the beginnings of the data domain, and that really had a major shift in the market. But what happened was that shift from tape device into disk device really eliminated the need for backup software to be a separate entity. But the innovators of that time, 20, 25 years ago, didn't go far enough to reimagine the new world. And when I looked at it in 2013, I said, "It's almost too late." There's still -- nobody is doing it. So why not go all the way and transform the whole architecture, not having like 2 or 3 or different products to do one thing. And that one thing is also not being done right because done in an old architecture because it's not solving the cyber issue. So how about we combine the metadata systems, the data systems. And since you combine the metadata and data together, can you build the cybersecurity capabilities right into that same system, that data engine to really create a new platform for -- purpose built for cyber resilience. And it was a bold move because when we first went to customers, customers said, "What is this? This sounds like a black box" because I used to schedule jobs, I used to have storage systems, I used to have backup systems, neither giving one system where I don't do scale jobs, are you going to take my job away, I don't know how to manage this. And we lost some bank deals in the early days of the company because they could not imagine that such as system will scale to petabytes and petabytes of data because it was like we are giving them 5-year out thinking. And sometimes it's hard for people to reconcile what they know versus what it is, which is from the future. And once the cyber attacks has started happening in '18, '19 then folks realized that we are the only game in town with this unique architecture purpose-built for this reason. And that's why now every vendor in our space is printing their website as cyber resilience, but nobody has a platform.

It's rare to see a company get to the $1 billion type revenue run rate in such a short span of time. So tell us about the journey. What were the obstacles you faced? And how did you get to be where you are today and then we can talk of the future and the challenges and the opportunities ahead.

One thing that I have a firm belief in that whatever has happened in the past doesn't need to repeat in the future. So when we started Rubrik, we had this firm belief that we could be the fastest-growing software company ever. Even if it is B2B, even if it has the friction of hand-to-hand selling, we could be the fastest. And we are 8.5 years selling right now. We crossed $900 million in subscription ARR, and we have projected over $1 billion for the end of this year as our guide. It shows the ambition of this company. So -- but to get to this ambition, you have to train your people to also open up their minds. So in the early days, what we did was we said, "We'll not have like small goals." So if you look at the Rubrik's trajectory, it was TCV, but first half a year of selling Rubrik, we sold 5 million. First full year of selling Rubrik, we sold 47 million. Second full year of selling Rubrik, we sold 168 million. Third year of selling Rubrik, we sold 350 million. There's no other company that grew at this pace because what we did was we programmed the company to have this unlimited ambition, where we wanted to fill fast and way fast and take it to market faster. But when you do that, you run into operational infrastructure issues. We didn't have the proper management, proper operationally managing and trying business because age-wise, we were still 5-year-old, but state-wise, we were a teenager in the marketplace. Then we had to quickly build the operating infrastructure of the company and how we manage company metrics and responsibility, accountability, coordination. And so that we had to do in 2019 to fit the company for the next phase of growth. And that was painful. I mean we had to take a lot of people out of the company. We had to reimagine our management team, reimagine our practices because our speed of growth was far outpacing company's infrastructure to support that growth.

Kiran, to loop you into the conversation, how would you describe the market opportunity ahead? What are the drivers of the market and really an ocean of competing priorities right now?

Which as Bipul shared, the market is pretty significant, and it's continued to evolve. I will also say that we are fairly underpenetrated in the market today, right? At the time of our IPO, we talked about having 6,000-plus customers when we size the market as being 60,000 plus. We are still less than 40% in the Fortune 500. And even within the customers we have acquired, including customers who are several million in ARR, we are less than 50% penetrated. When you look at those statistics in the concept of this large market, which we are evolving, we have a lot of room for growth here, right? Market is large, the company's ambitions are high, and we are underpenetrated. So it comes down really to us as Bipul talked about is execution. It is just the operational discipline, growing the business, growing efficiency, hitting the targets, holding people accountable and the operational metrics and discipline around it. So that's what we're really focused on.

Perhaps it's largely a brownfield opportunity, right? So how do you incentivize customers to migrate from legacy solutions?

Our customers are naturally incentivized because they want to keep their business as continuing operations. And the last several years of cyber attack and ransomware attack has proven that what cyber attacks used to be, then denial-of-service attacks, and the website goes down and can bring that back up. But in this new era of cyber attack, more destructive, can bring your whole business down. I was in Vegas day before yesterday, and I was standing at Cosmopolitan, and they are still taking the -- their screen look like mainframe because they are still not fully recovered. So think about like they have to make phone call to figure out if the room is available or not. That's a massive drag to the business. And this is after how many months. So what we do really matter, and it is not a discretionary thing. It's not that your site is down, you can bring that back up. The whole business will be wiped out and gone, and what is the cost of that? So obviously, this particular incidence has brought even more awareness in the eyes of Board members and CEOs because they saw this as a preview to what could happen if it is a real cyber attack.

Okay. And any -- since you mentioned it, it's not planned on asking, but any customers that you happen to serve that did better and recovered very quickly?

Many, many customers. In fact, when this particular incident happen, I got a call from [ George ], and we decide to like go together and help our customers. And we helped hundreds of customers. We got like tens of love letters from our customers saying, "We could keep our hospitals up and running and keep delivering patient service because of you guys. Our prior solution would have been a different case." And we dealt like from oil and gas companies to health care hospitals to insurance companies, all over the place. In fact, in our earnings call, we gave one example. We had so many examples that we could -- we're talking about that the whole earnings call.

So your sales pipeline must have gotten a boost after this?

I mean look, this is really...

Not to be crassly commercial about but an incident that was massively disruptive, but just to help your customers forestall and I think one of the things you've always talked about is we are not a security company. We're not going to pretend to try to prevent an attack, but you're going to get attacked and we're going to help you get up and running very quickly. That's the...

We are definitely seeing anecdotally a lot of like discussion and interest. We are not numerically seeing in the data yet. It's early. But look, I mean, if you look at our last quarter, we see no negative disruption because of it whereas a lot of other companies saw their pipeline install or decision get stalled. We had no such issue. And we continue to see strength in this market. I mean that's why we are so confident about our guidance. We actually raised our ARR guidance by over 5% for the rest of the year, near our guidance is because cyber resilience continues to be the #1 topic, and we are clearly winning the market.

Not many companies raised guidance. Many of them left it unchanged. And the big debate among investors was the magnitude of the raise for the year was lower than the magnitude of the beat. And so the second half guidance actually went down. There were many interpretations of how negatively people viewed the guidance. And in that landscape, clear, beat and raise was definitely a positive. So I want to dig a little bit deeper into the technology for the benefit of -- for my benefit primarily and for people who are here and listening to the webcast. How would you describe the architecture? Why is it so unique? And what gives you the confidence, therefore, that there is a durable competitive advantage in this architecture? Because as you rightly pointed out, you've got competitors that also claim that they have durable competitive advantage. Help us sift through all this.

I mean our story is no different than many generations of disruptive companies that came in with a new architecture purpose built for the use case and really evolve the agenda of the market. If you look at like Rubrik Security Cloud, we took 7 years, 6 to 7 years to build from scratch the Rubrik Security Cloud. Everybody else in our market space when they talk about cloud, it's a lift and shift of the legacy software that is now human-powered and providing cloud service, not Rubrik. It's a purpose-built platform. From day one, our idea was to combine the metadata system, which is backup software, sold by Commvault, Veritas, Veeam, Cohesity and storage software, which is sold by EMC, NetApp as well as Cohesity. Combine those 2 systems, so the metadata system plus the data system in a single software, and when you combined the metadata system and data system in a single software, what you get is self-describing data because data understands the metadata and application and user in context. And we use that intelligence to natively build data threat engine in the same software. So as we are pulling data from production system, we are applying AI/ML to understand attack, to understand the scope of the attack, to understand point of infection, to do the data classification, to look for known threats. Our integration with Mandiant is, again, another feed that will give us intelligence about newer and newer attacks that we can look for in the data while we are taking the -- pulling the data out of production system. As a result, what Rubrik does is everything that you need for recovery is precalculated in the Rubrik system as opposed to legacy system where they have 10 or different -- 15 different partnerships and third-party software that is now scanning data post the impact. And that is the difference between whether you are up and running in a day or down for weeks or in some cases, months. So architecture matters when you're delivering cyber resilience. Just because you're calling yourself a cyber resilience company and checking the box on the messaging doesn't mean that you have the real platform because if you look at our growth rate and if you look at our scale with which we are operating and the number of customers we are helping, it clearly demonstrates the strength of our platform and resonance that we are getting in the marketplace.

Kiran, you've had an established career at Oracle, Goldman, Atlassian and now Rubrik. So what are the key learnings that have helped you inform your approach to being a public company CFO?

Yes, had the fortune of working at some strong franchises. Almost all my career I spent in software, even at Goldman, Kash, as a software banker. I think a lot of learnings even though the business models and the individual end customer base is different, right? I think it's really some things Bipul alluded to is when you're a company with the kind of ambition we have, there's a lot of balance you need between near-term execution and long term as well, right? That directly translates into my role and my team's role is make sure the near term is secure with the right level of investments and the execution muscle but as well we're investing to the future 3 to 5 years out with the products we want to build, the markets we want to be in. So that when we get to that stage, we have those growth levers, right? So that's a key focus. I think building durability in the business is really critical for us. It is clearly product and platform. So right from the vision to implementing these different, I would say, snowballs in terms of product investments, which get to fruition over time to keep that difference way ahead is critical. And then I would say the companies I worked with, they're all durable software franchises. And one thing which is common is at scale, durable software franchises are very profitable in addition to growth, right? So that's the journey we are on as well is over time with the growth and the scale generate meaningful level of profitability. And the last thing I'll say...

Described Goldman as a solid franchise, durable franchise.

And the last thing I'll say is as Bipul talk, vision can be all talk. You got to deliver in execution, right? So we're day in and day out focused on that. And that's a key part of my role as well because it's a very cross-functional role. And end of the day, we are a numbers-driven business, so to drive that discipline in the business, that is something developed over time at these companies but also train ourselves to do better every day.

So Bipul, you hired an engineer to be your CFO.

That's right.

How does an engineer with a master's degree in engineering get to be a CFO? Is this job too easy for this? It must be, like it's just numbers. I mean it's not even technology.

Crazy part about my career is I'm an electrical engineering undergrad, and I did software engineering for many years. I have over 30 patents in distributed computing, some of the hardest part of software ecosystem. And then I did my finance MBA at Wharton.

Was it easy or tough?

It was relatively easy. In fact, I remember my finance officer called me and said, "What do you do?" I said, "I'm Director of Engineering." He said, "Leave your job and go to Wall Street because you're uncanny about looking at numbers." And I was acing all these courses. So the thing is that when you look back at your career, many things that you do that seemingly -- that seems at that time not important or not beneficial, but everything kind of comes together. And that's why our partnership, Kiran and I, are so strong because both are engineers and both have -- I mean, obviously, Kiran is financial expert, and I'm somewhat literate. So we understand...

Open your [ desk ], you had courses at Wharton.

So we understand each other, like we understand what is important to deliver business. Obviously, as an entrepreneur and as a founder and somebody who has this outsized drive, obviously, I'm pushing to ensure that we can grow and take care of this or take advantage of this market opportunity. And Kiran is my partner, who is like keeping me center about making sure that profitability is my #1 focus, ensuring that we responsibly take advantage of this market opportunity to build a long-term company. So that's why this partnership is important, and that's why we work so well together is because we both understand each other from a technology perspective, and we both understand each other from a finance perspective. And the 2 pillars of where we are today are really important because financial is the underpinning of the business that we're going to create.

Yes. That's -- I'm glad you said that because it's very easy to find CEOs not have their CFO up on stage with them while doing a Q&A discussion like this. And so the fact that you partner together is a good thing. And I also think as an engineer, being a former engineer myself, being a little biased, being a CFO, you're able to better relate to the aspirations of the business. So kind you've been through all these successful profitable software franchises. What are the things that you learned from working at Atlassian and Oracle? Oracle, you are an engineer at Oracle, right, but Atlassian, you are in finance. What are the financial principles that have inspired you from these places that you could see yourself applying to Rubrik? Tell us about the financial discipline that you bring to bear from your experience.

Yes, the financial planning, you can think about it as a financial process is really a strategic planning process in the company. You have to involve everybody. It's about who we are. It starts with a reiterating of the mission to where are we headed, starting from what are we going to build, how are you going to go to market? What's the business model? And then that translates to actually numbers. And a lot of times, it appears that the financial plan is what drives the business, but I really think the financial plan is a reflection of the strategy and the mission of the business. And that's what I've learned from working at all these companies is you start from there, right? Where do you want to be in 5, 10 years? And then what do you get done in the next few years to work towards that mission? And then what do you need to invest in that? What are the results you want to get? And then that becomes -- you operate within the company. You are measuring ourselves every week, every month, every quarter, every year, right? And that's really, I think, what I've learned in my previous roles as well as what we are doing here. The one thing I've also learned in my career is you can't just take something and apply it because you run it 5 times before, right? The world is evolving. What we were as a company 5 years back in terms of the markets we're going after and the customers we're going to serve and the buyers is evolving. So similarly in my role, I can't just take everything I've learned and apply it just as is. That will not be good. So you take things you learn, try to apply it to the current business, and there's so many things you learn on the job as well, right? So -- and that's really how I operate.

And what metrics and goalposts should we, as investors and analysts looking at to gauge the progress of the company? What are the KPIs?

Yes. So the metrics -- these are metrics we've talked about in our journey to be a public company, and we report every quarter. We are a high-growth software business. Focus on the top line would be ARR. Subscription ARR is a key top in metric. I also think it's the best indicator of the business, but it also happens to be the metric you need for Rubrik, given the cloud transformation, right? Very few companies disclose ARR, even fewer guide on ARR. We do that. So that's the best measure, I would say, in terms of top line growth. And then understanding the drivers which drive that, right? The customer acquisition, which is best represented by 100-plus count, the NRR we report, cloud ARR, which is the majority of our subscription ARR, those, I would say, the key top line metrics. In terms of profitability, software businesses, gross margin ARR contribution margin, which is a proxy for operating margin and the free cash flow. But I think given where we are at the stage of business, subscription contribution margin is the best indicator of operating leverage. And then the last thing I'll say is we are a product company, and we're in the business of serving our customers. NPS is a really important metric. We report that as we do our independent service, but it's an important metric from inside the business. That really reflects are we building the best products? Are we making our customers successful?

I do believe we have a question from the audience.

I have a quick question. Today, I mean, you've got a lot more runway because there's a lot of cooperation with data everywhere and operational data. But more and more, isn't the important data going to be in the model data stack in Databricks or Snowflake? I would love to get your thoughts on that architecture going forward in the next 5 years or so.

So there are 2 issues when you run an application. One issue is that can you keep this application up and running? How do you ensure that this application or this service never goes away, whether it's your booking system, whether it's billing system, whether it's your hospitals and how do you admit patients, all of that. So we are in the business of availability of that application and making sure that in case of a cyber attack or any kind of disruption, that service is up and running. Then you have these other data platforms that pull the data from production system and transform the data to be able to query data for business intelligence. And that could be Snowflake, could be Databricks. But they are a secondary storage or secondary data copy that is done for analytics, and they periodically pull data from production. They can't recover the system because they don't have the untransformed data and their ability to restore is a different science altogether because they are organizing the data to be able to query the data. We are organizing the data to be able to keep the businesses up and running. So it's a completely different thing. Having said that, we have the unaltered data across all the applications in the business plus the data security built into it, which is classification of the data, sensitivity of the content, governance of the data all built into it. So in the world of generative AI where the database structures don't matter because it's all about interpretation of the data, who has the data and is the data secure and it has integrity matter. So that is a great level -- is a great leveler of all the technology.

In the minute that we have, I have a question for you each. One for you, Bipul, thoughts on Salesforce acquisition of Own data increase the competitive landscape or not and Kiran, finally free cash flows.

So very quickly, it's very positive for our strategy. In fact, it validates our strategy because we have been educating customers saying that for every SaaS app, you need cyber resilience. And some customers ask me this question that, "Hey, will Salesforce not do it? Or will Microsoft not do M365?" That question is forever answered by Salesforce buying a backup recovery company. So that's actually very positive. But Salesforce is one of the 20, 30 apps that we secure. And when the cyber attack happens, customers are not going to turn 30 knobs to recover because they are already so distressed. Consolidation is the name of the game. Consolidation of the cyber resilience across all applications is the name of the game for our market and for any customer serious about cyber attacks. So we believe that the messaging and acquisition is positive for us, and it validates our strategy.

So on free cash flow, I guess the question is there's the path to free cash flow. So obviously, as I said, it's one of our key profitability metrics. And in a software business like ours, some of the durable franchises we've talked about, they all generate free cash flow over time, and that's our goal as well. We've been working hard at it. Obviously, the scale we have with the strong gross margins and improving operating margin, subscription contribution margin, we are on that path. In fact, we guided to cash flow positive for the second half. But there's a lot of opportunity here as we scale the business. Two areas we're very focused on is sales and marketing and R&D, key areas of investment. And both of them, we improved significantly in terms of contribution margin over year -- over the last year. We improved our contribution margin by 600 basis points in Q2, taking out the onetime impact of the IPO taxes, and over 1,000 of that came from sales and marketing where we are focused on increasing productivity of our reps. So if you can increase productivity with multiple products and better enablement, you can produce more with less, right, lowering the cost of acquisition, more targeted marketing. And then we are getting a natural leverage with scale too, it's renewals. Still a very small part of our business, minority. And high retention business, the software we sell, as renewals grow, it's a very high-margin business as well. And then R&D, we are leveraging our global footprint, world-class talent in Bangalore in particular, to grow and deliver world-class products but at a much more optimal cost structure as well. So as the operating leverage business grows, and the top line skill grows. Naturally, it will drive free cash flow in the business.

I love the answer. I love the detail there. On that note, thank you, Bipul and Kiran. Let's give it round of applause.

Thank you.