Rubrik, Inc. (RBRK) Earnings Call Transcript & Summary

Barclays Tech Conference. My name is Saket Kalia. I cover software here at Barclays. Absolute honor to have with us the management team from Rubrik. We have Bipul Sinha, CEO; as well as Kiran Choudary, Chief Financial Officer. Also have in the back Melissa Franchi, Head of Investor Relations. So we've got about 30 minutes together. Let's spend the first 20 or 25 minutes just doing some fireside chat, which I know is going to be really fun. And then we'd love to make this interactive. So any questions, just pop up your hand, and we've got a mic runner in the back. So maybe with all of that as a starting point, Bipul, Kiran, thanks so much for being with us here today.

Our pleasure.

Thanks for having us.

Absolutely. It's funny when last year, you were here as a private company. So just very happy to see Rubrik here as a public company, hopefully, the first of many times here at the Barclays conference. So you just completed your IPO back in April, very successful IPO. So maybe for the folks in the room who haven't had the pleasure, Bipul, can you just maybe give us a brief synopsis of Rubrik's business and the market you compete in? And Kiran, maybe you can offer some -- just some financial highlights from the quarter you just reported last week.

So Rubrik is a data security company. We help businesses -- ensure business continuity against ransomware and other cyberattacks. So think about the history of cybersecurity, it has traditionally been focused on prevention of attack. And our thesis says, you can't prevent the unpreventable. You need to have a cyber resilience strategy, so that you are still up and running, even when a successful cyberattack or breach happened to you. We are actually replacing backup and -- traditional backup and recovery products. and transforming that into a data security platform to deliver cyber resilience. We are in a replacement market, competing against legacy or legacy-like architectures. We have a very unique product that combines cyber recovery and DSPM on a single platform. And as a result, we are winning vast majority of deals against competition.

Absolutely. Good starting point. Kiran, maybe...

Sure. We just reported our Q3 fiscal year '25 results in January fiscal year. So we're very pleased to report that we crossed $1 billion in ARR. It's a big milestone for our company, just crossed our tenth year earlier -- tenth-year birthday earlier this year. And in terms of other metrics, our revenue growth was 43% year-over-year. Subscription revenue 55%. And we run the business from an operating leverage perspective on subscription ARR contribution margin, we're at minus 3%, over 1,100 basis points improvement from last year, and we generated about $16 million in free cash flow.

Very helpful, that's very helpful overview. Bipul, maybe we can talk a little bit about the perception of the "backup" industry. A lot of people think about backup, and they think of data replication, right? Having a spare copy of your data in case of an outage or someone mistakenly delete something, right, that type of use case. The backup is becoming a little bit more of a security or CISO level security priority as you've seen. What are some key drivers of that shift?

So first of all, what has happened is that the cyberattack has changed -- have changed in the nature. It used to be a board teenager sitting in the basement of the parents and showing middle finger to large corporation by doing denial of service attack, bring the website down, those kinds of things. But with the advent of crypto Bitcoin anonymity over these transactions, plus the digital transformation that has happened in the last 5 years and the ubiquity of data, has really changed the cybersecurity game. Now the -- whether it's nascent state actors or cyber criminal or financial criminals, they are going after the data as the core vector of attack, and they are encrypting data and asking for ransom against that data. And this has changed the focus in terms of the customers, purely prevention of attacks to really making sure that their data is available and they can run their businesses so that hospitals can admit patients, banks can continue to dole out money, kids can go to a school, even when they are breached -- the schools are breached. And that change -- required a change in the technology of backup and recovery because backup and recovery is not just needed for human error recovery or natural disaster recovery, it is now needed for cyber recovery, but cyber recovery is distinct from the old backup and recovery. And what Rubrik did was we created a unique architecture, purpose built to deliver cyber recovery. And we changed the use case of the product for this market. Just like iPhone changed the use case of phone from calling and texting device to Internet device, Rubrik transformed backup and recovery from backup and recovery for human error and natural disasters to cyber recovery, cyber resilience platform, and we are very unique in that aspect. And that's what has propelled Rubrik to a cybersecurity company, being in the center of cyber resilience, and we are really creating the future of cybersecurity, which is truly the data security.

Absolutely. Definitely came through when we spoke to customers, a lot of CISOs involved in the purchase decision. So it makes a ton of sense. Kiran, maybe for you. Can you just help contextualize where Rubrik kind of fits into the industry compared to other players out there? Maybe the question is -- maybe the way to delineate that is, how much of your business comes from larger enterprise customers like Fortune 500, Global 2000? And also how long is sort of a typical sales cycle for those types of customers?

Yes. So as Bipul described, our product strategy of what we provide is securing data across all different locations, whether it's in the cloud, within SaaS applications, whether it's an enterprise and whether it's structured or unstructured data. That gives us a very large market opportunity to execute towards. But where we focus from a customer base, customer size perspective is truly in the enterprise, I would say mid enterprise to the very largest Global 2000, Fortune 500, Fortune 100. And in terms of our metrics, which you report, we focus on the customers of scale, and that's the metric we report. That's the 100,000-plus customer count, and that continues to grow well at 30% plus. We are well over 2,000 now. In terms of your sales cycles, for the complex, high-value product we provide, our sales cycles are fairly short. It's about 4 months on the average, 120 days, but that is the average. We've closed Fortune 100 transactions in weeks, and also it's taken more than a year, right? But the average is about 120 days.

Got it. Got it. Very helpful. Bipul, maybe just on that topic of the industry at large. I mean this has been a market -- and you referred to it earlier, this has been a market that's long been dominated by the likes of Dell EMC, Veritas, IBM. And those vendors are now considered legacy in this part of the -- in the data protection market. When you talk to customers -- and I know you spend a lot of time with customers. When you talk to customers that want to switch off of legacy technology, which vendors are you typically displacing the most? And how much more share is there to go, right, in terms of this disruption?

See, backup and recovery market is as old as computing, and Veritas was built in 1983, and that's how old this industry is, that's how old these technologies are. So dynamics of our market is similar to the ServiceNow ITSM dynamics. ITSM was a legacy platform, HP, BMC with supplying the software, ServiceNow came in and transformed the legacy ITSM into business workflow platform to deliver digital transformation because that was the need of the hour. Rubrik did something similar. We went after the legacy backup and recovery transforming that into a data security platform to deliver cyber resilience and cyber recovery. Then what happens is that whenever there is a transformation of legacy platform. And we are equal opportunity replacer. We are replacing Commvault, Veritas, EMC. We see it, we kill it. Having said that, whenever there is a transformation project, all the legacy vendors also come in and say, we do this, we do that. We have a similar capability. They have all copied our message over time, but when the customers see Rubrik side-by-side, vast, vast majority of deals in a competitive side-by-side comparison we win is because we have a unique platform that is purpose built for cyber recovery, and that combines not only cyber recovery, but also data security posture management. And that unique architecture allows us to continue to innovate, deliver the fastest recovery to our customers and give them the peace of mind that they can confidently do digital transformation without worrying about the services being down due to cyberattack.

Yes. If we look back at last quarter's -- last week's earnings call, one of the most interesting things I thought was the customer examples that you were giving, almost all of them were talking about how you were backing up Azure or Salesforce or some sort of cloud product. And I know that those -- a lot of the public cloud companies, right, like the AWS or the Azure of the world, have native backup tools or capabilities that they've built in the platform. And a lot of -- I think a lot of investors have rightfully questioned like, hey, do you really need back up when the cloud is so pervasive and it's just such an incredible fallback? I mean, I guess maybe the question is, how do you think about sort of the value proposition of using Rubrik to back up cloud data, right, instead of their native cloud provider, if that makes sense?

If you look at an average enterprise, they have 3 clouds and 10, 15, maybe 50 SaaS applications, and then they have on-premises enterprise applications. And when the cyberattack happens, attackers are not thinking about SaaS versus cloud or GCP versus AWS or on-premises, the could happen in multiple of these places all at the same time. So if the customers have to turn 30 different knobs to be able to do cyber recovery, they will never be able to recover. So everybody is looking for a single policy-driven, single-control plane for data security and cyber recovery across all of their data, and that's why they are switching to Rubrik because we have Rubrik security cloud as a single platform, single policy engine to orchestrate data recovery, cybersecurity, cyber resilience across all of the data estates irrespective of the locality of the data. That reduces the customer's risk. That delivers fastest recovery uniformly across all apps. You don't have to worry about how is my data retained in AWS versus GCP versus Azure versus SFDC versus M365 versus Oracle database and SAP in their enterprise system. They don't have to worry about it.

Single pane of glass basically.

It's a single pane of glass, single control engine, single data threat engine. So if a threat actor is poking around with your M365, and same threat actor is poking around with your SAP on-premises, you can real time correlate the threat.

Got it. Kiran, maybe for you. I'd love to talk about just -- I mean, the growth that you have existing customers, can you just give us a little bit of insight, first of all, remind us what the net revenue retention here is, right? Because I think that was a standout number last quarter. Could you just give us some insight into how much of that growth kind of comes from existing customers, maybe adding more applications and data, right, to Bipul's point around sort of the breadth of coverage versus cross-selling your customers, something that I want to talk about a little bit more, right, which is security, I mean, I think -- again, I think it was a very healthy NRR number. Talk to us a little bit about some of the drivers behind this.

Yes. So we have a land-and-expand model, which is fairly common in SaaS software businesses. What makes it really unique in terms of our model is, we have multiple different categories of land products across cloud, SaaS, enterprise and unstructured data. In addition, DSPM is our fifth land product as well. And then each of these can be expansion vectors as well. So when you look into the NRR dynamic, the 3 contributors are obviously in addition to a very strong gross retention rate, it is the data could grow and when the data grows, your relationship with Rubrik grows. And then the new workloads could be brought under management as well. You start in the cloud, you want to now protect the SaaS application, that is application growth or application-related data growth. And the third vector, which you identified is the security -- data security application growth on top of that. And they're all mutually reinforcing. You can go in different cycles around this, but they all -- you can start with SaaS, go to cloud, and then you can have data security. You could start with cloud and data security and then you could add a SaaS app. So they're mutually reinforcing that way. About 1/3 of our NRR comes from the security applications, and that's something we have broken out, and it grew from about 1/4 last year. So that is growing in terms of contribution. The other 2 vectors are meaningful contributors, but we have not broken them apart the other 2/3.

Got it. Got it. I think that's an interesting segue just into the -- there are 2 aspects of security here, Bipul, if you think about it. There's cyber recovery, right, backing up in a ransomware situation, for example. But then there's using the data that you look at and layering on more security on top of that, the data security. Talk to us about sort of the adoption that you see from customers, the willingness of customers to think about you as a vendor, not as a backup vendor, but also a data security vendor?

Our fundamental true north is cyber resilience. And the basic assumption of cyber resilience is that you will get attacked. You can't prevent the unpreventable. And if you assume that you will get attacked, how are you preparing for that attack? So you have to do 3 things. You have to understand data risk that where is my data, what is the sensitivity of the data, who has access to the data. So that is the risk piece. Then you need to understand data threat, which says who is doing -- actively poking around with my data? Is there an illegitimate access on the data by a legitimate user, which could be a credential compromise or dark web, somebody bought something from a dark web and now actively poking around and attacking. And then the third piece is cyber recovery that once the attack has happened, how do you recover and get back into business quickly. So if you think about these 3 distinct things, they are data risk, data threat and cyber recovery. DSPM is our big product for data risk data threat, and cyber recovery is our core. So what we do is we sell the DSPM separately as standalone or we combine DSPM plus Enterprise Edition, which is a full cyber recovery together in a complete product. But the biggest observation here is Rubrik is the only cybersecurity company that has access to the business data. There is no other cybersecurity company that has access to the business data. When cybersecurity company talks about data, they talk about CIS log, access log, machine log, the Splunk kind of data, not the core business data. So the -- our opportunity to make sure that this data is secure and what is happening to this data if we continue to kind of enlighten our customers, we have a tremendous opportunity to continue to build the data security vector. And then we recently launched Annapurna, which allows us to open this data with the security built in for businesses to use this data to build generative AI LLM applications in a secure and trusted way because everybody is struggling with -- if -- what if I send this data to LLM or AI app, and then wrong people will access to the wrong data. We are solving that in the input side of the equation at the origin. And that is where it is solved because LLMs are so complex that you can't correlate input and output security. So in many ways, we are at the heart of the most important real estate in the B2B, that is data. And opportunities are many. So we are not opportunity constrained, like any good business, we need to ensure that we continue to keep the focus and true north on cyber resiliency, data, data security, data availability, data platform, data management and continue to evolve ourselves.

Absolutely. I want to come back to the AI part of the story here in a second. But Kiran, maybe for you. I mean I think we shifted to selling Rubrik Security Cloud around 2 years ago, if I remember correctly. And to Bipul's point, you sell based in -- sell different tiers based on what -- whether a customer just wants straightforward sort of cyber resilience if they want to layer on more security on top of that. Can you just talk to us about the different pricing tiers? And what trends you're seeing in terms of customers adopting one versus the other?

Yes. So our core product offering, as you said, is Rubrik Security Cloud, and that could vary across different data as you're securing, but the offering is the core platform is Rubrik Security Cloud. Now within that, we have 3 additions or bundles at scale, which we have launched over the past few years. The basic is foundation, which gives you basically 0 trust data protection, immutable data. It's already a big step up with any legacy product we are replacing. And then as you work your way up the tier, the next is business addition, which gives you ransomware remediation and then full cyber recovery is enterprise addition. So enterprise addition is the most advanced here right now we have in the market at scale. That's about an 80% premium on list price to the foundation tier. And in terms of adoption trends, obviously, as Bipul talked about, it's quite a bit of awareness about cyber risk around data. So Enterprise Edition is almost half our new customers are directly landing on Enterprise Edition.

Right. Right. Bipul, I will come back to the AI part of the story here. And -- I mean I think you touched on it a little bit, but maybe I'll ask the question a little more directly. How does AI become a revenue opportunity for Rubrik going forward?

We are an ambitious company. And we think about our business in 3 ways. So number one is, whatever is working for us, how do we amplify that and supersize that. The second piece is that the things that we have incubated in the past and if they are at a point that to be scaled and how do we scale that. And then the third part of the equation is how do we create new products and services and find product market fit and discover pricing so that 3 to 5 years down the line, they become significant. So if you look at the cybersecurity capabilities, data security capabilities that we are selling Enterprise Addition today, we started working on them in 2016, 2017 because some of these visionary products takes time to do market discovery, understanding, and we want to be a long-term company. And so if we have to figure out today what we are going to do today that create growth 3 to 5 years from now as we are enjoying the cybersecurity growth today. So Annapurna, which is our AI effort, is in that direction. So it is not at a point that we can even think about that as a model, as a revenue model. We need to discover the market. We need to educate the customer. We need to understand pricing. We need to find product market fit messaging. So there's a lot of work ahead of us, but the opportunity is significant because everybody in generative AI world is struggling with responsible AI, trusted AI, having the right data access to the right user, how do we bring all the business data together in a single catalog, single platform to deliver it to the Gen AI apps because Gen AI apps are data hungry. And Rubrik is the natural next generation data lake with data security built into it. And we are doing reverse ETL to recover an app. We can -- we are opening another door on the same data for generative AI through creating and embedding factory on top of our secure data.

So interesting. Kiran, maybe we can just shift over to some financial questions. I would love to talk a little bit about the subscription transition story here, which I know is a fun discussion. Can you just remind us what stage we're in for this transition? And what are some of the milestones in the transition that we should look forward to?

Yes. I'll clarify the 2 pieces within this transition. So the first is back in the day, about 6, 7 years back, we used to sell perpetual licenses, and there was a maintenance stream associated with that. Obviously, we don't sell that now for several years. So we're converting that legacy maintenance stream into subscription. And you're moving basically revenue from maintenance revenue to subscription revenue. That is largely behind us. We disclosed through the IPO process in S-1 and the past earnings, the contribution to growth. And this past quarter, it's about 2 points of growth. And we believe that is close to done. In fact, in the modeling points for next year, we said we are not assuming any further benefit from that. Now the transition, which is still continuing, and we are reaching towards the end of it, but still have more to go is within subscription itself converting term licenses to cloud license or SaaS. And this is what we launched in a significant way in August 2022, with the launch of Rubrik Security Cloud. Really pleased with the progress we have made so far. In terms of the contribution from SaaS, it's well over 70% of our total subscription ARR is cloud ARR. But as we have shared, our long-term goal is 80% plus. So we're approaching that, and we'll give you an update when we achieve that milestone, but very pleased with where we are.

Yes. Absolutely. I'd love to -- the other part, I think, of the story we were talking about before, really what's been -- I think the most surprising thing to me has been the margin story here as well, right? And we have a metric, ARR -- subscription ARR contribution margin, which kind of strips out some of the noise from that transition. Can you just maybe help us understand what's driving that big improvement in contribution margin that you're seeing and right -- and really from a business perspective, financial perspective, and what it's going to take to get to breakeven next year?

Yes. And that metric, you and I have discussed before we got into the IPO process. So thanks for all the help in thinking through that. But that's our key operating leverage metric. We think about it as a proxy for operating margin and a leading indicator as we go through the cloud transformation because we go through a period where revenue was depressed, so it kind of depressed our operating margins, but contribution margin is the best way to look at it is because we run the business on ARR. And very pleased with the progression to date. Every -- each of our public quarters, we reported stronger progression in ARR contribution margin versus the previous quarter as well as previous year. This most recent quarter, it was minus 3%, about 1,100 basis points up year-over-year. And this is not things we could just turn a light switch on and get the margin benefit, these were things we have been working hard at internally for years now. I would say when I focus on the key investment areas, one is R&D and sales and marketing for software businesses. In terms of R&D, we have a global talent platform now, primarily India supplementing Palo Alto, and we hire world-class talent there, but it's an investment which Bipul and the co-founders made very close to founding of the company. And today, we hire more of our new engineers there than in Palo Alto. And that will continue. So we get great talent for innovation, while still getting some cost leverage as well. Sales and marketing, which is the bigger area of investment, multiple, I would say, drivers for that in terms of the improving efficiency, in terms of the cost of acquisition, much more targeted, in terms of marketing, in terms of driving productivity up for reps, we are focused on delivering new products and also shaping the organization where we add -- we shape the ratio so that when we add reps, we don't add as much resources around the reps as well. And then I'd also point out that we get some natural leverage in our model from the growth and renewals. Renewals is still a minority of our business, but it's very efficient. We don't have much incentives around renewals and it's a fairly sticky business. And as it grows, it drives more sales and marketing leverage as well. So we expect some of these to continue. But at the same time, we gave some modeling points for next year, where we have said we expect to be breakeven or better on contribution margin.

Absolutely, absolutely. It's been great to see. Bipul, I want to ask you a competitive question. So you've got a competitor out there, right, Cohesity that just closed the acquisition of the data protection business of Veritas, which has been a share donor in the past and arguably continues to be so. The question is, how do you think this deal will impact the market as a whole? And how could it maybe impact the new business that Rubrik might otherwise be getting from these legacy customers looking to make a switch?

Look, not only Veritas is a shared donor to Rubrik, but also Cohesity is a share donor to Rubrik. And if anything, this transaction, we see a more positive for us because Veritas is a single product company. And they don't have a high leverage in the account. They are not like 10, 15 products and try to cross-subsidize. And if that single product is acquired by some other company and they are asking customers to switch the product, then customer will naturally think what else exists out there in the marketplace. And that will open up more opportunity for us, shake many of their customers lose. And so overall, we see that as positive. We have a strong unique platform, and our win rate against both Cohesity as well as against Veritas is vast, vast, vast majority of deals that we win, and there is no comparison when it comes to side-by-side product. And so in terms of like opportunity, we see more opportunity with this. Obviously, for the -- for obvious reasons, the customers will continue to -- the 2 companies merging will continue to make noise that is so great. But in the history of Silicon Valley, I've never heard and I have -- I'm a capitalist. I used to be a venture investor. I've never seen a 10-year-old company buying a 40-year-old company and suddenly become a very successful company. Financial engineering don't create innovation. So it's good to have excitement in the marketplace. We are changing this marketplace, transitioning this market. People are trying to merge with each other to survive. And we'll see how it goes.

Absolutely. And this is a big market as well, right? And there's plenty of share gains to be had from others as well. Bipul, maybe the question I'd like to ask you and one of the ones that we're trying to ask in a lot of our sessions is, I know you spend a lot of time with customers. How do you sort of feel about the health of spending in this data protection area in calendar '25? Just sort of feeling on the ground, if you will.

Look, I mean, the Rubrik has this fortunate situation to have this secular market trend around cyber and cyber recovery. Cyberattacks are not abating. If you think about the new administration is going to be a very business-focused administration. A little bit of a deregulatory effect in the business will lead to more business investment because the top line will be healthier. And when your businesses expand, you have more data in more places, more cyberattack, industrial [indiscernible], IP theft. So if anything, we believe that Rubrik is positioned well in the right market. Obviously, like any other business, we'll be very prudent in terms of where we invest and how do we create ROI from our investments. Again, as I said, I'm a capitalist. I love cash flow, I love profitability. We are here to not only capture the market opportunity, but really create a long-term profitable business. And we'll make sure that we have the right balance of capturing the market opportunity and trying to fast -- grow as fast as possible, while ensuring that we have a profitable growth along the way.

I couldn't think of a better way to end that session on that. So with that, let me thank Bipul and Kiran, thanks so much for being with us here today.

Thank you, Saket.