Rubrik, Inc. (RBRK) Earnings Call Transcript & Summary

This is a very special session. Can you hear me loud and clear? Welcome to Day 3 of Goldman Sachs Communacopia Technology Conference. This is the fourth year in a row that we rebranded this conference and merged 2 or 3 business units, not just coverage areas together to create Communacopia Technology, and registration is up very nicely. We crossed 3,000. I know in the industry that's not the [indiscernible] 3,000-plus, up mid-single digit...

It's a huge number.

It's a really big deal. I will turn it over to Bipul in a second, but I want to tell you very a good story. The year is 2013 or so?

'13-'14.

Yes, 2013 or '14, you had started the company, it was an idea. I still remember literally how there was a white board and you drew on a white board, the idea behind Rubrik, and I was just spelled on, okay? So distributed systems in a cloud world, I mean, this is like yet another technology inflection and yet another idea that is poised to benefit from the new architectural approach to how everything changes with the cloud. And 12 years later, they are a public company. I was delighted to work on your IPO. And the IPO is not everybody got it. It was a tough idea to buy into. But here, you are one of the more enviable multiples of revenue and cash flow. So congratulations on turning over the best of sentiment and earning a credible spot on people's mind. I mean that's really well done -- very well done.

As I said, we are still in the early days of Rubrik. And I'll -- I accept your congratulations, but I'm happily dissatisfied because Rubrik will always be a misunderstood company because Rubrik will always be at the frontier of innovation. And I used to be an engineer and then I became venture capitalist and now Founder, CEO. And I always believe that the best companies are counter consensus and misunderstood. That's when the value is created and that's when value is realized. So I would say we are still evolving. We have just put our initial kind of -- through our initial salvo into AI. We are defining what the AI acceleration would be in the enterprise. And we're constantly changing and evolving. There is a impermanence to Rubrik, let's just say that.

I like that. And I'm going to ask you my opening question.

We've not even opened this conversation yet. It's just going to get started. But I have to tell you something that came out of our fireside chat last year. You've been on the fire side as a private company. And every time we do this, I learned something about Rubrik, I learned something about you. But last year, you said -- somebody said I should go get an MBA. So I decided to go to MBA [indiscernible] and as a target was too easy compared to engineering which is too easy and decided to come back and do something in tech. I probably... On that note, how has the vision of Rubrik changed in the last few years? And one of the things about you that I like is your -- you adapt, you adapt, you adapt. Some entrepreneurs have stuck with the vision when they found the company, and it's that vision, and they just march towards it. Whether it comes to fruition or not, they haven't made course corrections or not, they don't generally do a great job being flexible, but you've been so flexible in adapting. How do you see the last few years for Rubrik? And how do you see the road ahead to the extent that you can for the next 4 to 5 years?

I love market. I don't love technology. And that's a very bad thing to say for a technology CEO. Because what -- a lot of times, what happens is that technology people fall in love with technology, and they don't track the market. But market is where the truth is. Market is where the demand is. Market is where transformation happens and market is always changing. So what you need to have is a very strong sense of where you come from. So we came from backup and recovery, which means that we have all the enterprise data in a single place. And we use that enterprise data to recover businesses, application services from cyber attack. But we are not stuck on that idea of recovery. We are stuck on the idea of all the data. And then how do we constantly evolve to make that data more useful, more productive, more beneficial to our customers. And that is what we have been pushing. So our step one was that data should transform backup and recovery industry into a cyber recovery like Play. The next was cyber recovery itself is not enough because you need to also understand risk if you're really ready for recovery. So we expanded the whole idea into cyber resilience and created this whole paradigm that you should assume breach. And if you have to assume breach, you need to understand the risk and be able to do the recovery. Now what we are seeing is our customers want to accelerate their AI journey. And if you think about AI acceleration in the enterprise, there are 2 facets to it. One is, do you understand the risk of AI adoption, agentic adoption? And are you able to deliver AI in an accurate and cost-effective way? And in both these scenarios, data is the critical piece because data can be used to assess the risk and data can be used to deliver more accurate results because you can fine-tune model using the data. So we acquired a company called Predibase. They are the model fine-tuning and inference serving platform. So as you can see, it's kind of like you never forget where you come from because if you forget where you come from, you belong nowhere. We belong in data. But data is not our be all and all. We are in love with our customers and market.

That's great. And my colleague, Matt Martino watch this space. It's going to be a big shot one day. But before I have him jump in discussion, I wanted to sound like I'm half as smart as Matt Martino and ask you a couple of questions. The installed base of this industry has been around for a very, very long time. One of the things that I remember we're telling me several years ago is that this is a B+ space, and we want to be an A+ company in the B+ space, right? When you look at the installed base that's still running decades long legacy, what is the path ahead for Rubrik? How easy has it become to displace incumbents and become the new system of choice?

Displacement doesn't happen just because you have a cheaper technology or displacements doesn't happen just because you are a little bit better. Displacements happen when you have quantum shift. And quantum shift, me as a venture capitalist, has always been that can you create 10x value for the customer so that they are compelled to change. And if you look at the world today, every enterprise have spent like millions of dollars between 80 to 100 different technology to prevent and detect cyber attacks. And I will be as bold as to say that this whole cyber industry has been a bogus industry because where else you will spend $200 billion and still get attacked every day. So the strategy has to change. And that new strategy has to be one of resilience and recovery that assumes breach. And when you say I'm assuming breach and I'm ready for cyber attack because 1%, 0.5% of attacks will be successful. And how do I keep my business up and running? How do I have integrity in my data? That's the compelling 10x reason for people to change. Just because you have legacy technology, it doesn't mean that you can recover from cyber attacks. And people are learning this the hard way. I mean, look at Marks & Spencer, look at UnitedHealth Group, Change Health, look at MGM. These are all proofs that just because you have a legacy backup, just because you have a backup team and just because you have best practices around recovery, it does not work for cyber, because cyber is a completely different game.

Bipul, you've spoken in the past about the importance of layering concurrent S curves. Data protection was the first. You're now making strategic bets on DSPM and identity recovery. What gives you the conviction that these two markets represent the right S curves for Rubrik's next chapter of growth?

If you look at the last 5, 7 years of evolution of cyber attacks, hackers are not hacking in, hackers are logging in. They are behind firewall, behind your VPC. And why is that? It is because of the ubiquity of computing, personal devices and our inclination to click on an offer. So identity theft, a credential compromise has become the #1 cyber attack vector because now attackers are not technically trying to outwit us. Now they are trying to psychologically outwit us. They are creating like psychological compulsion loop in the name of an offer or a friend request or text message. And before we think our system on thinking clicks on it. So as a result, identity and identity protection has become a huge issue. The issue with our industry has been in cybersecurity, identity has been seen as an infrastructure. Can we allocate identity, Okta? Can we do PAM, you have CyberArk. Can we actually do access management, you have SailPoint. These are all infra side of it. And if you look at CrowdStrike is doing a great job in identity threat and response, just like SoC. But there is a space in between where you say if an identity is compromised, how do I know how much data is at risk because identity companies have never looked at the data side of it. But that's the biggest risk. If there is a privilege escalation, how much of a new sensitive data comes into the picture so that if you have identity compromised, what is the blast trade is? How do I understand what is going on to my sensitive data? And all the great things happen at the intersection of two unrelated or seemingly unrelated stuff. That's where we see the opportunity of bringing identity with data to really create an identity resilience platform that goes from preparation stage that do you have misconfigured identity, misconfigured data to threat stage where you say is somebody actively changing identity or escalating the privilege in a way that is detrimental to your posture. And if your identity system gets compromised, how do we recover it, so that to back up and running in terms of hours, not days and weeks.

So Bipul, is this white space? Is this new budget that you're unlocking? Or is this displacement spend? Like maybe peel that back a little bit for investors to understand kind of the TAM opportunity here.

I always like displacement market because it's very hard to create a new line item specifically for CISO because they are tired of buying tools. And in some ways, they're trying to consolidate. So they are already spending money today with legacy platforms on identity recovery. But those legacy platform has no data visibility. Those legacy platform doesn't have the full gamut of identity resilience as we are bringing the solution into the picture. So it's about going after legacy replacement or new gen replacement with a value proposition that is 10x better. And that's the sweet spot that we want to be.

I want to touch on that security budget point. You've talked a lot about in the past of moving deeper into CISO led budgets. How far along is Rubrik in that transition today? And at maturity, what does that mix look like between traditional IT spend and security budget?

I think in the last, I would say, at least 5 years, there has been a convergence of IT operations and security operations. In fact, in many large banks, the infrastructure leader is also the CISO. And this is a trend that we have been actually advocating for and anticipating for many years. And what we are also seeing is that now CISOs are directly involved in Rubrik purchase. And in some ways, they made the decision for Rubrik. Very large oil and gas company have never met anybody outside of CISO. So that is happening. And then as -- then on the other side, this identity recovery resilience is a CISO budget. So now we are tapping into it. So we are taking this journey of like converging infrastructure security. And again, we are equal opportunity money taker, whoever gives us money, we take it.

I'm curious, when you look at the last several months, it seems like Rubrik continues to expand their workload coverage across SaaS, databases, on-prem. At what point does that breath creek sort of a tipping point for your customers to sort of consolidate their entire estate on Rubrik? Are you finding that more and more?

So data protection market is expanding because it used to be just the data center. And as the critical applications have been moving into the cloud, is cloud, now M365, identity systems, Salesforce, these are all mission-critical applications. So as the criticality of these applications grow and as applications also becomes a scattered, there is more of a need of a centralized platform with single policy control and single management to be able to control and holistically understand the data threats. So the need for Rubrik will grow as we see more of a diverse set of things and AI and AI agentic world make it even worse. Because if the problem even worse and need for Rubrik is even more. Because if you think about it, AI agents are not generic systems. AI agents are a specific system because they are replacing human labor. And human labors do a specific work in the enterprise. So it's custom AI. So in the AI world, you'll get two kinds of AI. I call it Infrastructure as a Service AI, which you build those AI agent yourself in your own environment or cloud environment. And then you have PaaS AI, such as M365 agents or Salesforce agents. And you have to bring both together to holistically run your agentic world. And now think about you have a multitude of this Infrastructure as a Service AI across different clouds. And then you have PaaS AI across different systems, you need a centralized management and control and policy enforcement to be able to secure and undo the unwanted work of these agents.

That's fascinating. I want to touch on the AI piece. Your launch of Annapurna is centered on providing enterprises with secure access to their data to build GenAI applications. Given how many platforms are vying for this opportunity? Why is Rubrik uniquely positioned to win here? And how critical is this to the long-term growth story?

The way we think about enterprises, Rubrik has some fundamental architectural advantage because Rubrik reflects the production permissioning on the Rubrik data. So users don't have to repermission for the usage. If you have any other data lake or warehouse, you have to repermission data. So we have that advantage. But we are not trying to become, again, a data company. We see where the customer is and what problems we can solve for them. So our idea is that how do we connect with secure data into fine-tuning model so that we can deliver accurate result. That's why we acquired Predibase. We also see an opportunity that as people are now like using agentic applications, if agents and agents are probabilistic systems, they can hallucinate. As a result, you may have to undo the unwanted work of an agent, and you saw what happened with Replit when the agent went around creating havoc. So as you can see, we are connecting the dot from data into model tuning, to agentic operations and applying undue for unwanted actions. So that's the kind of path we are taking.

I just had one interjection before I turn it back to Matt. How much is the agentic application discussion a part of your sales cycles? Are people actually making decisions tilting towards Rubrik based on the perceived threat from agents? Or is that something that is at the back of your head and you say, "Okay, when agents get deployed, we're ready to tell our story."

When we were actually internalizing agents and did the announcement for agentic AI, internally, we thought that it's a day 1 or day 2 problem, it's not a day 0 problem. But the number of like unsolicited requests that we have gotten for briefing indicates that there's a high degree of awareness and inclination to understand the operationalizing of agents. So my thinking is that businesses are still in the proof of concept and then going from proof of concept into production and value realization requires operationalizing of these agents. And operationalizing means that high accuracy, you need to have 90% confidence interval in the results. Otherwise, you'll have cascading errors. You need to have ability to undo. You need to have to trace. You need to also find control who has access to what. So these are the problems in their head. And one last thing I'll say is that last week, I met with the CIO of a large semiconductor company, and I was showing them our vision of how the AI world would be. And he said that this is the most brain crushing meeting he had in the last several weeks. In the sense that he was really technically force to reckon what it means to run an agentic AI system. So again, it is top of mind, but from top of mind to actual operationalizing, there are some steps that are needed. And we believe that Rubrik will have a place to play in that market.

So aren't rogue agents playing the role of bad actors, but in an agentic world. So the purpose takeaway here is that something bad is going to happen in the agentic world and you're going to have to trace it back to the data or recover the data. So it's almost like you would benefit if agents go rogue. Just don't -- which is not what you want to have happen, but the assumption is that cybersecurity has failed to solve the problem proactively, but we are here to fix it. So the same kind of logic applies in a perverse way in the agentic world.

The only difference with agent is that there are two reasons for perverse action. One is the malicious reprogramming or deprogramming of the agent. And the other reason is that agents are probabilistic system. And if you have a probabilistic system. It can hallucinate and it can bear in a direction that you didn't anticipate. But these agents have full authority to take action on your behalf. So the cascading issues whether it's data changes or system changes or calling other agents because agents will be autonomous unit and folks will do agent orchestration. So if you're doing agentic orchestration and if first agent creates 80% good results and the second agent creates 80% good results. And if you trigger both at the same time, your results could be garbage like a coin cross or close to it. So that's the -- those are the challenges that are not natural to just the cyber aspects of it, but it is purely operational probabilistic aspect of it. The issue is that as a consumer you go ChatGPT or perplexity, you can deal with 60%, 80% good results. Because now you are actively looking at it and then trying to make decisions. And you're not like actually taking action that could have a irreversible impact. For in a business setting when you have a fine chunk of work that somebody has to execute and make a decision, if your systems hallucinate or makes wrong calls, the repercussions are very high. That's why the agentic adoption has a higher barrier in the enterprise, and that's where we believe we have our opportunity to fine-tune to be able to serve at a lower cost, do the Agent Rewind that we announced, plus, plus, plus.

Agent Rewind, sounds like a...

We actually announced the product, Agent Rewind.

I want to piggyback on the AI piece. I'm curious, Bipul, just high level. How you think about AI evolving kind of the threat landscape? And how CISOs are sort of posturing against that and where Rubrik fits into this?

So the way I think about AI is two pieces. One is the AI security. So if you look at purely AI security, it's no different than traditional security. Because AI systems or data systems, AI systems are database orchestration systems. So there is that world. And then there is a world of guardrailing AI. And guardrailing AI means that AI reserves have to be tracked identity and access management has to be fine grained and also probabilistic. And that piece of the agent is specific security is going to be different. And so folks have to attack this problem in two ways. General purpose AI security is like just today's security. There is no difference. You need to have your endpoint secure, you need to have your browser secured. There's no real difference.

Bipul, I want to talk about the business momentum. More recently, you reported 2Q results last night. If you think about the broader software landscape. There still appears to be some macro headwinds, but Rubrik has done a nice job executing. So I guess what would you attribute that success to? Is it just the growing importance of cyber resilience? Is it a TCO dynamic that's resonating with customers? Can you talk to us a little bit about what you're seeing?

We had an exceptional quarter. We grew top line north of 50% and generated 19% cash flow margin. This combination of top line growth and profitability is rare at our scale. And it is a testament to our maniacal focus on delivering cyber-resilient, cyber recovery because all our customers have invested so much money in the prevention and detection, from endpoint to cloud to SaaS, to network, to everything, [indiscernible] And they now realized that if they need to have a higher posture switching one firewall to the next is not going to do it. The way it has to happen is that they need to have a firm cyber resilience posture. And that's why we believe that the cyber resilience is the #1 cybersecurity category. And our customers are replacing legacy, replacing new gen vendors, really looking for ability to detect malware, detect threat in the data, isolate it, deliver clean recovery. And our differentiated platform, which is the preemptive recovery engine in Rubrik Security Cloud, we -- against our competition, we are winning vast, vast, vast majority of deals because nobody has this capability that we deliver.

As you say, Rubrik's done a good job delivering high growth and accelerated margin expansion. What are the structural reasons you can continue to deliver operating leverage even as you continue to invest heavily in R&D and new product capabilities?

As I've always said, I come venture capital background. And in my view, if the business has no profitability, you have no business because business job is to create value. And value only accrues if you create cash flow because all the value is in the future cash flow that's going to generate, will generate. So in my mind, I look at two things. Do you have a high gross margin and fast, fast growth. And then are you running your operations in a way that uses the gross profitability in the most cost-effective way to generate cash. And so Kiran and I partnered on this and we're manically focused on how do we build a high efficiency, high growth business. Not an easy thing to do all the time because we are in a very large market with very unique products. But we both also realized that win at all cost and burn a lot of money to win is not a sustainable thing, not just for business but also for the culture of the company because the company has a culture of high bond and win at any burn, it is very hard to change that culture to be more disciplined culture. So we actually always thought about how do we create a culture that is frugal that understands how to use dollars and create high ROI, at the same time, aggressively invest in areas where we see high ROI, as well as aggressively invest in markets where we believe that we have to win that market for long-term profitability. And that's the balance that we are establishing.

I want to touch on consolidation. Cohesity's acquisition of Veritas' data protection business, landscape appears to be shifting a little bit. What's your view on whether scale or innovation will matter more in the next phase of competition?

So let me take a step back and give you my framework of consolidation. In any market, when the market transitions, look at phone market. When iPhone came, it transitioned the phone market from calling and texting device to an Internet device. And what happened after that. Blackberry went away, and Nokia and Microsoft merged to survive. And now you know the results. Similarly, Rubrik transitioned backup and recovery market into a cyber resilient, cyber recovery market. We changed the use case. And when you change the use case, the existing player to survive, try to merge to build a scale. But you can't take 2 pebbles for a swim. And you can't have 2 companies with 90% product overlap and people overlap and everything else and say, "I'm going to innovate on 2 things." These are all theoretical and sounds very good. But if you ask an investor why did he invest in the combined entity, they want profitability, product rationalization, people to be fired. So this consolidation is not in a happy situation. And any consolidation like this with so much overlap only happens in a stressful situation. And this is a natural order of things. The market use case is transitioning, and folks are trying to survive. That's like constructive destruction that we are all used to in technology. And also the technology space is evolving. So now think about a fast evolving pace of technology from cyber recovery, cyber resilience, AI. And in this one, if you have like the heavyweight merger and figuring out to products and consolidate all of that, you lose time.

I had a question, if I could intersect. I think you invented the term cyber resilience. I mean, so you're not only good technologies, but you're a good marketer as well. At your customer base, 7,000 customers, it would seem to me that if this cyber resilience category were to become mainstream like databases or firewall that you should have a customer base that should be 100,000-plus. So what are you looking to do as you scale the business from $1 billion to $10 billion plus? What are the things that you should be doing from an operational standpoint, executive alignment, bringing in new people, channels, market awareness, integration, partnerships, how do these things change for the company?

That's actually a very good question. Because if you look at the market that we operate in, it's a global market with many markets inside global markets and it requires high scale. In many cases, we are replacing legacy vendors. We are replacing legacy big companies that have this offering on the side. So our way to win is always is through partnership, whether it is our channel partners, global system integrators, whether it's our strategic alliance partners such as Microsoft, CrowdStrike, Zscaler because we need to create an ecosystem to really attack this market, because we can't hire people and scale people to win this market. And that's what we are doing. We are focused on figuring out the routes to market that are efficient, routes to market that are compelling for our customers. And figuring out like can we build technology with our partners with CrowdStrike, Zscaler, Microsoft that 1 plus 1 is greater than 2. So that for the customer looking out, they feel like they're getting more value for their investments. And as you know, the adoption bell-curve you will always have a late majority that you want to go and convince the late majority. And number one is, are you ready to recover from cyber attack? And how long will it take for you to recover? That's a compelling question. And then, by the way, Rubrik enhances the value of the ecosystem for your cyber posture, cyber recovery, AI enablement, AI acceleration. And those are the things that will help us go and get the large share of this market.

Well, on that note, we wish you really well in your journey to 10x. You like 10x. So...

Always.

I hope you get to be a 10x from here. My best wishes, and thank you for your support of Goldman Sachs, and we'll have you back next year with this guy driving a lot of it thought leadership, hopefully.

We'll miss you, Kash. You have been such a big part.

I'll be sitting in the audience, asking you really tough questions. Great. Thank you so much.