Rubrik, Inc. (RBRK) Earnings Call Transcript & Summary

All right. Good morning, folks. We're going to get started in the interest of time. We have a pleasure to have Bipul Sinha, CEO of Rubrik here this morning. Welcome back to the conference, Bipul.

Thanks, Matt.

Right. Well, let's get started. So Bipul, you've called this a singularity moment for AI and cybersecurity. As enterprises become increasingly reliant on AI systems and autonomous agents. What do you think changes most about the way organizations think about risk and resilience?

We have been talking about this for the last many years that prevention and detection is not sufficient. Folks have to really think about recovery and resilience because you can't prevent the on preventive. And what Metros and frontier models have shown us that you can't really prevent and detect anything because these attacks are at machine speed. And at machine speed, you can't prevent all the technologies that we have built for cyber in the last 20, 30 years was built for a human operator and human attackers. We are in a completely different era. So this is a new moment. And all you can do is to think about how do you patch your systems at machine speed and how do you deliver cyber recovery at machine speed. And that's what Rubrik is solving for our customers, doing a cyber recovery at machine is speed.

Okay. And even over the last 2 years, I think Rubrik started with backup, you evolved into cyber resilience, and now you talk about security and AI operations. So when you connect those dots, what do you ultimately want rubric to become? 3 years from now, what do you think customers will be buying from Rubrik that they're largely not buying today?

So our goal is to deliver resilience to every aspect of operations. What are the different things we do. Number 1 is data. So we want to ensure that your data is recovered and your applications are up and running. Number 2 is identity. Because we want to ensure that the data risk comes from identity and identity systems are up and running, and they are in the correct state. And then the third piece is AI. As we know, agents assume identity and operate on sensitive data. So you need to have resilience and security for agents. So how do we ensure that agents are only taking the right actions. And if they do bad action, how do we remind the action of agents. So we are very clear. There are 2 major trends in the market, AI and cybersecurity Underneath ARM cybersecurities identity and data, we want to deliver complete cyber resilience across data identity and agentic world.

Okay. You talked about prevention and detection alone not being enough. I think you've been very consistent in that message. So if attacks are becoming increasingly autonomous and continuous. What does the security architecture ultimately look like on the other side of that shift? And where does Rubrik sit within that architecture?

So in my mind, since attacks are going to be at machine speed. It will be a world of continuous attacks. Today, operations in cyber are two different teams and two different things inside any business. I believe that these two operations and security will merge. And you will have a situation of continuous attack and continuous recovery and continuous patching. And in this world of continuous attack and continuous patching, you need to have a human in the loop at the very, very minimum level where the humans are making decisions, but machines are implementing this -- and this is where the cyber is going to go. It's going to be a world of no human in the loop patching, mostly no human in the loop recovery.

Let's pull that into the most recent quarter. Net new ARR accelerated to 35%. You raised the full year guide. I guess, a 2-parter here. One is what felt different in the business this quarter? And then I guess, if we dovetail off previous question. Are you seeing Rubrik sort of increase in relevance within sort of the security get more broadly? Like how is that shaping customer conversations today even relative to a year ago?

If you think about this idea of [indiscernible] and frontier AI and machine speed, businesses, particularly Board and CEOs are realizing more and more that cyber has gone from a technology discussion whether it's endpoint, network, cloud, Zero Trust network, all of that mumbo jumbo to a risk discussion that can we keep our business up and running. What is our dollar address should we go down for a day or 2 or 3? Do we have a situation where my large manufacturing will come to a screeching halt is because of the ransom attack or cyber attacks. So that's the discussion now. And Rubrik plays in that discussion because we are giving experience to our customers saying, no matter what happens, whether it's AI attack, human attack, machine speed attacks, you'll always be up and running. Because of our preemptive recovery engine. We precalculate a clean data estate in peace time to be able to deliver a machine speed recovery. And this message is resonating Obviously, Rubrik is a considered purchase, we are not like a Facebook app that millions of people download overnight and we won the market. So there will be a process. But I like that process because at the end of the day, I want us to have consistent high growth for many years. And we believe that we are set up for it.

Okay. Now A lot of the strategy increasingly is around data, identity and agents, right? So you broadened the aperture from just pure cyber resilience into some new categories. Why is it important to see all three of those together? And what can Rubrik do with that combination that customers can't get from separate point solutions?

Let's just take agents. If you think about genetic security and governance, there are many pieces to it. You need to have visibility into all your agents sanctioned or unsanctioned. Second piece is, can you do identity-based just in time regulation on activity of these agents. That's the net. So that's an identity-based MCP server level, which database, which entity these guys can update. The third one is runtime security, and this is where the intent understanding of agents are important. What happened in the Open AI hugging phases, these agents to get to a goal they actually circumvented the gardens that was built for them. So you need to understand the intent of the agent and check the intent on every interaction of the agent to be able to stop the Agentic action on run time at the point of action. And then finally, the refined piece that if the agent still does something that is not desirable, how do you undo it. Folks are now buying observability from one vendor, identity from a different vendor, runtime security, intent from third vendor and agent rewind or recovery from a fourth vendor. We believe that businesses need a consistent, fully integrated agent security and governance platform. And Rubrik has the vision and the path to deliver that.

Just on the Open AI hugging face point, right? I mean, I think in the past, you've seen a lot of basically major brands ransomware attacks creating a catalyst for new spend within category. To what extent are you actually seeing that play out in your own customer conversations and pipeline, particularly for agent cloud?

I mean hugging face incident is new, and the word is getting out in the last few weeks, but if you look at like all the write-ups around it and what is new is that there were attacks in Europe and in America coming out of are largely innocuous testing and sandboxing of agents. Just think about if it was a malicious kind of a situation where somebody designed these agents for attack and the goal was to attack. The goal here was to -- was different, we would be -- we have a completely different outcome. So now folks are realizing that agents and AI is making the world more dangerous. And obviously, AI has tremendous promise of like productivity and benefits but it also creates 100x more risk. So now they are looking at a world where you have 100x more opportunities, but it can also do 10x more damage at 1/10 of the time. And that's what they're grappling with.

Okay. Let's pivot to identity. I think it was sort of interesting your disclosures at the Analyst Day, you showed how enterprise data security scaled to $100 million in 2.5 years. You did that with identity. It's $50 million in just over a year. So Tell me about your sort of aspirations for the identity business more broadly. Could this be the next several hundred million dollar business? What are the biggest factors that determine how large that opportunity becomes?

Look, data security fundamentally is impacted by identity because user interaction on data is what creates risk. If you have more user interaction or an entity interaction on sensitive data, you have more risk. So identity is critical for enterprise data security. And what we are also seeing is that identity has become the perimeter for enterprise. Hackers are not breaking in. They are logging in. And as a result, identity systems have become ground 0 for cyber attack. You have issues around destruction of identity systems, persistence persistent identity where identity bad identity persists for a long period of time. And you can't just undo the identity system because then you'll not just under the persistent bad identity but you will also bring your x employees back into the system. So how do you undo and redo both together undue for all the identity changes and redo for only good identity changes so that you bring the identity system in a correct state. All these are very difficult problems for our customers to solve, and this is what Rubrik is delivering in the marketplace. If you look at the identity systems, it's not just 1 or 2 systems. You have active directory, you have [indiscernible]. There's just a number of identity systems and you need consistency and recovery and removal of persistence across all of these. So we believe that it's a tremendous opportunity. We are in the early innings of it. I can't tell you here that if it is bigger than data protection or smaller than data protection, but if you look at the growth rate and acceleration in this market, we are very excited.

And then maybe another way to think about this, just I think Rubrik has traditionally priced identity like per heartbeat, if you will. With nonhuman identities, I mean, we've all seen the statistics 8:1, 10:1. I mean how are you thinking about maybe evolving the pricing mechanics to kind of capture that opportunity as we start to see a lot more agents running on our behalf.

I mean, look, we'll work with our customers. We learn from the market as how they want to protect the nonhuman identity or Agentic identity, maybe Agentic identities could be more important than human identity in the next several years. Ultimately, our goal is to meet where our customers are, create value for them. And I'm confident that monetization will happen.

Okay. I want to get your perspective on a more recent development within the business, which is sort of self-hosted and sovereign. You guys have actually started to see a bit of an improvement in that business. And it's not just rework specific. We're starting to see that across broader software. From your lens, what's driving that trend? Are customers thinking differently about where critical data and AI workloads should live? And does that make this a more durable opportunity than investors appreciate [indiscernible].

This has been the trend for the last few years. And I'll give you an example. I was in Germany and talking to one of our very large customers CIO and she came into the room and first question he asked was that BiP, we are using your cloud and what if you guys decided to shut down the cloud for us because of geopolitical situations or the geopolitics risk. And so everybody in lots of countries around the world are thinking I want so vent in terms of operations. Sovereignty in terms of data, sovereignty in terms of infrastructure, locality. So we are giving them Rubrik Security Cloud, private addition to ensure that the sovereignty is maintained. And sovereignty is not always going into their own data centers, it could be colocation, it could be a bunch of controls around cloud and cloud is hosted in the right country. So there is a lot of flavor to it. But ultimately, I believe that geopolitics will force more localization. And we have the solutions to meet our customers where they are. So we believe that the non-cloud sovereign on-prem deployments, particularly international could be a good part of our business.

Okay. And then let's talk about Flex. You introduced a new consumption model. I think this sort of defines your pivot from, let's say, more cyber recovery to a broader sort of platform play. What kind of early customer feedback have you gotten there? And with the early deployments under your belt, like, what are you learning? Is it changing how customers evaluate, adopt or expand with Rubrik in ways that you expected or perhaps didn't expect?

If you look at our business in the last, say, 3, 4 years, we are now a fully fledged platform play with many different products that has this complementary network effect. What I mean by complementary network effect is if customers adopt more than one product on Rubrik platform, the value of all the products go up. For example, if they're protecting data and start to protect identity with us, now we can give them information about threat actor on both sides of the equation. Same thing with data center in the cloud. If the protected data center, if they add cloud, we can immediately tell them if the same threat actor or the securities posture is same different across these two and because of 6, 7 different products that we have on our platform, every time we wanted to introduce a new product to the customer, you have to go do a new contract because we didn't have a vehicle on which we can add new SKUs or have them try new things. Plus, they are buying many different products. They don't -- they want to swap one further [indiscernible] customers go from on-premises to the cloud. They want to increase cloud more and reduce on-premises or the vice versa. So they need flexibility to have one contract, one commitment, one purchase across 6 or 7 different product suite that Rubrik has. And Flex made more sense to give our customers flexibility so that they can actually buy and consume Rubrik in a consistent way.