Rubrik, Inc. (RBRK) | The Buildout — AI Infrastructure
The Verdict
Rubrik sells cyber resilience software. Its Rubrik Security Cloud suite back-ups and recovers enterprise data across on-premises systems, cloud, SaaS applications and identity providers, with the aim of restoring clean data after an attack. In fiscal 2026 it added Rubrik Agent Cloud, which monitors and controls what AI agents do. The pitch is that AI-powered attacks move too fast for detection alone, so recovery has to be pre-planned and machine-speed.
| Market Cap | — |
| Revenue (TTM) | $1.5B |
| Revenue Growth | +42.4% |
| EBITDA Margin (TTM) | -14.9% |
| Net Cash | $615M |
| Earnings Beats | 7 of 7 |
| P/E (TTM) | — |
| EV/EBITDA (TTM) | — |
What We Like
- Subscription ARR was $1.66B at July 31, 2026, up 33% y/y, and net new subscription ARR grew 35% y/y — a rate management called an acceleration.
- FY2027 guidance was raised across every metric in one quarter: subscription ARR to $1.88B–$1.885B, revenue to $1.685B–$1.693B, non-GAAP EPS to $0.47–$0.53, free cash flow to $323M–$333M and contribution margin to ~15.5%. Both raises were organic; Strata Identity was assumed at 0 ARR.
- Subscription ARR contribution margin improved to 14% LTM from 9.4% a year earlier, and free cash flow was positive in each of the last four reported quarters.
- Identity Resilience went from nothing to more than $50M in subscription ARR in "just 4, 5 quarters," and Q2 FY2027 closed the largest international identity deal in company history.
- Customers with $100k+ subscription ARR reached 3,084, up 23% y/y and 88% of subscription ARR, while the $1M+ cohort grew over 57%.
What We’re Watching
- Back-half net-new ARR: the FY2027 guide implies a step-down from the first-half pace, and the Q3 FY2027 quarter ends October 31, 2026 — the first read comes with those results.
- Rubrik Agent Cloud ARR: no figure is disclosed and none is assumed in FY2027; management says it will keep investors updated as the year progresses.
- Identity Resilience disclosure: the >$50M subscription ARR figure given in Q1 FY2027 was not updated in Q2; watch whether the number resumes and at what growth rate.
- Channel concentration: Partner A and Partner B were ~56% of Q1 FY2027 revenue, and the next quarterly filing shows whether that dilutes.
On the evidence, the operating thesis is strengthening: subscription ARR grew 33% y/y, net new subscription ARR growth accelerated to 35% y/y in Q2, and guidance was raised across every metric one quarter after the previous raise — with Strata Identity contributing 0 ARR, so the raises were organic. Contribution margin and free cash flow both moved the right way, and the customer base is expanding at the top end, with 88% of subscription ARR now coming from customers above $100k. The open question is whether that acceleration is structural or a first-half pull-forward: the full-year guide implies a sharp second-half step-down in net new ARR, and management reframed that question to the annual basis rather than explaining the slope.
Earnings Beat
Rubrik's fiscal Q2 2027 (quarter ended July 31, 2026) produced total revenue of $427.3M, up 38% y/y, with subscription revenue of $407.2M, up 37%. The company's non-GAAP gross margin was 81%, versus 81.6% a year earlier. The standout metric was net new subscription ARR: about $96M, below the $103M booked in Q1 but up 35% y/y — the first-half growth rate management described as an acceleration.
| Metric | Q2 FY2027 | Q1 FY2027 | Q2 FY2026 | YoY |
|---|---|---|---|---|
| Revenue | $427M | $387M | $310M | +37.9% |
| Gross margin | 78.4% | 80.5% | 79.5% | -110bps |
| EBITDA | −$52M | −$41M | −$86M | −39.1% |
| EPS | $-0.30 | $-0.21 | $-0.49 | −38.7% |
| Subscription ARR | $1.66B | $1.57B | n/a | +33% y/y |
| Net new subscription ARR | ~$96M | $103M | n/a | +35% y/y |
And this quarter, we accelerated — yes, let me repeat, accelerated net new subscription ARR growth.— Bipul Sinha, CEO and co-founder, 2026-08-27
Management tone: Q2 carried the same confident, beat-and-raise register as Q1, with management citing a 10th consecutive quarter of outperformance as a public company. Language about AI security intensified: Q1 called Anthropic's Mythos "a powerful breakup call"; Q2 called it "a singularity moment" and cited a Hugging Face incident in which an autonomous agent exploited a zero-day. Three shifts stand out. Net new ARR framing moved from Q1's dollar record to Q2's year-over-year growth rate. Rubrik Agent Cloud moved from narrative to a count of more than 15 paying customers. And the Identity Resilience ARR figure given in Q1 was not updated in Q2, with a record-deal anecdote substituted. On questions, management was direct on Strata's 0 ARR, RAC readiness, non-cloud margin and hardware lead times, and reframed the back-half net-new ARR deceleration to an annual basis.
Management Guidance
Management guided FY2027 subscription ARR to $1.88B–$1.885B, total revenue to $1.685B–$1.693B, non-GAAP EPS to $0.47–$0.53 on about 228 million weighted-average shares, free cash flow to $323M–$333M, and non-GAAP subscription ARR contribution margin to approximately 15.5%, with about $18M of material-rights revenue for the year. For Q3 FY2027 the guide is revenue of $429M–$431M, described as up 23% or up 31% when normalized for material rights, material rights of about $2M–$3M, contribution margin of approximately 14%, and non-GAAP EPS of $0.07–$0.09 on about 230 million shares. The company said Strata Identity is assumed at 0 ARR for the year, and that revenue growth normalized for material rights is expected to outpace subscription ARR growth.
Trajectory
Revenue has risen in each of the last ten reported quarters, from $187.3M in Q1 FY2025 to $427.3M in Q2 FY2027. Reported growth is decelerating — 39% in Q1 FY2027 and 38% in Q2 — because material-rights revenue is unwinding: $8.5M in Q1 FY2027, about $4.7M in Q2, and guided to about $2M–$3M in Q3. The company says revenue normalized for material rights grew 43% in Q2 against 38% reported. On the reported figures' basis, gross margin slipped from 81.2% in Q3 FY2026 to 80.5% in Q1 FY2027 and 78.4% in Q2 FY2027, and the company attributes the Q2 non-GAAP step-down to 81% from 82.9% to lower material-rights revenue and mix. The EBITDA loss narrowed to $(52.4)M in Q2 FY2027 from $(86.0)M a year earlier, and free cash flow has been positive in each of the last four quarters.
The Model
The model's FY+1 projection is $1,710M of revenue and $(174)M of EBITDA, a (10.2)% margin. FY+2 is $2,190M of revenue and $(59)M of EBITDA, a (2.7)% margin — about 28% more revenue than FY+1 while the EBITDA loss narrows close to break-even. The near-term anchors are the FY2027 guide, which management expects to be organic (Strata and Rubrik Agent Cloud both assumed at 0 ARR), and a mix where non-cloud and sovereign demand grows at a higher reported margin than cloud. FY+2 depends on whether identity and agent security become disclosed revenue lines rather than narrative ones.
| Metric | FY2026 | Next FY (E) | Following FY (E) |
|---|---|---|---|
| Revenue | $1.3B | $1.7B | $2.2B |
| YoY Growth | — | +29.9% | +28.1% |
| EBITDA | −$308M | −$174M | −$59M |
| EBITDA Margin | -23.4% | -10.2% | -2.7% |
Projections are the median of 5 independent model runs. The model’s revenue sits 5.1% above analyst consensus.
Management guided FY2027 subscription ARR to $1.88B–$1.885B, total revenue to $1.685B–$1.693B, non-GAAP EPS to $0.47–$0.53 on about 228 million weighted-average shares, free cash flow to $323M–$333M, and non-GAAP subscription ARR contribution margin to approximately 15.5%, with about $18M of material-rights revenue for the year. For Q3 FY2027 the guide is revenue of $429M–$431M, described as up 23% or up 31% when normalized for material rights, material rights of about $2M–$3M, contribution margin of approximately 14%, and non-GAAP EPS of $0.07–$0.09 on about 230 million shares. The company said Strata Identity is assumed at 0 ARR for the year, and that revenue growth normalized for material rights is expected to outpace subscription ARR growth.
What Could Go Right — and Wrong
- Back-half net new subscription ARR lands at the first-half pace, which would make the FY2027 guide look conservative and lift the FY2028 base.
- A first disclosed Rubrik Agent Cloud ARR figure, with more than 15 paying customers converting from proof-of-concept to production.
- Identity Resilience resumes disclosed sequential growth from the >$50M base and reaches deeper into the installed base; management says penetration is still early.
- Non-cloud and sovereign ARR grows around 10% while carrying a higher margin than cloud, improving blended margin as the cloud mix percentage falls.
- Channel concentration dilutes gradually: the top two partners were ~56% of Q1 FY2027 revenue.
- The back-half net new ARR step-down implied by the FY2027 guide is real, making the first half a pull-forward rather than an acceleration.
- Gross margin drifts toward the low end of the 77%–82% long-term target band as material rights fade and mix shifts toward the lower-margin other revenue line.
- Agentic security spend consolidates onto identity and observability incumbents rather than a new platform, leaving Rubrik Agent Cloud a stub with no disclosed ARR.
- A channel partner disruption: two partners delivered ~56% of Q1 FY2027 revenue.
- Sole-source appliance supply from Supermicro becomes a constraint on exactly the on-premises and sovereign book that is growing fastest.
Looking Ahead
Over the next 12 months the tests are the back half of FY2027 and whether the new products become measurable. Management guides FY2027 revenue of $1.685B–$1.693B, says cloud migrations are "wrapping up this year," and limits Rubrik Agent Cloud commentary to a promise to update "as the year progresses." Strata Identity is assumed at 0 ARR for FY2027. The launch cadence continued past the quarter — Apache Iceberg protection on AWS in September 2026, MCP support and Rubrik Code Guardian with Anthropic's Claude Mythos 5 in September 2026 — but only Rubrik AI carries a disclosed adoption figure, described as trusted by one-third of the company's global customers.
- Q3 FY2027Q3 FY2027 results — Tests whether net new ARR holds the first-half pace or steps down.
- FY2027Rubrik Agent Cloud ARR update — Management says it will update investors as the year progresses.
- FY2027Cloud migrations wrap up — Material rights are guided to ~$2M–$3M in Q3; the migration tail ends.
- Over timeFlex as default motion — Management expects Flex to become the default for largest strategic accounts.
Financials
Annual Summary
| Metric | FY2025 | FY2026 | TTM | YoY |
|---|---|---|---|---|
| Revenue | $887M | $1.3B | $1.5B | +48.5% |
| Gross Margin | 68.9% | 80.0% | 80.2% | +1,110bps |
| EBITDA | −$1.1B | −$308M | −$230M | +71.6% |
| EBITDA Margin | -122.4% | -23.4% | -14.9% | +9,894bps |
| Net Income | −$1.2B | −$349M | −$254M | +69.8% |
| Free Cash Flow | $24M | $270M | $321M | — |
| Net Cash | — | — | — | — |
Key Ratios (Trailing)
- P/E TTM—
- EV/EBITDA TTM—
- EV/Revenue TTM—
- Price/FCF TTM—
- Gross Margin (TTM)80.2%
- EBITDA Margin (TTM)-14.9%
- Net Margin (TTM)-16.5%
- SBC / Revenue4.8%
The Company
Rubrik sells cyber resilience software. The Rubrik Security Cloud suite protects enterprise data on physical systems, operating systems, virtual machines, databases, file systems and containers with immutable, access-controlled backups, extends to petabyte-scale NAS storage, cloud application data on Azure, AWS, GCP and Oracle, and SaaS applications including Microsoft 365, Salesforce and Atlassian Jira Cloud, and covers identity systems such as Microsoft Active Directory, Entra ID and Okta. A second suite, Rubrik Agent Cloud, monitors and controls what AI agents do — which tools and MCP servers they can reach, what scoped access each call gets, and how to surgically undo destructive actions. Management frames the two suites as mapping to the two-sided risk enterprises face as they adopt AI: AI-powered breach and agentic overreach. Recent press releases brand the company as "the Security and AI Operations Company."
Rubrik owns no factories or data centers. Its appliances are built on servers designed and supplied by Supermicro, which the 10-K describes as its source for all Rubrik-branded appliances, and its cloud software is delivered using third-party vendors, which the 10-Q flags as a dependency. All offices are leased, across nine locations; the headquarters is the roughly 81,031-square-foot Palo Alto site, whose lease expires in 2027. Revenue is concentrated in the Americas — $299M in Q2 FY2027 versus $129M outside — though international grew faster at 52% versus 33%.
Business Segments
Competitive Landscape
Rubrik's 10-K names its competition as data management and protection vendors — Commvault, Dell EMC, IBM, Veeam and Cohesity — a field Rubrik repeatedly says it displaces in head-to-head deals, including a decade-long legacy incumbent and 400-plus backup policies in Q1 FY2027. Management argues the field is fragmenting into point solutions that customers do not want to stitch together, and positions Rubrik as a comprehensive platform; on the Q2 call the CEO acknowledged "competition for point solutions" and said Rubrik takes "a very long-term platform approach." The company also partners with adjacent security vendors, including CrowdStrike, Palo Alto Networks and Okta, positioning itself as the recovery and resilience layer behind prevention and detection. Competitors are also converging from adjacent layers: the supply-chain wiring lists CrowdStrike and Datadog as competitors, and an analyst raised ServiceNow as a claimed AI control-plane contender, which management reframed toward comprehensiveness.
- CommvaultNamed in the 10-K among data management and protection vendors; the supply-chain wiring also lists it for cloud data protection and cyber resilience.
- CohesityNamed in the 10-K among data management and protection vendors.
- Dell EMCNamed in the 10-K among data management and protection vendors.
- IBMNamed in the 10-K among data management and protection vendors.
- VeeamNamed in the 10-K among data management and protection vendors.
Supply Chain
Rubrik is largely a software company with a thin hardware edge. Its branded appliances run on servers designed and supplied by Supermicro, its cloud software sits on third-party infrastructure, and no supply-chain neighbor in the evidence set mentions Rubrik by name.
More on RBRK: Earnings recap