Rubrik, Inc. 2027 Q2 Earnings Call

Please go ahead. Hello, everyone.

Welcome to Rubrik's second quarter fiscal year 2027 financial results conference call. On the call with me today are Bipul Sinha, CEO, Chairman, and Co-founder of Rubrik, and Kiran Choudary, Chief Financial Officer. Our earnings press release was issued today after the market closed and may be downloaded from the investor relations page at www.ir.rubrik.com. Also on this page, you'll be able to find a slide deck with financial highlights that, along with our earnings release, includes a reconciliation of GAAP to non-GAAP financial results. These measures should not be considered in isolation from or as a substitute for financial information prepared in accordance with GAAP.

During this call, we will make forward-looking statements, including statements regarding our financial outlook for the third quarter and full fiscal year 2027, our expectations regarding market trends, our market position, opportunities, including with respect to generative and agentic AI, growth strategy, product initiatives, and expectations regarding those initiatives and our go-to-market motions. These statements are only predictions that are based on what we believe today, and actual results may differ materially. These forward-looking statements are subject to risks and other factors that could affect our performance and financial results, which we discuss in detail with our filings with the SEC. Rubrik assumes no obligation to update any forward-looking statements that we may make on today's call. With that, I'll hand the call over to Bipul.

Thank you, Melissa, and thank you all for joining us today. I'm pleased to report that our second quarter results were truly outstanding. Once again, we exceeded all guided metrics across top line and profitability. This is not the first time. In fact, it is our 10th consecutive quarter of outperformance as a public company. This quarter, we accelerated. Let me repeat, accelerated net new subscription ARR growth. This is a testament to the strength of our platform and the continued durability of demand for Rubrik's agentic cyber resilience. Here are the key numbers. First, subscription ARR reached $1.66 billion, growing 33% year over year. Second, net new subscription ARR reached approximately $96 million in the second quarter. Third, our subscription revenue was $407 million, growing 37% year over year. Fourth, our subscription NRR remained strong at over 119%. I'm not done yet. Here are two more key numbers.

Customers with 100,000 or more in subscription ARR reached 3,084, growing 23% year-over-year. Finally, on profitability, we once again made material improvement in subscription ARR contribution margin, up about 460 basis points year-over-year. We generated $66 million in free cash flow this quarter. Very few companies at Rubrik's scale can drive this level of growth, plus expanding margins and a strong free cash flow generation. I am pleased to report we are once again raising our outlook for the year. Let me start by giving you some context on how the market is evolving and what is driving our confidence in the future of our business. Needless to say, AI is the most transformative technology of our lifetime.

What is fascinating to us is that the scale of productivity that AI creates is matched only by the scale of new risks that AI spawns. Mythos and Frontier AI models are proving it every day. Rubrik is a participant in Anthropic's Project Glasswing. We built a complete harness to close the loop from vulnerability discovery to code patching. The reason I bring this up is because our Project Glasswing findings underscore our belief that we are in a singularity moment with AI and cybersecurity. As you might recall from my comments earlier this year, we are no longer in a world of human speed. A few years ago, humans were attacking us, and humans were running our business processes. Enterprises have spent billions across thousands of security tools trying to detect and prevent those threats from materializing. These investments are not proving to be relevant anymore.

Today, AI agents are attacking us. These autonomous agents use AI for vulnerability chaining to find the right malicious combination to intrude, breach, and encrypt at machine speed. If you have yesterday's cybersecurity tools with human speed response, you have a huge mismatch. At the same time, AI agents are increasingly running business processes, workflows that assume identities, access sensitive data, and take autonomous action. Both threat actors and business operators are now agentic. We have witnessed vivid real-world illustrations of the unprecedented risk that these dynamics pose. This includes the recent Hugging Face incident, in which we saw an autonomous AI agent exploit a zero-day vulnerability and gain unauthorized access to live systems, all without human direction.

This clearly demonstrated both halves of the risk companies are grappling with, an AI-orchestrated attack moving faster than any human speed response, and an agent operating well outside the guardrail anyone intended for it. In this new reality, prevention and detection are no longer enough. At the same time, you can't fight AI with the same legacy software you have been using. What you will need is a new approach, preemptive risk assessment, real-time guardrail, and AI-speed recovery. In short, agentic cyber resilience. No wonder businesses around the world are turning to Rubrik for agentic cyber resilience. We deliver Rubrik as an AI agent, because an agent is the only way to respond to AI-speed attacks. Rubrik, as an agent, is designed to autonomously collect, monitor, and understand information, create recovery plans, ask humans for permission, and create outcomes.

Rubrik also has agentic governance and security built onto our platform to create runtime guardrails for agentic work. This is the same capability we are delivering to our customers with Rubrik Agent Cloud, which governs and secures our customers' own AI agents. As you may know, we operate two complementary product suites onto our single platform, Rubrik Security Cloud for cyber resilience and Rubrik Agent Cloud for agentic security and governance. These two suites map directly to the two-sided risk enterprises face as they adopt AI, assuming AI-powered breach and assuming agentic overreach. Let me first discuss our opportunity with Rubrik Security Cloud or RSC. Our proprietary preemptive recovery engine is the backbone of Rubrik agentic cyber resilience. Our architectural advantage, which combines time series data and metadata, allows us to continuously pre-calculate clean points of recovery across on-prem, cloud, SaaS, unstructured data, and identity before an attack occurs.

Rubrik's preemptive recovery engine does the work in peacetime to be able to achieve recovery at AI speed in wartime. This is how we deliver record fast recoveries with RSC when our customers are breached or their agents get compromised, and this is why we continually deliver extremely high competitive win rates. Our cyber resilience data protection business continues to benefit from the ongoing transformation towards cyber resilience and consolidation to platforms, not point solutions. Amid an increasingly malicious cyber environment, customers increasingly view Rubrik's unified single platform approach to cyber resilience as a board-level mandatory requirement rather than a discretionary purchase. Customers can initially adopt Rubrik in many different ways, cloud, on-prem, unstructured data, identity, Microsoft 365, Agent Cloud, but we initiate the same single policy engine on our single Rubrik platform.

When a customer adopts Rubrik, they are not just buying a solution, they are stepping into an ecosystem where each additional product adopted makes all existing Rubrik products more powerful. This is a testament of a true platform built on complementary network effects. Let me share two of the many illustrative customer wins from the quarter. First, we landed a new logo deal with a U.S. state government agency, which displaced its legacy incumbent after concerns around cyber recovery times amid the rise of cyber threats. The agency chose Rubrik for enterprise and Microsoft 365 protection, noting our reliability, compliance fit, and the speed of cyber recovery. Second, we won a new Global 2000 financial services customer, displacing a legacy vendor and outcompeting a new-gen competitor.

This customer selected Rubrik to protect its full data environment, including on-premises data centers, cloud, Microsoft 365 unstructured data, and identity with Rubrik winning due to the strength of our cyber resilience capabilities across a single platform. In addition to cyber resilience, Rubrik solved for the customer's tool consolidation needs amid growing tech sprawl. Turning to Rubrik Flex, our unified platform contract vehicle, which we introduced at Forward in June. Rubrik Flex is one license, one contract, one commitment for complete agentic cyber resilience. We are pleased with the early reception and have already closed a handful of Flex deals.

As an example, one of our largest expansion deals of the quarter was a Flex deal with a large U.S. healthcare system, extending our platform beyond its existing on-premises footprint to cover Microsoft 365 cloud and identity data under a single enterprise agreement. This win came against cloud-native backup tools, with customers citing a single pane of glass across on-prem cloud SaaS and identity data as the deciding factor for true cyber resilience. We believe Flex will become the default motion for our largest strategic accounts over time. Turning to identity, our identity resilience business continues to be one of the fastest-growing product lines in the company's history. As you might recall, we started our identity journey with the release of Identity Recovery, which provides the rapid recovery of identity services following cyber attacks or operational failures.