Rubrik Delivers Record Q4 With 90%+ Win Rates, But Agent Cloud Contribution Remains a Multi-Year Wait
Q4 and Fiscal Year 2026 Earnings Call — March 12, 2026
Rubrik closed fiscal 2026 with its strongest quarter to date, posting record net new subscription ARR of $115 million and full-year free cash flow of $238 million — more than ten times the prior year's figure. The results were unambiguous, and management did not shy away from saying so. But beneath the headline momentum, two structural questions dominated the call: how durable is the core cyber resilience growth engine at scale, and whether Rubrik Agent Cloud, the company's newest and most ambitious product bet, can evolve from a promising concept into a measurable revenue contributor in any near-term timeframe.
Subscription ARR Growth Accelerates as Win Rates Hit a Milestone
Subscription ARR reached $1.46 billion, growing 34% year-over-year, with cloud ARR of $1.29 billion now representing 88% of the total subscription base — a figure that signals the cloud transition is nearly complete. Subscription revenue for the quarter was $365 million, up 50%, while total revenue came in at $378 million, up 46%. Subscription net retention rate held above 120% for another quarter, with adoption of additional security products now accounting for over 45% of NRR expansion, up from 34% a year ago. The number of customers spending $1 million or more in subscription ARR grew by over 50%, with a record 32 such customers added in Q4 alone.
Perhaps the most operationally significant data point of the evening was competitive win rates. CEO Bipul Sinha stated that Rubrik's win rate against data protection vendors crossed 90% in Q4, adding bluntly, "The only deal that we are losing is the fight that we are not in." The company is now focused on expanding routes to market and geographic reach rather than improving a competitive position it considers already dominant.
Identity Crosses 900 Customers in Roughly Three Quarters of Selling — Fastest Product in Company History
The identity security business continued its rapid ascent. Rubrik crossed 900 identity customers in Q4, up from 400 reported in Q3, making it the fastest-growing product in the company's history by its own characterization, and one that has already exceeded internal expectations. The product line now extends beyond Active Directory and Entra ID recovery to include Okta Identity protection, announced this quarter, making Rubrik the only platform to cover all three major identity providers. Management noted that over 50% of M365 bookings in Q4 were attached to identity solutions, illustrating meaningful cross-sell traction.
Customer examples cited were illustrative of the business impact driving deals. A major U.S. healthcare provider expanded its Rubrik deployment this quarter to cover identity resilience and over 10 petabytes of unstructured data, with the strategic rationale being a reduction in Active Directory and Entra ID cyber recovery time from over 30 days to under four hours — with potential downtime losses estimated at tens of millions of dollars in revenue per day. These are the kinds of ROI conversations that justify significant budget allocation at the CISO level, a buying persona Rubrik has been deliberately cultivating as a complement to its traditional CIO and CTO relationships.
Rubrik Agent Cloud Goes GA, But Financial Contribution Is Explicitly a Multi-Year Story
The most closely watched new product, Rubrik Agent Cloud, moved from beta to general availability in the weeks preceding the call, with a number of proof-of-concept engagements now underway across early AI adopters and Fortune 500 companies. The product is designed to provide enterprises with visibility into all AI agents operating within their environment — both sanctioned and shadow-IT — real-time guardrails to control agentic interactions, and eventually a "rewind" function to undo destructive agent actions.
Sinha was direct about the sequencing of customer priorities: "Customers first are trying to understand how many agents do they have in the system, both sanctioned ones as well as shadow-IT unsanctioned ones. Then they want to understand what these agents are actually doing. And then once they have understanding of this kind of monitoring observability, then the second step for them is to understand how they control it." The rewind capability, he added, is a "day 2 problem" for most enterprises.
The company's differentiated technical position here rests on the 2024 acquisition of Predibase, an LLM fine-tuning and inference serving platform that provides the model engineering capability Sinha argues neither traditional cybersecurity vendors nor observability startups currently possess. "You can't bring a knife to a gun fight," he said, framing the need for AI-native controls to govern AI agents.
However, when pressed by BMO's Keith Bachman on when Agent Cloud would begin showing up in reported metrics, management declined to provide a timeline. CFO Kiran Choudary confirmed that fiscal 2027 guidance includes minimal contribution from Agent Cloud, stating explicitly, "The assumption around AI, while we are very excited, is we have not assumed much when we talk about fiscal '27." Investors should calibrate accordingly — this is a long-cycle investment thesis, not a near-term revenue driver.
Fiscal 2027 Guidance: Solid Growth, Deliberate Investment, Some Deceleration in ARR Rate
For fiscal 2027, Rubrik guided to subscription ARR of $1,829 million to $1,839 million, representing 25% to 26% year-over-year growth — a deceleration from the 34% reported in fiscal 2026. Total revenue guidance of $1,597 million to $1,607 million implies approximately 27% to 28% growth when normalized for material rights, which will contribute only approximately $10 million in fiscal 2027 as the cloud transition winds down. Non-GAAP subscription ARR contribution margin is guided at approximately 13% for the full year, up from 12% in the last twelve months, with free cash flow expected in the range of $265 million to $275 million.
Q1 guidance calls for revenue of $365 million to $367 million, roughly flat sequentially, which prompted questions about potential Q4 pull-forward. Choudary pushed back on that characterization, noting that Q1 of the prior year was unusually strong, creating a tougher comparable growth rate, and emphasizing that the full-year net new ARR starting point is stronger in growth terms than it was entering fiscal 2026.
Choudary also addressed the CRO transition — longtime sales leader Brian leaving and being succeeded by Jesse Green — with notable specificity. Green was hired nearly three years ago with succession in mind, having run Americas for roughly that period after joining from MongoDB. Management characterized the transition as smooth, with team stability intact, and the guidance as already incorporating this leadership change.
Sovereign Cloud Emerges as an Incremental Opportunity With an Undefined TAM
Responding to a question from Citi's Fatima Boolani, Sinha provided a detailed framing of the sovereign cloud opportunity, which he described as fast-emerging but not yet quantifiable. He outlined two distinct demand patterns: fully ring-fenced government infrastructure that must remain on-premises within national borders, and public cloud deployments with additional controls governing cross-border data flows. A third dynamic — countries building sovereign AI infrastructure that could be "rented" to other nations through what he described as "digital embassies" — was flagged as an emerging angle. Sinha was candid that the TAM is still evolving and that it remains unclear how much represents net new spend versus a shift in how existing IT budgets are structured.
Management Addresses AI Disruption Risk to Core Business — And Dismisses It
Mizuho's Gregg Moskowitz raised the question that likely sits at the back of many institutional investors' minds: could AI itself automate away the core data recovery and resilience value proposition over time? Sinha's response was substantive rather than dismissive. He argued that Rubrik's platform represents roughly a decade of enterprise-scale system-of-record engineering, incorporating thousands of customer use cases and SOC experience that cannot be replicated by generative AI coding tools. More structurally, he pointed out that Rubrik prices on data volume rather than headcount, meaning AI-driven data growth directly expands the company's addressable opportunity rather than threatening it. "Rubrik's importance only grows with the growth of AI and AI transformation of the enterprise," he said.
Profitability Trajectory Improving But Balance Sheet Leverage Warrants Monitoring
Gross margin reached 84% in Q4, up from 80% a year ago, with tailwinds from both revenue outperformance and improved hosting cost efficiency. Subscription ARR contribution margin improved approximately 950 basis points year-over-year to 12%, or approximately 730 basis points adjusting for the prior-year IPO-related payroll tax charge of $23 million. Free cash flow for the quarter was $70 million, slightly below the $75 million generated in Q4 of fiscal 2025, though full-year free cash flow of $238 million represented a more than tenfold improvement. The balance sheet holds $1.7 billion in cash and equivalents against $1.1 billion in convertible debt, a leverage position investors should continue to monitor as the company scales its investment across R&D and go-to-market for identity and AI.
Management flagged an inaugural Investor Day scheduled for June 10 in Las Vegas, coinciding with its Forward User Conference. Given the volume of unanswered questions around Agent Cloud commercialization, sovereign cloud TAM sizing, and the longer-term margin profile, that event will likely be a more meaningful catalyst for institutional sentiment than any single quarterly print.
Rubrik, Inc. Deep Dive
From Backup to Cyber Resilience: The Business Model
Rubrik operates at the critical intersection of data protection, cyber resilience, and artificial intelligence governance. Founded on the premise of disrupting legacy disaster recovery, the company has successfully transitioned its business model from selling on-premises backup appliances to delivering a cloud-native software-as-a-service platform known as Rubrik Security Cloud. Historically, the data backup industry was architected to mitigate the risks of natural disasters or hardware failures, fundamentally prioritizing data availability over data security. Rubrik inverted this paradigm by engineering a platform built on Zero Trust Data Security principles. Operating under the assumption that the network perimeter is already breached, Rubrik focuses on securing the data at the point of storage. The company monetizes this architecture through a highly lucrative subscription model. As of the end of fiscal year 2026, Rubrik reported a subscription annual recurring revenue of $1.46 billion, representing a 34 percent year-over-year growth rate. This recurring revenue stream is characterized by exceptional unit economics, reflected in a non-GAAP gross margin of 83.7 percent and an improving subscription contribution margin that recently inflected to a positive 11.6 percent. By charging enterprises based on the volume and complexity of the data protected across hybrid and multi-cloud environments, Rubrik captures increasing wallet share as corporate data gravity inevitably expands.
The Competitive Landscape and Market Share Dynamics
The enterprise data protection market is a highly consolidated oligopoly dominated by four major players, each leveraging a distinct strategic vector. Rubrik currently commands an estimated 14 percent market share within the specialized cyber recovery category, though the broader data management landscape is fiercely contested. The company serves over 6,100 enterprise customers, including 2,805 clients generating more than $100,000 in annual recurring revenue. Its key competitors include Veeam, Cohesity, and Commvault. Veeam remains the absolute volume and market share leader globally, competing primarily on a thesis of data portability and infrastructure agnosticism. Commvault, a legacy incumbent, has successfully executed a multi-year pivot to a cloud-based delivery model, recently reporting $1.12 billion in annual recurring revenue for its own fiscal 2026. However, the most seismic shift in the competitive landscape is the recent integration of Cohesity and the data protection business of Veritas. This merger created a formidable industry behemoth with an estimated $1.6 billion in pro-forma revenue and deep penetration into the Fortune 500 installed base. Consequently, Rubrik is no longer competing against fragmented legacy vendors; it is engaged in a trench war against heavily capitalized platforms. The primary buyers of these systems are Chief Information Security Officers and Chief Information Officers at large multinational corporations, healthcare networks, and public sector entities, while the underlying cloud infrastructure providers, notably Microsoft Azure, act as both foundational suppliers and strategic go-to-market partners.
Structural Advantages and The Zero-Trust Moat
Rubrik derives its primary competitive advantage from its proprietary underlying architecture, specifically the Atlas file system. Unlike traditional network-attached storage architectures that expose writable protocols like server message block or network file system to the broader network, Atlas is a purpose-built, append-only system. This creates a logical air gap, ensuring that once data is written, it achieves native immutability and cannot be encrypted, modified, or deleted by unauthorized internal actors or external ransomware payloads. This structural superiority allows Rubrik to offer deterministic recovery at scale. In a severe ransomware event, legacy systems often struggle with a high entropy of infected backups, requiring manual, iterative restores that result in catastrophic downtime. Rubrik utilizes an orchestration engine that automatically identifies the last known good copy of data and executes a rapid, prioritized recovery. Management reports an estimated 90 percent win rate in competitive proof-of-concept trials when the primary purchasing criterion is recovery speed under simulated ransomware conditions. Furthermore, Rubrik benefits from substantial switching costs. Once an enterprise integrates Rubrik Security Cloud across its on-premises servers, Microsoft 365 environments, and public cloud infrastructure, extracting the platform becomes an operationally prohibitive and deeply risky endeavor.
Industry Vectors: Opportunities and Existential Threats
The structural dynamics of the cybersecurity industry provide a massive tailwind for Rubrik. The proliferation of polymorphic, AI-generated malware and the professionalization of ransomware cartels have forced boards of directors to accept that perimeter defenses will eventually fail. Concurrently, regulatory frameworks such as the European Union Digital Operational Resilience Act and updated Securities and Exchange Commission cyber disclosure mandates require enterprises to prove continuous business continuity capability, rather than merely demonstrating perimeter compliance. These factors elevate data resilience from an IT operational expense to a board-level risk management necessity. However, the industry dynamics also present formidable threats. The Cohesity-Veritas combination provides Cohesity with an unprecedented opportunity to cross-sell modern cloud-native capabilities into Veritas' massive legacy footprint, potentially locking Rubrik out of critical enterprise renewal cycles. Additionally, the increasing Balkanization of global data privacy laws is driving a requirement for localized, sovereign cloud data centers. For a cloud-native platform like Rubrik, expanding physical infrastructure to comply with localized data residency mandates in secondary international markets introduces margin-dilutive capital expenditure requirements that legacy competitors, with decades of localized data center build-outs, are better equipped to absorb.
Next-Generation Drivers: DSPM and Agentic AI Governance
To sustain its premium growth trajectory and distance itself from commoditized backup providers, Rubrik is aggressively expanding into data security posture management and artificial intelligence governance. Following the acquisition of Laminar, Rubrik integrated data security posture management natively into its platform. Traditional backup systems are fundamentally blind; they duplicate data without understanding its contents. By integrating posture management, Rubrik can automatically scan and classify sensitive intellectual property and personally identifiable information within the backup payload. If a breach occurs, the enterprise knows exactly which sensitive assets were exposed, dramatically accelerating regulatory reporting and damage control. More significantly, Rubrik is positioning itself as the mission control for the AI enterprise. The company recently launched Ruby, a generative AI companion built on Microsoft Azure OpenAI, designed to automate complex threat hunting and bridge the cybersecurity skills gap. Building on this, Rubrik has introduced Sage, a semantic AI governance engine. As enterprises rapidly deploy autonomous AI agents capable of executing workflows, the risk of an agent hallucinating or being hijacked to delete mission-critical data scales exponentially. Sage operates as a real-time runtime guardrail, auditing agentic actions, enforcing compliance, and offering the ability to instantaneously undo destructive AI mistakes. This proactive governance layer represents a massive total addressable market expansion, moving Rubrik from reactive data recovery into the proactive AI security operations space.
Emerging Threats: The Shifting Perimeter
While the barrier to entry in enterprise data protection is heavily insulated by data gravity and the necessity of managing multi-petabyte workloads, the periphery of the market is witnessing an influx of specialized, highly agile startups. A new cohort of pure-play data security posture management and cloud-native application protection platforms are attempting to unbundle the cybersecurity stack. These entrants leverage lightweight, agentless architectures to provide rapid visibility into cloud vulnerabilities without the heavy operational lift of deploying a full enterprise backup solution. While these startups do not possess the infrastructure to execute mass data orchestration and recovery, they threaten to siphon off discrete portions of the Chief Information Security Officer's budget. However, the prevailing trend in enterprise software procurement in 2026 is extreme vendor consolidation. Chief Information Officers are systematically eliminating point solutions in favor of unified platforms. Consequently, while these disruptive entrants drive technological innovation, their ultimate trajectory is more likely to culminate in acquisition by the incumbent oligopoly rather than achieving standalone market dominance. The true existential threat to Rubrik does not stem from a rogue startup, but rather from the major public cloud providers deciding to natively bundle advanced, zero-trust data recovery features directly into their core compute and storage offerings.
Management Execution and Capital Allocation
Rubrik's operational execution has been defined by a relentless, highly aggressive corporate culture driven by Chief Executive Officer Bipul Sinha. With a background as a venture capitalist and early investor in infrastructure disruptors like Nutanix, Sinha has explicitly oriented the company toward a perpetual creation mode, rejecting the stabilization strategies typical of mature software entities. Over the past decade, management successfully navigated the treacherous transition from hardware appliance sales to a fully recurring cloud subscription model without stalling top-line momentum. The execution surrounding the company's 2024 initial public offering was clinically precise, providing the capital necessary to fund the Laminar acquisition and aggressively scale global enterprise sales capabilities. Financially, management has balanced top-line expansion with a disciplined pivot toward cash generation. Entering fiscal 2027, the company is guiding for revenues approaching $1.6 billion and free cash flow generation between $265 million and $275 million. This indicates that the core business model has reached sufficient scale to throw off significant operating leverage. While typical post-IPO insider stock sales have been registered, the overarching management track record points to a leadership team that accurately predicted the convergence of cybersecurity and data protection years before the broader market consensus.
The Scorecard
Rubrik has successfully engineered one of the most compelling enterprise software platforms in the cybersecurity infrastructure landscape. By marrying the deterministic reliability of append-only, immutable storage with advanced threat analytics and AI governance, the company has erected a formidable technological moat against both threat actors and legacy competitors. The financial profile reflects this competitive strength, characterized by highly visible recurring revenue streams, expanding contribution margins, and robust free cash flow generation. The strategic pivot toward managing the systemic risks of agentic AI deployments further cements the platform's relevance in the next decade of enterprise architecture.
However, the macroeconomic and competitive environments allow zero margin for execution errors. The consolidation of Cohesity and Veritas has birthed a colossal competitor with immense distribution power, and legacy peers like Commvault have proven surprisingly resilient in their transition to the cloud. Rubrik must continue to out-innovate its heavily capitalized rivals while simultaneously navigating the complex margin implications of global sovereign cloud mandates. The ultimate investment thesis hinges on the company's ability to transition its narrative from being the fastest-growing backup vendor to becoming the definitive, irreplaceable security control plane for the artificial intelligence era.