Rubrik: The Mythos Effect Is Real — AI-Speed Attacks Are Driving a Step-Change in Cyber Resilience Demand
Q1 FY2027 Earnings Call, June 4, 2026 — Record Quarter, Guidance Raised, and a New Product Category Taking Shape
Rubrik opened its fiscal 2027 with what management called a record first quarter, and the numbers support that characterization. Subscription ARR reached $1.57 billion, up 32% year-over-year, with $103 million in net new subscription ARR — a Q1 record. Subscription revenue came in at $374 million, up 41%. Free cash flow hit $74 million, more than double the $33 million generated in the year-ago period. The company beat every guided metric and, more importantly, raised its full-year outlook — a signal that the demand environment is strengthening, not merely holding steady.
Mythos Changes the Threat Calculus — and Rubrik's Pipeline
The most consequential new information from this call is how the emergence of Anthropic's Claude Mythos model is reshaping enterprise security conversations in Rubrik's favor. CEO Bipul Sinha was direct: "With Mythos, cyber detection is almost impossible. So as soon as intrusion happens, breach will happen." This is not vendor fear-mongering. Gartner has reportedly issued client notes stating that cyber resilience is the necessary response to Mythos, and preemptive recovery technologies must be explored. That external validation matters for enterprise budget conversations.
Sinha disclosed that he personally conducted 140 CIO and CISO meetings in the last quarter — up 50% sequentially — a data point that illustrates the urgency now embedded in enterprise security planning. Rubrik has also joined Anthropic's Project Glasswing, receiving early access to the Claude Mythos research preview, positioning the company to test and harden its platform against the very attack vectors that are driving customer anxiety. The practical implication is that Rubrik raised its top-line guidance in part because Mythos is generating incremental pipeline, not just awareness.
Rubrik Agent Cloud: One Quarter of Selling, Already Moving to Production
The most forward-looking development investors need to understand is the early traction of Rubrik Agent Cloud, the company's purpose-built AI operations platform for governing autonomous agents. This product, underpinned by the Predibase acquisition, is designed to monitor, control, and remediate agentic actions in real time through what Rubrik calls its Semantic AI Governance Engine, or SAGE. The pitch to enterprises is straightforward: as AI agents assume employee identities, access sensitive data, and take autonomous action, the consequences of compromise or hallucination become catastrophic. Rubrik's answer combines real-time guardrails with what Sinha describes as "Agent Rewind" — the ability to undo destructive agent actions and restore systems to a clean state.
In just one quarter of commercial selling, early proof-of-concepts are converting to production deployments. A U.S. financial services firm moved from AI experimentation to full production deployment across AWS Bedrock and Microsoft Copilot, selecting Rubrik Agent Cloud specifically for its unified monitoring, policy-based controls, and — critically — its remediation capability. The customer identified agent rewind as the essential feature that finally gave them confidence to scale AI in a regulated environment. Sinha framed the competitive dynamic clearly: "Just doing observability on agents is not enough. Just doing posture management on identity for agents is not enough. Just doing real-time guardrail is not enough. Because when all of these things fail, you need to also deliver fundamental agentic rewind." The analogy he reached for was the consolidation in cloud security, where fragmented point solutions eventually gave way to platform vendors like Palo Alto Networks.
Identity Business Hits $50 Million ARR, Growing 38% Sequentially
Rubrik's Identity Resilience business crossed $50 million in subscription ARR in Q1, growing 38% sequentially from Q4. That is a striking sequential acceleration for a business the company has been building for roughly four to five quarters. The growth is being driven by identity-based attacks becoming the dominant breach vector — making simultaneous protection of data and identity a non-negotiable enterprise requirement rather than an optional add-on. A large U.S. agricultural company, already a Rubrik data customer, expanded into identity resilience this quarter after a ransomware attack on its Active Directory environment caused material operational downtime. That use case — an existing customer experiencing real damage and turning to Rubrik for the solution — is precisely the land-and-expand motion the company is trying to systematize.
Identity is also expanding Rubrik's buyer base beyond its traditional CIO and CTO personas into CISO organizations, which carry separate budgets and separate mandates. The strategic importance of this is significant: it gives Rubrik two independent entry points into large enterprises and increases the stickiness of the platform once both personas are engaged.
Sovereign Infrastructure: An Underappreciated Tailwind
One dynamic that received less attention but deserves investor notice is the on-premises ARR trajectory. Rubrik is nearing the end of its cloud migration, with cloud ARR now representing 89% of subscription ARR. But non-cloud ARR, which had been declining as migrations progressed, is now stabilizing and expected to grow. CFO Kiran Choudary noted that federal agencies and regulated industries represent a "small but meaningful" self-hosted business. Sinha added a geopolitical dimension: European and Middle Eastern customers are increasingly interested in sovereign infrastructure — customer-controlled environments that do not rely on hyperscaler clouds — driven by data locality requirements and geopolitical sensitivity. If that trend accelerates, it represents an incremental growth vector that current models may not fully capture.
Hardware Costs: A Non-Issue With Caveats
Several analysts pressed on whether rising hardware and storage costs — servers reportedly doubling in price, HDDs and DRAM up materially — were creating headwinds through total cost of ownership for customers. Rubrik's answer is that its software-only model insulates it directly, and that enterprise data center protection now represents a smaller share of the overall business given the expansion into cloud, SaaS, identity, and M365 workloads. Sinha also made the case that cyber resilience is non-discretionary: "You have to be in business, first and foremost, to be even able to adopt AI." That argument is credible in the current environment, though investors should note that hardware cost sensitivity among on-premises customers remains a watch item as refresh cycles approach.
Financial Guidance and Unit Economics
For Q2, Rubrik guided to revenue of $395 million to $397 million, representing 27% to 28% growth, with non-GAAP EPS of $0.03 to $0.05. For the full fiscal year 2027, the company raised its subscription ARR outlook to a range of $1.854 billion to $1.862 billion, implying approximately 27% year-over-year growth. Full-year revenue guidance is $1.638 billion to $1.648 billion. Importantly, material rights revenue related to the cloud transition — which had been artificially inflating reported revenue — is expected to contribute only $17 million for the full year, a dramatic reduction that creates a revenue growth headwind on a reported basis. Normalized for material rights, revenue growth is expected to exceed subscription ARR growth.
On profitability, subscription ARR contribution margin improved over 500 basis points year-over-year to 13.2% on a trailing twelve-month basis, and the company guided to approximately 14% for the full year. Free cash flow guidance was set at $293 million to $303 million, a substantial step-up from fiscal 2026 that reflects both scale benefits and improving operational discipline. The balance sheet remains solid at $1.7 billion in cash and equivalents against $1.1 billion in convertible debt.
Go-to-Market Stability After Leadership Change
Investors had flagged the sales leadership transition last quarter as a potential execution risk. Sinha addressed it directly: new sales leader Jesse has settled in well, the team is executing with what the CEO described as "high resonance," and no further organizational changes are anticipated. The company continues to run a two-track go-to-market model — a "forward" team scaling existing products and a "lateral" incubation team focused on new product categories. Rubrik Agent Cloud is currently being handled by the lateral team, the same group that previously incubated identity resilience, M365, and cloud security before handing them to the core sales force.
Net retention rate held steady at approximately 120%, with all expansion vectors — data growth, new application coverage, identity products, and now Agent Cloud — described as healthy contributors. Customers with $100,000 or more in subscription ARR reached 2,946, up 24%, while customers at the $1 million or more threshold grew over 50% — the latter figure suggesting that Rubrik is deepening its penetration within its largest accounts at an accelerating rate.
Rubrik's Analyst Day is scheduled for June 10 in Las Vegas, where management has indicated it will lay out the full vision for agentic cyber resilience in detail. Given the early commercial signals on Agent Cloud and the structural shift in the threat landscape that Mythos represents, that event is likely to be a meaningful catalyst for how the market frames the company's long-term addressable opportunity.