10-Q: Rubrik Q3 2026: Strong Subscription Growth, Predibase Acq.

Rubrik, Inc. reported significant subscription revenue growth and improved operating loss in Q3 Fiscal 2026, driven by strong Rubrik Security Cloud adoption and the Predibase acquisition, while managing its debt structure.

Summary

• Total revenue for the three months ended October 31, 2025, increased by 48% to $350.17 million, up from $236.18 million in the prior-year period.
• Subscription revenue grew by 52% to $336.39 million for the three months ended October 31, 2025, compared to $221.51 million in the same period last year.
• Net loss for the three months ended October 31, 2025, significantly narrowed to $(63.83) million, an improvement from $(130.91) million in the prior-year quarter.
• Loss from operations improved to $(75.48) million for the three months ended October 31, 2025, compared to $(124.79) million in the same period last year.
• Subscription Annual Recurring Revenue (ARR) increased by 34% year-over-year to $1.35 billion as of October 31, 2025.
• Cloud Annual Recurring Revenue (ARR) grew by 53% year-over-year to $1.17 billion as of October 31, 2025.
• The number of customers with $100,000 or more in Subscription ARR increased by 27% to 2,638 as of October 31, 2025.
• Free Cash Flow for the nine months ended October 31, 2025, was $167.77 million, a substantial improvement from $(53.57) million in the prior-year period.
• The Subscription ARR Contribution Margin improved to 10% for the 12 months ended October 31, 2025, from (3)% in the prior-year period.
• Acquired Predibase, Inc., a developer platform specializing in open-source AI models, for $109.1 million (consisting of $14.5 million cash and $94.6 million in Class A common stock) in July 2025.
• Issued $1.15 billion aggregate principal amount of 0.00% convertible senior notes due June 2030, with net proceeds of approximately $1.13 billion.
• Repaid in full the outstanding balance of $327.9 million under the Amended Credit Facility and terminated the agreement in June 2025, incurring a $6.7 million loss on debt extinguishment.

Sentiment

Score: 7

Explanation: The company shows strong operational improvements with significant growth in subscription and cloud ARR, substantial reduction in net and operating losses, and positive free cash flow. Strategic moves like the Predibase acquisition and successful debt refinancing are positive. However, it remains unprofitable, faces intense competition, and has ongoing risks related to market evolution, customer transitions, and a legal investigation, warranting a moderately positive but cautious outlook.

Positives

• Subscription revenue demonstrated strong growth, increasing 52% for the quarter and 54% for the nine months ended October 31, 2025, indicating robust adoption of the Rubrik Security Cloud (RSC) platform.
• Net loss significantly reduced by over 50% in Q3 2025 compared to Q3 2024, reflecting improved operational efficiency and cost management.
• Operating loss also showed substantial improvement, decreasing from $(124.79) million to $(75.48) million in Q3 2025.
• Subscription ARR grew by 34% year-over-year to $1.35 billion, highlighting continued success in acquiring new subscription customers and expanding existing relationships.
• Cloud ARR surged by 53% year-over-year to $1.17 billion, underscoring strong demand for cloud-based security solutions.
• The average subscription dollar-based net retention rate remained strong at over 120%, indicating effective customer retention and expansion within the existing customer base.
• The number of customers with $100,000 or more in Subscription ARR increased by 27% to 2,638, demonstrating success in attracting and scaling with larger enterprise clients.
• Achieved positive Free Cash Flow of $167.77 million for the nine months ended October 31, 2025, a significant turnaround from a negative free cash flow in the prior year.
• Subscription ARR Contribution Margin improved to 10% from (3)% for the trailing 12 months, reflecting increased operating leverage.
• The strategic acquisition of Predibase, Inc. is expected to accelerate agentic AI adoption, enhancing product capabilities and market positioning.
• Successful issuance of $1.15 billion in 0.00% convertible senior notes provides substantial liquidity and strengthens the financial position.
• Repayment and termination of the Amended Credit Facility reduced interest expense and simplified the debt structure.

Negatives

• The company continues to report operating losses and net losses, indicating it has not yet achieved sustained profitability.
• Maintenance revenue decreased significantly by 65% in Q3 2025 and 61% for the nine months, as expected due to the transition away from perpetual licenses, but still represents a declining revenue stream.
• Non-recurring revenue from Subscription Credits, which benefited subscription revenue growth, is expected to decline sequentially for the remainder of fiscal 2026 and further in fiscal 2027, potentially impacting future growth rates.
• The company is exposed to market risk from fluctuations in interest rates and foreign currency exchange rates, which could negatively affect financial results.
• The dual-class common stock structure concentrates voting control with Class B holders, including executive officers and directors, limiting the influence of Class A stockholders.
• The dual-class structure makes the company ineligible for inclusion in certain stock indices (e.g., FTSE Russell), potentially reducing investment by passive funds.
• An ongoing Department of Justice (DOJ) investigation related to potential violations of federal law in government contracts, involving a former employee, poses legal and reputational risks.
• Reliance on a limited number of third-party cloud providers and commodity server manufacturers introduces supply chain and operational risks.
• Sales cycles can be long and unpredictable, especially with large organizations, leading to potential revenue fluctuations.
• Increased costs are anticipated due to scaling operations and compliance requirements as a public company, which may impact profitability.
• Growing SaaS adoption is expected to increase hosting costs, potentially impacting subscription gross margins.
• There is a risk of customer dissatisfaction if Subscription Credits are not utilized before expiration, which could harm future results.

Risks

• Recent rapid growth may not be indicative of future growth, and rapid growth makes it difficult to evaluate future prospects.
• If the market for data security solutions does not grow, the ability to grow the business and results of operations may be adversely affected.
• A limited operating history, particularly with the Rubrik Security Cloud (RSC) offering, makes it difficult to forecast future results of operations.
• Inability to attract new customers could harm future results of operations.
• A history of operating losses and may not achieve or sustain profitability in the future.
• If customers do not renew their subscriptions or expand their usage, results of operations could be harmed.
• If data security solutions fail, do not perform as intended, or are perceived to have defects, errors, or vulnerabilities, brand and reputation will be harmed.
• Information technology systems or data, or those of third parties, have been and may in the future be compromised, leading to significant adverse consequences.
• Use of generative and other artificial intelligence tools may pose risks to business and operations, including proprietary software and systems, and may subject the company to legal liability.
• Revenue mix and certain business factors are expected to impact period-to-period revenue, making comparisons not meaningful and revenue difficult to predict.
• Reliance upon third-party cloud providers to host data security solutions; any disruption would adversely affect business.
• Inability to successfully manage growth efficiently could harm business, financial condition, and results of operations.
• The markets in which the company participates are competitive; failure to compete effectively could harm business.
• Estimates of market opportunity, forecasts of market growth, and potential return on investment may prove inaccurate.
• The dual-class structure of common stock concentrates voting control with Class B holders, limiting influence of Class A stockholders.
• A limited number of contract manufacturers and original equipment manufacturers of commodity servers are compatible with solutions; failure to forecast demand or manage relationships could negatively impact sales.
• If customers have not utilized their Subscription Credits before they expire, this could result in customer dissatisfaction.
• Reliance on highly skilled personnel; inability to retain or motivate key personnel or hire qualified personnel will harm business.
• Derives substantially all revenue from its data security platform; failure to satisfy customer demands or achieve continued market acceptance would harm business.
• Fluctuations in financial results make it difficult to project future results; failure to meet expectations could cause stock price decline.
• Ability to introduce new data security products and features is dependent on adequate research and development resources and successful acquisitions.
• Dependence and reliance on SaaS technologies from third parties; interruptions or performance problems could adversely affect business.
• Inability to maintain successful relationships with Channel Partners and technology alliance partners, or if partners fail to perform, will harm business.
• Failure to effectively expand and train the sales force could harm ability to add new customers or increase sales.
• Sales cycles can be long and unpredictable, and sales efforts require considerable time and expense.
• Failure to adapt and respond effectively to rapidly changing technology, evolving industry standards, changing regulations, or customer needs could make solutions less competitive.
• Competitive position depends on ability to operate with third-party products and services; failure to maintain compatibility may harm business.
• Incorrect or improper implementation or use of data security solutions could result in customer dissatisfaction.
• Use of third-party open-source software could negatively affect ability to sell solutions or subject the company to litigation.
• Success depends on the integrity and scalability of systems and infrastructures; interruption or delays could impair delivery of solutions.
• Reliance on software and data licensed from other parties; defects or loss of access could increase costs and harm quality.
• Subject to governmental export and import controls and economic sanctions laws and regulations that could impair international competition or subject to liability.
• Subject to anti-corruption, anti-bribery, and similar laws; non-compliance can subject to criminal or civil liability.
• Downturns or upturns in sales may not be immediately reflected in financial condition and results of operations.
• Seasonality may cause fluctuations in revenue and related metrics.
• Subscription ARR, Cloud ARR, and other operational data are subject to assumptions and limitations and may not provide an accurate indication of actual performance.
• Risks associated with the growth of business with certain heavily regulated industry verticals.
• Sales to government entities are subject to a number of challenges and risks.
• Acquisitions, strategic investments, joint ventures, or alliances could be difficult to identify, pose integration challenges, divert management attention, disrupt business, dilute stockholder value.
• Inability to maintain a high-quality customer support organization could lead to lack of customer satisfaction.
• Business is subject to the risks of warranty and product liability claims from real or perceived defects or misuse, and indemnity provisions.
• Failure to effectively develop and expand sales and marketing capabilities or improve productivity could harm ability to expand customer base.
• Failure to enhance brand cost-effectively could impair ability to expand customer base.
• Limited history with pricing models; may need to adjust pricing terms, which could have an adverse effect on revenue.
• May require additional capital to support business growth, and this capital might not be available on acceptable terms.
• Servicing debt may require a significant amount of cash; may not have sufficient cash flow to pay indebtedness.
• May not have enough available cash or ability to raise funds to pay cash upon conversion of Notes or repurchase upon a fundamental change.
• Exposure to fluctuations in currency exchange rates could negatively affect results of operations.
• Unfavorable conditions in industry or global economy, including conflicts or reductions in technology spending, could limit business growth.
• Typically provides service-level commitments; failure to meet these could lead to customer terminations and damage reputation.
• Sales to enterprise customers involve risks not present or present to a lesser extent with smaller organizations.
• Intellectual property rights may not adequately protect business.
• Employees may be subject to claims alleging violations of contractual obligations to prior employers.
• Inability to maintain company values as the company grows could lead to increased employee turnover.
• Business is subject to the risks inherent in international operations.
• Changes in tax laws or regulations could harm financial condition and results of operations.
• Could be required to collect additional sales or other indirect taxes or be subject to other tax liabilities.
• Ability to use net operating losses to offset future taxable income may be subject to certain limitations.
• May be subject to additional tax liabilities.
• If estimates or judgments relating to critical accounting policies prove incorrect, results of operations could be adversely affected.
• Leverage could adversely affect financial condition, ability to raise additional capital, ability to operate business, and ability to react to changes in economy or industry.
• Stock price may be volatile, and the value of Class A common stock may decline.
• Future sales of Class A common stock in the public market could cause the market price to decline.
• Capped call transactions may affect the market price of the Notes and Class A common stock.
• Subject to counterparty risk with respect to the capped call transactions.
• Issuance of additional capital stock will dilute all other stockholders.
• Does not intend to pay dividends for the foreseeable future.
• As an emerging growth company, reduced reporting and disclosure requirements may make Class A common stock less attractive to investors.
• Incurs significant costs as a result of operating as a public company.
• Anti-takeover provisions in charter documents, the Indenture, and under Delaware law could make an acquisition more difficult.
• Amended and restated certificate of incorporation designates exclusive forums for certain disputes.
• If securities or industry analysts do not publish research or publish unfavorable or inaccurate research, market price and trading volume could decline.
• Any future litigation could be costly and time-consuming to defend.
• Business could be disrupted by catastrophic events.

Future Outlook

The company expects to continue innovating its platform and product functionality, particularly in the data security market, and anticipates new and existing customers will continue to adopt the Rubrik Security Cloud (RSC) platform. It foresees a continued transition of existing maintenance customers to RSC, largely completed by the end of fiscal 2026, and expects non-recurring revenue from Subscription Credits to decline in fiscal 2026 and further in fiscal 2027. Operating expenses are projected to increase with business growth but decrease as a percentage of revenue over the long term (excluding stock-based compensation). The company plans to maintain a full valuation allowance on U.S. federal and state net deferred tax assets for the foreseeable future and expects to cease qualifying as an emerging growth company as of January 31, 2026.

Management Comments

• "We are on a mission to secure the worlds data. Cyberattacks are inevitable. Realizing that cyberattacks ultimately target data, we created Zero Trust Data Security to deliver cyber resilience so that organizations can secure their data across the cloud and recover from cyberattacks. We believe that the future of cybersecurity is data security—if your data is secure, your business is resilient."
• "We expect new and existing customers to continue to adopt RSC."
• "We expect the contributions to growth from these transitions to continue to subside in fiscal 2026."
• "We expect our subscription revenue to continue to benefit from customers exercising or forfeiting their Subscription Credits for the remainder of fiscal 2026, although we expect a sequential decrease in the amount of revenue attributable to material rights. We believe these benefits will decline for the remainder of fiscal 2027."
• "We expect our other revenue as a percentage of total revenue to continue to decrease."
• "We expect our operating expenses will continue to increase as our business grows. We also expect our operating expenses, exclusive of stock-based compensation, as a percentage of revenue to generally decrease over the long term."
• "We expect to continue to incur operating losses, and our operating cash flows may fluctuate between positive and negative amounts for the foreseeable future due to the investments we intend to make as described above."
• "We believe that our existing cash and cash equivalents will be sufficient to fund our operating and capital needs for at least the next 12 months."

Industry Context

The cybersecurity industry is traditionally focused on preventing cyberattacks, whereas Rubrik emphasizes Zero Trust Data Security to secure data across various environments and enable cyber recovery. The market for data security solutions is in an early and rapidly evolving stage, driven by increasing ransomware activity and the need for data resilience. Rubrik faces intense competition from established data management and protection vendors (e.g., Dell-EMC, IBM, Commvault, Veeam, Cohesity), cloud and SaaS data management providers, and specialized cyber/ransomware detection companies. Competitors are also actively investing in AI technology to enhance their offerings. The industry is experiencing consolidation, which could impact overall spending on data security solutions.

Comparison to Industry Standards

• Many current and potential competitors, such as Dell-EMC, IBM, Commvault, Veeam, and Cohesity, have longer operating histories and substantially greater financial, technical, sales, and marketing resources, as well as larger installed customer bases and broader product solutions.
• Competitors can often devote greater resources to the development, promotion, sale, and support of their data security products, potentially allowing them to respond more quickly to new technologies and customer requirements.
• Many competitors are actively investing in AI technology to improve their data security products, which could enhance their ability to address emerging threats and customer needs.
• It is costly and time-consuming for customers to switch data management systems, giving incumbent competitors an advantage in customer retention due to the significant risk to data continuity.
• Rubrik positions itself as one of the only providers of a unified data security platform, necessitating heavy investment in sales and marketing to educate customers and drive market adoption.

Management Changes

Corporate Governance

Legal Proceedings

• The company received a grand jury subpoena from the Department of Justice (DOJ) in October 2023, requesting information regarding two specific companies associated with a former sales team employee who was indicted by a federal grand jury in October 2024.
• The company is fully cooperating with the DOJ investigation and conducting its own thorough internal investigation into communications among certain sales team employees, including the former employee, related to potential violations of federal law in connection with government contracts.
• Management believes that any liabilities resulting from these claims will not have a material adverse effect on the company's results of operations, financial position, and cash flows.

Stakeholder Impact

• Shareholders: Potential for dilution from future equity issuances (including convertible notes conversion), concentrated voting power with Class B holders, stock price volatility, and potential exclusion from certain stock indices.
• Employees: Continued stock-based compensation, potential for increased attrition due to wealth disparities post-IPO, intense competition for talent, and potential operational disruptions to Bangalore-based teams due to geopolitical conflicts. Named executive officers received amended severance benefits.
• Customers: Benefits from enhanced data security solutions and new AI offerings, but also face potential dissatisfaction if Subscription Credits expire unused, and reliance on third-party cloud providers and hardware manufacturers.
• Suppliers/Partners: Continued reliance on third-party cloud providers (GCP, Azure, AWS) and commodity server manufacturers (Supermicro), with risks if partners fail to perform or comply with applicable laws.
• Creditors: Debt obligations from the $1.15 billion convertible senior notes, with the ability to service this debt dependent on future financial performance.

Next Steps

• Continuously innovate the platform and product functionality to capture market share in the data security market.
• Expand the sales force and increase marketing efforts, including expanding into new international markets.
• Invest in cloud infrastructure technology, including systems architecture, scalability, availability, performance, and security.
• Continue investments in AI technologies and tools, including Rubrik Agent Cloud.
• Effectively leverage and expand the partner ecosystem.
• Explore future acquisitions or strategic investments in complementary businesses or technologies.
• Complete the transition of existing maintenance customers to RSC, expected to be largely finished by the end of fiscal 2026.
• Manage the expected decline of non-recurring revenue from Subscription Credits in fiscal 2026 and 2027.
• Comply with Section 404 of the Sarbanes-Oxley Act for the fiscal year ending January 31, 2026, including hiring additional accounting and financial staff.
• Continue full cooperation with the Department of Justice investigation and internal investigation into potential violations of federal law in government contracts.

Key Dates

Recommendation

Rubrik demonstrates strong operational momentum with significant subscription and cloud ARR growth, substantial reduction in net and operating losses, and positive free cash flow, indicating effective execution of its business strategy and increasing market adoption. The strategic acquisition of Predibase and successful debt refinancing further strengthen its position. However, the company remains unprofitable, operates in a highly competitive and rapidly evolving market, and faces ongoing risks related to customer transitions, reliance on third-party infrastructure, and a legal investigation. While the outlook is positive, the long-term path to sustained profitability and the full impact of these factors warrant a cautious 'hold' recommendation for seasoned investors, suggesting continued monitoring of performance and risk mitigation efforts.

Keywords

Rubrik, data security, cyber resilience, Zero Trust, Rubrik Security Cloud, RSC, SaaS, AI, Predibase, convertible notes, financial results, Q3 2026, cybersecurity, cloud data management, enterprise software, IPO, stock, ARR, free cash flow