10-Q: Rubrik Reports Strong Subscription Growth and Improved Cash Flow in Q1 2026, Net Loss Narrows Significantly Post-IPO

Rubrik, Inc. announced robust subscription revenue and Annual Recurring Revenue growth for the first fiscal quarter ended April 30, 2025, alongside a substantial reduction in net loss and a positive shift in operating cash flow, largely influenced by post-IPO accounting adjustments.

Summary

• Total revenue increased by 49% to $278.5 million for the three months ended April 30, 2025, compared to $187.3 million in the prior year period.
• Subscription revenue grew by 54% to $265.7 million, driven by a 38% increase in Subscription Annual Recurring Revenue (ARR) to $1.18 billion as of April 30, 2025.
• Cloud ARR surged by 60% to $971.5 million as of April 30, 2025, indicating strong adoption of Rubrik Security Cloud (RSC).
• The company's average subscription dollar-based net retention rate remained strong at over 120%.
• The number of customers with $100,000 or more in Subscription ARR increased by 28% to 2,381.
• Net loss significantly narrowed to $(102.1) million for the quarter, a substantial improvement from $(732.1) million in the same period last year, primarily due to a $556.8 million decrease in stock-based compensation expense following the IPO-related recognition in the prior year.
• Gross profit increased by 139% to $218.0 million, with total gross margin improving to 78% from 49% year-over-year.
• Net cash provided by operating activities turned positive at $39.7 million, compared to net cash used of $(31.4) million in the prior year period.
• Free cash flow (non-GAAP) also improved to $33.3 million, up from $(37.1) million in the prior year, with the prior year including a $20.6 million cash outlay for employer payroll taxes due to equity award vesting at IPO.
• Rubrik completed an immaterial acquisition for $2.0 million during the quarter, allocating $0.7 million to intangible assets and $1.3 million to goodwill.

Sentiment

Score: 8

Explanation: The sentiment is highly positive due to exceptional growth in key subscription metrics (Subscription ARR, Cloud ARR), a dramatic reduction in net loss, and a significant positive shift in cash flow from operations and free cash flow. While the net loss reduction is partly due to IPO-related accounting, the underlying business growth and operational improvements are strong. The company is executing its transition to a SaaS model effectively, despite acknowledged risks and challenges.

Positives

• Strong growth in Subscription ARR by 38% to $1.18 billion and Cloud ARR by 60% to $971.5 million, demonstrating successful customer acquisition and expansion in the subscription model.
• Significant improvement in net loss from $(732.1) million to $(102.1) million, largely due to lower stock-based compensation expense post-IPO.
• Positive shift in net cash provided by operating activities to $39.7 million and free cash flow to $33.3 million, indicating improved operational liquidity.
• Gross profit increased by 139% and gross margin improved to 78%, reflecting better cost management and revenue mix.
• The average subscription dollar-based net retention rate remained over 120%, highlighting strong customer retention and expansion within the existing customer base.
• The number of customers with $100,000 or more in Subscription ARR grew by 28%, indicating success in attracting and scaling with larger customers.

Negatives

• The company continues to operate at a net loss, with an accumulated deficit of $(2.94) billion as of April 30, 2025.
• Maintenance revenue decreased by 59% as the company transitions customers to subscription offerings, a trend expected to continue through fiscal 2026.
• Significant concentration of revenue and accounts receivable with two partners (Partner A and Partner B), accounting for 29% and 32% of total revenue respectively in Q1 2025.
• The transition of existing customers to RSC and the exercise/forfeiture of Subscription Credits are expected to cause fluctuations in revenue growth through fiscal 2027.
• Other income (expense), net decreased significantly due to a weakening of the US dollar against foreign currencies on foreign-denominated intercompany payables.

Risks

• Rapid growth may not be indicative of future growth, and the limited operating history with Rubrik Security Cloud (RSC) makes future results difficult to forecast.
• If the market for data security solutions does not grow as anticipated, or if the company is unable to attract new customers, future results could be harmed.
• Continued history of operating losses and uncertainty about achieving or sustaining profitability in the future.
• Risk of customer non-renewal or reduction in subscription scope, which could harm results of operations.
• Potential for data security solutions to fail, perform as intended, or be perceived to have defects, errors, or vulnerabilities, harming brand and reputation.
• Information technology systems or data, or those of third parties, have been and may in the future be compromised, leading to significant adverse consequences including regulatory actions, litigation, and reputational harm.
• Use of generative artificial intelligence tools may pose risks to proprietary software and systems, and subject the company to legal liability, including intellectual property infringement claims and regulatory scrutiny.
• Revenue mix and certain business factors are expected to impact period-to-period revenue recognition, making comparisons difficult to predict.
• Reliance on third-party cloud providers (GCP, Azure, AWS) for hosting data security solutions, with any disruption or interference adversely affecting business.
• Inability to successfully manage growth efficiently could harm business, financial condition, and results of operations.
• Intensely competitive markets, with many competitors having greater resources and established customer bases.
• Estimates of market opportunity and growth forecasts may be inaccurate, and the business may fail to grow at forecasted rates.
• Limited number of contract manufacturers and OEMs for compatible commodity servers, posing risks to supply chain and customer experience.
• Customer dissatisfaction if Subscription Credits are not utilized before expiration.
• Dependence on highly skilled personnel, including senior management and engineering, with risks related to retention and recruitment.
• Sales cycles can be long and unpredictable, particularly with large organizations and government entities, requiring considerable time and expense without guaranteed sales.
• Failure to effectively develop and expand sales and marketing capabilities or improve productivity could harm customer acquisition and market acceptance.
• Need for additional capital to support business growth, which may not be available on acceptable terms.
• Exposure to fluctuations in currency exchange rates, which could negatively affect results of operations.
• Unfavorable conditions in the industry or global economy, including ongoing conflicts (e.g., Israel/Middle East, Russia/Ukraine) and inflation, could limit business growth.
• Failure to meet service-level commitments under customer agreements could lead to terminations, reduced renewals, and reputational damage.
• Intellectual property rights may not adequately protect the business, and intellectual property disputes can be costly and lead to significant liability.
• Risks inherent in international operations, including political and economic conditions, regulatory differences, and increased costs.
• Changes in tax laws or regulations could harm financial condition and results of operations, including the impact of the Tax Cuts and Jobs Act and BEPS 2.0 proposals.
• Potential for additional sales or other indirect tax liabilities in various jurisdictions.
• Ability to use net operating losses (NOLs) to offset future taxable income may be subject to limitations.
• Leverage from debt could adversely affect financial condition and ability to raise additional capital.
• Anti-takeover provisions in charter documents and Delaware law could make company acquisition more difficult and limit stockholder influence.
• Designation of specific exclusive forums for certain disputes may limit stockholders' ability to choose judicial forums.

Future Outlook

Rubrik expects new and existing customers to continue adopting the Rubrik Security Cloud (RSC) platform, with active migration of existing customers from legacy Cloud Data Management (CDM) capabilities to RSC. The company anticipates the ratable portion of subscription revenue to increase as RSC adoption grows. Modest benefits from customers exercising or forfeiting Subscription Credits are expected to continue through fiscal 2026, gradually declining in fiscal 2027 and substantially completed by fiscal 2028. Maintenance revenue is expected to decrease, with the transition largely completed by the end of fiscal 2026. Other revenue is expected to be primarily driven by professional services and decrease as a percentage of total revenue. Operating expenses are projected to increase in absolute terms as the business grows, but are expected to generally decrease as a percentage of revenue over the long term, excluding stock-based compensation. The company intends to continue significant investments in research and development, sales and marketing, and general and administrative functions to capture market share and scale operations. Rubrik expects to maintain a full valuation allowance on its U.S. federal and state net deferred tax assets for the foreseeable future due to its history of losses.

Management Comments

• "We are on a mission to secure the world's data."
• "Cyberattacks are inevitable. Realizing that cyberattacks ultimately target data, we created Zero Trust Data Security to deliver cyber resilience so that organizations can secure their data across the cloud and recover from cyberattacks."
• "We believe that the future of cybersecurity is data security—if your data is secure, your business is resilient."
• "We built Rubrik Security Cloud ('RSC') with Zero Trust design principles to secure data across enterprise, cloud, SaaS, unstructured data, and identity providers."
• "RSC delivers a cloud native SaaS platform that detects, analyzes, and remediates data security risks and unauthorized user activities."
• "We began transitioning customers from our legacy CDM capabilities to RSC, which is offered on a subscription basis, in fiscal 2023."
• "We primarily measure our business on the basis of Subscription ARR, as we believe it best reflects our actual growth and our growth prospects."

Industry Context

The cybersecurity industry is evolving from a focus on preventing attacks to a more data-centric approach, emphasizing data security and recovery. Rubrik positions itself at the forefront of this shift with its Zero Trust Data Security platform, Rubrik Security Cloud (RSC), addressing the growing demand for cyber resilience amidst increasing cyberattack activity, particularly ransomware. The market for data security solutions is described as being at an early stage and rapidly evolving, with significant potential for growth. Rubrik's strategy aligns with the trend of cloud adoption and the need for unified data security across diverse environments (enterprise, cloud, SaaS, unstructured data, identity providers).

Comparison to Industry Standards

• Rubrik competes with traditional data management and protection vendors such as Dell-EMC, IBM, Commvault, Veeam, and Cohesity (which recently acquired Veritas data protection business).
• The company also faces competition from cloud and SaaS data management vendors and specialized vendors in cyber/ransomware detection, data security posture management, identity security, insider threat detection, and data classification.
• Rubrik highlights its ability to converge data security and data management in a cloud architecture as a significant competitive factor, differentiating itself from competitors who may focus on existing infrastructure security tools alone.

Corporate Governance

Legal Proceedings

• The company received a grand jury subpoena from the Department of Justice (DOJ), U.S. Attorneys Office for the District of Maryland, requesting information regarding two specific companies associated with a former employee.
• The former employee was indicted by a federal grand jury in October 2024 and is being prosecuted by the DOJ.
• Rubrik is fully cooperating with the DOJ investigation and conducting its own internal investigation, which has uncovered communications among certain sales team employees (including the former employee) related to potential violations of federal law in connection with government contracts.
• The investigations are ongoing, and the ultimate outcome, including potential substantial fines, penalties, financial exposure, reputational harm, and exclusion from future federal government contracting, is uncertain.

Stakeholder Impact

• **Shareholders**: Class A common stockholders face limited influence over corporate matters due to the dual-class voting structure and potential dilution from future equity issuances. The stock price is subject to volatility based on financial performance, market conditions, and analyst expectations.
• **Employees**: The company's success depends on retaining and attracting highly skilled personnel, particularly in engineering and sales. Rapid headcount growth and the transition to a public company may impact company culture and employee retention, especially if the perceived value of equity awards declines.
• **Customers**: Customers benefit from the expanding features and functionality of the Rubrik Security Cloud (RSC) platform, offering enhanced data security and cyber resilience. However, they may face challenges and potential delays during the migration from legacy systems to RSC, and some may experience dissatisfaction if Subscription Credits are not utilized.
• **Partners (Channel Partners & Technology Alliance Partners)**: Rubrik heavily relies on its Channel Partners for sales and distribution, with a significant concentration of revenue flowing through a few large partners. The company's ability to market and sell solutions is dependent on maintaining successful relationships and ensuring partners effectively market and sell its solutions. Any failure by partners to comply with laws could also impact Rubrik.
• **Creditors**: The company's debt under the Amended Credit Facility imposes restrictive covenants that limit certain operational and financial actions, which could affect its ability to meet obligations if financial conditions deteriorate.

Next Steps

• Continuously innovate the platform and product functionality to capture share in the data security market.
• Expand the sales force and marketing efforts, including into new international markets.
• Accelerate the migration of existing customers from legacy CDM capabilities to the RSC platform.
• Monitor and manage the impact of customers exercising or forfeiting Subscription Credits on revenue recognition.
• Continue to assess the capital structure and evaluate the merits of deploying available cash, potentially seeking additional equity or debt financing.

Key Dates

Recommendation

Keywords

Data Security, Cybersecurity, Zero Trust, Cloud Security, SaaS, Ransomware Recovery, Data Management, Enterprise Software, Subscription Revenue, Annual Recurring Revenue, SEC Filing, 10-Q, Financial Results, Corporate Governance, Risk Management