Research Note: Rubrik Files for IPO

Rubrik, Inc. has filed an S-1 document with the SEC that now provides some information on an upcoming initial public offering (IPO) for the company. We take a look at the details and how they reflect on the current business offerings from Rubrik and the market in general.

Background

Rubrik, Inc. has filed an S-1 notice with the SEC, which precedes an intention to go public through an IPO process. The S-1 provides a significant amount of background information on Rubrik’s products, services, and financials (although much of the actual detail on pricing and shares to be floated are still withheld).

Financial Status

Rubrik has included two years of financial data for FY2023 and FY2024. The company financial year ends in January, so the data covers mostly calendar years 2022 and 2023. Although we have only a small amount of information to review, we can glean some insight into the state of the business.

Figure 1 – Revenue by Category FY2023-FY2024

Figures 1 and 2 show revenue split by type, which falls into the Subscription, Maintenance and Other categories. Rubrik has been steadily moving customers towards a subscription model, reducing the dependency on perpetual and appliance-based sales (categorised as “Other” in the graphs). This transition appears to have been working successfully, although the data shows the company took a revenue hit between Q3 and Q4 FY2023 as part of this process.

Figure 2 – Revenue by Category – Quarterly

Financially, the company continues to make significant losses, as shown in Figures 3 and 4. FY2023 losses were $277.7 million, while FY2024 reported $354.2 million in the red. In total, the S-1 indicates Rubrik has made cumulative losses of $1.683 billion.

ARR

The profit and loss data are not out of alignment with similar start-up companies, where growth in sales is prioritised ahead of profitability. However, between FY2023 and FY2024, revenue grew by only 4.7%. Rubrik would rather we focus on ARR (annual recurring revenue), especially as the company is pivoting to a subscription model. Between FY2023 and FY2024, ARR grew 47%. However, net retention is 133%, meaning customers increased spending by a third at renewal time (typically due to the increase in data being retained as data volumes grow).

Figure 3 – Rubrik Financials FY2023-FY2024

The Rubrik graph representing this data is shown in Figure 5. Additional information has also been provided in the S-1 that claims the company has 99 customers with greater than $1 million in ARR and another 1742 customers with greater than $100K. A quick calculation shows that those customers account for a minimum of $273 million, leaving $511 million from 4259 customers or around $120,000 each. We think, therefore (as none of the 4259 can be over $100K), that the average $1m and $100K customers are much higher than those base thresholds.

One final financial note to make – three partners represent 76% of Rubrik’s revenue in FY2024 (79% in FY2023). The three aren’t identified in the S-1, but are shown as “Partner A, B, C”, although we believe at least one is Microsoft. This is a high concentration of dependency, which is difficult to reconcile with the current sales & marketing spend.

A significant amount of information relating to share volumes and pricing are not included in the S-1, therefore we can’t comment on the future market capitalisation of Rubrik. We expect the S-1 to be updated prior to IPO when we will update this research note (which we hope will also reveal the partner names above).

Products & Services

Rubrik started out as a data protection vendor with a strategy based on hardware appliances. As we highlighted in this blog post from 2018, the company started to transition away from selling Rubrik-branded appliances, instead selling software licences that enabled the Rubrik solution to run on virtual instances.

The company has since pivoted to a SaaS-based model and rebranded CDM (originally Converged Data Management, then Cloud Data Management) as RSC, the Rubrik Security Cloud.

RSC has four components.

Data Protection – the original platform offering, now covering on-premises (enterprise), NAS, public cloud and SaaS solutions.
Data Threat Analysis – Anomaly detection, Threat Monitoring & Threat Hunting.
Data Security Posture – locating sensitive data and identifying data risks.
Cyber Recovery – orchestrated recovery from cyberattacks (including guarantees).

These aspects of the Rubrik Security Cloud form a foundation for data protection and recovery while reducing the attack vector for would-be hackers and mitigating poorly configured systems.

Remember, though, that Rubrik operates on secondary data, the point-in-time copies stored through a backup. This makes all of the Rubrik solutions reactive rather than proactive, which points to why the company recently acquired a start-up called Laminar.

Although ransomware attacks are inevitable, data protection vendors looking to transition into data security need to move towards proactive protection as much as possible. The Laminar acquisition and previous partnership announcement with Zscalar are clearly aimed at moving the company towards a true data security platform.

The Architect’s View®

Rubrik has been able to evolve from a data protection company into data security. However, this is a trend the industry has already undertaken. Commvault announced Commvault Cloud in November 2023, with an evolution of the Metallic platform that includes data security features such as Risk Analysis, Threat Scan, Auto Recovery and ThreatWise Advisor. Cohesity has similar functionality, as well as a potentially larger customer base when the intended acquisition of Veritas’ data protection assets completes.

These two examples show that Rubrik is far from unique in the industry, in which competition is intense. However, the company clearly recognises the scale of the challenge for enterprises, especially those with diverse data profiles, and is delivering services to meet those needs.

We will be watching the IPO with interest, and reporting on the progress of the company as it goes public.