Rubrik

Rubrik has executed one of the cleaner repositionings in security — from a data-backup vendor into a cyber-resilience and data-security platform — and the numbers since its April 2024 NYSE IPO are outstanding: fiscal 2026 (ended January 2026) closed with subscription ARR of $1.46B, up 34%, Q4 revenue of $377.7M with subscription revenue up 50%, an 81.5% GAAP gross margin, and strong free cash flow, with momentum accelerating into Q1 FY2027 (subscription ARR $1.57B, revenue up 39%). The strategic insight is that backup is no longer an IT-operations afterthought but the last line of cyber defense: when ransomware detonates, immutable backups and clean recovery are what determine whether an enterprise survives, and Rubrik Security Cloud unifies immutable backup, ransomware recovery, sensitive-data discovery and classification, and threat monitoring across on-prem, cloud, and SaaS in one platform. That reframing moves Rubrik out of the commoditized backup market and into the higher-value, security-budget-funded resilience category, where Microsoft's strategic backing lends further credibility. The Annapurna offering extends the platform into securing and governing data for enterprise AI workflows — a large, emerging market — positioning Rubrik to ride the AI-data-governance wave on top of its recovery franchise. A 34%-growth, high-gross-margin, free-cash-flow-generative pure-play data-security leader with a durable ransomware tailwind is a strong public compounder.

Rubrik's growth is impressive but bought with heavy dilution and persistent GAAP losses — the company still spends aggressively on sales and stock-based compensation to sustain 30%-plus ARR growth, and a $1.46B ARR business trading at a rich revenue multiple leaves little room for a stumble. The competitive field is brutal and well-entrenched: Cohesity (which merged with Veritas to form a data-protection giant), Commvault, Veeam, and Rubrik's own founders' old rivals contest backup and recovery, while Microsoft — simultaneously a strategic backer and a potential competitor through its own data-protection and Purview data-security offerings — is an ambiguous ally whose priorities could shift. The repositioning into "cyber-resilience" and "data security posture management" is partly a narrative premium: at its core Rubrik still sells backup and recovery, a category with real switching costs but also real commoditization pressure, and the DSPM and threat-monitoring extensions face dedicated specialists (Cyera, Varonis, BigID) who go deeper. Annapurna's AI-data-governance pitch is early and unproven against a crowded field racing for the same emerging budget. And the ransomware tailwind, while real, is not proprietary — every backup vendor now markets immutability and clean recovery, eroding Rubrik's differentiation to execution and go-to-market rather than defensible technology. Sustaining premium growth against consolidated incumbents while narrowing GAAP losses is the unresolved tension a high public multiple demands it resolve.