Rubrik, Inc.RBRKNYSE
LOADING
|||
Operator: Good afternoon, ladies and gentlemen, and welcome to the Rubrik Third Quarter Fiscal Year 2026 Results Conference Call. [Operator Instructions]. This call is being recorded on Thursday, December 4, 2025. I would now like to turn the conference over to Melissa Franchi, Head of Investor Relations. Please go ahead.
Melissa Franchi: Hello, everyone. Welcome to Rubrik's Third Quarter Fiscal Year 2026 Financial Results Conference Call. On the call with me today are Bipul Sinha, CEO, Chairman and Co-Founder of Rubrik, and Kiran Choudary, Chief Financial Officer. Our earnings press release was issued today after the market closed and may be downloaded from the Investor Relations page at www.ir.rubrik.com. Also on this page, you'll be able to find a slide deck with financial highlights that, along with our earnings release includes a reconciliation of GAAP to non-GAAP financial results. These measures should not be considered in isolation from or as a substitute for financial information prepared in accordance with GAAP. During this call, we will make forward-looking statements, including statements regarding our financial outlook for the fourth quarter and full fiscal year 2026. Our expectations regarding market trends, our market position, opportunities, including with respect to generative AI, growth strategies, current initiatives and expectations regarding those initiatives and our go-to-market motions. These statements are only predictions that are based on what we believe today, and actual results may differ materially. These forward-looking statements are subject to risks and other factors that could affect our performance and financial results, which we discuss in detail in our filings with the SEC. Rubrik assumes no obligation to update any forward-looking statements we may make on today's call. With that, I'll hand the call over to Bipul.
Bipul Sinha: Thank you, Melissa, and thank you all for joining us today. Let me start by saying our third quarter results were exceptional. Every quarter for the past several quarters, we have successfully delivered in many cases, record numbers. In fact, this quarter has been our best ever. We have not only added record net new subscription ARR, but also generated tremendous free cash flow. And I'm happy to report we once again exceeded all guided metrics across top line and profitability. Here are 5 key numbers. First, subscription ARR reached $1.35 billion, growing 34% year-over-year. Net new subscription ARR reached a record $94 million. Second, our subscription revenue was $336 million, growing 52% year-over-year. Third, our subscription NRR remained strong once again, over 120%. Fourth, customers with $100,000 or more in subscription ARR reached 2,638, growing 27% year-over-year. And finally, on profitability, we once again made material improvement in subscription ARR contribution margin, up about 1,400 basis points year-over-year. We generated a record $77 million in free cash flow this quarter. This combination of top line growth and cash flow margin at our scale is best in class. We remain confident about the opportunity ahead, and thus, we are again raising our outlook for the year.
Bipul Sinha: But let me begin by providing some additional context on our market opportunity as well as our areas of focus. Our mission is to lead Rubrik into our next era as the, let me repeat, the security and AI operations company. My discussions with IT and security leaders consistently reveal an assume breach mentality, which means being prepared for the inevitable reality that every enterprise will face a successful cyber breach. This preparation includes 2 things: First, understanding the risk of a cyber breach in terms of both data content and identities. And second, the ability to remediate and recover from the breach to ensure business continuity. But the landscape in which these threats occur has dramatically evolved. Organizations are now facing a new cyber landscape with AI potentially enabling threat actors to inflict 10x more damage in 1/10 of the time. Alongside these challenges, enterprises are also focused on modernizing their infrastructure in anticipation of the impending enterprise AI transformation. While AI presents 100x more risk, the AI transformation promises 100x more opportunities, much like every big generational shift in enterprise technology. When cloud redefined IT, Rubrik ensured simple and reliable recovery. When cyber threat surged, we extended our Rubrik Security Cloud product suite across data and identity to deliver true cyber resilience. Now with the rise of AI agents, a new transformation is underway. AI transformation presents unique challenges. An agent operates within an organization's environment runs business processes, assumes identity, touches critical data and impacts mission-critical applications at unprecedented speed and scale. These agents are effectively superhuman, but organizations don't yet have the guardrails to monitor and contain what they do. We need to think about AI agents very differently. Through this AI transformation, Rubrik's mission and its strategy remains the same, to accelerate our customers' journey to AI enterprise. I will delve deeper into our AI agent innovations later in my remarks.
Bipul Sinha: As companies shift deeper into cloud and AI, customers continue to turn to Rubrik for complete cyber resilience, which includes 2 key set of capabilities. First, consistent data and identity security policy controls, and second, rapid and accurate recovery from cyber attacks. While we believe we have a tremendous opportunity in enterprise AI acceleration, we continue to focus on and when the vast cyber resilience market, which includes our core data protection solutions and identity resilience. Let me provide some more details across our 3 businesses: data protection, identity resilience and AI operations. Our cyber resilient data protection journey remains in its early stages, particularly as data availability and security become the most crucial element for AI. We continue to add new solutions across data center, cloud and SaaS workloads, leveraging the same underlying preemptive recovery engine to deliver complete risk and remediation capabilities. Our unique architecture consistently enables us to outperform both legacy and new gen backup vendors. In fact, in the third quarter, bookings from legacy replacements accelerated year-on-year, surpassing the growth rates seen in the first half of the year. Let me provide 2 specific examples of legacy replacements in very large enterprises. First, one of the largest banks in Asia and worldwide selected Rubrik as the strategic cyber resilience partner, replacing a long-standing legacy vendor. We outcompeted several new gen backup vendors for this opportunity. Rubrik's platform now provides data protection across its data center and cloud workloads for mission-critical applications. The customer also chose the Rubrik's Identity Recovery solution for over 250,000 users. And the second, a Fortune 250 professional services firm selected Rubrik to displace its 15-year legacy backup vendor. Rubrik again outcompeted several new gen competitors for this opportunity. Rubrik will provide a unified cyber resilience platform across the customer's rapidly evolving hybrid and multi-cloud environments.
Bipul Sinha: Let me now talk about the momentum we are seeing in cloud protection. Many sophisticated cyber attack inevitably occurs, organizations need to recover quickly and seamlessly, which is difficult across multiple workloads, tools and interfaces. Rubrik Security Cloud delivers complete cloud and SaaS protection from a single platform that understands the relationship among data, applications and identities regardless of where they live. We continue to build upon our core to cloud cyber resilience offerings, which delivers protection from the first line of code to full stack application in production across the major hyperscalers. For example, we recently announced Rubrik DevOps protection for Azure, DevOps and GitHub. This new solution is designed to ensure our customers most valuable intellectual property and development pipeline are protected and preserved. Now let me illustrate our momentum in cloud protection with 2 specific customer wins. A health and wellness technology company chose Rubrik cloud protection to protect a multi-petabyte mission-critical workload containing user data. Rubrik offered not only cyber resilience, but also a significant cost reduction compared to cloud-native backup solutions due to our unique platform. With Rubrik, this customer can confidently meet their minimal viable business plans with our immutable and secure data protection solution. And second, a Fortune 150 biopharmaceuticals company strengthened the partnership with Rubrik this quarter by adding cloud protection for its multi-petabyte public cloud data estate. We not only replaced native backup solutions, but also outcompeted new gen vendors. Rubrik was selected due to the strength of our cyber resilience capabilities as well as lower TCO with an estimated 30% annual cost savings.
Bipul Sinha: Next, let's talk about our Identity business. As we have discussed, our comprehensive identity resilience platform uniquely combines identity posture and recovery with the Data Security Posture Management, or DSPM to deliver complete identity risk and remediation solutions. Our Identity line of business has been highly successful in garnering budget from CSOs, extending Rubrik beyond our traditional CIO and CTO buying personas. This business has achieved significant momentum in just over 3 quarters of the first general availability, reaching about $20 million in subscription ARR. In Q3 alone, we more than doubled the total number of identity customers. In fact, 40% of those identity customers added in the third quarter were net new to Rubrik. As you might recall, we started our identity journey with the release of identity recovery, which provides the rapid recovery of identity services following cyber attacks or operational failures to minimize business disruption. This quarter, we announced support for Okta Identity making Rubrik the only identity recovery solution to support Okta, Active Directory and Entra ID recovery. We also announced a new identity integration with CrowdStrike this quarter. With this integration, our customers can not only detect identity threats in real time, with Falcon Next-Gen Identity Security, but also surgically roll back malicious changes and restore their identity system to a safe operational state with Rubrik Security Cloud. CSOs are increasingly turning to Rubrik for a more comprehensive identity strategy. This quarter, we launched Rubrik identity resilience a higher tier addition above identity recovery. This solution monitors and protects both human and nonhuman identities, tracks misconfigurations and high risk or malicious changes within active directory and Entra ID. It also enhances risk posture and accelerates cyber recovery by linking identity-based information such as privileged access with Rubrik's DSPM's sensitive data context and activity. In just 1 quarter of selling, we closed 65 deals for identity resilience. This early momentum makes us very excited about what's ahead for identity resilience.
Bipul Sinha: Let me share 2 illustrative customer wins. Our U.K. government agency added identity resilience for its large user base, alongside cloud data protection for Azure and AWS, as they sought to bolster resilience for critical national infrastructure amid rising cyber attacks in the U.K. This agency also consolidated several disparate tools with the Rubrik platform and replaced native cloud backup solution, which proved unscalable for the customer's massive and complex data estate. And second, a U.S. state agency turned to Rubrik this quarter after the rise of cyber attacks on governments nationwide. And in particular, after a recent incident, that impacted a critical state agency, seeking to bolster its cyber strategy and reduce recovery times, the agency chose Rubrik identity resilience and M365 protection for 100,000 users, replacing their native cloud protection and traditional data center identity backup. With Rubrik, cyber recovery times will move to mere hours compared to months with the incumbent solution.
Bipul Sinha: Lastly, I will talk about our innovations in the AI space. As I mentioned earlier, agentic AI can unlock significant new efficiencies for every organization. It also introduces considerable risks, including threats by bad actors and the issue of hallucinations. To help accelerate AI transformation, we recently launched Rubrik Agent Cloud, or RAC, a new product suite that enables enterprises to deploy AI agents safely and confidently at scale. With the release of Rubrik Agent Cloud, Rubrik now operates 2 complementary product suites built on the same Rubrik platform, which combines application, data and identity context across all enterprise workloads. First, Rubrik Security Cloud for cyber resilience and accelerated cloud adoption. And second, Rubrik Agent Cloud for AI resilience and accelerated AI agent adoption. Our competitive advantage is Rubrik's core platform that sits in the center of data application and identity. Following the acquisition of Predibase last quarter, we now have agent context in the mix as well. Together, this forms the Rubrik Agent Cloud, the first integrated enterprise control layer for managing the AI agent life cycle. RAC answers the 3 most critical questions currently facing every CIO and CISO. Number one, what agents do I have? And what are their capabilities and activities. Number two, what data are these agents allowed to access? And are they operating within the enterprise guardrails? And number three, if something goes wrong, can I undo it. RAC provides organization with the ability to answer these questions through its core capabilities, namely agent monitoring, agent governance and full agent remediation. This includes Rubrik Agent Rewind, which we announced last quarter, Agent Rewind helps customers undo the mistakes of AI agents, which is crucial for a scalable and secure AI adoption. We also recently announced that Rubrik Agent Cloud will integrate with Microsoft Copilot Studio and AWS Bedrock. As we have said previously, we are still in the initial phase of a multiyear effort to scale Rubrik's AI solutions. Rubrik Agent Cloud is currently in beta, but we are very excited about the early customer enthusiasm. Looking ahead, we plan to expand our capabilities and investments to enable confident enterprise AI transformation and agentic work adoption.
Bipul Sinha: In closing, I would like to share my gratitude to my fellow Rubrikans. Rubrik continues to win the cyber resilience market. And at the same time, we are defining the AI enterprise future. Rubrikan's collective focus and disciplined execution always inspired me. Also, I extend my sincere gratitude to our customers and partners. Your confidence in us motivates our continuous effort to lead and shape the future of cybersecurity and enterprise AI. And lastly, of course, thank you to you, our shareholders, for your continued support and trust. A number of you have mentioned to me the consistency with which we have been delivering the beat and raise cadence since our IPO. This is true. We have done so quarter after quarter. We are confident in closing out this year strong and continuing our great momentum into the next year and beyond. With that, I'm pleased to pass it over to our Chief Financial Officer, Kiran Choudary.
Kiran Choudary: Thank you, Bipul. Good afternoon, everyone, and thank you for joining us today. We had a very strong Q3 marked by record net new subscription ARR and continued improvement in profitability metrics. These results reinforce our leading position in the large and expanding cyber resilience market. We are raising our Q4 outlook as we look forward to a strong close to the fiscal year. Let me start by briefly recapping our third quarter fiscal 2026 financial results and key operating metrics, and then I'll provide guidance for the fourth quarter and full year fiscal 2026. All comparisons, unless otherwise noted, are on a year-over-year basis. We are very pleased to have ended Q3 with subscription ARR of $1.35 billion, growing 34%. We added $94 million in net new subscription ARR, a record amount for Rubrik. We continue to drive adoption of our Rubrik Security Cloud, which resulted in $1.17 billion of cloud ARR up 53%. Our differentiated land-and-expand model benefits from multiple avenues to gain new customers and grow our footprint after the initial contract. Expansion occurs through data growth in existing applications, securing more applications or identities or adding more security products. As a result, we continue to see a strong subscription net retention rate, which remained over 120% in the third quarter. We are very proud of the high customer retention and expansion dynamics of our business. All vectors of expansion are healthy contributors to our NRR, highlighting the meaningful runway we have to more deeply penetrate our customer base. Adoption of additional security products contributed over 40% of our subscription net retention rate in the quarter, up from 32% in the year ago period. In the third quarter, we saw significant growth in our largest accounts with the number of customers contributing $100,000 or more in subscription ARR rising 27% to 2,638. These large customers now represent 86% of our subscription ARR, an increase from 83% a year ago. Furthermore, we added a record 23 new customers with subscription ARR of $1 million or more driving over 50% growth in our $1 million subscription base. For our third quarter, subscription revenue was $336 million, up 52%. Total revenue was $350 million, up 48%. Revenue in Q3 primarily benefited from a strong ARR growth. However, we again had tailwinds from our cloud transformation, resulting in higher nonrecurring revenue, which is accounted for as material rights. Material rights contributed approximately $25 million to revenue this quarter, modestly ahead of our expectation. Revenue growth normalized for material rights was approximately 36% in the quarter. Turning to the geographic mix of revenue. Revenue from the Americas grew 51% to $256 million. Revenue from outside the Americas grew [ 51% ] to $94 million. Before turning to gross margins, expenses and profitability, I would like to note that I'll be discussing results in a non-GAAP basis going forward. Our non-GAAP gross margin was 83% in the third quarter, compared to 79% in the year ago period. Our gross margin benefited from the revenue outperformance, including higher nonrecurring revenue and the improved efficiency of our customer support organization. As a reminder, we look at subscription ARR contribution margin as a key measure of operating leverage. We believe the improvement in our subscription ARR contribution margin demonstrates our ability to drive operating leverage and profitability at scale. Subscription ARR contribution margin was positive 10% in the last 12 months ended October 31, compared to negative 3% in the year ago period, an improvement of approximately 1,400 basis points. When normalizing for the $23 million in employee payroll taxes associated with the IPO in the prior period, the improvement was approximately 1,200 basis points. The improvement in subscription ARR contribution margin was driven by higher sales, the benefits of scale and improving efficiencies and management of costs across the business. Free cash flow was $77 million compared to $16 million in the third quarter of fiscal 2025. This increase was driven by higher sales, improving operating leverage and optimizing our capital structure.
Kiran Choudary: Turning to our balance sheet. We ended the third quarter in a strong cash position with $1.6 billion in cash, cash equivalents, restricted cash and marketable securities and $1.1 billion in convertible debt. Let me now provide some context on our guidance. We are confident in our outlook driven by the robust cyber resilience market and strong demand for our unique offerings. We expect these factors, combined with our consistent and effective execution to deliver strong subscription ARR growth ahead. We plan to continue making operational investments across 2 key areas. First, we'll continue to invest in R&D to accelerate innovation in the large, but developing markets of data security and AI. Second, we will invest in our go-to-market, specifically targeting regions and verticals that offer the most attractive ROI. These go-to-market investments will also focus on achieving product market fit and scaling our newer innovations such as identity resilience platform and Rubrik Agent Cloud.
Kiran Choudary: Now turning to guidance for the fourth quarter and full year fiscal 2026. In Q4, we expect revenue of $341 million to $343 million, up 33% or approximately 30% when normalized for material rights. We expect non-GAAP EPS of negative $0.12 to negative $0.10 based on approximately 201 million weighted average shares outstanding. For the full year fiscal 2026, we now expect subscription ARR in the range of $1.439 billion to $1.453 billion, reflecting a year-over-year growth rate of approximately 32%. We expect total revenue for the full year fiscal 2026 in the range of $1.280 billion to $1.282 billion, up approximately 44% or 35% when normalized for material rights. We expect material rights related to our cloud transformation to contribute approximately $68 million to revenue in fiscal year 2026. We expect non-GAAP subscription ARR contribution margins of approximately 9%. We expect non-GAAP EPS of negative $0.20 to negative $0.16 based on approximately 197 million weighted average shares outstanding for the full year. We expect free cash flow of $194 million to $202 million. As we progress through the final stages of our successful cloud journey, our reported revenue growth has seen significant tailwinds from our cloud transformation, including material rights in fiscal 2026. In fiscal 2027, dynamics related to our successful cloud transformation and a substantial reduction in material rights revenue will represent a headwind to our reported revenue growth. However, normalized revenue growth will be ahead of subscription ARR growth. As we have always communicated, subscription ARR is the primary top line metric to evaluate our business performance as it is not impacted by the aforementioned accounting dynamics related to our cloud transformation. In terms of profitability, we will continue to stay focused on taking advantage of the market opportunity in cybersecurity and AI while balancing growth with improved efficiency. Based on our current investment plans, we expect to deliver modest improvement in our subscription ARR contribution margin and modestly higher free cash flow for the fiscal year 2027. In addition, we included some additional modeling notes in our investor presentation. In closing, we are pleased with our strong performance in the third quarter. We look forward to finishing the year strong, given our leadership, innovation and ability to execute on a large and growing market opportunity. With that, we'd like to open up the call for any questions.
Operator: Your first question comes from Saket Kalia of Barclays.
Saket Kalia: Nice quarter. Bipul, maybe for you. It's very clear that you're taking share in kind of the core cyber resilience, right, the first of 3 pillars. But you're also growing other businesses like identity. And so I'm curious, how additive can identity be to an average data protection deal? And maybe relatedly, is identity replacing any established tools or is that creating new budget as you sell increasingly to CISOs?
Bipul Sinha: Identity is completely additive to the deal. So it is a net new buyer for Rubrik. We are selling identity to the CISO organization to IM persona. And in some cases, we are replacing legacy or new gen vendor, a new gen identity recovery vendor. In other cases, it's a white space. Nevertheless, it's a net new buyer for Rubrik, which is a CISO organization and a net new solution that we have created completely from scratch. In fact, this product went into GA -- first GA in December last year. And we are seeing 40% of new customers last quarter is net new to Rubrik. So this is very exciting.
Kiran Choudary: Saket, this is Kiran. I also wanted to add that in my prepared remarks, I had mentioned that our NRR was again 120% plus for the quarter. And while all the drivers were good contributors, the security component crossed 40% and identity is one of the key components of that -- or drivers for that.
Saket Kalia: That's super helpful. I would love to squeeze in just 1 housekeeping question, Kiran, maybe if I can for you. The SaaS ARR line really speaks for itself. But I was wondering if you could just comment on the non-SaaS ARR line, right? There's an element of there that's conversion. There's also some natural churn. Can you -- since we're all together here on the call, can you just talk about how we should think about modeling that going into Q4 and then maybe into next year?
Kiran Choudary: Sure, Saket. I'll add my thoughts to that. So as you know, we are predominantly a cloud SaaS business now. We are very pleased with how the cloud transformation has progressed in the last few years. This quarter, we were around 87%. Cloud ARR as a percentage of subscription and we grew 53%. When you look at the non-cloud run, that is one of the lines which is also contributing to the cloud ARR growth, one with smaller components, but is contributing. So as a result, that declines, and that's declined now for a few quarters. And we'll continue a bit more because we believe there is more room to run in our cloud ARR -- cloud business as a percentage of subscription ARR.
Operator: Your next question comes from Matt Martino of Goldman Sachs.
Matthew Martino: Bipul, do your comment that bookings from legacy replacement accelerated year-over-year stood out to me. I guess from your perspective, what's driving the acceleration there? Is it the modernization ahead of AI that you flagged in the prepared remarks or maybe a growing recognition from CIOs that they simply can't wait to modernize due to the growing threat vectors out there.
Bipul Sinha: Thanks. It's both. It's definitely preparing for AI and modernizing the infrastructure, that's a big driver. And the other driver is cyber attacks are inevitable and Rubrik has a unique platform that delivers cyber recovery, leveraging our preemptive recovery engine that is unique in the marketplace. And our speed of recovery is the key factor in making this decision. So CIOs and CISOs are looking at their legacy landscape, including new gen vendors and saying that I'm at risk. Cyber attacks are going to come to me. And if I can't keep my business up and running, it threatens the very existence of the business, and that's what is also driving legacy replacement.
Operator: Your next question comes from Fatima Boolani of Citi.
Fatima Boolani: Bipul, this one I want to direct to you. Since your IPO, there has been an absolute avalanche of new product introductions and new capabilities and you're showing and putting points on the board with respect to installed base and new customer uptake in adoption. What I wanted to ask you was just with respect to the platform having expanded so dramatically in the span of the last 18 months. I'm curious how that's influencing your overall sales strategy? And really, the spirit of the question here is what's become very involved and certainly, the companies we cover and the broader enterprise software is this notion of providing flex or consumption-oriented type vehicles to enable customers to have a more fulsome frictionless access to the full portfolio. So a long-winded way to ask you, is that something that you would potentially consider just given how quickly and how robustly the platform's expanded? And how would you idea around that?
Bipul Sinha: Thanks, Fatima. So if you look at Rubrik from day 1, our strategy has been a true platform company. And you might ask what is a platform company. Our definition of a platform company is a product when -- a platform when the customer adopts more than 1 product, their value from the platform goes up. I'll give you an example. When our customers buy Rubrik Security Cloud for both data center as well as AWS or Azure cloud, if there is a threat actor in the cloud and same threat actor is in the data center, we can auto correlate threat and give you the full cyber resilience intelligence and recovery on that threat actor. You don't have to pull the logs into Splunk and then try to analyze and figure out what's going on. Rubrik automatically does that for you. Now the same platform is expanded into identity. So now you can actually see what's happening to your identity vis-a-vis data when the privilege gets escalated. Now the same platform we have launched a new product suite in Rubrik Agent Cloud. So now we have 2 distinct product suite. Rubrik Security Cloud for cyber resilience, Rubrik Agent Cloud for enterprise AI acceleration. So our strategy has always been give customer a comprehensive platform and be the strategic IT vendor for that customer for years and years to come. Obviously, we want to make it easier for our customers to consume Rubrik product, try new Rubrik product. And we don't easily lose customers because we provide a mission-critical solution and customer retention has been one of the hallmarks of Rubrik. So we are looking at all avenues going forward to make it easier for our customers to adopt Rubrik, consume Rubrik because we are selling is only 5% of my job, 95% of my job is to ensure customer delight, the first use experience, repeated user experience, expansion experience and providing end-to-end cyber resilience.
Operator: Your next question comes from John DiFucci of Guggenheim.
John DiFucci: This is an impressive quarter. And I'd just like to congratulate the extended Rubrik team beyond even those on this call. Bipul, I want to sort of go high level with you on something because you hit something that everybody is hitting now and we are just trying to figure out. It seems really early when it comes to securing AI agents. But things can move really fast. It seems that everybody in security is saying they're best positioned to serve this role, which looks like it can be huge, right? Can you explain why Rubrik is well positioned to capture this opportunity or maybe even just part of the opportunity? And if that's the case, what else do customers -- what else will they need to have beyond Rubrik to solve this problem?
Bipul Sinha: Thanks, John. That's a really good question. If you take a step back, Rubrik is all about data, identity and business applications. And these are the 3 main things even to deliver AI. AI is not a purely security question. Neither it is purely operations question. AI sits at the intersection of security, which is risk management and governance, plus the operations, which is how do you deliver the accurate AI, how do you fine-tune the model? How do you create real-time operational guardrails and observability and undo action if they misbehave because of cyber compromise or hallucination. And Rubrik is squarely at the intersection of operations and security. So this is a natural place for us to deliver a complete agentic operation platform, agentic management platform, if I can be so bold to call it agentic ERP. And what does agentic ERP needs to deliver? 3 things. How many agents do I have, including the ones that is sanctioned as well as the ones that are non-sanctioned. What the hell they are doing? What do I want them to do in terms of my operational guardrail? Are they hallucinating, can I make them more accurate so that humans can be confident of the results of the AI agents. And if they misbehave, can I take -- press the rewind button and take away the effect of them, of misbehaving agent. So this requires an end-to-end complete platform across monitor, govern and remediate. So this is a very natural extension to Rubrik's core strategy. And you know what? On top of it, Rubrik is also secure data lake. So we have additional opportunity to bring Rubrik data to do fine-tuning of the model, to deliver more accuracy with Predibase acquisition, we have the ability to virtualize GPU, to reduce the cost or to multiplex different training model to be able to deliver perfect guardrail for our customers to have confidence in the agentic actions. So we believe that we are strongly positioned to deliver this new infrastructure product suite, Rubrik Agent Cloud. And then we are integrating this across the ecosystem. You saw our announcement with Copilot Studio, with AWS Bedrock, we are extending and expanding this platform across all the tools that users can use to build agents. And this is, again, a [ strategic ] opportunity just like cyber resilience across all business applications. Rubrik Agent Cloud is product suite across all agent tool builders, whether it's AWS, Azure, GCP, M365, Salesforce, Agentforce, no matter whether it is infrastructure as a service agent or platform as a service agent, Rubrik Agent Cloud is giving our customers the confidence to do the AI transformation, deploy agents at a scale and truly take advantage of the AI opportunity.
John DiFucci: That actually -- that is the first time I've heard anything about this described in a way that I can understand. So thank you very much.
Operator: Your next question comes from Brad Zelnick of Deutsche Bank.
Brad Zelnick: Excellent. And I echo my congrats as well. What a great quarter. And my question actually follows on what John just asked about Rubrik Agent Cloud, across monitor, govern and remediate. And I reflect on the announcement this week adding Amazon Bedrock along with Copilot Studio support. Bipul, how are these partnerships structured with the AI platforms. Is there a co-investment in go-to-market and co-innovation on product? And what are the ways you'll monetize Rubrik Agent Cloud along with the platforms.
Bipul Sinha: Thanks, Brad. We have been working with hyperscalers for a number of years. And our initial -- our big partnership started with cyber resilience, and we have found tremendous success. We have hundreds, if not thousands of customers with them and joint customers where we are helping hyperscalers deliver a complete business transformation, cloud transformation with confidence of cyber resilience. And now we are expanding on that partnership to bring Rubrik Agent Cloud. And so the idea is if you develop your agents on AWS Bedrock or on Copilot to Studio, you can manage that on Rubrik Agent Cloud. And so we have prebuilt go-to-market partnership with hyperscalers, and we expect to leverage those existing infrastructure with the new teams that are involved on the AI side to expand the go-to-market.
Brad Zelnick: And from a monetization standpoint, Bipul, these are dedicated SKUs that are incremental. The strategy isn't necessarily to migrate customers up different tiers of the core product. Is there anything we should know about the way that you'll monetize?
Bipul Sinha: So Rubrik Agent Cloud is a completely separate product suite. It is early where the product is in beta, but we are getting very strong customer feedback on these products. I'll give you a couple of examples, a very large healthcare organization said that they are slow to adopt agents because they have yet to find a platform that they can confidently operationalize agents, which means that monitor and have visibility into agents. There was another pharma company where the exec said that why are we not having a product like Rubrik Agent Cloud already. And they said that they see our vision as really enabling them to an agentic future, and this is the right idea. Obviously, all of this is very early, but we are very encouraged by the reaction and obviously, we'll update you as we make progress, but I anticipate there to be a separate product suite that we'll sell.
Operator: Your next question comes from Eric Heath of KeyBanc.
Eric Heath: Great. Bipul and Kiran, I wanted to follow up on your comments about the strong beat and raise cadence that you've acknowledged and the outlook for Q4. When I look at the guide, it's shown a seasonally stronger growth rate than 3Q, which hasn't historically been the case. So can you just talk about the dynamic there? Is that purely a function of the sales comp change this year? Is it more so a reflection of the strong pipeline you see? Or anything else to call out?
Kiran Choudary: Thanks, Eric. This is Kiran. I'll take that one. So we're very pleased with the Q3 results we delivered in terms of scale and growth. That gave us the confidence to raise Q4 as well. It's about a 3% raise on the net new ARR, 3% plus based on the implied Q4 guide from the last quarter's call. But as you know, we run the business on an annual basis on net new ARR and we have spoken about that in the past as well. So we look at the total net new ARR for the year, really, that's what we plan for and look to deliver. So the annual comp plan changes have progressed really nicely, but we have to finish the year as well, and we can give you an update on that after Q4.
Operator: Your next question comes from Gregg Moskowitz of Mizuho.
Gregg Moskowitz: And congratulations on the strong execution. I'd like to go back to Identity because Identity Recovery is off to a really strong start. And by the way, the feedback was also positive at AWS Reinvent this week. Bipul, when you look ahead, so Rubrik has many thousands of customers that you can potentially cross-sell into. And as you've noted, you're already landing with Identity as well. So when you look at Identity Recovery and now Identity Resilience in addition, how are you thinking about penetration rates for this part of the platform going forward?
Bipul Sinha: We believe that Identity Recovery is a widely applicable horizontal platform in terms of the Identity Security strategy that we have. And going from Identity Recovery to Identity Resilience, we are really adding before and during pieces to ensure that if there is a privilege escalation, what kind of sensitive data gets exposed to. And that's where we are bringing the DSPM capabilities with identity capabilities to expose the full risk. Because if you take a step back, cyber resilience assumes that the attacks will happen to you. So if you know that attacks will happen to you, you have to understand the risk of the attack and be able to remediate. And the risk of the attack, you need to understand data risk and you need to understand the identity risk. Because you can't understand the full risk without understanding data and identity both. And then in terms of remediation, you have to remediate both, you need to do a cyber recovery on all the data to ensure that your applications are up and running plus you have to also recover Identity system partially or fully. So we believe that for full cyber resilience, both identity and data is applicable everywhere, Obviously, these are early days. We are just over 3 quarters into it. We are just about $20 million in subscription ARR. We doubled our number of customers in Q3. The customer excitement is very, very high. I'll give you an example. Our European consumer technology company. They were really worried about -- is scattered spider because one of their suppliers got hit. And as you know, scattered spider is detrimental to identity systems as well as virtual machines because they are bypassing the traditional EDR. So there is increased awareness of importance of identity systems, both full availability of the identity system plus the escalations, which are illegal and how data gets impacted. So we have a full vision to really create full cyber resilience solution. And as we said, we are also partnering with CrowdStrike ITDR solution to provide end-to-end confidence for our customers saying that Falcon will detect and will help roll back bad changes.
Operator: Your next question comes from Todd Coupland of CIBC.
Thomas Ingham: I wanted to ask about net new. That's been a little bit lumpy the last few quarters. And I'm just wondering if the acceleration that you experienced this quarter and going into Q4, is that the new normal? Or should this still be considered an area of volatility as we think about '27?
Kiran Choudary: Hi Todd. This is Kiran. I'll take that one. So very pleased with the Q3. Net new ARR was a record for the company, $94 million. But the way to look at net new ARR really in our business is on an annual basis, and that's the number we planned for when we start a year, and there's obviously shifts between quarter-to-quarter because of deals pipeline, et cetera. So I would focus on the annual number, including the guide and then there's going to be some quarterly movements because of compared to previous years and timing.
Operator: Your next question comes from Junaid Siddiqui of Truist.
Junaid Siddiqui: Bipul, with cyber insurance requirements tightening and ransomware costs increasing, are you seeing Rubrik's platform play a role in lowering those insurance premiums for customers and do you see this convergence of identity and data security becoming a differentiator for cyber insurance and compliance frameworks.
Bipul Sinha: Thanks Junaid. Absolutely, you need to have both identity resilience and cyber recovery to be able to drive complete cyber resilience. And for insurance company to underwrite, there is asymmetry of information and for them to have confidence that the customers have the right technology, it is definitely attractive for them to actually recommend Rubrik. In fact, one of the insurance companies, which is our customers actually became our reseller to their customer base, based on that same thesis. We believe that we are still in the early innings of cyber resilience as very large segment, and I would argue that the most important segment of cybersecurity and we believe that as this market continues to expand and as we continue to lead this market into the future around full cyber resilience across data and identity, we believe that there are a lots of opportunities, including around insurance for us.
Operator: Your next question comes from Keith Bachman of BMO.
Keith Bachman: I wanted to go back to the agent market. The identity market seems like a tremendous opportunity in a natural adjacency. I still struggle a little bit with the opportunities associated with the agent market. And so I wanted to just ask it in maybe some different threads, a, is the go-to-market going to be different for the identity that is to say, is there -- do you anticipate it being a different buyer in the agent market? It would seem to me that it's a different buyer, but I just wanted to get your perspective. And b, how do you think the competitive landscape is going to shape up. It's super early, and there's probably going to be more than 1 winner. And then finally, is there any thoughts about when you might emerge from beta to actually have production environments or GA into the market?
Bipul Sinha: So if you look at agents, they assume identity, they work on data and they operate on many applications at a scale. And as I said before, the Rubrik platform is a combination of data, identity and applications. So we are naturally positioned to take advantage of this agentic opportunity. We are not building a platform for people to build agents. They have many platforms for them to build agents. We are helping our customers operationalize agents and have confidence and governance controls to be able to deliver the agentic outcome because that's the biggest inhibitor in terms of AI going into; production. And that's what we are focused on. In terms of the market, obviously, we are early. As I said, we are still in beta. We expect to go GA, not too far in the future. We'll continue to learn from this market, continue to enable our customers on this journey. So far, it feels like operations team, which is CTO, CIO organization would be responsible for agentic work transformation across line of businesses. So there is a convergence in the buying persona. But again, it's very early. We learn in the market, but we believe that we have a very strong vision for this market. And again, as this market evolves, we want to really take our customers on this agentic journey.
Operator: Your next question comes from Shrenik Kothari of Baird.
Shrenik Kothari: And many congrats on great execution. Bipul, of course, you mentioned we're launching the Identity Resilience this quarter and already noted, pretty strong early adoption. Can you speak to the uplift versus Identity Recovery? And just on that note, Kiran, highlighted that security represents over 40% now and was a major contributor to sustaining and or above 120%. Just with these modules that you're adding resilience and agent cloud adding more breadth, like just how should we think about the durability of that NRR.
Kiran Choudary: Kiran, do you want to take the question?
Kiran Choudary: Yes. So Shrenik, this is Kiran. I'll just give you some thoughts on how to think about the NRR. So obviously, and continued to have strong NRR 120% plus, which we see as best-in-class. And our business lends itself to strong NRR. We have a very strong gross retention, and this has been the case historically. And on top of that, we have multiple expansion vectors through different products. And that helps drive the strong NRR. But at the same time, we are scaling as a business with the strong growth rates and $1.35 billion in subscription ARR this quarter. So naturally, NRR tends to moderate over time at scale, but it will be strong NRR just given the drivers of the business. And then on the question you have on Identity Resilience, I would say it's early. We have just launched it. Obviously, that has got more features backed into it. So there will be a price uplift, but I think we need more data points to give you a sense for the amount of uplift.
Shrenik Kothari: Great. Very helpful. Thanks a lot. Congrats again.
Operator: There are no further questions at this time. I would hand over the call to Bipul Sinha for closing remarks. Please go ahead.
Bipul Sinha: In closing, I would say thank you, everyone for continuing to be on Rubrik's journey. As I've mentioned before, our ambition is to build the next 100-year-plus company. And that 100-year plus company will be built based on all participants in the ecosystem to our customers, to our partners, to all the Rubrikans and our ability to continue to lead the market, imagine new product, validate that vision and produce the product. I'm very excited that Rubrik is able to organically create products such as Identity Resilience and Identity Recovery and create an independent product line and business. We want to continue to be on this journey with you. Thank you so much for your support. It's still early days for Rubrik. Look forward to talking to you soon.
Operator: Ladies and gentlemen, this concludes today's conference call. Thank you for your participation, and you may now disconnect.