Investment Gems

The easiest way to misunderstand Rubrik (RBRK) is to begin and end with the word “backup.”

Backup is where the company came from, but it is no longer the most useful description of what customers are buying. Rubrik’s modern proposition begins with a more uncomfortable assumption: prevention eventually fails. Credentials are stolen, ransomware enters the environment, an administrator makes a destructive mistake, or an AI agent takes an action nobody intended. When that happens, the board-level question is not whether the company owns another detection tool. It is whether the business can prove that its data and identities are clean, recoverable and ready to operate.

That is the market Rubrik calls cyber resilience.

Rubrik Security Cloud, or RSC, protects data across enterprise infrastructure, AWS, Azure, Google Cloud, Oracle, Microsoft 365, Salesforce, Jira, unstructured storage and identity systems such as Active Directory, Entra ID and Okta. It then layers security intelligence and recovery orchestration on top of those protected copies.

The product suite includes immutable data protection, anomaly detection, sensitive-data monitoring, threat hunting, identity recovery, identity-resilience controls, cyber-recovery simulation and threat containment. The objective is not merely to preserve a backup. It is to determine the blast radius of an attack, find a clean recovery point and restore the minimum viable business without reintroducing the attacker.

This distinction matters for valuation. A backup product belongs in an infrastructure budget and competes heavily on reliability and price. A cyber-resilience platform can participate in CIO and CISO budgets, consolidate point products and become progressively more valuable as it incorporates data, identity and application context.

Rubrik has largely completed the business-model transition accompanying that repositioning. Hardware is now economically peripheral, most customers buy multiyear subscriptions, and cloud subscriptions account for most of the business. In Q1 FY2027, subscription revenue represented approximately $374 million of $387 million in total revenue. According to the company’s Q1 FY2027 filing, cloud ARR represented 89% of subscription ARR.

Rubrik should therefore be analyzed as a cloud-security software company with data-protection roots, not as a hardware-assisted backup appliance vendor.

The core engine is doing the heavy lifting

There is a temptation to make Rubrik’s investment case entirely about AI. That would get the sequencing wrong.

The principal revenue engine over the next 18 months remains Rubrik Security Cloud. At the end of Q1 FY2027, Rubrik reported:

Metric	Q1 FY2027 result	Year-over-year growth
Subscription ARR	$1.57 billion	32%
Cloud ARR	$1.39 billion	43%
Subscription revenue	$374 million	41%
Total revenue	$387 million	39%
Customers above $100,000 ARR	2,946	24%
Subscription net retention	Approximately 120%	—

Rubrik added $103 million of net-new subscription ARR during the quarter, a Q1 record. Customers generating more than $1 million in subscription ARR increased by more than 50%, while customers above $100,000 accounted for 88% of total subscription ARR.

Those figures demonstrate why RSC remains more important than any early-stage product announcement. A 20% expansion on a $1.39 billion cloud ARR base creates far more value than triple-digit growth from a product that has not yet reached material scale.

Rubrik can land through five different workload categories: enterprise, cloud, SaaS, unstructured data and identity. It can then expand through four principal vectors:

1. Existing applications generate more data.
2. The customer adds applications and workloads.
3. The customer purchases additional security and recovery products.
4. The customer adopts Identity Resilience or Rubrik Agent Cloud.

That structure helps explain the approximately 120% net-retention rate. Rubrik does not need to win a new logo for every incremental dollar of ARR. More importantly, the value of the platform can increase as the customer connects more environments. Identity context improves the analysis of data risk; sensitive-data context improves incident response; recovery information makes agent remediation more useful.

Management describes this as a complementary network effect. I would use a less promotional phrase: product adjacency built on shared enterprise context. Either way, the economic mechanism is attractive.

Identity is the most credible near-term adjacency

Identity Resilience is currently the clearest evidence that Rubrik can expand beyond data protection.

The identity business exceeded $50 million in subscription ARR in Q1 and grew 38% sequentially. It protects Active Directory, Entra ID and Okta while monitoring dangerous configuration changes, privileged access and malicious identity activity.

The strategic advantage is not simply another backup workload. Identity brings Rubrik into the CISO’s budget and connects a compromised account with the sensitive data that account can access. That allows Rubrik to answer a more valuable question: if this identity is compromised, which data and applications are inside the blast radius, and how do we restore both without discarding months of legitimate changes?

Over the next 18 months, Identity Resilience is more likely than Agent Cloud to contribute a clearly measurable amount of incremental ARR. It already has product-market validation, an existing cross-sell base and a quantifiable starting point.

The metrics I want management to disclose are identity ARR growth, new versus existing customer mix, and the proportion of large RSC customers adopting identity products. If identity can sustain strong growth after passing $50 million of ARR, the argument for a platform multiple becomes materially stronger.

Agent Cloud is the option, not yet the foundation

Rubrik Agent Cloud became generally available in February 2026. The platform is designed to discover enterprise AI agents, monitor their actions, enforce policies and reverse destructive behavior.

Its architecture contains four increasingly complete elements:

• Agent Observability: discovers agents, tools, MCP servers, skills and plugins.
• Agent Identity: determines who can use an agent and what that agent can access.
• Agent Runtime Security: uses the Semantic AI Governance Engine, or SAGE, to evaluate intent and enforce real-time policies.
• Agent Rewind: connects an undesirable action to a clean snapshot and reverses the damage.

Predibase, acquired in 2025, supplies model fine-tuning and inference technology underlying parts of SAGE. Rubrik’s differentiated claim is that it can combine model-level governance with the data, identity and application context already present in RSC.

The August introduction of Rubrik Agent Identity makes the product more coherent. Agent Identity extends Entra ID and Okta controls to the chain running from a human user through an AI agent to a specific tool call. Instead of giving an autonomous agent broad standing credentials, Rubrik can issue a short-lived permission for an individual action.

That is an important technical addition. It does not yet establish a material revenue stream.

Management said early proofs of concept were converting into production deployments, including a financial-services customer using AWS Bedrock and Microsoft Copilot. But Rubrik has not disclosed Agent Cloud ARR, customer count, average contract value or renewal behavior.

For now, I treat Agent Cloud as valuable optionality. It can improve Rubrik’s strategic positioning, help win RSC deals and eventually become a separate expansion vector. I am not willing to capitalize it like a mature security franchise before the company provides commercial evidence.

A repeatable way to incubate new products

One underappreciated element of the Rubrik story is organizational rather than technical.

The company uses a specialist “lateral” team to incubate new products, refine product-market fit and establish the initial customer base. Once the sales motion has been proven, responsibility can pass to the larger forward sales organization. Rubrik previously used this model for Enterprise Edition, Microsoft 365, cloud security and Identity Resilience. The lateral team is now commercializing Agent Cloud.

This approach has two advantages. It avoids forcing every field representative to sell an immature product, and it creates a repeatable process for turning R&D into ARR. The risk is that specialized teams, proofs of concept and overlapping sales coverage increase expenses before the product reaches scale.

That trade-off is visible in the income statement. Rubrik is already extracting leverage from sales and administration, while continuing to spend aggressively on engineering.

The margin story is becoming real

Q1 FY2027 non-GAAP gross margin increased from 80.5% to 82.9%. GAAP subscription gross margin increased from 80% to 82%. Management attributed the improvement to revenue scale, more efficient cloud-hosting costs and greater productivity in customer support.

The operating-expense comparison is revealing:

Q1 FY2027 item	Year-over-year growth
Revenue	39%
Sales and marketing expense	14%
General and administrative expense	-4%
Research and development expense	40%

Rubrik is not manufacturing profitability through broad cost cuts. It is allowing revenue to outrun sales, support and administrative expenses while reinvesting heavily in data security, identity and AI.

Subscription ARR contribution margin reached 13.2% for the trailing 12 months, up from 8.0%. Free cash flow was $73.6 million in Q1, compared with $33.3 million one year earlier.

Management’s FY2027 guidance calls for:

• Subscription ARR of $1.854-$1.862 billion, approximately 27% growth.
• Revenue of $1.638-$1.648 billion.
• Subscription ARR contribution margin of approximately 14%.
• Free cash flow of $293-$303 million.

One accounting issue will obscure the underlying trend. Revenue from legacy Subscription Credits and related material rights is fading as the cloud transition concludes. These items contributed approximately $8.5 million in Q1, are expected to contribute only $3-$4 million in Q2 and approximately $17 million for FY2027. Investors should watch revenue excluding material rights, which increased 43% in Q1, rather than treating the transition-related headwind as a change in customer demand.

There is also a meaningful caveat to the FCF story. Rubrik recorded approximately $73.4 million of stock-based compensation in Q1, almost equal to quarterly FCF. Stock-based compensation is noncash, but it is not economically free. Current share-count data indicate dilution of approximately 7% over the past year. A valuation based on FCF should therefore be cross-checked against future diluted shares and per-share growth.

Valuation: the market already sees a platform

At the August 10 close of $97.91, Rubrik had an enterprise value of approximately $19.55 billion. That equates to roughly:

• 11.4 times FY2027 consensus revenue.
• 9.8 times FY2028 consensus revenue of approximately $2.0 billion.
• 66.5 times trailing free cash flow.

The following comparison uses approximate forward EV/revenue, calculated from current forward sales multiples and enterprise values. Market data are as of August 11, 2026.

Company	Strategic role in the comparison	Forward EV/revenue	Trailing FCF margin
CrowdStrike	Maximal security-platform outcome	36.1x	29.6%
Palo Alto Networks	Scaled platform-consolidation outcome	23.4x	35.8%
Datadog	High-quality land-and-expand analogue	18.2x	29.8%
Rubrik	Current valuation	11.4x	20.6%
Zscaler	Cloud-security control	7.2x	30.4%
Varonis	Data-security and identity floor	5.6x	17.7%
Nutanix	Mature subscription-infrastructure floor	5.5x	28.0%
Commvault	Closest direct product floor	4.3x	21.3%
Tenable	Slow-growth security floor	3.7x	25.3%

The key conclusion is not that Rubrik should trade at Commvault’s multiple. Rubrik is growing much faster and has stronger product optionality. The conclusion is that the market has already decided Rubrik is not Commvault.

At today’s valuation, investors are paying in advance for sustained growth above 20%, stable net retention, successful identity cross-selling and continued margin improvement. Agent Cloud success would create additional upside, but part of that possibility is already embedded in the premium.

CrowdStrike and Palo Alto are useful descriptions of what Rubrik might become. Their current multiples should not be applied directly. Both incorporate unusual momentum and extremely optimistic expectations. Datadog is a better economic aspiration because its growth, data-driven expansion and approximately 30% FCF margin illustrate what Rubrik could achieve if multiple products scale over a shared platform.

For a disciplined bull case, I would use 12-16 times FY2028 revenue, not 20-36 times. For a bear case, a 4-6 times range is supported by Commvault, Varonis, Nutanix, SentinelOne and Tenable.

Using approximately 240 million prospective diluted shares and $0.8-$1.0 billion of net cash produces the following framework:

Scenario	FY2028 revenue	EV/revenue	Indicative value per share
Bull	$2.05-$2.15 billion	12-16x	Approximately $106-$147
Base	Approximately $2.0 billion	8-11x	Approximately $70-$96
Bear	$1.80-$1.90 billion	4-6x	Approximately $34-$52

These are scenario ranges, not price targets. Their purpose is to show the asymmetry. At approximately $98, Rubrik is already above the upper end of my base range and close to the lower boundary of the bull case. The business does not have to fail for the stock to decline. It only has to be reclassified from emerging platform to high-quality cyber-recovery vendor.

The chart confirms that expectations have changed

The price action tells the same story as the valuation.

Rubrik declined from the prior $99-$100 supply zone to a 52-week low of $42.25 in April 2026. It has since advanced approximately 132%. More recently, the stock moved from $72.36 on July 31 to $97.91 on August 10, a gain of roughly 35% in six sessions.

In Wyckoff terms, the June-July period resembles a reaccumulation range between approximately $67 and $90. The July 28 decline to $67.31 can be interpreted as a shakeout, followed by a low-volume test as trading stabilized around $70-$73. The August advance then produced a credible Sign of Strength: wide upward spreads, expanding volume and a break above the $89-$90 resistance line.

August 10 volume reached 5.93 million shares, approximately twice average daily volume, while the stock closed near the top of its range. That is constructive effort-versus-result behavior. Buyers applied more effort and received substantial upward progress.

The Nison candlestick interpretation is similarly bullish. A bearish engulfing pattern formed on July 15 near $90 and correctly preceded the decline toward $67. That signal has now been negated by a close above the engulfing candle and the prior resistance area.

The recent advance also created rising windows near $75-$76 and $85-$87. Those gaps should act as support during a pullback. The more important Wyckoff level is $89-$91, the former resistance line and potential “creek” that price has just crossed.

The chart has not yet completed the ideal confirmation sequence. Rubrik has jumped across the creek, but it has not backed up to test whether the old resistance has become support.

The principal levels are:

Price zone	Interpretation
$99-$101	Historical supply and psychological resistance
$89-$91	Breakout line and preferred retest area
$85-$87	First rising-window support
$80-$81	Prior congestion and weaker secondary support
$72-$76	Deeper reaccumulation support
$67-$70	Structural support; loss would damage the bullish interpretation

A decisive close above $100 followed by a successful test of $89-$91 would support entry into Wyckoff Phase E, or sustained markup. A simple projection of the recent $67-$90 range points toward approximately $112-$115, which overlaps the lower part of the fundamental bull valuation.

The bearish alternative is an upthrust: price trades above $100, encounters supply and closes back below $90. A shooting star, bearish engulfing candle or high-volume reversal around $100 would strengthen that interpretation. In that case, the likely support sequence would be $85, $80 and eventually $72-$75.

The current candle structure is strong, but the entry is no longer early. Six consecutive positive real bodies into historical resistance can represent momentum and overextension at the same time.

What could change the rating

The next major checkpoint is Rubrik’s Q2 FY2027 report on August 27. Following the recent advance, an ordinary in-line quarter may not be enough.

I would become more constructive if Rubrik delivers several of the following:

• Subscription ARR growth and net-new ARR above the existing FY2027 trajectory.
• Net retention holding around 120% without meaningful help from legacy migrations.
• Identity ARR materially above the $50 million Q1 level.
• Quantified Agent Cloud customers, ARR or production conversions.
• Continued improvement in cloud-hosting and support efficiency.
• Higher FY2027 ARR, contribution-margin and FCF guidance.
• A breakout above $100 followed by a successful retest rather than a vertical extension.

Conversely, the thesis would weaken if ARR growth falls toward the low twenties sooner than expected, NRR declines, Identity Resilience stalls after its initial cross-sell, or Agent Cloud remains a collection of proofs of concept. A material increase in hosting or inference costs would also challenge the margin narrative.

Competition remains substantial. Commvault, Veeam and Cohesity compete in data protection and recovery; cloud providers offer native protection tools; and established security companies can extend into data security, identity posture and AI governance. Rubrik does not need to defeat every one of these vendors, but it must prove that its unified recovery context is valuable enough to command a platform premium.

Conclusion

Rubrik is one of those situations where the bullish business argument is easier to make than the bullish stock argument.

The company has executed an impressive transition from backup appliances and term licenses into cloud subscriptions and cyber resilience. The core RSC engine is growing rapidly, net retention is healthy, Identity Resilience is becoming commercially relevant, and operating leverage is emerging. Agent Cloud adds a legitimate long-duration call option on enterprise AI governance.

But at approximately $98, investors are no longer being paid to discover that transformation. The market has already discovered it.

Rubrik trades at a premium to direct data-protection vendors and several established cloud-security companies. Its price is pressing against the same $99-$100 area that previously contained supply, immediately before an earnings report for which expectations are now elevated.

I therefore rate RBRK Hold. I am constructive on the company and neutral on the current entry. The more attractive setup would be either a fundamental de-risking through stronger product disclosures and another guidance increase, or a technical backup toward $89-$91 that confirms demand without requiring investors to chase a vertical move into resistance.

Rubrik may eventually earn the valuation of a major cybersecurity platform. At the current price, however, it must keep proving that outcome quarter after quarter.