Commvault Systems, Inc. (NASDAQ: CVLT) — The Cohort’s Cleanest Cash Flow, Re-Rated Back to a Full Price After a 60% Round-Trip

Independent fundamental research. As-of date: July 18, 2026. Price referenced: $147.81 (July 17, 2026 close).

⚡ Claude’s Take

This block is the author’s own subjective opinion. It is general information and independent analysis, not investment advice. The analytical sections that follow take no position, carry no price target, and confine themselves to embedded-expectations and scenario analysis.

Verdict: HOLD — quality at a full price after a violent round-trip; accumulate on weakness, not a short. Medium conviction. Fair-value zone ~$120–150 (~4.5–5.5x EV/sales / ~24–28x FCF); I would add in the ~$95–115 band (~4–4.75x sales — roughly where the March-2026 washout found a floor and where the modest ~9.6% embedded FCF-growth bar starts to underwrite the downside), and would not chase into the $160s+ where the sell side has just planted $175 targets and the stock has already doubled off its low. The realistic de-rate zone if growth cools and the high-beta cohort rolls over again is ~$75–95 (~3.5–4x sales) — a level the tape actually printed three months ago, which is the single most important risk fact in this name.

Commvault is the honest-cash inverse of Rubrik — the one profitable, genuinely FCF-generative, share-shrinking pure-play in data protection, growing subscription ARR ~27% and total revenue ~19%, with stock-based comp of only ~10% of revenue (versus Rubrik’s ~25%) so its ~$237M of free cash flow survives an ex-SBC “owner” test at ~$114M positive, where Rubrik’s is roughly negative ~$90M. It trades ~5.6x sales versus Rubrik’s ~9x — and the reverse-DCF says the market is underwriting only ~9.6% long-run FCF growth, a beatable bar for a business compounding ARR in the high-20s. That is the bull case, and it is a real one: this is the cash-quality name in a cohort full of accounting profitability. My tag: “the profitable one in the bin.”

Three things keep me at HOLD rather than BUY. First, the “improving economics” story is almost entirely non-GAAP: GAAP operating income has been flat at ~$74M for three straight years while revenue grew 41% — S&M at 44% of revenue, SBC, and a swelling restructuring line have eaten every dollar of incremental gross profit, so operating leverage remains a promise, not a fact, and reported EPS is further flattered by an $85M FY24 tax-valuation-release and a 6% FY25 tax rate (normalized GAAP EPS is roughly flat ~$1.40→$1.58). Second, the moat is narrow and eroding: Rubrik has passed Commvault in subscription ARR ($1.57B vs $989M) and grows twice as fast, Veeam leads on scale, and Cohesity+Veritas is a $7B roll-up aimed squarely at Commvault’s on-prem enterprise base — this is a defensible #4–5 franchise running to stand still, not a fortress. Third, the stock has already round-tripped — $195 ATH → $75 → $148 — and sits at the 84th percentile of its own P/S history with a 1.31 beta, insiders sold into the March low with zero dip-buying, and management’s own FY27 guide decelerates to ~11% revenue. The factor tape reads “recovered falling-knife priced for continuation,” not “cheap.” I want the cash-quality edge, but I want it after the next high-beta wobble, not at a full multiple into a bullish-consensus rebound.

Conviction: medium. Flips bullish if GAAP operating income finally inflects upward (proving the operating leverage the non-GAAP margin claims) while subscription ARR holds ~mid-20s and the share count keeps shrinking — i.e., the cash quality converts into real earnings quality. Flips bearish if net-new subscription ARR rolls over or NRR slips further (the Q3-FY26 miss repeating), or if Rubrik/Veeam/Cohesity visibly take enterprise cyber-recovery share and Commvault’s ~19% growth cracks toward single digits. Tag: “the profitable one in the bin — cleanest cash in cyber-resilience, now priced for the rebound to keep going.”

📈 Stock Price Action — Five-Year Event Map

Factual price history — no recommendation, no price target. Price moves are FACT; attributed causes are INTERPRETATION.

Over five years Commvault has completed a full round-trip and change. The stock drifted from ~$77 (mid-2021) down to the high-$50s in the 2022 software/rate bear, then re-rated almost fourfold through the subscription/SaaS re-acceleration to an all-time-high close of ~$195 (September 2025; intraday 52-week high ~$200.68 on July 30, 2025), crashed ~62% to a 52-week low of ~$71.75 (April 9, 2026; ~$75 close in late March), and has since rebounded ~90% to $147.81. Today it sits ~24% below its all-time high, inside a 52-week range of roughly $71.75–$200.68, with a beta of ~1.31 — a high-volatility name that has already been both a momentum darling and a falling knife inside twelve months.

Cycle narrative. (1) The 2022 bear de-rated a then-stalled ~2–7%-grower (Fact: −27%; Interp: rate-driven multiple compression). (2) The ~170% run to ~$153 tracked the genuine subscription/SaaS re-acceleration (revenue growth doubled from ~2% to the high-teens) and a broad software recovery. (3) The final leg to the ~$195 ATH was momentum — the “cyber-resilience” narrative and the Rubrik/Cohesity IPO/M&A halo lifting the entire data-protection cohort’s multiples. (4)–(6) The ~62% crash was not a fundamental break — revenue grew +18.9%, ARR +21%, and FCF +16% through it — but a rich starting multiple (P/S at the 84th percentile of its own history) meeting a cohort-wide high-beta de-rate, amplified by self-inflicted sentiment events: the Q2 EBIT-margin guide cut (Oct-2025), the Q3 net-new-ARR miss and FCF-to-$2M timing air-pocket plus fresh restructuring (Jan-2026), and the September-2025 convert issuance adding a dilution-overhang narrative right at the top. (7)–(8) The Q4-FY26 beat (record net-new subscription ARR and $132M FCF), a $259M in-quarter buyback into the low, the well-received return of Gary Merrill as CFO, the June-2026 Microsoft Azure ISV partnership, and a wave of sell-side upgrades to ~$175 drove the ~90% rebound. The stock is now priced as though the rebound continues.

1. Executive Summary

Commvault Systems is a ~$1.18B-revenue, ~92%-recurring data-protection and cyber-resilience software company — the profitable, cash-generative incumbent in a crowded, secularly-growing market. Its investment identity is defined by a single contrast with its faster-growing rival Rubrik: Commvault is the cohort’s honest-cash name. It is GAAP-profitable (FY26 diluted EPS $1.58), generates ~$237M of real free cash flow at a ~20% margin on trivial capex, carries stock-based compensation of only ~10% of revenue (roughly half Rubrik’s load), and has shrunk its share count ~7% over five years through ~$1.25B of buybacks. Where Rubrik’s celebrated free cash flow is roughly negative on an ex-SBC owner basis, Commvault’s owner-FCF is genuinely positive at ~$114M.

The business has executed a clean, largely-completed perpetual→subscription→SaaS transition. Total ARR reached $1,121.6M (+21%), subscription ARR $989.3M (+27%), and SaaS ARR $400.2M (+42%) at FY26 year-end (March 31, 2026), with SaaS net-dollar-retention of 122%. Revenue re-accelerated from a stalled ~2–7% to +18.6% (FY25) and +18.9% (FY26), driven entirely by subscription and SaaS. It is a recognized Gartner “Leader,” strongest in large, hybrid, on-premise and government estates where its breadth-of-workload coverage and switching costs bind the installed base.

But the quality story has three hard qualifications. First, there is no GAAP operating leverage yet. GAAP operating income has been flat at ~$74M (6–9% margin) for three straight years despite 41% revenue growth — S&M at 44% of revenue, SBC, and a growing restructuring line have consumed every incremental gross-profit dollar. The attractive “~20% margin” is a non-GAAP, SBC-and-restructuring-adjusted construct, and reported EPS is distorted by an $85M FY24 tax-valuation-allowance release and a 6% FY25 tax rate (normalized GAAP EPS is roughly flat ~$1.40→$1.58). Second, the moat is narrow and eroding. Rubrik has passed Commvault in subscription ARR ($1.57B vs $989M) and grows twice as fast; Veeam leads on scale; Cohesity’s ~$7B Veritas roll-up targets Commvault’s core enterprise base. Commvault’s ~11% ROIC and slipping share (127%→122% SaaS NRR, growth trailing peers) fail Greenwald’s market-share-stability test — this is a defensible #4–5 franchise running to stand still. Third, valuation and the tape. At $147.81 the stock trades ~5.6x EV/sales (84th percentile of its own history) with a 1.31 beta, has already doubled off its March low, and management’s own FY27 guide decelerates to ~11% revenue. Insiders sold into the low with zero dip-buying.

At ~$6.6B enterprise value the market embeds only ~9.6% long-run FCF growth — a modest, beatable bar that supports the “reasonable, not cheap” read and explains why the stock is far less demandingly priced than Rubrik. But a modest embedded bar is not the same as a margin of safety in a 1.31-beta name that printed a 62% drawdown three months ago. This is a good business at a full-ish price after a round-trip: own the cash quality, but the entry matters more than the story.

2. Business Overview

Commvault Systems (NASDAQ: CVLT), incorporated in Delaware in 1996 and headquartered in Tinton Falls, New Jersey, is a ~3,300-employee (36% US / 64% international) software company that sells “cyber resilience” — data protection, cyber recovery, and data security/governance — delivered through Commvault Cloud, a cloud-native control plane that unifies protection across on-premise, hybrid, multi-cloud, and SaaS environments. Sanjay Mirchandani has been CEO since 2019 and led the turnaround from stalled legacy-backup vendor to re-accelerating subscription business.

What the platform does. Commvault Cloud is packaged in three ascending tiers: (1) Operational Recovery — core backup and restore across physical servers, virtual machines, containers, databases, endpoints, and SaaS workloads; (2) Autonomous Recovery — adds disaster-recovery automation, orchestration, replication, and failover/failback; and (3) Cyber Recovery — the most comprehensive tier, adding threat scanning, anomaly/indicator-of-compromise detection inside backups, and clean-recovery validation. Around this sit differentiated modules: Cleanroom Recovery (an isolated, on-demand cloud environment for recovery testing and forensic analysis), Air Gap Protect (isolated immutable cloud storage), ThreatScan (malware/ransomware scanning of backup copies), Cloud Rewind (cloud application/infrastructure rebuild, from the Appranix acquisition), Clumio Backtrack (point-in-time revert for AWS S3/DynamoDB, from Clumio), an Active Directory/Entra ID identity-resilience offering, and Arlie, an AI support assistant. Metallic is the SaaS delivery brand. The core value proposition: in a ransomware world where backups are the last line of defense, Commvault protects the broadest set of workloads from a single platform and — critically — can recover them cleanly and provably.

How it makes money — revenue model and segmentation. Commvault has largely completed the perpetual→subscription→SaaS transition. FY26 revenue of $1,183.7M (+18.9%) breaks down as:

Subscription is now ~65% of revenue (up from 51% in FY24), SaaS ~28% (up from 15% in FY24), and the recurring base — subscription plus customer support — is ~92% of revenue. Perpetual license is a deliberately-managed runoff stub (<4%), sold only in limited verticals and geographies. Within support, term-based support ($202.2M) is growing while perpetual support ($118.3M) declines ~20%/year as the installed base migrates — the model change is retaining customers rather than losing them.

The forward book. ARR at March 31, 2026 was $1,121.6M total (+21%), $989.3M subscription (+27%), and $400.2M SaaS (+42%) — total ARR now exceeds GAAP revenue, implying a strong contracted forward book. Remaining performance obligations including deferred revenue were $1,041.2M, ~59% recognizable within twelve months.

Customers, geography, channel. The base spans large enterprises, SMB, and government agencies across banking/financial services, insurance, healthcare/life sciences, technology, legal, manufacturing, and energy/utilities (the company no longer discloses a hard customer count, historically “100,000+ organizations”). Sales outside the US were 47% of FY26 revenue, with international growing 24% versus Americas 16%. Distribution is ~90% indirect — through distributors, VARs, systems integrators, resellers, OEMs, and cloud marketplaces — an efficient, low-touch model, but with two-distributor concentration worth flagging: Partner A was 32% of total revenue (down from 36% in FY24) and Partner B 11%.

Verdict. A high-quality, ~92%-recurring, ~$1.18B software business built on a broad, deeply-integrated data-protection platform, with a clean and de-risked model (subscription/SaaS-led, $1.12B ARR, 122% SaaS NRR) and efficient channel leverage. The business model itself is not in question; the durable questions — addressed below — are competitive position and whether the model’s high-teens growth and best-in-cohort cash quality translate into real, GAAP-visible operating leverage over time.

3. Industry Dynamics

Market size and growth. The global data-protection and replication software market is roughly $6.9B (2025), forecast toward ~$12.5B by 2034 — a ~7.5% CAGR — with the “cyber-resilience”/cyber-recovery sub-segment growing faster (mid-teens) as ransomware pushes spend from commodity backup toward higher-value recovery. This is the demand backdrop: a durable, non-discretionary secular tailwind (ransomware frequency, regulatory/sovereignty mandates, and — newly — the need to protect AI training data and lakehouses), with high-gross-margin software economics.

Structure — fragmented, no dominant share. This is a crowded market with no commanding leader. Per IDC’s software tracker, Veeam is #1 globally (the only top-5 vendor to cross $1B in a single half, and gaining share fastest), followed by Dell (Data Domain/PowerProtect), Cohesity (now including the acquired Veritas/NetBackup base), Rubrik, and Commvault, with IBM, NetApp, Acronis, Druva, Zerto, and others behind. The share leader sits well under ~15%. Gartner’s 2025 Enterprise Backup & Data Protection MQ places Rubrik (completeness of vision), Veeam (ability to execute), Cohesity, Commvault, Dell, and Druva in the Leaders quadrant — Commvault is a recognized Leader, but not the vision or execution frontier, grouped mid-pack with Cohesity.

Consolidation and the capital cycle. The competitive intensity is intensifying, not easing, and the Marathon capital-cycle lens is unambiguous: strong recent returns and a compelling narrative have attracted heavy fresh capital into the supply side. Rubrik IPO’d in April 2024 and is well-capitalized; Cohesity closed its ~$7B acquisition of Veritas’ data-protection business in December 2024, creating a scaled enterprise rival with a large legacy NetBackup installed base (~$1.5B+ combined revenue) aimed directly at Commvault’s core; and Veeam is PE/Insight-backed with ~$1.7B+ ARR and an IPO track. Multiple well-funded players are racing for share, all citing “cyber resilience” — the classic late-capital-cycle setup that produces pricing pressure and rising S&M intensity. Commvault’s own 10-K names “ongoing pricing pressure from competitors” and rising SaaS-hosting cost commitments. A partial offset: the market is still growing and fragmented enough to support several winners for now. A structural dependency worth noting — Commvault hosts Metallic on Microsoft Azure and competes at the SaaS low end with Microsoft 365 native protection, so a key partner is also a competitor.

Barriers to entry (Greenwald test). Moderate — patents (1,600+ for Commvault), breadth of workload coverage, security/compliance certifications (SOC 2, ISO 27001, HIPAA, PCI DSS, FedRAMP), and enterprise trust raise the bar, but there is no economies-of-scale-plus-captivity lock, as evidenced by continual entry and ongoing share shifts.

The capital-cycle arithmetic. Marathon’s supply-side lens is worth quantifying because it directly governs whether Commvault’s high-teens growth is value-creative or merely revenue for revenue’s sake. In roughly eighteen months the supply side of this ~$6.9B market absorbed: Rubrik’s April-2024 IPO (raising ~$750M and now capitalized to spend), Cohesity’s ~$7B Veritas acquisition (December 2024), and Veeam’s ongoing PE backing (~$1.7B+ ARR, IPO-track). That is well over $8B of fresh enterprise value and capital pointed at a market that grows ~$500M/year in aggregate. When the incremental capital chasing a market dwarfs the market’s own annual growth, the textbook outcome is rising customer-acquisition cost and compressing incremental returns — precisely the mechanism visible in Commvault’s own P&L, where S&M at 44% of revenue and flat GAAP operating income coexist with 19% top-line growth. The tailwind is real, but it is being competed away at the margin; the question for every player is who earns a return net of the S&M arms race, and the answer favors the scale leaders (Veeam) and the fastest growers with pricing power (Rubrik) over the mid-pack.

Verdict. Structurally attractive demand, moderately unattractive supply. The secular tailwind (ransomware → cyber-resilience, regulatory data mandates, AI-data protection) is real, durable, and rides high-gross-margin software economics — a good place to sell software. But the industry is fragmented, intensely competitive, and now absorbing large pools of fresh capital (Rubrik IPO, Cohesity+Veritas $7B, Veeam) in a late-capital-cycle dynamic that pressures pricing and forces heavy go-to-market spend — a hard place to earn durable excess returns. Commvault is a mid-pack Leader inside this structure, not the share or growth frontier.

4. Competitive Position

The claimed differentiation. Commvault’s pitch rests on four pillars: (1) the broadest workload and deployment coverage — physical, VM, container, database, endpoint, and SaaS, across on-premise, hybrid, multi-cloud, and SaaS, from one platform; (2) distinctive cyber-recovery capability — Cleanroom Recovery (isolated recovery/testing), air-gapped immutability, ThreatScan, and clean-recovery validation; (3) 1,600+ issued patents and a full certification stack including FedRAMP for government; and (4) 14 consecutive years as a Gartner MQ “Leader.” These are real assets, and they anchor a genuine installed-base moat.

Name the moat: narrow demand-side switching costs. In Greenwald’s taxonomy, Commvault’s advantage is customer captivity / switching costs (a demand-side advantage), reinforced by breadth-of-coverage and a channel/OEM distribution web. Backup and recovery is operationally entangled — deeply integrated into IT operations, recovery SLAs, retention/compliance policies, and years of protected data (“data gravity”). Migrating a protection estate risks recovery gaps and is costly and slow. The evidence that this captivity is real: ~92% recurring revenue, 122% SaaS net-dollar-retention, and term-support revenue growing as perpetual runs off (the installed base is retained through the model change). It is explicitly not a network effect (my backup does not improve because yours is protected), not a low-cost-production advantage (SaaS gross margins are below peers), and not economies-of-scale-plus-captivity (no dominant share; several sub-scale rivals coexist profitably).

The moat fails the share-stability test. Greenwald’s core moat test is market-share stability, and here Commvault falls short. The decisive head-to-head: Rubrik has passed Commvault in subscription ARR — Rubrik ended its FY26 at $1.46B subscription ARR (+34%), reached $1.57B (+32%) by Q1-FY27, and grew revenue ~46%, versus Commvault’s $989M subscription ARR (+27%) and ~19% revenue. Veeam remains #1 overall and gains share fastest; Cohesity+Veritas is a scaled enterprise rival. Commvault’s relative share is eroding — it is out-grown by the frontier players even as it re-accelerates its own absolute ARR. A durable moat produces stable share; Commvault is running to stand still. Its ~11% ROIC (normalized; FY24/FY25 ROIC figures were inflated by one-time tax items) is a low-double-digit, roughly-at-or-modestly-above-WACC return — not a fortress return profile.

A worked example of the switching cost. Consider a large bank protecting a heterogeneous estate — thousands of VMs, dozens of databases, a mainframe, endpoints, and Microsoft 365 — under a Commvault deployment with seven years of retained backup catalogs and tuned recovery runbooks tied to audited recovery-time objectives. To rip that out for Rubrik, the bank must re-index the historical data (or maintain Commvault in parallel for the retention window, paying twice), re-certify recovery SLAs with regulators, retrain operations staff, and accept execution risk on the one system whose entire purpose is to work during a disaster. The all-in switching cost — cash, time, and risk of a recovery gap — is high relative to the annual license, which is exactly why Commvault retains ~92% of revenue and expands the base at 122% net-dollar-retention. That is a genuine moat. Its limit is equally clear: it protects the installed base but does little to win new workloads, especially cloud-native estates being stood up fresh, where there is no legacy catalog to anchor and Rubrik’s security-branded, cloud-native pitch competes on even ground. So the moat is a retention moat, not a share-gaining moat — which is precisely what the ARR growth-rate gap versus Rubrik shows.

The net-new share read. The cleanest way to see the share dynamic is net-new ARR. Rubrik disclosed a record ~$115M of net-new subscription ARR in a single quarter and grew subscription ARR 32–34%; Commvault does not disclose net-new ARR directly, but its full-year subscription-ARR addition (~$210M on a $989M base) and its own FY27 guide (~$190M of net-new subscription ARR) imply a slower absolute pace of new-business capture than a rival that is now larger in absolute subscription ARR and growing faster. In a fragmented, growing market, both can add ARR — but the one adding it faster off a larger base is, definitionally, taking a bigger slice of the incremental spend at the frontier.

Where the moat holds, and where it doesn’t. Commvault’s captivity is strongest in large, heterogeneous, hybrid/on-premise enterprise and government estates (FedRAMP, data sovereignty, breadth of legacy-workload support) where rip-and-replace is hardest and Rubrik’s cloud-native pitch is weakest. It is weakest at the cloud-native, SaaS-first, security-buyer frontier, where Rubrik’s positioning and hyperscaler-native tools win, and at the low-end SaaS tier, where Microsoft 365 native protection competes. The company’s tuck-in acquisitions (Clumio for AWS-native, Appranix for cloud rebuild, Satori for data/AI security) are precisely an attempt to shore up the cloud-native flank where the moat is thinnest.

Verdict. Narrow, eroding moat — real but not wide. The mechanism is genuine demand-side switching costs plus breadth-of-coverage and channel distribution, enough to keep 92% of revenue recurring and a strong hybrid/government base captive. But it fails the share-stability test: Rubrik has overtaken Commvault in subscription ARR and grows twice as fast, Veeam leads on scale, Cohesity+Veritas is a scaled roll-up, and Commvault’s ROIC sits in the low double digits. This is a defensible #4–5 franchise strong in defense of its installed base, competitively disadvantaged at the growth frontier — not a fortress. The moat is real enough to protect the cash flows for years; it is not wide enough to compound share.

5. Growth History and Forward Opportunities

The re-acceleration is genuine. Total revenue went from $769.6M (FY22) → $784.6M (FY23, +1.9%) → $839.2M (FY24, +7.0%) → $995.6M (FY25, +18.6%) → $1,183.7M (FY26, +18.9%). Growth roughly doubled off a stalled base — a well-executed second act, driven entirely by subscription. FY26 subscription revenue grew +30% ($768.3M), of which term-license +18% and SaaS +52% ($333.0M); the SaaS trajectory is $126.2M (FY24) → $219.3M (FY25) → $333.0M (FY26), roughly 2.6x in two years. Deal quality is healthy and volume-driven: deals over $0.1M rose 19% year-over-year, transaction volume +16%, average deal size +2% — growth by more customers and more expansion, not price.

Growth is overwhelmingly organic. The three acquisitions in the window are small capability/talent tuck-ins, not revenue-scale deals: Appranix (April 2024, cloud cyber-recovery → Cloud Rewind; final contingent consideration only $1.9M), Clumio (~October 2024, cloud-native AWS S3/DynamoDB backup → Clumio Backtrack; Appranix+Clumio combined FY25 cash ~$65.3M), and Satori Cyber (August 2025, Israel-based data/AI security; ~$28.1M). The high-teens revenue growth is organic.

But every growth-rate metric is decelerating at the margin. Subscription ARR growth 31%→27%, SaaS ARR growth 68%→42%, SaaS NRR 127%→122%, revenue flat at ~19%. The second derivative is negative across the board even as absolute ARR compounds — and management’s own FY27 guide steps down to ~11% revenue and ~18–19% subscription ARR growth. This is durable, self-funding organic growth, but it is a share-follower’s growth, running behind Rubrik (~40–46% revenue) and Veeam.

Forward opportunities. (1) SaaS mix-up — SaaS is still only ~28% of revenue versus SaaS-native peers at 70–100%, a long runway to convert the term-license/on-premise base to Metallic; SaaS ARR is guided above $500M by FY27-end. (2) Cyber-resilience cross-sell — upselling the installed base from Operational → Autonomous → Cyber Recovery tiers (Cleanroom, air-gap, ThreatScan) at higher ASP is the engine behind 122% NRR; identity + data-security offerings were ~33% of Q4 net-new ARR and Active Directory ARR more than doubled. (3) AI/agentic data protection — Clumio for Apache Iceberg/S3 (AI lakehouses), Satori data/AI security, and Arlie. (4) Government/sovereign (FedRAMP breadth) and international (24% growth, 41% of revenue). (5) The June-2026 Microsoft Azure ISV partnership is a genuine new distribution channel to validate and size.

The margin catch. SaaS mix-up is dilutive to gross margin near-term — SaaS gross margin is only ~64.5% versus ~99% for term-license — so blended gross margin has drifted from ~85% (FY22) to 81.2% (FY26) even as revenue quality improves. Growth and near-term margin move in opposite directions here.

Verdict. High-quality growth — organic, recurring, subscription/SaaS-led, volume-driven, 122% net-expansion, re-accelerated from stall to high-teens with $1.12B ARR and only ~28% SaaS penetration (long runway). The blemishes are equally real: growth-rate deceleration on every metric, a share-follower’s pace well behind Rubrik/Veeam, a decelerating FY27 guide (~11% revenue), and a SaaS-mix gross-margin drag. Genuinely good, durable, self-funding growth of respectable quality — but not the market-leading, share-gaining growth its re-acceleration narrative sometimes implies.

6. Financial Quality

This is the section where the bull and bear cases collide, because Commvault’s financials are excellent on cash metrics and mediocre on GAAP earnings — and the gap between them is the debate.

The cash economics are strong and clean. FY26 gross margin was 81.2%, free cash flow $237.2M (OCF $244.7M less trivial $7.5M capex) at a ~20% FCF margin, and capex is negligible (~0.6% of revenue) — an asset-light model. Critically, stock-based compensation is only $123.4M, or 10.4% of revenue — low by software-cohort standards (Rubrik ~25%, Nutanix ~14%, SentinelOne far higher). That matters because it means the FCF survives an “owner” test: owner-FCF (FCF less SBC) is ~$114M, still solidly positive, where Rubrik’s is roughly negative ~$90M. On cash quality, Commvault is best-in-cohort.

But there is no GAAP operating leverage — the single most important QoE fact. The “established” $105.6M operating income (from ROIC and various screens) is wrong: it excludes a $32.2M restructuring charge that sits in the actual GAAP income statement. True GAAP operating income is $74.0M (6.25% margin) — and it has been essentially flat for three years: $75.4M (FY24) → $73.7M (FY25) → $74.0M (FY26) — while revenue grew 41% from $839M to $1,184M. Every dollar of incremental gross profit has been consumed by S&M (43.9% of revenue), SBC, and a swelling restructuring line ($4.5M → $10.0M → $32.2M). The attractive “~20% margin” management guides is a non-GAAP figure — the roughly $124M wedge between GAAP net income ($70.7M) and non-GAAP net income ($194.3M, implied non-GAAP diluted EPS ~$4.35 vs GAAP $1.58) is almost entirely SBC ($123M) plus restructuring ($32M) add-backs. The operating-leverage thesis is, so far, a promise visible only after adjustments.

The operating-leverage arithmetic, made concrete. Between FY24 and FY26 revenue grew $344M (from $839M to $1,184M) at an 81% gross margin, so incremental gross profit was roughly $280M. GAAP operating income over the same span moved from $75.4M to $74.0M — i.e., it fell $1.4M. That means ~$281M of incremental gross profit was entirely consumed by incremental operating expense: S&M rose in lockstep with revenue (the land-and-expand SaaS motion is intrinsically S&M-heavy), SBC grew from $94.6M to $123.4M, and restructuring swelled from $4.5M to $32.2M. A business with genuine operating leverage converts some fraction of incremental gross profit to the operating line; Commvault has converted ~zero on a GAAP basis for three years. The bull’s rejoinder — that this is a deliberate “year(s) of investment” and that leverage appears once S&M normalizes and restructuring rolls off — is plausible and is exactly what the FY27 guide (20.5% non-GAAP EBIT margin) implies. But it remains a forecast; the GAAP record to date shows a company growing revenue without growing profit.

The SaaS gross-margin bridge. The blended gross-margin drift (85% in FY22 to 81.2% in FY26) is entirely mix, not deterioration, and is worth decomposing because it will continue. Term-license carries a ~99% gross margin (essentially pure software), customer support ~82%, and SaaS only ~64.5% (hosting/infrastructure cost is a real COGS). As SaaS grows from 28% of revenue toward the SaaS-native peer range (70%+), blended gross margin mechanically compresses further even if every line is executed perfectly — each point of mix-shift from 99%-margin term-license to 64.5%-margin SaaS costs ~0.35 points of blended gross margin. This is a structural headwind to the “margin expansion” thesis: the very mix-shift that improves revenue quality (recurring, cloud) degrades gross margin, so operating-margin expansion must come from S&M and G&A leverage — the exact lines that have not levered. It is not a crisis (SaaS at 64.5% is still a good software margin and improves with scale), but it means the path to the guided 20.5% non-GAAP EBIT margin runs uphill against gross margin, not with it.

The owner-FCF decomposition. Reported FY26 FCF of $237.2M is OCF ($244.7M) less capex ($7.5M). To get to an owner’s economic return, charge SBC as the real cost it is: $237.2M − $123.4M = ~$113.8M of owner-FCF (~9.6% of revenue). Against the $6.62B EV that is a ~1.7% owner-FCF yield — thin, and the honest counterweight to the “cheap vs Rubrik” framing. The redeeming feature versus the cohort is that the number is positive at all: Rubrik’s equivalent is roughly negative $90M, and SentinelOne’s is worse. So Commvault clears the owner-FCF test the cohort mostly fails — but it clears it by a modest margin, and at a valuation that capitalizes owner-FCF at ~58x. The reported-FCF and owner-FCF framings tell different stories (26x vs 58x), and the truth sits between them because a ~10% SBC load is real but not egregious.

Reported EPS is further distorted by tax and one-time items (QoE flags):

• FY24 tax benefit. FY24 GAAP net income of $168.9M / EPS $3.75 was flattered by an $85.3M income-tax benefit — a deferred-tax valuation-allowance release. Pretax income was only $83.6M. Normalized at ~24%, FY24 net income is ~$63.5M and diluted EPS ~$1.41. The apparent FY24→FY26 EPS “decline” ($3.75 → $1.58) is a tax artifact; on a normalized basis EPS rose.
• FY25 tax rate. FY25’s effective tax rate was only ~6.1% (discrete benefits) versus a normalized 23.3% in FY26. Normalized at ~24%, FY25 EPS is ~$1.36 (versus reported $1.68).
• FY23 impairment. The FY23 GAAP net loss of −$35.8M was driven by a ~$53.5M real-estate/lease impairment producing a GAAP operating loss; there was no “$68M non-operating gain” (a data-aggregator mapping artifact). FY23 is non-comparable.

Net: normalized GAAP diluted EPS is roughly flat at ~$1.41 (FY24) → ~$1.36 (FY25) → $1.58 (FY26). Real GAAP earnings growth has been muted; the growth story lives in ARR and non-GAAP metrics, not the GAAP income statement.

Balance sheet — a deliberately-surrendered fortress. Cash was $899.99M at March 31, 2026 (up from $302.1M), the jump reflecting the September-2025 $900M convertible. Debt is the $880.9M carrying value of the 0% Convertible Senior Notes due 2030 plus ~$36.6M of leases, leaving net debt essentially neutral (~+$17.5M). Historically Commvault carried zero funded debt and net cash; it deliberately traded that pristine balance sheet for a leverage-neutral one to fund buybacks and M&A (see). The $300M revolver (refinanced April 2025) is undrawn; current ratio 1.95x; liquidity ample. Book equity ($7.5M) is near zero from cumulative buybacks (accumulated deficit −$1,472M against APIC $1,496M), so ROE and P/B are meaningless — anchor on ROIC and FCF, not book.

Verdict. Mixed-to-good. Cash economics are strong and clean by cohort standards — 81% gross margin, ~20% FCF margin, negligible capex, SBC only ~10% of revenue (so owner-FCF is genuinely positive at ~$114M, unlike Rubrik), and a near-neutral balance sheet with ~$900M liquidity. But the answer to “do economics improve with scale?” on a GAAP basis is, so far, no: operating income has been flat at ~$74M (6–9% margin) for three years while revenue grew 41%, because S&M and SBC scale with revenue and restructuring keeps recurring — and reported EPS is distorted by the FY24 tax release and a 6% FY25 tax rate (normalized EPS is roughly flat). This is a genuinely good cash generator with best-in-cohort earnings quality relative to Rubrik, but the operating-leverage story is unproven on GAAP and the “improving economics” narrative is currently a non-GAAP construct.

7. Capital Allocation

Capital allocation is one of Commvault’s clearer strengths — active, consistent, and shareholder-oriented, with a few blemishes of timing and incentive design.

Buybacks that genuinely shrank the share count. Commvault has repurchased ~$1.25B of stock over five years (~14.7M shares): FY22 $305.2M, FY23 $150.9M, FY24 $184.0M, FY25 $165.0M, and FY26 $446.1M (of which $259.3M / 3.03M shares in Q4 alone, into the March low at ~$85.66). Shares outstanding fell from 44.5M (FY22) to 41.3M (FY26) — a net ~7% reduction despite ~$540M of cumulative SBC, so the buybacks did more than offset dilution and delivered real per-share accretion. Management has stated it intends to direct ~60% of annual FCF to buybacks, and refreshed the authorization to $250M in April 2026. No dividend. The knock: much of the reduction only arrived in FY26 (and was partly convert-funded), and some repurchases were executed at prices ($135.77 average in FY25, $100+ into FY26) that soon traded at $75 — this is buying momentum, not value.

The 0% convertible — a shrewd but character-changing move. In September 2025 Commvault issued $900M of 0%-coupon Convertible Senior Notes due 2030 — no regular interest, conversion price ~$236.88 (a ~33% premium to the $178.78 reference), with the company able to settle principal in cash. It simultaneously spent ~$99.6M on capped calls that lift the effective dilution threshold to $357.56/share. With the stock at ~$78–148 over the past year — far below both the $236.88 conversion price and the $357.56 cap — the notes are deeply out-of-the-money and produce zero current dilution (diluted EPS excludes them until the stock exceeds $236.88; the cap protects to $357.56, +142% from spot). Proceeds funded a ~$117.7M concurrent buyback, the capped calls, and M&A dry powder (cash rose from $302M to $900M). The logic is rational — monetize a near-peak stock price with 0% money and capped dilution — but it converted a fortress balance sheet into a leverage-neutral one and front-loaded buybacks partly at prices that later looked high. At maturity, if never in-the-money, Commvault repays $900M cash (it holds ~$900M today, so this is manageable).

The per-share math on the buyback. The buyback’s value hinges on price paid versus intrinsic value, and Commvault’s record is mixed. Over five years it retired ~14.7M shares for ~$1.25B — an average of ~$85/share, below today’s $147.81, so in aggregate the program has been accretive. But the timing dispersion is wide: FY25 repurchases averaged $135.77 (the stock traded to $75 a year later — value-destructive), while the FY26 program averaged $106.91 with the Q4 tranche at ~$85.66 into the March low (value-accretive). The net-count reduction of ~7% over five years, achieved despite ~$540M of cumulative SBC, is genuine per-share accretion — a shareholder buying at today’s price owns ~7% more of the company’s FCF than they would have without the program. The critique is not that the buyback is wrong (it clearly beats a dividend for a no-yield growth name and has offset dilution), but that it is run on cash-availability cadence rather than value discipline — buying steadily regardless of price, and even accelerating (via convert proceeds) near the top. A returns-disciplined program would have bought far more at $75 and far less at $135; Commvault did some of both.

M&A — disciplined, small-bore. Appranix, Clumio, and Satori (~$95M total) are capability/talent tuck-ins that build the cyber-recovery, cloud-native, and data-AI-security stack — all cash-funded, integrated within ~12 months, with no goodwill blow-ups (goodwill rose modestly to $209.3M; acquired-intangible amortization only $4.7M). No history of value-destroying elephant deals.

Spending posture. S&M is $519.7M (43.9% of revenue) — the primary reason GAAP margins are thin, reflecting a land-and-expand SaaS GTM in a competitive market. R&D is $162.2M (13.7%, down from ~15.8% in FY24 as revenue outgrew R&D). This is a demand-side, go-to-market-heavy posture — ~44 cents of every revenue dollar spent on selling.

Incentives — reasonable, with one gap. The FY26 proxy shows the annual cash incentive keyed to Total Revenue (60%) + Non-GAAP EBIT (40%), and long-term PSUs (60% of target LTI) keyed to Relative TSR versus the Russell 3000 (up to 300%) and Total ARR (up to 300%), with the remainder time-based RSUs. Metrics are shareholder-aligned and hard to game (rTSR versus a broad index is a genuine external check). The notable absence: no ROIC/ROE metric and no FCF-per-share or absolute-FCF metric — management is paid on growth (revenue/ARR) and non-GAAP profit, not on capital efficiency or per-share cash generation. Given flat GAAP operating income and heavy S&M, that is a mild governance blemish.

Verdict. Good, shareholder-friendly capital allocation with minor blemishes. A coherent program — ~$1.25B of buybacks that more than offset SBC (share count net −7%, real per-share accretion), disciplined tuck-in M&A with no blow-ups, no dividend, and a shrewd 0%-coupon convert with capped calls that monetized peak valuation while capping dilution at $357.56. The knocks are timing (buying stock at $100–136 that soon traded at $75) and incentive design (no ROIC or FCF metric). Net: management allocates capital intelligently and in shareholders’ interest, though it favors buyback velocity over price discipline and is not paid on capital efficiency. A clear positive for the thesis.

8. Changes and Headwinds — Last Two Years

The last two years cut both ways — the franchise strengthened operationally and financially even as the events that broke the stock played out.

Financing. The September-2025 $900M 0% convert (with capped calls and a concurrent $117.7M buyback) and the April-2025 upsizing of the revolver to $300M (undrawn) transformed a zero-debt/net-cash balance sheet to leverage-neutral, accelerating buybacks and building M&A dry powder. Commvault also completed a sale-leaseback of its Tinton Falls HQ for ~$34.8M net in FY26.

M&A. Appranix (April 2024), Clumio (October 2024), and Satori Cyber (August 2025) — three capability tuck-ins (~$95M total) building the cyber-recovery / cloud-native / data-AI-security stack.

Leadership. A CFO transition: Jennifer DiRico departed December 31, 2025, and Gary Merrill (CFO 2022–24, then Chief Commercial Officer) returned as CFO — a well-received reset that contributed to the Q4 rebound in sentiment. Geoffrey Haydon was named President of Customer & Field Operations. CEO Mirchandani has been continuous throughout.

The events that broke the stock. Two guidance disappointments drove the ~62% drawdown: the Q2-FY26 (October 2025) cut to the FY26 non-GAAP EBIT-margin guide (~150bps, framed as a “year of investment”) plus flagged term-duration compression; and the Q3-FY26 (January 2026) net-new-ARR miss (~$39M vs the ~$45M guided), FCF collapse to $2M (collections/payroll timing), SaaS NRR slipping 125%→121%, and the initiation of two company-wide restructuring plans ($32.2M FY26 charge). These self-inflicted sentiment events, meeting a rich starting multiple and a cohort-wide high-beta de-rate, produced the crash — even as revenue (+18.9%), ARR (+21%), and FCF (+16%) all compounded through it. It was a multiple event, not a fundamental break.

The rebound and a decelerating outlook. The Q4-FY26 beat (record net-new subscription ARR, record $132M FCF, EBIT margin back to 21.3%), the $259M in-quarter buyback, the Merrill-CFO reset, and the June-2026 Microsoft Azure ISV partnership drove the ~90% recovery. But the FY27 guide decelerates — revenue $1.30–1.31B (~+11%, down from +18.9%), non-GAAP EBIT margin 20.5%, FCF $250–260M, subscription ARR +18–19%, SaaS ARR above $500M, diluted shares shrinking to ~42M. And a reporting recast effective FY27 folds term-support into subscription (subscription revenue → ~82% of total), stops disclosing Total ARR, and shifts NRR to an annualized-subscription basis (FY26 = 114% on the new basis) — cleaner alignment to the model, but it breaks YoY comparability and conveniently sunsets the decelerating Total-ARR and SaaS-NRR series. Watch the optics.

Verdict. Net neutral-to-slightly-positive, but the changes cut both ways. The business is modestly stronger and better-capitalized than two years ago (cyber-recovery tuck-ins, Microsoft ISV, record Q4 FCF, share-count reduction, CFO upgrade, 0% convert). But the same window delivered the two guidance disappointments that broke the stock, a decelerating FY27 growth guide, a reporting recast that reduces disclosure granularity, and recurring/growing restructuring. Slightly thesis-strengthening on quality and capital; thesis-cooling on growth.

9. Risk Analysis

The dominant risks are valuation/multiple compression (the stock’s own three-month history is the warning) and competitive share loss at the growth frontier. Neither is a catastrophic-loss or total-loss risk — the balance sheet is sound, the FCF is real, and the recurring base is sticky — but the combination of a 1.31 beta, an 84th-percentile P/S, and a decelerating guide means the near-term return distribution is skewed toward multiple risk rather than fundamental risk.

10. Valuation Discussion

Rebuild the enterprise value at spot — the aggregator number is stale. At $147.81 (July 17, 2026) on ~44.7M diluted shares, market cap is ~$6.61B. Cash of ~$900M nets against the ~$917.5M convert-plus-leases to leave net debt essentially neutral (~+$17.5M), so EV ≈ $6.62B. This must be built by hand: ROIC’s snapshot shows market cap of ~$3.43B and EV of ~$3.44B, but that uses the March-31 fiscal-year-end close (~$77.89) and is stale by ~90% versus spot — its EV/sales of 2.9x, EV/EBITDA of 29.7x, and EV/FCF of 13.5x are all understated. The correct multiples at spot EV of $6.62B:

So Commvault reads ~5.6x sales / ~26x FCF / ~3.9% FCF yield — a mid-to-full multiple for a ~19%-grower, but attached to the cleanest cash quality in the cohort (SBC only ~10% of revenue).

The comp table — the variant framing lives here.

The load-bearing cross-read is Rubrik. Commvault trades at roughly half Rubrik’s EV/sales (5.6x vs ~9x) — but the honest math tempers the “it’s cheap” reflex: on a growth-adjusted basis (EV/sales per point of growth), CVLT at ~0.30 and RBRK at ~0.28 are nearly identical, so the raw multiple gap is mostly explained by Rubrik’s ~32% ARR growth versus Commvault’s ~19%, not by a clean mispricing. Commvault’s real edge is quality, not price: it earns GAAP profit and ~$114M of ex-SBC owner-FCF, where Rubrik’s “$238M FCF” is roughly negative $90M once SBC is charged. The correct statement is “cheaper and far higher earnings quality than Rubrik, at the cost of ~13 points less growth” — a quality-versus-growth trade, not a valuation arbitrage. Against Nutanix (similar ~5x sales, similar growth, but ~$750M of FCF scale and the VMware-disruption tailwind), Commvault looks fairly valued with cleaner SBC but less FCF scale. Commvault sits at the cheap end of the software/cyber complex — closer to DT/NTNX than to the premium CRWD (~26x sales) / PANW / RBRK names.

Embedded expectations — a modest bar. A reverse-DCF at spot EV of $6.62B, starting FCF of ~$255M, discount rate 9.5% (consistent with the 1.31 beta), and 3% terminal growth implies the market is underwriting only ~9.6% long-run FCF CAGR. Sensitivity: an 8% FCF CAGR justifies ~$5.9B EV (below spot — the market needs more than 8%); 10% → ~$6.8B; 12% → ~$8.0B; 14% → ~$9.2B. That ~9.6% embedded bar is modest relative to Commvault’s ~19% recent revenue growth and its subscription/SaaS mix shift — a far less demanding hurdle than Rubrik’s (which must sustain high-20s ARR growth to hold ~9x sales). This is the quantitative core of the “reasonable, not cheap” read: if Commvault merely grows FCF ~10–12% (low-teens revenue plus modest margin expansion), spot is fair-to-slightly-cheap. But the bar is not trivially clearable: it requires SaaS/ARR to keep offsetting legacy term-license decay, no share loss to Rubrik/Veeam/Cohesity, and — the swing factor — the ~5–6x sales multiple to hold in a 1.31-beta name that just proved it can trade to 3.5–4x sales.

Scenarios (no price target):

• Bear — revenue decelerates to ~8–10%, FCF margin stalls ~20%, the multiple compresses to ~4x sales / ~18x FCF (a repeat of the 2026 high-beta growth-scare) → EV ~$4.5–5.0B. This is the March-2026 experience (the stock hit $75).
• Base — revenue ~12–14%, FCF margin drifts to ~23–24%, ~5–6x sales holds → EV ~$6.5–7.5B (roughly spot). Embeds the ~9.6% FCF CAGR.
• Bull — SaaS ARR inflects, revenue sustains ~16–18%, FCF margin toward 26%+, and the cyber-resilience narrative supports ~7–8x sales → EV ~$9–11B. Requires beating the modest embedded bar convincingly and GAAP operating leverage finally appearing.

A deserved-multiple cross-check (Rule of 40). A second lens corroborates the reverse-DCF. Commvault’s Rule of 40 — revenue growth plus FCF margin — is roughly 19% + 20% ≈ 39–40 (or ~47 in the strongest recent quarter on a subscription-growth basis), squarely at the “40” threshold that historically separates premium-multiple software from the pack. On a growth-plus-margin score of ~40, a ~5–6x EV/sales multiple is market-appropriate, not cheap and not expensive — which is exactly where Commvault trades. Rubrik scores higher (~50, on ~32% growth plus its flattered ~18% FCF margin) and earns ~9x; Nutanix scores ~48 and earns ~5x; the cohort roughly prices Rule-of-40 at ~0.12–0.18x of EV/sales per point. Commvault at ~5.6x sales on a ~40 score sits mid-cohort — the market is paying a fair, not a bargain, multiple for the profile. The bull’s edge is not that the multiple is cheap on this math; it is that the earnings quality inside the score is the cohort’s best (real FCF, not SBC-flattered), and that the reverse-DCF’s ~9.6% embedded FCF-growth bar is low enough to be beaten even if the multiple never expands.

What the market is pricing correctly vs. incorrectly. Correctly: that Commvault is a slower-growing, share-following incumbent (hence the discount to Rubrik) and that its cash is genuinely cleaner (hence a premium to no-moat SentinelOne). Potentially incorrectly, in either direction: the bull says the market under-credits the cash-quality edge and the modest embedded bar; the bear says the market over-credits a re-rate on a business with flat GAAP operating income, an eroding moat, and a decelerating guide, in a name whose 84th-percentile P/S and just-doubled price leave no cushion.

11. Variant Perception

Consensus. A profitable data-protection incumbent successfully pivoting to SaaS/ARR (cyber-resilience), re-accelerated to ~19% growth, GAAP-profitable and FCF-generative — a “quality compounder” re-rated after a violent round-trip, fairly-to-attractively valued at ~5–6x sales. The sell side has turned constructive: Mizuho, KeyBanc, and Oppenheimer moved targets to ~$175 in mid-July, ~18% above spot; the news tape (Microsoft ISV deal, PT hikes) skews bullish into the rebound.

The strongest bull case. Commvault is the only profitable, FCF-positive, ~19%-growing pure-play in a secular cyber-resilience/ransomware market. SBC of only ~10% of revenue makes it the cleanest cash-quality name in the cohort — ex-SBC owner-FCF is still +~$114M versus Rubrik’s −$90M. SaaS ARR is inflecting (+42% to $400M, guided above $500M), the buyback genuinely shrinks the share count, and the stock trades at ~half Rubrik’s multiple with an embedded bar of only ~9.6% FCF CAGR — beatable. As the cyber-recovery TAM expands (ransomware mandates, AI-data protection), a profitable share-holder in a growing market compounds.

The strongest bear case. This is a mature backup incumbent dressed in a “cyber-resilience” narrative. GAAP operating margin is only ~6% and GAAP operating income has been flat for three years — the ~19% growth is a SaaS-mix optical high that decelerates (to ~11% guided for FY27) as legacy term-license runs off, and the “20% margin” is a non-GAAP construct. Better-funded, faster rivals — Rubrik (32% ARR, now larger in absolute subscription ARR), Veeam (scale leader), Cohesity/Veritas — are taking the frontier. The stock has already doubled off its low, sits at the 84th percentile of its own P/S with a 1.31 beta, insiders sold into the March low with zero dip-buying, and the factor tape identifies it with moderate-growth software (Tyler, Autodesk, Dropbox), not hyper-growth cyber. Multiple compression is the base rate — it printed a −62% drawdown three months ago.

The 3–5 assumptions that matter most, and what falsifies each side:

1. SaaS/subscription ARR keeps growing fast enough to offset legacy decay. Falsifies bull if subscription ARR growth decelerates below low-teens or NRR slips further; falsifies bear if ARR re-accelerates and net-new ARR sets records.
2. No share loss to Rubrik/Veeam/Cohesity. Falsifies bull if win-rates or large-customer counts stall; falsifies bear if Commvault keeps taking enterprise cyber-recovery share.
3. FCF quality is durable and converts to GAAP earnings. Falsifies bear if GAAP operating income finally inflects while SBC stays ~10% and the share count keeps falling; falsifies bull if SBC creeps up or restructuring keeps recurring.
4. The ~5–6x sales multiple holds. The swing factor — in a 1.31-beta name, if the cohort re-rates down, Commvault follows (it demonstrably will).
5. The cyber-resilience premium reflects real demand, not narrative. Watch the attach/cross-sell of Cyber Recovery / ThreatScan / identity resilience versus commodity backup.

The factor read into the debate. The tape is ~69% idiosyncratic (R² only 0.31, idiosyncratic vol ~49%) — a single-name story, not a factor proxy — with no meaningful momentum, value, or quality loading despite the ~90% rally. The defining fact is a −61.5% max drawdown (the 2025–26 crash) followed by the recovery; long-run Sharpe is mediocre (~0.3 over 5–10 years) despite good absolute returns — the volatility tax of a high-beta, high-idiosyncratic-vol name. Net: this is a recovered falling-knife / high-beta idiosyncratic re-rate, not crowded momentum and not deep value. Consensus is not obviously offsides in either direction; the genuine debate is growth-durability-and-earnings-quality versus multiple, and the tape says “already recovered, priced for continuation.”

12. Fact vs. Interpretation Table

13. Open Questions

1. Does GAAP operating income finally inflect? The whole quality-vs-price debate turns on whether flat ~$74M GAAP operating income starts to lever up as SaaS scales and restructuring rolls off — or whether S&M keeps consuming the gross-profit growth. FY27’s guided 20.5% non-GAAP EBIT margin says nothing about GAAP leverage.
2. Is ~27% subscription-ARR growth defending share or slowly ceding it? Commvault does not disclose net-new ARR the way Rubrik does; without it, we cannot cleanly settle whether Commvault is holding or losing share at the frontier. The SaaS NRR deceleration (127%→122%) is a yellow flag on expansion durability.
3. Is term-duration compression a benign mix optic or an early demand-softness tell? It recurred in Q2–Q3 FY26 and mechanically depressed reported term ARR/revenue.
4. What does the FY27 reporting recast obscure? Retiring Total ARR and SaaS NRR right as both decelerate reduces the ability to track the growth cool-down — watch for the annualized-subscription-NRR (114%) trajectory.
5. How large and durable is the Microsoft Azure ISV partnership? A genuine new channel, but unsized; validate against IR and future prints.
6. Gross-revenue-retention (churn) is undisclosed — needed to fully validate the switching-cost moat versus the 122% net retention (which can mask logo churn under expansion).

14. What Must Be True

For the bull case (own the cash-quality compounder at a reasonable price):

• Subscription ARR sustains ~mid-20s growth and SaaS ARR clears $500M+ while NRR stabilizes — the SaaS engine keeps offsetting legacy term-license decay.
• GAAP operating income begins to inflect upward (proving operating leverage), SBC stays ~10% of revenue, and the buyback keeps shrinking the share count — cash quality converts into earnings quality.
• The ~5–6x sales multiple holds; the ~9.6% embedded FCF-growth bar is beaten.
• Falsification test: If, over the next 2–3 quarters, GAAP operating income stays flat at ~$74M and net-new subscription ARR / NRR decelerate further (a repeat of the Q3-FY26 miss), the “improving-economics compounder” thesis is broken — it is a flat-earnings, share-following incumbent at a full multiple.

For the bear case (a mature backup vendor at a full price, priced for a rebound that fades):

• Rubrik/Veeam/Cohesity visibly take enterprise cyber-recovery share; Commvault’s ~19% growth cracks toward the ~11% FY27 guide and below.
• The high-beta cohort re-rates and Commvault follows it back toward 3.5–4x sales (the March-2026 level).
• Falsification test: If Commvault posts consecutive quarters of record net-new subscription ARR, holds NRR, and GAAP operating margin expands measurably — while the multiple holds — the “mature vendor dressed as cyber-resilience” bear is wrong; the operating leverage is real and the discount to Rubrik is an opportunity.

The two cases share a single clock: the FY27 prints (starting Q1-FY27, ~late July 2026), read for GAAP operating leverage and net-new subscription ARR. That is the shared falsification event.

15. Source Appendix

See Appendix B below for the full, categorized source list with URLs and access dates. Primary sources include: Commvault FY2026 10-K (filed 2026-05-11, cvlt-20260331.htm) and the FY2022–FY2025 10-Ks; the FY2026 DEF 14A (2026-06-24); 8-Ks including the September 2025 convert (2025-09-05) and quarterly earnings; the EDGAR Form 4 corpus (CIK 0001169561); Commvault Q1–Q4 FY2026 earnings-call transcripts; Rubrik and Nutanix public filings for peer comps; IDC/Gartner data-protection market-share and MQ sources; and quantitative data from a financial-data service, a market-data service, and a quantitative factor model (reconciled to filings). Facts are cited to primary sources; interpretations are labeled as such throughout.

APPENDIX A — Standard Diligence Questionnaire

Commvault Systems, Inc. (NASDAQ: CVLT) — supplemental diligence, as-of July 18, 2026. Fact/Interpretation/Assumption labels applied where material.

General

What thoughtful questions have other investors asked about this company? The central debate is quality-versus-price after a round-trip: (1) Is the ~19% growth a durable second act or a SaaS-mix optical high that decelerates (FY27 guided to ~11%) as legacy term-license runs off? (2) Why does GAAP operating income stay flat at ~$74M while revenue grows 41% — when does operating leverage appear? (3) Is Commvault losing share to Rubrik (which has passed it in subscription ARR) and Veeam/Cohesity, or defending a durable installed base? (4) After a −62% drawdown and a ~90% rebound, is 5.6x sales (84th-percentile P/S) a reasonable price for a profitable pure-play, or a full multiple with no cushion? (5) Is the “cyber-resilience” repositioning a real moat or marketing over a commoditizing backup core?

Cyclicality & Earnings Nature

Are earnings at a cyclical high or low? Neither extreme. Revenue and ARR are compounding; GAAP operating income is flat (~$74M for three years), not cyclically high. Reported EPS is artificially depressed on a P/E basis by SBC and normalized tax, and was artificially inflated in FY24 by an $85M tax-valuation release. Free cash flow (~$237M, +16%) is near a company high but grew through the stock’s crash. Interpretation: earnings are mid-cycle operationally, with the reported GAAP line understating cash generation.

Driven by the external environment or internal actions? Both: the secular ransomware/cyber-resilience tailwind (external) plus a genuine internally-driven subscription/SaaS re-acceleration and cost discipline (internal). The stock’s volatility, by contrast, was largely external (high-beta cohort de-rate) plus self-inflicted guidance events.

How stable are revenues? Very — ~92% recurring (subscription + support), $1.12B ARR exceeding GAAP revenue, RPO $1.04B. Among the more stable revenue bases in software.

Outlook for products/services; how big will this market be? The data-protection software market is ~$6.9B growing ~7.5% (cyber-recovery faster, mid-teens), toward ~$12.5B by 2034; growing, global, non-discretionary. Commvault’s own software-TAM growth is low-single-digit; its growth comes from SaaS mix-up and share, not market growth alone.

Business Quality & Competitive Moat

Is the industry getting more or less competitive? More. Rubrik IPO’d (2024), Cohesity rolled up Veritas (~$7B, 2024), Veeam is PE-backed and IPO-track — heavy fresh capital, a late-capital-cycle setup pressuring pricing and forcing heavy S&M.

How profitable is the business (ROIC, ROE)? ROIC ~11% (normalized low-double-digits; FY24/FY25 figures inflated by one-time tax items) — roughly at/modestly above WACC. ROE/P/B are meaningless (near-zero book equity from buybacks). Anchor on ROIC and FCF. Gross margin 81.2%; GAAP operating margin only ~6.25%; FCF margin ~20%.

How profitable is the industry — competitors, barriers? Fragmented, no dominant share (leader under ~15%); high gross margins but heavy S&M erodes operating margins across the group. Barriers are moderate (patents, breadth, certifications, switching costs) — not a scale-plus-captivity lock.

Can the business be easily understood? Yes — sell recurring access to backup/recovery software across every major workload; ~92% recurring.

Undermined by foreign low-cost labor? No — enterprise software with high switching costs; competition is other well-funded software vendors, not labor arbitrage.

Do brands matter? Moderately — “Commvault” carries 14 years of Gartner-Leader trust and enterprise/government credibility; but brand has not prevented Rubrik/Cohesity from taking frontier share.

Nature of competition; switching costs? Competition is feature/platform breadth, cyber-recovery capability, and channel reach. Switching costs are real but narrow (data gravity, operational entanglement, recovery-SLA risk) — evidenced by 122% SaaS NRR and 92% recurring — strongest in hybrid/on-prem/government estates, weakest at the cloud-native frontier.

Financial Condition & Balance Sheet

Assets not fully recognized on the balance sheet? The installed base / customer relationships and the recurring ARR book ($1.12B) are the real economic assets, largely unrecognized beyond modest goodwill ($209M) and intangibles. 1,600+ patents carried at little/no book value.

Off-balance-sheet liabilities? Standard operating-lease commitments (post-HQ sale-leaseback) and SaaS-hosting purchase commitments; ~$172M unrecognized SBC. No unusual off-balance-sheet structures.

How conservative is the accounting? Reasonably conservative on revenue (subscription/ASC 606) but the non-GAAP presentation is the watch item — it adds back SBC ($123M) and a recurring, growing restructuring line ($32M), so non-GAAP EBIT (~$240M / 20%) sits far above GAAP EBIT (~$74M / 6.25%). Restructuring recurring every year argues against treating it as fully “one-time.” Reported EPS distorted by FY24 tax release and 6% FY25 tax rate.

How CapEx-hungry? Not at all — capex ~0.6% of revenue; asset-light software. FCF ≈ OCF.

Capital Allocation & Management

How much FCF, and how is it used? ~$237M FY26 (~20% margin), guided $250–260M FY27. Used ~60% for buybacks (~$446M FY26), the rest for small tuck-in M&A and cash build. No dividend.

Significant acquisitions recently? Only small tuck-ins — Appranix, Clumio, Satori (~$95M total) — capability/talent deals, no goodwill blow-ups.

Buying back shares? Yes, aggressively — ~$1.25B over five years, share count 44.5M→41.3M (net −7% despite ~$540M SBC). Some repurchases were ill-timed ($135.77 avg FY25, $100+ into FY26, before the stock hit $75).

Issuing large amounts of new shares to insiders? SBC is moderate (~10% of revenue, best-in-cohort); buybacks more than offset it — share count is falling, not rising. The $900M 0% convert is deeply OTM (conversion $236.88, cap $357.56) — zero current dilution.

Compensation policy / incentive metrics? AIP = Revenue (60%) + Non-GAAP EBIT (40%); PSUs = Relative TSR vs Russell 3000 + Total ARR. Reasonable and shareholder-aligned, but no ROIC/ROE or FCF-per-share metric — paid on growth and non-GAAP profit, not capital efficiency. Mild governance blemish.

Motivations of management? CEO Mirchandani leads the turnaround; Merrill returned as CFO (well-received). Insider tape is negative-to-neutral: uniform selling (largely programmatic/sell-to-cover), including into the March-2026 low at ~$79, with zero open-market purchases anywhere — no insider signaled the bottom was cheap.

Valuation & Market Data

ADR / MLP / K-1? No — US common stock, standard C-corp, no K-1.

Dividend policy? None. 100% buyback.

How profitable is the business? GAAP profitable ($1.58 EPS, 6.25% operating margin) but the earnings are cash-rich and GAAP-thin; the attractive margins are non-GAAP. FCF ~20% margin is the honest profitability read.

Is net income diverging from cash from operations? Yes, favorably — OCF ($244.7M) is ~3.5x GAAP net income ($70.7M), the gap being SBC, deferred revenue, and D&A. This is normal for a recurring-software model and a positive quality signal (cash exceeds accrual earnings), the opposite of a red flag.

Risks & Downside

What would cause the stock to decline? (1) A high-beta cohort re-rate (it printed −62% three months ago); (2) growth deceleration below low-teens / a net-new-ARR miss (as in Q3-FY26); (3) visible share loss to Rubrik/Veeam/Cohesity; (4) failure of GAAP operating leverage to appear; (5) macro IT-budget cuts.

Risk of a catastrophic loss? Low. The balance sheet is sound (~$900M cash, net-neutral debt, undrawn revolver), FCF is real and recurring, and the base is sticky. The convert is manageable. Catastrophic loss would require a structural collapse of the backup franchise — not the base case.

Chance of a total loss? Very low — profitable, cash-generative, no going-concern or solvency risk. The realistic downside is multiple compression (a ~40–50% drawdown, as demonstrated), not impairment of the enterprise.

Recent News & Events

Has the business environment changed recently? Yes: the June-2026 Microsoft Azure ISV partnership (new channel), the Q4-FY26 beat (record FCF and net-new ARR), the Merrill-CFO return, and a wave of sell-side upgrades to ~$175. Offsetting: a decelerating FY27 guide (~11% revenue) and a reporting recast that retires Total-ARR/SaaS-NRR disclosures.

Significant acquisitions? Satori Cyber (Aug-2025); Appranix and Clumio in the prior year — all small.

Change in accounting policies? FY26 disaggregated subscription revenue into term-license vs SaaS (presentation only); FY27 folds term-support into subscription and retires Total ARR — a disclosure change to watch.

Recent changes — new markets, facilities, management? CFO transition (Merrill back); HQ sale-leaseback (~$34.8M); expanded cyber-recovery/AI-data-security product stack; the $900M 0% convert restructured the balance sheet.

APPENDIX B — Source Appendix

Commvault Systems, Inc. (NASDAQ: CVLT). Sources categorized primary-first; access date 2026-07-18 unless noted. Facts are cited to primary sources; third-party aggregated data (a financial-data service, a market-data service, a quantitative factor model) reconciled to filings and labeled.

1. Company SEC filings (primary — EDGAR CIK 0001169561)

• FY2026 Form 10-K (filed 2026-05-11, cvlt-20260331.htm) — statement of operations (Income from operations $73,990K; SBC $123,425K), COGS-by-type, revenue disaggregation (Note 3), ARR KPIs (pp.33–34), MD&A (pp.33–43), competition/patents/certifications (Item 1 pp.4–9), risk factors (Item 1A), business-combination and debt notes, balance sheet ($899,987K cash / $880,863K notes), cash-flow statement, Item 5 repurchase table. Local mirror: output/CVLT/sources/10-K/2026-05-11_cvlt-20260331.htm.
• FY2025 / FY2024 / FY2023 / FY2022 Form 10-Ks (2025-05-05, 2024-05-13, 2023-05-05, 2022-05-06) — multi-year revenue/margin/ARR trend; FY24 3-year statement showing the FY23 $53,481K impairment and −$15,885K operating loss; FY24 $85.3M tax-valuation-allowance release.
• FY2026 DEF 14A proxy (2026-06-24, cvlt-20260624.htm) — Annex A non-GAAP reconciliation (non-GAAP NI $194,319K / $164,954K); CD&A incentive metrics (AIP Revenue 60% / Non-GAAP EBIT 40%; PSUs rTSR vs Russell 3000 + Total ARR); executive transitions.
• 8-K, 2025-09-02 and 2025-09-05 (cvlt-20250902.htm) — $900M 0% Convertible Senior Notes due 2030 (conversion price ~$236.88; capped calls to $357.56; $99.6M cost; concurrent buyback). Local: output/CVLT/sources/8-K/.
• Quarterly earnings 8-Ks — Q1 FY26 (2025-07-29), Q2 FY26 (2025-10-28), Q3 FY26 (2026-01-27), Q4 FY26 (2026-04-28).
• Form 4 corpus (CIK 0001169561, Aug-2025→Jul-2026, parsed live from EDGAR) — insider-transaction read: zero code-P open-market purchases; CEO/CFO/director sales including into the March-2026 low.
• Credit Agreement (8-K April 2025; 10-K Ex-10.8) — $300M revolver, undrawn.

2. Earnings-call transcripts (primary management commentary — treated as hypothesis)

• Commvault Q1–Q4 FY2026 earnings calls: 2025-07-29, 2025-10-28, 2026-01-27, 2026-04-28 (from public transcripts) — ARR/SaaS/NRR trajectory, FY27 guidance, capital-allocation and CFO-transition commentary, cyber-resilience positioning.

3. Peer / comparables (public filings + public company filings)

• Rubrik, Inc. (RBRK) — FY2026 results / press release (rubrik.com newsroom) and public filings (2026-06-27): subscription ARR $1.57B (+32%), ~120% NRR, ~25% SBC, owner-FCF ≈ −$90M, ~9x EV/sales, dual-class founder control.
• Nutanix (NTNX) — public filings (2026-07-03): ~$2.5B revenue, ~5x sales, ~30% FCF margin, ~14% SBC.
• Dynatrace (DT), SentinelOne (S), CrowdStrike (CRWD), Palo Alto (PANW), Datadog (DDOG) — public filings (2026-06/07) for cohort multiple range and moat/valuation framing.

4. Industry / market data

• IDC Data Replication & Protection Software Tracker (2H2025) — Veeam #1; vendor share (via blocksandfiles.com, 2024-04-22 & 2025-02-11).
• Gartner 2025 Enterprise Backup & Data Protection Platforms Magic Quadrant — Leaders: Rubrik, Veeam, Cohesity, Commvault, Dell, Druva (via competitivecorner.ca).
• VerifiedMarketReports data-protection & replication software market forecast (2026–2034, ~$6.9B → ~$12.5B, ~7.5% CAGR).
• virtualizationreview.com (2025-07-01); trade press on Cohesity/Veritas (~$7B, Dec-2024) and Veeam.

5. News / recent events

• Commvault–Microsoft multi-year Azure ISV partnership (announced 2026-06-24; via Benzinga id 407967; validate vs Commvault IR).
• Sell-side price-target actions — Mizuho ($140→$175, Jul-15), KeyBanc ($175, Jul-16), Oppenheimer ($175, Jul-17), Stephens ($155, Jun-16) — via a market-data service news feed; underlying broker notes cited, not the aggregator score.

6. Quantitative data services (third-party; reconciled to filings)

• a financial-data service MCP — income statement, cash flow, balance sheet, profitability ratios, enterprise value, valuation multiples, earnings-call transcripts (FY22–FY26). Note: EV snapshot uses stale March-31 FY-end price — EV rebuilt at spot by hand.
• a market-data service — price CSV (azitrading.com/controls/download-data.php?t=CVLT; adjusted OHLCV, EMAs, beta 1.31) and valuation_index own-history percentiles (composite 72nd, P/S 84.5th, P/E 32nd, P/B 99.7th); news feed.
• a quantitative factor model — /api/{stock-loadings,leaderboard,stock-info,stock-specific-vol,related-stocks}/CVLT — beta ~1.2–1.31, R² 0.31, idiosyncratic vol ~49%, −61.5% max drawdown, factor-similar peers (Tyler/Autodesk/Dropbox cluster).

Third-party aggregated figures (a financial-data service, a market-data service, a quantitative factor model) are not primary; where they diverge from the filing, the filing governs. Statistical/factor estimates are reportable as facts (loadings, returns, drawdowns); directional inferences are labeled interpretation.