Rubrik, Inc. (NYSE: RBRK) — The Recovery Leader Now Priced for a Clean Escape

Independent research as of August 27, 2026. Price referenced: $107.02 (August 27, 2026 regular-session close). The analytical body contains no recommendation or price target.

⚡ Claude’s Take

This block is the author’s subjective, independent opinion and general information, not investment advice. The analytical body that follows takes no position, carries no price target, and confines itself to embedded-expectations and scenario analysis.

Verdict: AVOID-HERE / HOLD if owned; not a short. Medium conviction. My preferred entry zone is roughly $75–90 on the current basic-share capitalization, or about $70–85 on a fully diluted basis—approximately 9–11x subscription ARR depending on the share-count convention. At the $107.02 regular-session close, the stock capitalized the business at about 12.9x ARR on 206.1 million basic shares and 14.3x on 226.8 million diluted shares. A provisional $98.17 after-hours quote following Q2 still implied roughly 11.8x and 13.0x, respectively. Those are momentum prices, not dislocation prices.

The operating print deserves respect. Q2 FY2027 delivered 33% subscription-ARR growth, 35% growth in net-new ARR, 39% Cloud ARR growth, a material revenue beat, higher contribution margin, and a second guidance increase. The $107.02 close and 11.3% regular-session gain occurred before the post-close release and within a broad cybersecurity rally; the initial after-hours response was negative. Over three, six, and twelve months the official close was still up 52%, 97%, and 26%, and it stood 26% above its 50-day EMA. The factor framing is high-beta quality growth with powerful positive momentum at a full price—not a falling knife, and no longer the washed-out setup of June.

The restraint comes from the gap between headline and per-share economics. Adjusted net-new Cloud ARR grew 20% excluding migrations, materially below headline ARR growth; first-half reported FCF of $139.3 million was still $35.1 million below first-half SBC; Q2 SBC rose to 23.6% of revenue; and FY2027 guidance uses roughly 228 million diluted shares versus 206.1 million Q2 basic shares. The moat remains a narrow but valuable switching-cost moat rather than a scale or network-effect moat, Agent Cloud is not financially material, and the dual-class structure gives insiders disproportionate influence. A genuinely better business now carries a valuation that assumes clean execution on growth, margins, and dilution simultaneously.

Conviction: medium. Flips bullish if adjusted net-new Cloud ARR reaccelerates above 25% while SBC/revenue falls below 18% and diluted FCF per share rises. Flips bearish if net-new ARR growth drops below 20%, NRR falls below roughly 115%, or platform bundling slows new-logo wins. Tag: “the recovery leader has already escaped the bargain bin.” Factor loadings reinforce the risk: market beta 1.71, cybersecurity loading 1.43, Low Volatility loading −1.31, and Momentum loading −0.56 describe a high-beta recovery trade rather than a stable compounder.

📈 Stock Price Action — Five-Year Event Map

Rubrik IPO’d in April 2024, so this is the full available roughly 28-month history rather than five years. The shares moved from a $32 IPO price to a prior $99.74 peak, fell to a $43.81 52-week low, and then completed the round trip at a new $107.02 closing high on August 27, 2026. The current price is at the top of the $43.81–$107.91 trailing-52-week range, after gains of 62.6% in three months and 106.0% in six months.

Cycle narrative (price moves are FACT; attributed causes are INTERPRETATION):

1. The April 2024 IPO priced at $32 and closed the first day ~$37 (Fact); the pop reflected strong demand for a cyber-SaaS debut (Interp).
2. Through summer/autumn 2024 the stock drifted to ~$30–34 (Fact), with no earnings catalyst and lock-up supply likely capping it (Interp).
3. The November 2024–January 2025 surge to ~$66 (Fact) tracked the well-received Q3-FY25 print (Dec-5-24, +20.4% on the day) and a broad bid for profitable-growth software (Interp).
4. The run to the $99.74 ATH in June 2025 (Fact) was led by the Q4-FY25 blow-out (Mar-13-25, +27.8% one-day) that lifted the name into expensive territory (Interp).
5. The first leg down to ~$80 came on the Q2-FY26 print (Sep-9-25, −18.0%) (Fact); the reaction read as multiple fatigue rather than a fundamental miss (Interp).
6. The grind from ~$80 to the ~$44 low into early 2026 (Fact) was predominantly multiple compression as high-beta software de-rated, not an ARR reversal (Interp).
7. The rebound from the April low to roughly $85, followed by a retreat to $72.33 after the Q1 FY2027 beat, shows how quickly the stock moved between growth-factor enthusiasm and a demanding buy-side bar (Fact/Interp).
8. The 48.0% advance from June 27 through the August 27 close culminated in an 11.3% regular-session gain to $107.02 (Fact). Rubrik released Q2 after that close, so attributing the session to the print would be false. A broad cybersecurity rally and Rubrik’s preexisting Analyst Day and product narrative are plausible drivers (Interp). The first after-hours quote was $98.17, down 8.3% from the close but still above the prior day’s close; it is a provisional snapshot, not a completed earnings reaction (Fact).

1. Executive Summary

Rubrik is a cyber-resilience and data-security software company—the post-breach recovery layer for enterprise data, identities, and increasingly AI agents. Q2 FY2027 subscription ARR reached $1.661 billion, up 33%, Cloud ARR reached $1.48 billion, up 39%, subscription revenue grew 37%, and the count of customers spending at least $100,000 rose 23% to 3,084. Management exceeded each guided Q2 metric and raised the FY2027 ARR, revenue, contribution-margin, EPS, and FCF outlook. The operating evidence therefore strengthened since the June report.

The debate has shifted from whether execution is intact to how much future execution is already capitalized. At the August 27 regular-session close, basic enterprise value is approximately $21.45 billion and diluted enterprise value approximately $23.67 billion. Those figures equal about 12.9x and 14.3x current subscription ARR, respectively, and 65–72x the midpoint of FY2027 reported FCF guidance. The late-June dislocation has disappeared: the shares rose 48.0% from $72.33 and closed at a new high before the post-close earnings release. A provisional $98.17 after-hours quote lowered, but did not eliminate, the valuation premium.

Earnings quality remains the main counterweight. First-half SBC fell as a percentage of revenue to 21.4% from 27.5%, a real improvement, but it still exceeded reported first-half FCF by $35.1 million. Q2 SBC was 23.6% of revenue and the diluted share count used in guidance is roughly 11% above Q2 basic weighted shares. The company is producing cash, but it has not yet demonstrated positive cash earnings after treating equity compensation as a recurring owner cost.

Competitive quality is better than the “backup vendor” label suggests but weaker than management’s broadest platform language. Rubrik owns valuable demand-side switching costs: immutable recovery infrastructure is difficult to replace, net retention remains above 119%, and large customers continue to expand. It does not yet show a classic scale-cost advantage or an external network effect, and its frontier products face well-capitalized bundlers. Agent Cloud and Agent Identity extend the architecture logically, but Q2 did not provide product-level ARR.

Governance remains a structural weakness. Class B shares carry 20 votes each; current directors and executive officers held 46.2% of total voting power at the proxy record date, including 25.2% for founder/Chair/CEO Bipul Sinha and 19.7% for the CTO. Incentives lack a returns-based metric, and the company has both a $1.75 billion gross liquidity pool and an appetite for organic and inorganic expansion. The balance of evidence is a stronger, fast-growing franchise whose present valuation requires durable growth, margin expansion, and dilution control together. The institutional body below takes no position; the opinion above is confined to Claude’s Take.

2. Business Overview

Rubrik, Inc. (NYSE: RBRK) is a cyber-resilience and data-security software company that sells a cloud-native subscription platform built to protect, govern, and—critically—recover enterprise data, identities, and increasingly AI agents after a cyberattack. Founded in 2013, headquartered in Palo Alto, and public since April 2024, Rubrik operates on a January 31 fiscal year. The most recent reported period is Q2 FY2027, ended July 31, 2026 and filed August 27. Management now brands the company “the Security and AI Operations company,” a deliberate repositioning from backup toward cyber resilience plus agentic-AI operations.

What it sells. Rubrik’s product surface is organized into two solution suites:

1. Rubrik Security Cloud (RSC) — the core, ~95%+ of ARR. A cloud-native SaaS platform that takes air-gapped, immutable, access-controlled backups of enterprise data and layers security analytics and recovery automation on top. RSC’s commercial products span (FY26 10-K): Data Protection — Enterprise Data Protection (physical/VM/database/container), Unstructured Data Protection (petabyte-scale NAS), Cloud Data Protection (Azure/AWS/GCP/Oracle), and SaaS Data Protection (M365, Salesforce, Atlassian Jira); Data Security / Threat Analytics — Data Security Posture Management (DSPM, from the 2023 Laminar acquisition), Sensitive Data Monitoring, anomaly/ransomware detection, and cyber-recovery orchestration; and Identity Resilience — backup and rapid recovery of Active Directory / Entra ID, an offering management calls one of its fastest-growing, now >$50M ARR and growing ~38% sequentially Q4→Q1 (Q1-FY27 call). The unifying pitch is that legacy backup tools were built for operational/natural-disaster recovery, while traditional security tools try to prevent breaches; Rubrik claims to own the post-breach recovery layer that does both (FY26 10-K, “Our Competition”).

2. Rubrik Agent Cloud (RAC) — newly available and not yet financially material. A governance and recovery layer for enterprise AI agents, it is underpinned by the May 2025 Predibase acquisition. Agent Rewind lets customers audit and roll back actions taken by autonomous agents. August’s Agent Identity announcement extends the design toward per-tool-call visibility, agent identity, runtime controls, and recovery for agents and Model Context Protocol servers. On the Q2 call, management said RAC had more than 15 paying customers but would contribute minimal FY2027 ARR; Strata contributed no Q2 ARR and none to guidance. INTERPRETATION: early paid adoption is evidence of product-market testing, not yet commercial scale.

How it makes money — the model. Revenue is overwhelmingly subscription SaaS, sold via a land-and-expand motion through resellers, distributors, systems integrators, and cloud marketplaces. Customers land on one protection use case and expand into adjacent workloads and security or identity products. Although Rubrik-branded appliances are manufactured by Supermicro, the strategic and reported business is the cloud subscription. Cloud ARR reached $1.48 billion, up 39% and equal to 89% of subscription ARR, confirming that the legacy migration is near its tail. Management now discloses adjusted net-new Cloud ARR excluding migrations; that measure grew 20% in Q2 versus 33% headline subscription-ARR growth. Q2 material-rights revenue was $4.7 million versus $14.2 million a year earlier, so management’s normalized revenue growth was 43% versus 38% reported growth.

The KPIs that matter. Because GAAP revenue lags the business (deferred-revenue/SaaS ratable recognition), ARR and net-new ARR are the truer pulse:

• Subscription ARR = $1.661 billion, +33% year over year; FY2026 year-end subscription ARR was $1.46 billion, +34%.
• Net-new subscription ARR growth = 35%; the filed Q2 release did not disclose the dollar amount.
• Adjusted net-new Cloud ARR growth = 20% excluding migrations, the cleaner organic indicator as the cloud transition matures.
• Subscription dollar-based net retention exceeded 119% in Q2, according to management on the earnings call; the filed release did not include the metric. It exceeded 120% in FY2025 and FY2026.
• Customers with at least $100,000 of subscription ARR = 3,084, +23%, evidence that the installed base continues moving up-market.

Financial shape (for context; detailed later). FY2026 revenue was $1.316 billion, +48%, GAAP gross margin reached 80.1%, and reported FCF was $237.8 million. In the first half of FY2027, revenue grew 38% to $814.3 million, operating loss narrowed to $124.5 million, and reported FCF reached $139.3 million. The crux of earnings quality is stock compensation: first-half SBC was $174.4 million, or 21.4% of revenue, and FY2027 non-GAAP guidance assumes roughly 228 million diluted shares. End customers are diversified, while channel concentration is material.

Verdict (Business Overview): Rubrik is a high-growth, 89%-cloud subscription software business with strong retention evidence, roughly 80% GAAP gross margins, positive reported FCF, and a diversified enterprise base. Those are high-quality SaaS attributes. The caveats are that stock compensation still exceeds reported FCF, diluted shares materially exceed basic shares, and the AI-operations leg is not yet financially material. The core franchise is real; the remaining question is whether its competitive advantages can sustain the growth and justify the expectations embedded in the stock.

3. Industry Dynamics

The market. Rubrik sits at the convergence of two formerly separate IT pools: data protection / backup-and-recovery (a mature, decades-old infrastructure market) and cybersecurity (a high-growth, secularly expanding market). Its thesis — and the reason it can plausibly grow ~30%+ while legacy backup vendors stall — is that ransomware and AI-enabled attacks have turned backup from a passive insurance line item into an active security control: the last line of defense and the mechanism of recovery. Management frames cyber resilience as non-discretionary spending — when (not if) an enterprise is breached, the ability to restore clean, immutable data and identities is existential (FY26 10-K, risk factors; Q1-FY27 call). INTERPRETATION: this “non-discretionary” claim is the load-bearing beam of the entire bull case and the single most important thing to pressure-test through a down-cycle — it has not yet been tested in a genuine IT-budget recession, since Rubrik has only been public since 2024.

TAM and growth. The most defensible anchor is the roughly $13.3 billion CY2027 enterprise backup-and-recovery market cited from Gartner in Rubrik’s annual filing. Management’s Analyst Day expands the 2029 opportunity to more than $125 billion by combining data management, cyber resilience, identity, and AI. That larger figure mixes third-party estimates with bottom-up assumptions about seats, repositories, and pricing, so it is a management scenario rather than a serviceable market Rubrik can claim today. The proper structure is layered: core recovery is a large proven pool; identity and data-security adjacencies expand it product by product; Agent Cloud is unquantified option value until paid adoption is disclosed.

The competitive set — three concentric rings:

1. Legacy backup/data-management incumbents (the displacement opportunity). The 10-K names Commvault, Dell EMC, IBM, Veeam, and Cohesity as principal competitors (FY26 10-K, “Our Competition”). The structural backdrop here is favorable to Rubrik:

   • Veeam (private) has a large installed base and is investing in cloud and security capabilities; describing it as architecturally obsolete would overstate Rubrik’s advantage.
   • Cohesity combined with Veritas’s enterprise data-protection business in late 2024. Integration can distract sales and product teams, but the combined installed base, distribution, and portfolio also make it a stronger competitor. The event is two-sided, not an automatic Rubrik tailwind.
   • Commvault (public; pivoting to “cyber resilience” with its Metallic SaaS) is the most direct architectural competitor that has successfully repositioned, and Dell/IBM bundle backup into broader infrastructure relationships. FACT: these are real, scaled competitors with large installed bases.
   • Greenwald market-share read: the legacy backup segment shows clear instability — share is visibly migrating from appliance/perpetual-license incumbents toward cloud-native SaaS challengers (Rubrik, Cohesity, Commvault’s Metallic). Under Greenwald’s test, >5pt share swings over a few years signal weak barriers in the legacy pool — which is precisely why Rubrik can take share, but is also a warning that the pool is contestable in both directions.

2. Adjacent platform encroachment (the threat ring). Microsoft can bundle protection, identity, and security into M365, Entra, and Azure; CrowdStrike, Palo Alto Networks, and ServiceNow are competing for broader security and operations control planes. They are not disclosed as current like-for-like substitutes for Rubrik’s core recovery product, so the threat should not be overstated. It is more direct at the frontier—DSPM, identity, and agent governance—where customer budgets and product boundaries overlap. Rubrik’s defense is recovery depth and neutrality across clouds and SaaS; that is credible, not impregnable.

3. Specialist point vendors in DSPM, identity recovery, insider-threat, and data classification — fragmented, sub-scale, and frequently acquisition targets (Rubrik itself bought Laminar for DSPM).

Capital-cycle position (Marathon lens). Attractive cybersecurity economics and abundant venture funding have attracted both specialists and platforms. Consolidation has reduced the count of independent legacy vendors, but it has also created better-capitalized combinations. Rubrik is earlier in its growth curve than many public security peers, yet it operates in the same pool of talent, cloud infrastructure, channel capacity, and enterprise budget. The supply-side conclusion is mixed: regulated recovery demand is expanding, but capital and product supply are expanding with it. Sustained returns require company-specific captivity, not TAM growth alone.

Regulatory/structural tailwinds. Ransomware disclosure rules (SEC cyber-incident 8-K rules, effective Dec-2023), DORA in the EU (operational-resilience mandates for financial institutions), and rising cyber-insurance underwriting requirements all push enterprises toward demonstrable, tested recovery capability — structurally supportive of the “non-discretionary” framing. FACT that these mandates exist; INTERPRETATION that they translate dollar-for-dollar into Rubrik revenue.

Verdict (Industry Dynamics): Structurally favorable demand, crowded supply. Ransomware, recovery testing, and resilience rules support the category, but regulation does not make Rubrik specifically non-discretionary. The legacy pool is contestable, consolidation is two-sided, and well-capitalized platforms are entering the same adjacencies. The market can support durable growth; it does not by itself prove durable excess returns.

4. Competitive Position

Does Rubrik have a real moat, or is it a fast-running executor in a contestable market? The honest answer is: a narrow, real, but unproven switching-cost moat in its core recovery franchise, plus a nascent and as-yet-unearned platform/cross-sell effect — not (yet) the durable, scale-based fortress the bull narrative implies. Name the mechanism precisely.

The moat type (Greenwald taxonomy): demand-side customer captivity via switching costs. Once Rubrik becomes the recovery-of-record for an enterprise’s critical data and identities, the switching cost is high and rises with adoption:

• Operational embedding. Backup/recovery policies, immutability/air-gap configurations, RBAC, retention schedules, and recovery runbooks are wired into the customer’s compliance and incident-response processes. Ripping out the recovery system is a multi-quarter project with existential downside if it goes wrong (a failed recovery during a ransomware event is catastrophic) — the textbook Greenwald switching-cost combination of retraining cost + error risk.
• Data gravity and breadth. As a customer extends Rubrik across more workloads (VMs, databases, M365, Salesforce, NAS, cloud, and Active Directory/Entra), the platform becomes the single immutable system-of-record for recoverable state. The deeper the footprint, the higher the rip-out cost — the same multi-pillar lock-in that shows up in Zscaler’s and Cloudflare’s retention.
• Identity as the deepening hook. Identity Resilience (>$50M ARR, +38% sequentially) is strategically the most important expansion lever: making Rubrik the recovery layer for Active Directory/Entra — the keys to the kingdom in a ransomware event — materially raises captivity beyond pure data backup.

The financial test of the moat. Rubrik passes the installed-base test on the latest available evidence: management disclosed Q2 dollar-based net retention above 119% on the call, after more than 120% in FY2025 and FY2026; more than 50% growth in $1 million-plus customers and 88% of ARR from customers above $100,000 were last disclosed in Q1; and GAAP gross margin remains near 80%. Q2 also delivered 35% net-new ARR growth and 23% growth in $100,000-plus customers. The filed release omitted NRR, so the call transcript—not the 8-K—is the source for the current figure.

Where the moat is thin — pressure-testing management’s claims:

1. It is NOT economies of scale. Management gestures at “complementary network effects” (more products → more value → more stickiness). INTERPRETATION: this is multi-product cross-sell, not a true network effect (one customer’s adoption does not directly increase another customer’s value, the way Cloudflare’s traffic-derived threat intelligence does). Calling it a “network effect” overstates it. And Rubrik decidedly does not yet have a scale-economies barrier: its installed base is smaller than Veeam’s and Dell’s, so it cannot claim the self-reinforcing share-leader cost advantage that Greenwald identifies as the strongest moat. It is the challenger taking share, not the entrenched scale incumbent defending it.

2. The frontier is contestable. Switching costs protect the installed base, but new-logo and adjacency growth (DSPM, AI governance, identity) is fought against giants — Microsoft (bundling), CrowdStrike, Palo Alto, ServiceNow — exactly the pattern the peer reports flag: a moat that is real where it is deep (core recovery) and thin where it is new (the second act). The “agentic cyber resilience”/Rubrik Agent Cloud positioning is, at this stage, narrative ahead of substance — there is no retention or revenue signature yet to test whether Agent Rewind creates durable captivity or is a feature giants will replicate. OPEN QUESTION.

3. The Greenwald market-share-stability test is failing in Rubrik’s favor — which cuts both ways. Share in the broader data-protection market is unstable (migrating from legacy appliance vendors to cloud-native SaaS). Under Greenwald’s logic, instability signals weak barriers. Rubrik is the beneficiary today (winning best-in-cohort net-new ARR), but the same low barriers that let Rubrik take share from Veeam/Dell could, in principle, let the next architecture or a bundling giant take share from Rubrik. The moat protects existing accounts well; it does not yet demonstrably protect the category position.

The acid test — would the moat deteriorate in a down-cycle? Unknown, and this is the crux. Rubrik IPO’d in April 2024 and has never operated as a public company through an IT-spending recession. The bull’s claim that cyber resilience is “non-discretionary” predicts NRR and gross retention would hold in a downturn (as Okta’s ~106% NRR held through a recession and two breaches — a genuine moat signature). The bear’s concern is that backup budgets have historically been cyclical, and that in a hard down-cycle enterprises defer the expansion (new pillars, identity, AI governance) that drives Rubrik’s ~120% NRR back toward ~100%. This is the single most important unverified element of the thesis. INTERPRETATION/OPEN QUESTION.

Competitive scorecard vs. named peers. Rubrik’s distinctive position is the convergence of immutable backup, active data security, and identity recovery in one cloud-native platform. Legacy vendors approach from data management, while security platforms approach the adjacencies from prevention and operations. Rubrik’s 33% ARR growth, 35% net-new ARR growth, and large-customer expansion demonstrate strong execution; they do not establish a permanent category lead. Execution is emulable. The durable element is the cost and risk of replacing a deeply embedded recovery system.

Verdict (Competitive Position): A real but narrow and unproven moat—demand-side customer captivity in core recovery, not economies of scale and not a true network effect. Retention above 119%, gross margin, and customer expansion support that conclusion, while Q2 did not refresh Identity ARR. The moat is thinner at the frontier: Agent Cloud has more than 15 paying customers but minimal expected FY2027 ARR and no disclosed retention. Rubrik is a contender building a moat, not an entrenched scale leader defending one.

5. Growth History and Forward Opportunities

Rubrik’s growth record is unusually strong for a company already above $1.5 billion of recurring revenue. Total revenue rose from $627.9 million in FY2024 to $886.5 million in FY2025 and $1.316 billion in FY2026, growth of 41% and 48%, respectively. Subscription revenue reached approximately $1.26 billion in FY2026, up 53%. The first half of FY2027 added $814.3 million of revenue, up 38%, including Q2 revenue of $427.3 million, also up 38%. Subscription revenue of $407.2 million grew 37% in Q2 and represented more than 95% of revenue.

The apparent slowing from FY2026 revenue growth requires an accounting normalization. Material-rights revenue associated with legacy CDM contracts fell to $4.7 million in Q2 from $14.2 million a year earlier. That decline mechanically reduced reported growth; management calculated 43% Q2 revenue growth excluding the artifact. It is legitimate to show both figures, but ARR is the cleaner demand gauge. Subscription ARR grew 34% at FY2026 year-end, 32% in Q1 FY2027, and 33% in Q2 to $1.661 billion. Net-new subscription ARR grew 35% in Q2, provisionally falsifying the prior bear test that growth would rapidly roll over as the base scaled.

The guide moved in the same direction. After Q1, management expected FY2027 subscription ARR of $1.854–$1.862 billion and revenue of $1.638–$1.648 billion. After Q2, those ranges rose to $1.880–$1.885 billion and $1.685–$1.693 billion. Midpoints increased by roughly $24.5 million for ARR and $46 million for revenue. The updated ARR midpoint implies approximately 29% year-over-year growth from FY2026 year-end—not indefinite 30%-plus growth, but stronger than the prior guide.

There are three layers to the forward growth algorithm.

1. Core recovery expansion. The company continues to add enterprise workloads and larger customers. The $100,000-plus cohort reached 3,084 in Q2, up 23%, after ending FY2026 at 2,805. This cohort represents most ARR and makes expansion measurable rather than anecdotal. Management said Q2 NRR remained above 119%, following more than 120% in FY2025 and FY2026. The small moderation matters, but it still indicates healthy expansion.
2. Cloud migration and workload breadth. Cloud ARR reached $1.48 billion, 89% of subscription ARR, and grew 39%. The migration itself creates a tailwind that should fade, which is why adjusted net-new Cloud ARR matters. Excluding migrations, that measure grew 20% in Q2. The series disclosed at Analyst Day—$82 million, $72 million, $94 million, $110 million, and $99 million from Q1 FY2026 through Q1 FY2027—grew 20–30% year over year. Q2’s 20% growth is healthy, but it is a more sober organic signal than headline ARR.
3. New products and geographies. Identity Resilience exceeded $50 million of ARR in Q1, but Q2 did not update it. Agent Cloud now includes Rewind, Agent Identity, and integrations with developer and cloud-agent ecosystems. More than 15 customers were paying for RAC at Q2, although management expects only minimal FY2027 ARR; Strata contributed zero Q2 and guided ARR. International expansion is tangible: 32% of ARR was outside the United States at Analyst Day, Rubrik reported more than 2,000 EMEA customers, and it announced a £375 million five-year UK investment. Those facts support distribution capacity, not a revenue forecast by themselves.

The Analyst Day growth case is ambitious. Management combined data management, cyber resilience, identity, and AI into a 2029 TAM above $125 billion and showed examples of customers expanding across products and workloads. The Flex model—one multi-year commitment that can be applied across Rubrik products—can accelerate cross-sell and deepen contractual captivity. It can also obscure which products generate incremental demand, so product-level disclosure becomes more important as the platform broadens. A disclosed example of a customer expanding from roughly $300,000 to $10 million of ARR demonstrates the upper bound of land-and-expand, not the average outcome.

The disconfirming evidence deserves equal weight. Customer-count growth of 23% is below ARR growth, implying strong mix and expansion but also a decelerating logo count as the base grows. Adjusted net-new Cloud ARR growth at 20% sits below the 33% headline ARR rate. The filed release omitted NRR, while the call supplied an above-119% figure; Identity ARR was not updated. Agent products remain financially immaterial. These do not negate growth; they identify which components are proven and which remain narrative.

Verdict—high-quality growth with a stronger near-term trajectory and an unproved second act. Q2 strengthened the core thesis: ARR accelerated by one point, net-new ARR grew 35%, large-customer count grew 23%, NRR stayed above 119%, and guidance rose. The rapid-deceleration bear test is provisionally falsified. The durability test is not: adjusted net-new Cloud ARR growth is 20%, the business lacks recession evidence, and the AI layer is immaterial. Core recovery and identity expansion carry the forecast; Agent Cloud remains option value.

6. Financial Quality

Rubrik is a case where GAAP profit, management-adjusted profit, and cash flow tell different but complementary stories. The underlying model is improving quickly; the remaining dispute is who pays for that improvement. Stock compensation is not a non-cash irrelevance when it produces recurring dilution, and prepaid subscriptions are not recurring earnings when working-capital timing changes.

The FY2025 comparison is distorted by $913.9 million of SBC recognized when IPO-triggered restricted stock units became eligible to vest. FY2026’s $329.4 million is a better recurring baseline, and the first-half decline in SBC intensity to 21.4% from 27.5% a year earlier is genuine progress. It is not yet the long-term outcome management presented at Analyst Day. Q2 SBC of $101.0 million increased to 23.6% of revenue from 19.0% in Q1. A single quarter can reflect grant and vesting timing, but the burden remains too large to treat adjusted EPS as owner earnings.

GAAP losses continue to narrow. First-half revenue grew 38% while operating loss fell to $124.5 million from $187.6 million and net loss fell to $103.6 million from $198.0 million. Q2 GAAP EPS improved to negative $0.30 from negative $0.49. Management-adjusted diluted EPS reached $0.20 versus negative $0.03 and exceeded the $0.03–$0.05 guide. Full-year non-GAAP EPS guidance rose to $0.47–$0.53 from $0.25–$0.35. That bridge shows operating leverage, but it also excludes the largest recurring expense.

The cash-flow progress is substantial. FY2026 operating cash flow was $282.9 million and reported FCF was $237.8 million, up from $48.2 million and $21.6 million in FY2025. First-half FY2027 operating cash flow reached $158.5 million. After $9.9 million of property and equipment purchases and $9.4 million of capitalized internal-use software, first-half FCF was $139.3 million. Q2 contributed $65.7 million, a 15% margin. Management raised full-year FCF guidance from $293–$303 million to $323–$333 million, a $30 million midpoint increase and an implied 19.4% margin on revenue guidance.

The strict FCF-minus-SBC calculation is a sensitivity, not a GAAP measure. It asks what cash would remain if equity compensation were treated as a current cash-equivalent owner cost. On that basis, first-half FCF was negative $35.1 million and Q2 was negative $35.3 million. The calculation is intentionally conservative because grant-date SBC expense does not equal current-period dilution dollar for dollar. It is still useful: a company cannot claim mature owner economics while issuing equity worth more than its reported free cash flow.

Working capital provides a more nuanced signal than a simple prepaid-revenue explanation. Current deferred revenue reached $1.180 billion and noncurrent deferred revenue $750.2 million at July 31. Customer prepayments structurally support operating cash flow, but the first-half increase in deferred revenue was $84.5 million versus $165.9 million a year earlier. The FCF improvement therefore did not result from a larger incremental deferred-revenue inflow. Billing timing and renewals still create quarter-to-quarter noise, yet underlying expense leverage is doing more of the work than it did a year ago.

Gross margin confirms software economics but did not expand in Q2. GAAP gross margin was 78.4% versus 79.5% a year earlier; non-GAAP was 81.0% versus 81.6%. These remain strong levels, although hosting mix, product investment, and stock compensation can move them. Subscription-ARR contribution margin improved to 14.0% from 9.4%, and the full-year guide rose to approximately 15.5% from approximately 14%. Management’s long-term model targets 77–82% non-GAAP gross margin, 20%-plus non-GAAP operating margin, and 25%-plus FCF margin. Gross margin is already in range; operating and owner-cash margins are not.

The share count is part of financial quality, not a footnote. Q2 basic weighted-average shares were 206.1 million, 5.7% above 194.9 million a year earlier. Non-GAAP diluted shares were 226.8 million after including dilutive awards and the convert’s if-converted effect. FY2027 guidance assumes approximately 228 million diluted shares, and Q3 guidance assumes 230 million. Capped calls economically reduce dilution from the convertible notes above specified prices, but they do not erase employee-equity dilution or change the accounting share count. Per-share analysis must show both bases.

The balance sheet is liquid but should be stated net. Cash of $416.2 million plus $1.331 billion of short-term investments totaled $1.748 billion. Convertible debt carried at $1.133 billion leaves approximately $615 million of net cash before other liabilities. Deferred revenue is an operating liability, not financial debt, but it represents a performance obligation. Total liabilities were $3.346 billion and shareholder deficit was $499.4 million, reflecting $3.290 billion of accumulated losses. Conventional ROIC and ROE remain unhelpful because GAAP operating profit is negative and book equity is distorted by cumulative losses and equity compensation.

Cloud infrastructure is the largest quasi-fixed operating commitment. Rubrik amended a hosting agreement in June 2025, increasing the minimum commitment to $595 million through April 2029; $290.4 million remained at January 31, 2026. The commitment can improve unit cost if usage scales as expected and pressure gross margin if growth or workload mix disappoints. It belongs in margin and liquidity analysis, not financial debt.

Two additional cash items matter. Rubrik spent $24.2 million on acquisitions in the first half, consistent with bolt-on rather than transformational M&A. It also used $53.3 million for tax withholding and net-share settlement related to equity awards. That is a real cash cost of managing compensation dilution, not a repurchase designed to return capital.

On reported numbers, Rubrik meets the Rule of 40 comfortably: 33% ARR growth plus roughly 19% guided FCF margin exceeds 50. On a fully loaded owner basis, the result is much weaker because SBC absorbs the cash. Both readings are true. The first describes a high-growth SaaS model with excellent working-capital and margin characteristics; the second describes the economic cost to outside shareholders.

Verdict—economics are improving, but owner cash generation remains unproven. Q2 delivered real operating leverage, a raised contribution-margin guide, and higher FCF without a larger deferred-revenue tailwind. SBC intensity improved year over year but rose sequentially, basic shares grew 5.7%, and FCF remained below SBC. The quality-of-earnings question is no longer whether cash conversion exists; it is whether per-share cash growth can outrun dilution.

7. Capital Allocation

Rubrik is reinvesting rather than returning capital. It pays no dividend and has no economic share-repurchase program. The $53.3 million first-half cash outflow for tax withholding and net-share settlement was associated with employee awards; it reduced gross issuance but was not a discretionary return of capital. Given negative GAAP earnings and negative FCF after SBC, reinvestment is appropriate. The relevant questions are the cost of financing, acquisition discipline, and whether equity awards generate per-share returns.

Convertible financing. In June 2025 Rubrik issued $1.15 billion of 0% convertible senior notes due 2030 and purchased capped calls. Calling the financing “free” would be inaccurate. The notes carry no coupon, but issuance costs and the capped-call premium imply an estimated all-in annual cost near 2%. The initial conversion price is approximately $124.76, representing about 9.218 million shares if converted. Capped calls provide economic dilution protection only through approximately $175.10. Below the conversion price, the notes behave like debt; above the cap, dilution resumes. They are cheap, flexible capital—not costless or dilution-proof capital.

The financing leaves Rubrik with approximately $615 million of net cash on a carrying-value basis, or about $598 million against note face value. This provides resilience and acquisition capacity. It also creates a 2030 claim large enough to matter if the stock is below the conversion price and FCF has not scaled. The refinancing risk is remote, not nonexistent.

Acquisitions. Laminar added data-security posture management; Predibase added model fine-tuning and inference capabilities that underpin the agent strategy. Cash-flow-statement acquisition outlays materially understate total economic consideration. Disclosed consideration across known transactions exceeds $251 million, plus at least $64.2 million of retention awards. The deals remain small relative to enterprise value and strategically adjacent, but they are not de minimis. Retention awards also blur the boundary between purchase price and ongoing compensation.

H1 FY2027 acquisition cash outlays were $24.2 million. No evidence yet shows a value-destructive transformational deal. The balance sheet, premium equity currency, and stated appetite for organic and inorganic opportunities nevertheless create capacity for one. Future diligence should require purchase price, acquired ARR, retention, integration costs, and a return threshold—not accept a strategic narrative alone.

Organic investment. The announced £375 million UK commitment over five years averages roughly £75 million annually and supports hiring, customer operations, a London EMEA headquarters, and market expansion. It is an investment plan rather than a disclosed capex schedule. At roughly 6% of FY2027 revenue annually in dollar-equivalent terms, it is large enough to monitor through headcount, sales efficiency, international ARR, and regional contribution margin. International expansion can extend the growth runway; it can also slow margin conversion if hiring precedes demand.

Dilution. Basic weighted shares grew 5.7% year over year in Q2. Current non-GAAP diluted shares of 226.8 million were roughly 10% above basic shares, and full-year guidance assumes 228 million. Management’s Analyst Day aspiration is low-single-digit dilution. The present rate is higher. Capped calls address note conversion within a price range; they do not offset RSUs. The correct performance measure is fully diluted FCF per share after a normalized SBC charge, not aggregate FCF.

Incentives and governance. Rubrik has a dual-class structure. Class B shares carry 20 votes each. Current directors and executive officers held 46.2% of total voting power at the proxy record date; Sinha held 25.2% and CTO Arvind Nithrakashyap 19.7%. The board added Rakefet Russak-Aminoach as a ninth director in August, increasing financial and technology experience without changing the concentration of insider influence.

The proxy emphasizes new and expanded annual contract value in annual incentives and service-vesting RSUs in long-term pay. It does not use FCF, GAAP profitability, ROIC, or another capital-return metric as a core incentive. A stock-price-hurdle award aligns with market value only imperfectly because beta and multiple expansion can deliver it without better owner economics. The incentive design fits a growth company; it underweights the exact transition outside owners need—growth converted into per-share cash.

Insider activity. The refreshed Form 4 corpus shows recent named-executive sales were predominantly under prearranged Rule 10b5-1 plans. No named executive made an open-market purchase in the reviewed period; independent director Mark McLaughlin bought 10,638 shares at $47.21 in March, the sole open-market purchase found. Planned sales are not evidence that executives expect deterioration; they are still supply. The earlier report’s inference based only on filing counts is replaced here by transaction-level evidence.

Verdict—adequate strategic allocation, weak per-share alignment. The convert was attractively priced but has a real cost and bounded dilution protection. Acquisitions are strategically coherent but economically larger than cash-flow outlays suggest. Organic international investment can create value but needs efficiency disclosure. The central weakness is structural: service-vesting equity, basic dilution near 6%, no return-based compensation metric, and founder voting control. Management has funded growth effectively; it has not yet demonstrated that capital allocation compounds value per diluted share.

Four-sentence verdict summary: Growth strengthened: subscription ARR rose 33%, net-new ARR 35%, NRR stayed above 119%, and FY2027 guidance increased. Financial quality improved through contribution margin and FCF, but TTM reported FCF of $286.2 million remained below TTM SBC of $341.8 million, leaving a negative $55.5 million strict owner-cash cross-check. Capital allocation is strategically coherent but not costless: known acquisition consideration exceeds cash outlays, the convert costs roughly 2% all-in with capped protection, and the UK plan is substantial. Governance remains the largest structural discount: founder control, service-vesting equity, roughly 6% basic-share growth, and no FCF or returns metric.

8. Changes and Headwinds — Last Two Years

Rubrik’s two-year window covers nearly its entire public history. The most important changes are not cosmetic product launches; they are the shift to a nearly all-cloud recurring model, the turn to positive reported FCF, the construction of an AI and identity adjacency, and a valuation round trip that ended at a new closing high.

April 2024—IPO and accounting reset. Rubrik priced its IPO at $32 and became a controlled public company. The liquidity event triggered recognition of $913.9 million of IPO-contingent RSU expense in FY2025, producing a GAAP loss that is not a recurring run-rate comparison. It also began the post-IPO conversion of private-company ownership into a more liquid Class A float while preserving super-voting control.

FY2025–FY2026—cloud and cash conversion. Subscription revenue accelerated, Cloud ARR became 89% of subscription ARR, GAAP gross margin moved from 70% to about 80%, and reported FCF rose from $21.6 million to $237.8 million. Material-rights revenue has continued shrinking as legacy CDM contracts transition. Q2 FY2027’s $4.7 million material-rights contribution, down from $14.2 million, makes reported growth harder rather than easier and leaves a cleaner model.

2025—capital and platform construction. The $1.15 billion convertible financing expanded liquidity and added a 2030 obligation. Predibase supplied model infrastructure for the Agent Cloud strategy; Laminar’s earlier DSPM acquisition broadened data security. The economic consideration for acquisitions exceeds the cash-flow-statement outlay because stock and retention awards are material. Management is building adjacencies rather than buying reported ARR at scale, but disclosure needs to keep pace with the narrative.

2026—Identity and Agent Cloud. Identity Resilience exceeded $50 million of ARR in Q1 and had grown 38% sequentially, but Q2 provided no fresh figure. Agent Rewind, Rubrik AI, developer integrations, and Agent Identity broadened the product architecture. The Q2 call supplied the first limited commercial marker: more than 15 paying RAC customers, with minimal expected FY2027 ARR. Strata contributed no Q2 ARR and none to guidance. The gap between product breadth and financial materiality remains large.

June 2026—Analyst Day. Management introduced a $125 billion-plus 2029 TAM, the Flex commercial model, and long-term targets of 20%-plus non-GAAP operating margin, 25%-plus FCF margin, and low-single-digit dilution. The TAM combines independent and bottom-up assumptions and should not be treated as a current serviceable market. The long-term model is more decision-useful because it is falsifiable. Gross margin is already in range; operating margin, owner FCF, and dilution are not.

July–August 2026—international and board expansion. Rubrik announced a £375 million five-year UK investment and made London its EMEA headquarters. It also appointed Rakefet Russak-Aminoach as a ninth director. These actions expand capacity and governance experience. They do not by themselves demonstrate a return on invested capital.

August 2026—Q2 beat and second guidance raise. Subscription ARR reached $1.661 billion, net-new ARR grew 35%, revenue exceeded the prior $395–$397 million guide by more than $30 million, contribution margin reached 14%, and non-GAAP EPS was $0.20. Management raised ARR, revenue, contribution-margin, EPS, and FCF outlooks. The new guide is the clearest favorable change since the June report.

The stock and expectations reset twice. RBRK moved from a $32 IPO to $99.74 in June 2025, fell to $43.81 in April 2026, and closed at a new $107.02 high on August 27. The close occurred before the Q2 release and followed an 11.3% broad cyber-led session; it must not be labeled the earnings response. The first after-hours indication was $98.17, down 8.3% from the close. That provisional reaction, despite a strong print, is consistent with a buy-side bar that had risen alongside the 48% two-month rally.

Headwinds that became clearer. Adjusted net-new Cloud ARR grew 20%, SBC rose sequentially to 23.6% of revenue, channel partners remain concentrated, and the gap between basic and diluted shares is large. NRR above 119% remains strong but has moderated slightly. The AI portfolio has paying customers but not material revenue. These are normal scaling frictions, yet they matter much more at a premium capitalization.

Verdict—the business strengthened and the margin for error narrowed. Since June, Q2 provisionally falsified rapid ARR deceleration and confirmed better operating leverage. The same period removed the de-rating thesis, because the regular close moved from $72.33 to $107.02. This is not a reversal on business quality. It is a change in the relationship between quality and expectations.

9. Risk Analysis

Rubrik’s risk profile divides into high equity-duration risk and moderate operating risk. Liquidity is ample and there is no near-term refinancing wall. The more likely loss mechanism is a multiple reset while the business continues growing, amplified by dilution and high market beta. The matrix grades likelihood and impact as low, medium, or high.

Valuation risk is immediate. The stock’s factor profile—market loading 1.705, cybersecurity loading 1.432, Low Volatility loading −1.306, and lifetime maximum drawdown of 56%—means a small change in discount rates or growth expectations can dominate quarterly fundamental progress. The 48% rise between reports illustrates the same convexity in the favorable direction. A positive operating result does not prevent a negative stock reaction when expectations rise faster.

Growth risk is about composition, not current weakness. Headline ARR, net-new ARR, customer count, and guidance improved. The caution is that adjusted net-new Cloud ARR grew 20%, NRR moderated to above 119%, and migrations still affect the headline. A transition from 30%-plus to low-20s growth would not signal a broken product; it would change the multiple category.

Channel concentration is more material than customer concentration. End customers are diversified, but two partners accounted for 59% of FY2026 revenue in aggregate. Rubrik relies on resellers, distributors, integrators, and cloud marketplaces for reach. Contractual concentration does not necessarily equal economic dependence because partners may aggregate many unrelated customers, yet disrupted terms, incentives, or execution at a large partner could affect billings and collections.

Catastrophic-loss assessment. Total loss is unlikely given $1.75 billion of cash and short-term investments, approximately $615 million of net cash, positive reported FCF, and no debt maturity before 2030. Severe equity loss is plausible without insolvency: growth can moderate, owner FCF can remain negative, and the multiple can compress simultaneously. A breach of Rubrik itself is the clearest event capable of turning valuation damage into franchise impairment.

Verdict. Business risk is moderate and concentrated in retention through a recession, frontier-product competition, and channel execution. Equity risk is high because the share price capitalizes several favorable outcomes and the factor profile amplifies changes in expectations. Dilution links the two: even if ARR and reported FCF grow, per-share value can lag unless SBC falls.

10. Valuation Discussion (Embedded Expectations)

Current capitalization. The official $107.02 close preceded the Q2 release. Using 206.1 million Q2 basic weighted shares produces equity value of approximately $22.06 billion. Subtracting $614.8 million of net cash produces basic enterprise value of approximately $21.44 billion. Using 226.8 million non-GAAP diluted shares produces equity value of $24.28 billion and diluted enterprise value of $23.66 billion. The two share bases are not interchangeable.

The provisional $98.17 after-hours quote lowers basic and diluted EV to approximately $19.62 billion and $21.65 billion. That equates to 11.8x and 13.0x ARR and 59.8x and 66.0x guided reported FCF. The after-hours figure is included as a timing disclosure, not as a completed market verdict; thin liquidity and subsequent trading can change it.

The historical comparison reversed. At roughly 9x ARR in late June, the shares could be described as de-rated within cyber. That is no longer true. ROIC’s historical series showed EV/sales of 17.0x in July 2025, 12.2x in October, 8.2x in January 2026, and 7.3x in April. Those observations are useful history but stale for August because the data source also omitted short-term investments from cash in some periods. The current EV above is rebuilt from the filing. AZI’s current valuation-percentile endpoint was unavailable because the required token was not configured; the June 41st-percentile statistic is both stale after a 48% rally and weak because Rubrik has only about two years of public history. It is excluded.

ARR-multiple sensitivity. This table is not a set of share-price targets. It shows enterprise values associated with different current-ARR multiples so the embedded category assumption is explicit.

At the close, the basic capitalization sat near the 13x row and the diluted capitalization between 14x and 15x. The first after-hours quote moved the two conventions to roughly 12x and 13x. In either case, Rubrik has migrated from the middle of the software-growth spectrum toward the premium end. A simple EV/sales-to-growth ratio is no longer unusually low: 12.7x guided sales divided by 33% ARR growth is approximately 0.38 on the basic basis, before adjusting for SBC; the diluted result is higher.

Reverse-DCF framing. A stylized model starts with the $1.689 billion FY2027 revenue midpoint, a 10% discount rate, 3% terminal growth, and reported FCF margin rising from approximately 19% to 30% over seven years. Under those assumptions, the basic close EV requires roughly 23% annual revenue growth for seven years; the diluted EV requires roughly 25%. That is not a forecast. It is the growth path that makes the current enterprise values mathematically coherent under generous mature-margin assumptions.

The model is more demanding than it first appears for three reasons. First, revenue growth normally decelerates as a software company scales; Rubrik would need to remain above 20% for much of the horizon. Second, a 30% terminal FCF margin exceeds management’s stated 25%-plus long-term floor and requires sustained expense leverage. Third, the model uses reported FCF. If SBC remains near 20% of revenue, owner FCF will not approach reported FCF and the current EV requires either higher growth, a higher terminal margin, or a lower required return. If SBC falls toward the low teens while dilution becomes low-single-digit, the assumptions become more credible.

What the capitalization gets right. It recognizes that Q2 was not a low-quality beat. ARR and net-new ARR accelerated, NRR remained above 119%, revenue normalized for material rights grew 43%, contribution margin improved, and all major full-year guides rose. It also recognizes a structurally attractive recovery category, strong gross margins, and real cross-sell. Treating Rubrik like a slow-growth backup incumbent would ignore the evidence.

What may be overcapitalized. The close effectively gives credit for successful execution before the frontier products are material. Agent Cloud has more than 15 paying customers but minimal FY2027 ARR; Strata contributes none to guidance; Identity ARR was not updated; adjusted net-new Cloud ARR grew 20%; and H1 FCF remained below SBC. A 13–14x ARR capitalization asks core recovery to maintain premium growth while identity, AI, margins, and dilution all improve. It leaves little room for only one or two of those outcomes.

Scenario logic. In a slower-growth case, ARR growth falls into the high teens or low 20s, NRR approaches 110%, SBC remains above 20% of revenue, and the company is valued like a mature growth-software vendor. In a durable-core case, ARR remains in the mid-20s, NRR stays in the high teens, contribution margin advances, and diluted FCF per share turns positive after SBC. In an elite-platform case, growth remains near 30%, Agent Cloud and Identity become disclosed material lines, FCF margin reaches the high 20s, and dilution falls to low-single-digit. The current close lies closer to the durable-to-elite boundary than to the mature case.

Verdict—an expectations-rich valuation after a fundamental upgrade and a 48% rerating. Rubrik’s business earned a higher fundamental assessment, but the close also moved the multiple from roughly 9x ARR to 12.9x basic and 14.3x diluted. The embedded bar is not merely continued growth; it is multi-year growth above 20%, a high-20s or better reported FCF margin, and substantial SBC normalization. The valuation discussion contains no recommendation or share-price target; the required subjective entry judgment appears only in Claude’s Take.

11. Variant Perception

The consensus view. The dominant narrative is that Rubrik is the best-growing public cyber-recovery platform: ransomware makes tested recovery more important, the installed base expands across workloads, and an 80%-plus gross-margin model is beginning to convert ARR into cash. Analyst Day added a larger platform story around identity and agents. Q2 validated the operating part of that narrative with 33% ARR growth, 35% net-new growth, NRR above 119%, and a broad guidance increase.

What changed is the valuation and expectations context. The shares rose 48% between reports and closed at a new high before Q2 was published. The provisional negative after-hours response to a genuine beat suggests the buy-side bar had moved above the published guide. That is not evidence that the business weakened; it is evidence that “beat and raise” was at least partly anticipated.

Strongest bull case. Rubrik has defined a valuable recovery-of-record layer across data and identity, with switching costs that rise as policies, workloads, and incident-response processes accumulate. ARR growth accelerated despite a larger base, net-new ARR grew faster than ARR, and the $100,000-plus customer cohort grew 23%. The FY2027 ARR midpoint now implies roughly 29% growth, contribution-margin guidance is 15.5%, and reported FCF guidance is $323–$333 million. If NRR stays near 120%, Identity continues scaling, and Agent Cloud becomes a real paid layer, the company can grow into a premium capitalization while expanding margins. The bear’s rapid-deceleration test failed this quarter.

The bull also argues that reported FCF understates future operating leverage. Gross margin is already near management’s long-term range, while sales and R&D ratios can fall as the installed base and channel scale. SBC/revenue fell year over year in the first half. A business that sustains mid-to-high-20s growth and reaches a 25%-plus FCF margin would generate materially more cash on a much larger revenue base.

Strongest bear case. Rubrik remains a narrow-moat recovery vendor capitalized like an emerging platform. The strict organic Cloud signal grew 20%, below headline ARR; NRR moderated from more than 120% to more than 119%; Identity ARR was not updated; Agent Cloud has only more than 15 paying customers and minimal expected FY2027 ARR; Strata contributes none. The market is underwriting the second act before management has disclosed its economics.

Cash quality compounds the issue. H1 reported FCF was $139.3 million against $174.4 million of SBC, basic shares rose 5.7%, and guided diluted shares materially exceed basic shares. Founder control and time-vesting RSUs weaken outside-owner alignment. If Rubrik becomes a healthy low-20s grower while SBC remains above 20% of revenue, the business can keep expanding as the equity multiple contracts.

Assumptions that separate the cases:

1. ARR durability. The durable-growth case requires mid-20s or better ARR growth for several years. A fall in net-new ARR growth below 20% or NRR below 115% would challenge it. Continued 30%-plus ARR and net-new growth would challenge the deceleration case.
2. Owner cash conversion. The durable case requires SBC/revenue to fall toward the low-to-mid teens while reported FCF margin approaches the high 20s. Two more years above 20% SBC with negative FCF-minus-SBC would support the skeptical case.
3. Frontier monetization. Identity and Agent Cloud must become disclosed, retained, material recurring-revenue lines. Paid-customer announcements without ARR, revenue, or retention do not satisfy the test.
4. Moat through a downturn. A severe IT-budget slowdown must leave gross retention and NRR resilient. Rubrik’s short public history cannot answer this today.
5. Per-share discipline. Low-single-digit annual dilution, as framed at Analyst Day, must replace the current gap between basic and diluted shares. Otherwise enterprise growth will not translate cleanly into per-share value.

Factor-positioning read. The tape is a high-beta recovery trade. Three-, six-, and twelve-month returns were 52.2%, 97.0%, and 25.7% through the close; the shares stood 26.2% above the 50-day EMA and 47.1% above the 200-day EMA. Market and cybersecurity loadings were 1.705 and 1.432, Low Volatility loading was −1.306, Momentum loading was −0.559, and model R-squared was 0.530. The negative statistical Momentum loading alongside strong recent raw returns reflects a sharp reversal from an earlier drawdown, not a low-risk trend. Broad cyber moves can dominate company-specific news over short windows, as the August 27 regular session demonstrated.

Verdict. The operating evidence moved toward the durable-growth case; the valuation evidence moved toward the expectations-risk case. The variant is no longer “good fundamentals hidden by a de-rated multiple.” It is “better fundamentals than skeptics expected, but a close that already requires years of premium execution.” The next decisive evidence is not another product launch. It is sustained adjusted net-new Cloud ARR, product-level monetization, and fully diluted FCF per share.

12. Fact vs. Interpretation Table

13. Open Questions

1. Cyclical durability of NRR. Does retention above 119% hold through a genuine IT-budget downturn, or does expansion defer and push NRR toward 100%? Rubrik’s public history cannot answer this.
2. SBC normalization. Can H1 SBC/revenue of 21.4% fall toward the low-to-mid teens while basic dilution reaches management’s low-single-digit objective?
3. Adjusted Cloud ARR. Does 20% adjusted net-new Cloud ARR growth reaccelerate as migrations fade, or is it the leading indicator of headline ARR deceleration?
4. Agent Cloud monetization. How quickly do more than 15 paying customers become a disclosed, retained ARR cohort? What are ACV, gross margin, and sales-cycle length?
5. Identity trajectory. Can the greater-than-$50 million identity business sustain growth and become a second material pillar? Q2 omitted an update.
6. Flex disclosure. Does the all-access commitment improve expansion and retention, or obscure product-level demand and allow shelfware?
7. Channel dependence. How much end-customer and contract diversity sits behind the two partners that represented 59% of FY2026 revenue?
8. UK investment returns. What portion of the £375 million plan is operating expense, capital expenditure, or committed spend, and what regional ARR or margin hurdle governs it?
9. Acquisition economics. What acquired ARR and retention justify more than $251 million of known consideration plus retention awards?
10. Convert outcome. If the notes remain out of the money near 2030, can Rubrik repay or refinance without compromising growth investment?

14. What Must Be True (Bull and Bear, with Falsification Tests)

For the BULL case to be right (Rubrik becomes a durable recovery and security platform):

1. ARR durability. Subscription ARR must compound at least 25% for several years, with NRR near 120% and adjusted net-new Cloud ARR above 20%.
   • Falsification test: net-new ARR growth falls below 20% or NRR falls below 115% for two quarters.
2. Owner cash conversion. SBC/revenue must fall toward 12–15%, annual basic dilution must reach low-single-digit, and reported FCF margin must move toward 25–30%.
   • Falsification test: TTM FCF remains below TTM SBC and basic shares keep growing more than 5% two years from now.
3. The frontier must monetize. Identity and Agent Cloud must become disclosed material ARR cohorts with retention comparable to the core.
   • Falsification test: Agent Cloud remains immaterial through FY2028 or product wins require economically dilutive bundling.
4. Investment must scale. The UK plan and acquisitions must add international and product ARR without reversing contribution-margin progress.
   • Falsification test: sales and R&D spending reaccelerate while adjusted Cloud ARR and international growth slow.

For the BEAR case to be right (a narrow-moat recovery vendor capitalized as a platform):

1. Headline growth must converge toward the organic signal. ARR growth falls from 33% toward adjusted Cloud’s 20% as migrations and easy cross-sell fade.
   • Falsification test: ARR and adjusted net-new Cloud ARR both remain above 25% through a larger base.
2. Profitability stays share-funded. SBC persists above 20% of revenue and diluted FCF per share fails to grow.
   • Falsification test: two consecutive years of falling SBC/revenue, low-single-digit dilution, and rising FCF less SBC.
3. The moat proves cyclical. A softer spending cycle pushes NRR toward 100–110% and delays expansion.
   • Falsification test: gross retention and NRR remain resilient through a measurable enterprise-spending downturn.
4. The frontier remains features, not businesses. Platform vendors bundle adjacent controls and Rubrik never discloses material Agent or Identity economics.
   • Falsification test: those products become independently measured, retained, high-growth ARR lines.

Q2 strengthened the bull’s ARR-durability evidence and provisionally falsified rapid deceleration. It did not resolve the owner-cash, recession, or frontier-monetization tests. The body takes no position between the cases.

APPENDIX A — Standard Diligence Questionnaire

Rubrik, Inc. (NYSE: RBRK). Supplemental to the research memo. As of August 27, 2026; official close $107.02, before the post-close Q2 FY2027 release. This appendix contains no recommendation or price target.

General

What thoughtful questions have other investors asked? The debate has four parts. First, can subscription ARR remain above 25% growth after reaching $1.66 billion, especially when adjusted net-new Cloud ARR grew 20%? Second, does reported FCF become owner cash once SBC and dilution are treated as costs? Third, are Identity and Agent Cloud separate businesses or features that improve core retention? Fourth, how much premium is justified before those outcomes are disclosed? Q2 strengthened near-term growth but left owner cash and frontier monetization unresolved.

Cyclicality & Earnings Nature

Are earnings at a cyclical high or low? Rubrik is not commodity-cyclical. It is early in a software margin curve: Q2 GAAP operating loss was $71.9 million, while non-GAAP EPS was positive $0.20. Reported FCF is positive, but FCF less SBC remains negative. Earnings are at an internal maturation point rather than an external cyclical high or low.

Driven by external environment or internal actions? Both. Ransomware, resilience regulation, and enterprise cloud adoption support demand. Internal cloud migration, gross-margin improvement, sales leverage, and the roll-off of IPO-triggered SBC drive most of the profitability change. FY2025’s $913.9 million SBC was an IPO artifact; FY2026 and FY2027 better represent the recurring cost.

How stable are revenues? Revenue is more than 95% subscription and 89% of subscription ARR is cloud. Subscription ARR was $1.661 billion and NRR remained above 119%. Deferred revenue totaled $1.930 billion across current and noncurrent balances. This gives visibility, but two channel partners represented 59% of FY2026 revenue in aggregate. End-customer diversity does not eliminate channel execution risk.

Outlook for products and services? Core recovery remains strong: ARR grew 33%, net-new ARR grew 35%, and the $100,000-plus customer cohort grew 23%. Identity exceeded $50 million of ARR in Q1 but was not updated in Q2. Agent Cloud had more than 15 paying customers, with minimal expected FY2027 ARR; Strata contributed zero Q2 and guided ARR. Product breadth is expanding faster than disclosed product economics.

How big will the market be; domestic or international? The filing’s roughly $13.3 billion CY2027 backup-and-recovery anchor is more defensible than management’s $125 billion-plus 2029 combined TAM. The latter includes data management, cyber resilience, identity, and AI using third-party and bottom-up assumptions. International ARR represented 32% at Analyst Day, and the £375 million five-year UK plan signals serious expansion. Core recovery is a proven global market; AI is unquantified option value.

Business Quality & Competitive Moat

Is the industry getting more or less competitive? Demand is expanding and so is supply. Commvault, Veeam, Dell, IBM, and Cohesity-Veritas compete in data protection. Microsoft and large security platforms compete more directly in identity, DSPM, and agent controls than in Rubrik’s core recovery layer. Consolidation reduces vendor count but can create stronger combinations. The capital cycle is mixed, not automatically favorable.

How profitable is the business; what about ROIC and ROE? Conventional ROIC and ROE are not useful while GAAP operating profit is negative and shareholder equity is a $499.4 million deficit. Better measures are gross margin, contribution margin, FCF, and diluted FCF per share. Q2 GAAP and non-GAAP gross margins were 78.4% and 81.0%; ARR contribution margin was 14.0%. TTM reported FCF was $286.2 million versus $341.8 million of SBC.

How profitable is the industry; what are the barriers? Enterprise software can sustain 75–85% gross margins, but high returns attract capital. The core barrier is customer captivity: replacing recovery policies, immutable data, access controls, and tested runbooks is risky and costly. Rubrik has not demonstrated a scale-cost barrier or true network effect. Market-share migration away from legacy architectures proves opportunity and contestability simultaneously.

Can the business be easily understood? Yes at the core: Rubrik is the recovery-of-record after a cyber incident, sold as subscription software with land-and-expand economics. Complexity comes from material-rights accounting, migrations, SBC, Flex commitments, and the AI narrative. ARR, adjusted net-new Cloud ARR, NRR, customer cohorts, and diluted share count are the cleanest dashboard.

Can foreign low-cost labor undermine it? Not directly. This is security IP and enterprise trust, not labor-arbitrage production. Relevant substitutes are cheaper bundled software, open-source tools, or hyperscaler-native protection.

Do brands matter? Trust is the brand. A failed restore or breach of Rubrik could impair renewals and references quickly. Large-customer growth and NRR support current credibility; there is no consumer-style brand advantage.

What is the nature of competition? Legacy vendors approach from backup and data management; security platforms approach from prevention and operations. Rubrik differentiates through cloud-neutral recovery depth across workloads. At the frontier, the distinction is less protected and product bundling becomes more important.

What are customers’ switching costs? High in embedded accounts. Policies, RBAC, retention schedules, integrations, compliance evidence, recovery testing, and incident runbooks must be rebuilt. The cost is operational risk, not merely migration labor. NRR above 119%, 80%-class gross margin, and large-account expansion support captivity. The moat has not been tested through a severe IT-spending recession.

Financial Condition & Balance Sheet

Assets not fully recognized? The installed base, product code, channel relationships, and expensed sales investment are economically valuable but not recorded as assets. Conversely, cumulative equity compensation and losses produced negative book equity, so book value is not a useful franchise measure.

Off-balance-sheet liabilities? No unusual structure was identified. The largest operating commitment is a $595 million cloud-hosting minimum through April 2029, with $290.4 million remaining at January 31, 2026. Leases, acquisition retention awards, and the UK plan also matter. The $1.15 billion convert and $1.930 billion of deferred revenue are on balance sheet. Deferred revenue is a performance obligation, not financial debt.

How conservative is accounting? GAAP treatment is conventional, but adjusted presentation requires skepticism. Material-rights revenue fell to $4.7 million and depressed reported Q2 growth relative to normalized growth. SBC is added back in non-GAAP EPS and operating cash flow even though dilution is economic. FCF benefits from customer prepayments, but H1 deferred-revenue growth was smaller than a year earlier, so the recent FCF improvement was not driven by a larger working-capital inflow.

How CapEx-hungry? Physical and software capex is low: H1 property and equipment purchases were $9.9 million and capitalized internal-use software $9.4 million. The true capital intensity is sales, R&D, SBC, cloud commitments, and acquisitions.

Capital Allocation & Management

How much FCF and how is it used? FY2026 reported FCF was $237.8 million; H1 FY2027 was $139.3 million; FY2027 guidance is $323–$333 million. H1 FCF was $35.1 million below SBC, and TTM FCF was $55.5 million below SBC. Cash supports organic growth, acquisitions, award tax withholding, and the liquidity reserve. There is no dividend or economic buyback.

Significant acquisitions? Laminar added DSPM and Predibase added model infrastructure. Known consideration exceeds $251 million plus at least $64.2 million of retention awards. Cash-flow-statement outlays understate economic purchase price. Future deals need disclosure of acquired ARR, retention, integration costs, and return thresholds.

Buying back shares? No. The $53.3 million H1 outflow for tax withholding and net-share settlement was award administration, not shareholder capital return.

Issuing large amounts of shares to insiders? Yes, through broad employee awards. Q2 basic shares rose 5.7% year over year; non-GAAP diluted shares were 226.8 million versus 206.1 million basic. Management targets low-single-digit long-term dilution, which is not yet achieved.

Compensation policy? Annual incentives emphasize new and expanded ACV. Long-term compensation is mainly service-vesting RSUs, with no core FCF, GAAP-profit, or ROIC metric. This rewards growth and retention more directly than owner returns. The convert’s capped calls mitigate note dilution only between the conversion price of roughly $124.76 and cap near $175.10.

Motivations of management? Class B shares have 20 votes each. Current directors and executive officers held 46.2% of voting power at the proxy record date, including 25.2% for founder/Chair/CEO Bipul Sinha and 19.7% for the CTO. Strategy is growth- and platform-oriented. Recent executive sales were predominantly prearranged 10b5-1 transactions; no named-executive open-market purchase appeared in the refreshed corpus. Independent director Mark McLaughlin’s March purchase was the sole open-market buy found. Insider influence and incentives favor long-duration strategy, with limited outside-holder leverage.

Valuation & Market Data

ADR, MLP, or K-1? None. RBRK is domestic U.S. common stock listed on the NYSE.

Dividend policy? No dividend; reinvestment is the policy.

How profitable? Q2 GAAP EPS was negative $0.30 and non-GAAP EPS positive $0.20. Q2 FCF margin was 15%; FY2027 guided FCF margin is about 19%. Owner cash remains negative under the strict FCF-minus-SBC sensitivity.

Is net income diverging from cash from operations? Yes. H1 net loss was $103.6 million while operating cash flow was positive $158.5 million. SBC, depreciation, deferred revenue, and other working-capital items explain the gap. It is normal for growing SaaS but makes per-share dilution analysis essential.

What does the valuation embed? At the $107.02 close, basic and diluted EV were approximately $21.44 billion and $23.66 billion, or 12.9x and 14.3x ARR. The close preceded earnings. A provisional $98.17 after-hours quote implied 11.8x and 13.0x. A stylized reverse DCF with a 10% discount rate, 3% terminal growth, and 30% year-seven FCF margin requires roughly 23–25% revenue growth for seven years at the closing capitalization.

Risks & Downside

What could cause the stock to decline? Slower adjusted Cloud ARR, NRR below 115%, persistent SBC above 20% of revenue, platform bundling, channel disruption, weak returns on UK investment or acquisitions, or a growth-factor de-rate. The 1.705 market beta, 1.432 cyber loading, and 56% lifetime maximum drawdown show high equity sensitivity.

Risk of catastrophic loss? A breach of Rubrik itself is the clearest franchise event. A failed large recovery could also damage trust. These are low-frequency, high-impact risks.

Chance of total loss? Low. Cash and short-term investments were $1.748 billion, net cash approximately $615 million, ARR $1.661 billion, and the convert does not mature until 2030. Severe drawdown from multiple compression is much more plausible than insolvency.

Recent News & Events

Has the business environment changed? Q2 strengthened demand evidence and guidance, while the stock’s 48% rise between reports eliminated the prior de-rating. Cyber-resilience regulation and ransomware remain category tailwinds, not guarantees of Rubrik-specific spending.

Significant acquisitions? No new transformational transaction was disclosed. Predibase and Laminar remain the key strategic deals; H1 acquisition cash outlay was $24.2 million.

Accounting-policy changes? None material identified. The relevant changes are the continued fade of material-rights revenue and the normalization of IPO-related SBC.

New markets, facilities, or management? Rubrik announced a £375 million five-year UK investment and London EMEA headquarters, launched Agent Identity, and appointed Rakefet Russak-Aminoach as a ninth director. Q2 raised all major full-year guides. The $107.02 close and 11.3% regular-session rise occurred before the post-close release; the first after-hours quote was $98.17 and should not be treated as a completed market reaction.

APPENDIX B — Source Appendix

Evidence cut-off: 2026-08-27 after Rubrik’s post-close Q2-FY2027 release and earnings call. Primary sources are preferred. ROIC.ai, AZI, FactorsToday, and an automated transcript are labeled and reconciled where possible. The $107.02 price is the 2026-08-27 regular-session close; Rubrik released results after that close, so it is not a completed earnings-reaction price.

Primary — SEC Filings and Rubrik Investor Relations

Primary — Ownership, Regulation, and Industry Context

All sources above were accessed 2026-08-27. The Q2 release is the source of record for subscription ARR $1.661 billion (+33%), Cloud ARR $1.48 billion (+39%), revenue $427.3 million (+38%), and FY2027 guidance of $1.880-$1.885 billion ARR, $1.685-$1.693 billion revenue, approximately 15.5% contribution margin, and $323-$333 million free cash flow. Q2 NRR over 119% was disclosed orally on the call, not in the filed release, and is therefore attributed to the automated transcript with that limitation.

Earnings Calls and Transcript Controls

ROIC.ai’s exchange-qualified list_earnings_calls query returned unrelated issuers, its direct Q2 transcript lookup returned no call, and its company-news feed stopped at 2026-06-09 despite an end date of 2026-08-27. SEC, Rubrik IR, and the full automated Q2 transcript were therefore used as fallbacks. ROIC.ai was accessed 2026-08-27.

Market Data and Factor Evidence

Reproducible price and factor outputs

• RBRK regular-session close on 2026-08-27: $107.02, up 11.33% from $96.13 on 2026-08-26; intraday high $107.91 and volume 7.88 million, 2.34 times the trailing 90-session average. Rubrik’s earnings release followed the close, so the move must not be described as the completed Q2 reaction.
• Session-count raw returns through the 2026-08-27 close: 3 months / 63 sessions +52.19%, 6 months / 126 sessions +96.98%, 12 months / 252 sessions +25.65%.
• 50-day EMA $84.81 and 200-day EMA $72.74; close was 26.19% and 47.12% above them, respectively. The 50-day EMA was 16.59% above the 200-day EMA.
• Maximum close-to-close drawdowns: 3 months -19.84%, 6 months -23.84%, 12 months -55.52%, and full public history -56.08%. The full-history trough was a $43.81 close on 2026-04-10 after the $99.74 prior peak.
• All Factors model dated 2026-07-31: Market +1.705, Cybersecurity +1.432, Cloud Computing +0.702, Software industry +0.477, Low Volatility -1.306, Momentum -0.559, and Value -0.125; R-squared 0.530. Quality, Growth, and Small Size were zeroed by L1 regularization rather than missing.
• FactorsToday specific annualized volatility was 42.97%. The stock-info endpoint reported beta 1.781 and 12-month relative strength +25.65%.
• On 2026-08-27, the intraday factor regime was broad risk-on for cybersecurity (+2.31%, z-score +3.50) and software (+2.42%, z-score +3.68), while Momentum was -0.30% (z-score -0.50). The day’s RBRK move occurred within a broad cyber rally: CRWD +20.50%, ZS +9.98%, PANW +12.83%, OKTA +28.63%, and BUG +10.41% in the regular session.
• The Benzinga transcript-page quote snapshot showed RBRK at $98.17 after hours, down 8.27% from $107.02 but still 2.12% above the prior regular close of $96.13. This is provisional extended-hours evidence, not a closing return or final earnings verdict.

IPO-limited five-year event map

RBRK has only traded since April 2024, so a literal five-year price history does not exist. The map covers the complete approximately 28-month public record.

Evidence-Quality and Unsupported-Claim Flags

• Do not call the 11.33% regular-session gain an “earnings-day” or “post-earnings” move: Rubrik reported after the 2026-08-27 close.
• Do not use the 2026-06-26 AZI P/S percentile as current. A current valuation_index observation is unavailable and the two-year own-history distribution is structurally short even when the endpoint works.
• Treat “cyber resilience is nondiscretionary,” platform/customer-win claims, and the >$125 billion 2029 TAM as management hypotheses, not independently proven facts.
• Agent Identity, Agent Cloud, and the Strata acquisition expand the product narrative, but Q2 disclosed no separate Identity ARR; management said Rubrik Agent Cloud had more than 15 paying customers but minimal FY2027 ARR was assumed, and Strata contributed zero Q2 ARR and zero ARR to the FY2027 guide.
• Gartner leadership is a Rubrik-reported third-party designation; the underlying paid report and methodology were not reviewed.
• The Q2 written transcript is automated, not company-certified. Hard financial metrics must be sourced to the SEC exhibit.
• Same-day after-hours prices are provisional and can be illiquid; use the next regular close for a completed Q2 reaction.