Rubrik’s booming base offering and two side bets

Rubrik CEO Bipul Sinha and CFO Kiran Choudary, recently sat down with William Blair financial analysts and discussed its business situation, performance and prospects. We saw the WB report on the session and found it illuminating to read.

Overall, Rubrik is active in three market sectors: its core backup and recovery offerings, newer identity recovery and resilience, and newer still AI operations.

The core data protection market is hotly contested, with many established suppliers, from very large – think Veeam, Cohesity, Commvault – mid-range, and small suppliers. However it is not a single market, as workloads develop and change. Rubrik told the analysts that there were growth opportunities in three areas:

• “Brownfield” on-prem data centers, with acceleration in legacy replacements in the most recent third quarter;
• “Greenfield” SaaS apps, which include M365, Salesforce, GitHub, Azure DevOps, etc.;
• Customer self-managed cloud workloads on AWS, Azure, and GCP, with many customers only recently realizing that they need to protect cloud-based workloads with proper backup and recovery services.

It has seen an acceleration in legacy displacement deals in its most recent quarter.

As customers have a broader range of workloads to protect, the ability of a supplier to provide a single, all-encompassing backup and recovery service across legacy and modern on-premises workloads, SaaS applications, and customer’s self-managed public cloud workloads will have a stronger appeal.

Rubrik says it has only about 35 percent of the Fortune 500 as customers, and under 50 percent of workload coverage within those accounts. So there is room for expansion.

The company does not view the backup and recovery market as being strictly limited to backup and recovery, as cyber-attacks can trigger recovery. It makes sense, it says, to expand into protection against cyber-attacks by offering anomaly detection, threat scanning, ransomware recovery warranties, data security posture management (DSPM) to locate sensitive data and have it backed up, and more. These are not separate products so much as bolt-on expansions to basic backup and recovery.

Identity protection services are not simply bolt ons, being a separate market, and viewed as necessary by enterprise customers using Active Directory, Okta, and Entra ID. If these apps go down virtually all other applications are inaccessible. Rubrik sees this forming a new and large total addressable market sector, and having a different buyer persona – think CISO unit staff – from its core backup business offerings, and has set up a separate Rubrik sales organization.

It also sees a huge cross-sell opportunity here, with literally every organization needing protection for its ID management apps, and ID protection vital for resisting ID deception-based attacks.

Its Identity protection offerings recorded a roughly $20 million subscription ARR level in its latest quarter, the fastest Ruibrik product line to achieve that ARR level, with customer numbers doubling to 400-plus, and 40 percent of them being new customers.

The newest Rubrik business sector is AI operations, based on Rubrik Agent Cloud (RAC) operations and governance suite, which uses technology from its recent acquisition of Predibase. RAC is very new, being in its beta, product-market-fit and pricing-experimentation phase. This looks to became generally available later this year and, of course, its future is tied to the spread of AI agent technology.

Competitor Cohesity is also alive to the protection market possibilities of rogue agents and unwinding their actions.

All-in-all, Rubrik is confident of its growth prospects, with ID protection and already offering a separate and growing revenue stream alongside core backup, and AI agent Ops hopefully poised to do the same. Three growing business sectors will, it thinks, increase the size of its business faster than just one.

Comment

Rubrik, like most of the other data/cyber protection vendors basically offers data selection, extract and moving capabilities to a variety of target stores. Such stores include on-prem deduplicating backup targets (Dell PowerProtect, ExaGrid, etc.), and public cloud offerings, such as Backblaze, Keepit and Wasabi. Veeam has developed it’s own backup software appliance.

Could other backup vendors go down the data protection stack and start offering their own backup storage facilities? An integrated backup software and backup storage offering could provide a single system to customers with lower pricing, less complexity and simpler management. If another member of the top four data protection vendors, meaning Cohesity, Commvault, and Rubrik, did this then the idea might have legs.