Date: 2026-03-31 Author: Bert Hochfeld (TickerTarget) Market Cap: ~9.25B|SharePrice: 46.22 | Shares: ~200.8M FY26 Revenue: $1,316.2M (+48.5% YoY) | FY27 Guide: 1, 602M(+22EV: 8.70B | EV/S (NTM): 5.4x | EV/ARR: 5.9x | P/FCF: 38.9x | Rule of 40: 66.6
Rubrik is a cyber resilience platform company growing subscription revenue at 50% YoY, generating $238M in free cash flow (18.1% margin), and trading at an EV/S of 5.4x on next-twelve-month revenue — a discount of approximately 35-40% to the cohort average for companies growing at a normalized 28% CAGR with 83%+ gross margins. The company has delivered back-to-back non-GAAP operating profitability for the first time, is expanding its platform from data protection into identity resilience (900+ customers, fastest-growing product in company history) and AI agent governance, and has beaten every guided metric since its May 2024 IPO — with FY26 FCF exceeding initial guidance by 332%. The stock is down roughly 55% from its $103 peak and 30% year-to-date despite the strongest operating year in company history, which tells me the market is pricing in a deceleration that the underlying unit economics do not support. At current levels, this is a relative bargain — one of the more compelling risk/reward setups I have seen in the high-growth cybersecurity cohort. I am initiating coverage with a recommendation to buy.
I am not going to pretend that data backup and recovery is the most intellectually stimulating corner of enterprise technology. It is, however, one of the most commercially durable. Every enterprise must protect its data. Every enterprise must be able to recover from a cyberattack. These are not optional budget items, and they do not get cut in a recession any more than a hospital stops buying bandages.
What makes Rubrik interesting is not the category but the approach. The company built its architecture around an immutable file system — the Atlas file system — which means that backed-up data cannot be encrypted, modified, or deleted by ransomware. This is a fundamental architectural advantage over legacy vendors like Veritas and Commvault, whose agent-based architectures were designed before ransomware was a $20 billion criminal industry. Rubrik's CEO Bipul Sinha put it on the Q4 call with characteristic directness: "We are the system of record of last resort. When a large bank or large hospital faces a ransomware attack, Rubrik is there to help their business come back online."
The platform has expanded beyond data protection into three growth vectors:
Data Security (Core) — backup, recovery, ransomware protection, cloud archiving. This is 97% of revenue today and the engine that drives the financial model. The company claims a >90% win rate against legacy data protection vendors, a figure CEO Sinha repeated twice on the Q4 call with deliberate emphasis.
Identity Resilience — launched in December 2024, this product protects and recovers identity infrastructure (Okta, Microsoft Active Directory, Entra ID). It reached ~$20M ARR in three quarters with 900+ customers by Q4 FY26 and is, by management's explicit admission, "the fastest-growing product in company history" that "exceeded our expectations of how fast the product has scaled." The addressable buyer is the CISO, a budget that Rubrik could not access with data protection alone. This is entirely additive.
Rubrik Agent Cloud (RAC) — AI agent governance and security. Generally available as of Q4 FY26, with integrations to Amazon Bedrock AgentCore and Microsoft Copilot Studio. Capabilities: monitor agents (sanctioned and shadow IT), enforce real-time guardrails, and perform surgical rollback ("Agent Rewind"). This is early — "early days" appeared three times in the Q4 transcript — but the structural opportunity is genuine. Every enterprise deploying AI agents will need to govern them. Sinha was unusually candid about competition: "everybody with a mother is jumping into this market." He then argued, persuasively, that rule-based cybersecurity platforms are architecturally unsuited to real-time dynamic agent control. Time will tell.
The Microsoft Defender identity integration announced at RSAC 2026 (March 23-24) deserves mention. This is not a marketing partnership; it is a co-engineered product that connects Microsoft's real-time identity threat detection to Rubrik's automated clean-state recovery. This creates ecosystem lock-in that competitors — specifically Druva, which launched its own identity resilience product on March 17 — cannot easily replicate.
Headline KPIs:
What strikes me most about these numbers is the operating leverage trajectory. In FY25, Rubrik generated $21.6M of free cash flow. In FY26, on a revenue base 48.5% larger, it generated $237.8M — an eleven-fold improvement. The FCF margin went from essentially zero to 18.1%. Non-GAAP gross margins expanded from approximately 78% to 83.7%. Non-GAAP operating income turned positive for the first time in Q3 FY26 and remained positive in Q4. This is the financial signature of a subscription model reaching critical mass: incremental revenue is dropping to the bottom line at a very high marginal rate.
The subscription revenue mix tells the same story from a different angle. In FY23, subscriptions were 64% of revenue. In FY26, they are 97%. The legacy maintenance revenue stream ($138M in FY23) has shrunk to approximately $45M and will continue declining. This transition is nearly complete, which means the revenue quality — recurring, cloud-based, expanding — is about as good as it gets in enterprise SaaS.
Quarterly trajectory:
| Quarter | Revenue | YoY% | Net New ARR | GM% (NG) | FCF Margin | $100K+ Cust |
|---|---|---|---|---|---|---|
| Q1 FY26 | $278.5M | +48.7% | $88M | 80.5% | 12.0% | 2,381 |
| Q2 FY26 | $309.9M | +51.2% | $71M | 79.4% | 18.6% | 2,505 |
| Q3 FY26 | $350.2M | +48.3% | $95M | 82.8% | 22.0% | 2,638 |
| Q4 FY26 | $377.7M | +46.3% | $115M | 83.7% | 18.6% | 2,805 |
The Q2 FY26 net new ARR dip to $71M caused some concern at the time. Q3 and Q4 emphatically reversed it. The $115M Q4 net new ARR was an all-time record, and FY26 total net new ARR of $369M was exactly double FY25's $185M. That is not a company losing momentum.
Material rights distortion: FY26 included approximately $70M of material rights revenue — a non-recurring item from legacy contract transitions. This inflates reported FY26 growth and will create a headwind in FY27. On a normalized basis (stripping material rights from both years), FY26 growth was approximately 43%, and FY27 guided growth is 27-28%. This distinction matters enormously for valuation. The reported FY27 growth of 22% is misleading; the underlying growth rate is 28%.
Rubrik operates in a market undergoing generational vendor replacement. The legacy data protection market — Veritas, Commvault, Dell/EMC, IBM — was built on architectures designed before ransomware, before cloud, before SaaS delivery. Rubrik is displacing these vendors at a >90% win rate, and the CEO's statement that "the only deal we are losing is the fight we are not in" suggests the constraint is go-to-market capacity, not product competitiveness.
The competitive landscape has evolved in recent months:
Cohesity-Veritas completed its merger in December 2024 and now commands 19% market share vs. Rubrik's 14% (per IDC 1H 2024 data). A Cohesity IPO at $17B+ valuation is expected in 2026, which would create a directly comparable public-market competitor. This is the most significant structural competitive risk. However, market share in data protection is distributed across a dozen vendors — the addressable replacement opportunity remains enormous.
Druva launched its own Identity Resilience product on March 17, 2026, covering Okta, Active Directory, and Entra ID. This eliminates Rubrik's brief monopoly window in identity-based data recovery. However, Rubrik's Microsoft Defender co-integration and broader installed base of 2,805 $100K+ customers provide distribution advantages that a SaaS-only competitor cannot match overnight.
Gartner vs. Forrester divergence is worth noting. Gartner has placed Rubrik as the Vision Leader in its Magic Quadrant for six consecutive years, furthest on the vision axis. Forrester, however, downgraded Rubrik from Leader to Strong Performer in Q4 2024. Gartner weights vision; Forrester weights current offering execution. This divergence suggests Rubrik's product breadth (not vision or architecture) may trail Commvault on specific capability gaps. I take this seriously but note that Rubrik's financial execution — growing 48% with expanding margins — does not reflect a company losing competitive ground.
Customer reviews validate the product quality. Capterra 4.8/5 across 74 reviews. Practitioners on Reddit use Rubrik as the reference standard for "how backup should work." The consistent complaint is pricing — which, for an enterprise vendor with 83%+ gross margins, is more of a feature than a bug. Premium pricing signals premium value capture.
Rubrik's AI positioning operates on three layers:
Layer 1: AI beneficiary (structural). Every enterprise deploying AI creates more data, more attack surfaces, more identity sprawl. Rubrik's core data protection business grows with AI adoption regardless of whether Rubrik builds any AI products of its own. This is the picks-and-shovels logic that I have applied to companies like Pure Storage and Arista in the infrastructure space. You do not need to predict which AI applications win; you just need to know that they all generate data that must be protected.
Layer 2: AI-enhanced product (delivered). Turbo Threat Hunting, DSPM-in-RSC, and intelligent business recovery for Microsoft 365 all use machine learning to improve Rubrik's core offering. These are shipping products, not roadmap items.
Layer 3: AI agent governance (early stage). Rubrik Agent Cloud is genuinely new-category. The three-capability architecture (Monitor, Govern, Remediate) maps to a logical enterprise adoption journey: discover agents, control them, remediate when they go wrong. The Predibase acquisition (ML training platform) powers the real-time guardrail engine. Partnerships with Amazon Bedrock AgentCore and Microsoft Copilot Studio provide distribution into the two largest enterprise agent platforms.
I am not going to pretend that I can size the agent governance TAM with any precision. Neither can anyone else. What I can observe is that every enterprise deploying AI agents will face the governance question, and Rubrik's positioning — data-aware, identity-aware, integrated with the hyperscalers — is structurally strong. If this market develops as the cybersecurity industry expects, it could add several hundred million dollars to Rubrik's addressable opportunity over the next 3-5 years. If it develops more slowly, Rubrik's core business and identity expansion provide more than sufficient growth runway.
Bipul Sinha is a founder-CEO with a Lightspeed venture background and twelve years at the helm. His communication style on earnings calls is confident bordering on aggressive — "living and breathing entity that has no finish line," "two miles ahead, not 200 miles ahead" — but the confidence is backed by execution. Every guided metric since the May 2024 IPO has been beaten, several by wide margins. FY26 FCF exceeded initial guidance by $183M.
The management credibility pattern is clear: deliberately undemanding estimates followed by consistent beats. Initial FY26 revenue guide was $1,153M; actual was $1,316M (+14.1% beat). Initial FY26 FCF guide was $55M midpoint; actual was $237.8M. Initial FY25 ARR guide was $990M; actual was $1,093M (+10.4% beat). This is a sandbagging pattern I have seen at companies like Monday.com and Datadog — it creates a reliable beat-and-raise cadence that builds institutional credibility over time.
One yellow flag: the CRO transition. Jesse Green was promoted to Chief Revenue Officer in Q4 FY26, succeeding the outgoing CRO. Sinha framed this as a three-year succession plan ("he came to Rubrik with this clear path to be the CRO"). I take planned successions at face value but monitor the next two quarters closely. Having three sales leaders in fifteen months implies some issues; having a deliberate three-year succession plan implies the opposite. The Q1 FY27 result will tell us which interpretation is correct.
A second concern from the scuttlebutt: employee sentiment is deteriorating, not stabilizing. Glassdoor scores have declined across work-life balance (3.0, down from 3.2), culture (3.3, down from 3.6), and career opportunities (3.3, down from 3.5). A Blind discussion thread describes "quiet ongoing layoffs" with team members "disappearing" — particularly in sales. Post-IPO culture degradation is a common pattern at hyper-growth companies, but persistent decline in these scores can eventually manifest in go-to-market execution quality. I am monitoring, not alarmed.
NRR opacity. Six consecutive quarters of ">120%" with no precision is a deliberate management choice. Per the prior learning surfaced for this analysis, floor-reporting (">X%") typically means the actual number is within 1-4pp of the floor. If NRR is 121%, that is meaningfully different from 128%. The disclosure format itself is a negative signal — management is not confident in an upward trajectory. Any print below 120% is a bright-line sell trigger.
FY27 deceleration optics. Reported FY27 revenue growth of 22% will look weak to momentum investors who saw 48.5% in FY26. The normalized rate is 28%, which is healthy but requires investor education that may not fully penetrate. The stock could remain under pressure until Q1-Q2 FY27 beats re-establish the sandbagging narrative.
SBC dilution. FY26 SBC was $329.4M — 25% of revenue. SBC as a percentage of revenue is declining (33.3% → 22.5% over four quarters), which is the right direction, but $329M of annual stock-based compensation against $237.8M of FCF means the company is paying its employees more in equity than it generates in cash. FY27 weighted-average shares are guided at 232M vs. 200.8M currently — a 15.5% step-up. Until SBC drops sustainably below 20% of revenue, GAAP profitability will remain distant and dilution will weigh on per-share economics.
Cohesity IPO competition. If Cohesity goes public at $17B+, it creates a directly comparable public competitor with larger market share and a post-merger platform. Capital flows, analyst coverage, and media attention could bifurcate. Rubrik's defense is superior growth, margin trajectory, and product innovation — all currently intact.
Identity competition narrowing. Druva's March 2026 entry into identity resilience eliminates Rubrik's monopoly window. Rubrik's Microsoft Defender co-integration is a meaningful moat, but the window of differentiation has compressed from "only player" to "best-integrated player" in one quarter.
Agent Cloud execution risk. RAC is generally available but pre-revenue at material scale. Management's repeated use of "early days" (three times in one Q&A session) suggests this is a 2-3 year revenue story, not a near-term contributor. If the agent governance market develops more slowly than expected, the narrative of Rubrik as an "AI operations company" loses credibility.
This is where the analysis gets interesting. I am a numbers guy, and the numbers here tell a compelling story.
Current valuation:
| Metric | Value | Notes |
|---|---|---|
| Market Cap | $9.25B | As of March 30, 2026 |
| Cash + Investments | $1,675.8M | Net of convertible debt |
| Convertible Notes | $1,130.7M | Issued Q4 FY26 |
| Enterprise Value | ~$8.70B | $9.25B - $1.68B + $1.13B |
| FY26 Revenue (actual) | $1,316.2M | |
| FY27 Revenue (guide mid) | $1,602M | +28% normalized |
| EV/S (TTM) | 6.6x | On FY26 actual |
| EV/S (NTM) | 5.4x | On FY27 guide mid |
| FY26 FCF | $237.8M | 18.1% margin |
| FY27 FCF (guide mid) | $270M | ~16.9% margin |
| P/FCF (FY26) | 38.9x | |
| P/FCF (FY27) | 34.3x | |
| EV/ARR | 5.9x | On $1,462M sub ARR |
| Rule of 40 | 66.6 | Rev growth 48.5% + FCF margin 18.1% |
Cohort comparison: For companies growing at a normalized 28% CAGR with non-GAAP gross margins above 80% and positive FCF margins above 15%, the prevailing EV/S ratio in the current market is approximately 8-10x. SentinelOne, growing at a similar rate with lower margins, trades at roughly 7-8x NTM. CrowdStrike, growing at 23-25% with significantly higher margins, trades at approximately 14x NTM. Rubrik at 5.4x NTM is at a substantial discount — I estimate 35-40% below the cohort average for its growth and margin profile.
The acquisition comp floor: Wiz sold for $32B at approximately 40x EV/ARR. Even applying a massive discount — say, 10x EV/ARR for Rubrik — implies $14.6B or $72/share. Rubrik is trading at $46. The cyber resilience market is consolidating, and Rubrik is the only independent public-company platform of this quality at this growth rate. I am not suggesting an acquisition is imminent, but it provides a valuation floor that the current price sits well below.
FCF yield perspective: At $9.25B market cap and $237.8M FY26 FCF, the FCF yield is 2.6%. With the FY27 guide implying $270M and management's demonstrated pattern of beating FCF guidance by 50-300%+, the true FY27 FCF could approach $350-400M. At the midpoint, that would put the P/FCF at 25x — very reasonable for a company growing 28% with expanding margins.
PEG ratio: Non-GAAP EPS is barely positive ($0.04 in Q4, $0.17 midpoint FY27 guide), making PEG less useful as a primary tool. However, the revenue-based PEG (P/S ÷ revenue growth) at 5.4x/28% = 0.19x is exceptional. I have rarely seen a sub-0.2 PEG on a company of this quality.
My estimate: At the current price of approximately $46, Rubrik is undervalued. A reasonable EV/NTM revenue multiple for a 28% normalized grower with 83%+ gross margins, 18%+ FCF margins, and a Rule of 40 score above 60 is 8-9x. Applied to $1,602M FY27 revenue guide (which management will likely beat by 8-14% based on historical patterns), this suggests an enterprise value of $12.8-14.4B, or a market cap of $13.4-15.0B. That implies 45-60% upside from current levels. Even if I use the guide without a beat assumption and apply a more conservative 7x multiple, I arrive at $11.2B enterprise value, $11.7B market cap, or approximately $58/share — 25% upside.
Buy. This is an initiation. I have not previously covered Rubrik in the newsletter, but applying my framework, the risk/reward profile is among the most compelling in my coverage universe. The company is executing at a high level across revenue growth, margin expansion, and cash generation. The stock is down 55% from its peak despite the strongest operational year in company history. Panics tend to be indiscriminate, and the broader software selloff — the "SaaSpocalypse" as I have called it — has compressed valuations for high-quality growers alongside genuinely challenged businesses.
The specific catalysts I am watching for:
I would recommend a position size of 3-4% in the High Growth Portfolio, with room to add on Q1 FY27 confirmation.
This is an initiation — no prior beliefs exist.
Entering beliefs (as of March 2026):
Analysis based on Q4 FY26 results (ended January 31, 2026), FY27 initial guidance, scuttlebutt research, and market data as of March 30-31, 2026.
Sources: