Philip A. Fisher | March 2026
When I last examined Rubrik in February, I assessed the company as one of the more compelling growth investments I have encountered in recent years — a company that is "fortunate because it is able," where management is actively creating its growth through deliberate category expansion rather than merely riding the cybersecurity industry's rising tide. My thesis rested on three pillars: the cloud migration was nearing completion, the identity product was scaling faster than management expected, and Agent Cloud represented a genuinely novel market opportunity. The primary concern was dilution — SBC at 24% of revenue and 8% annual share count growth.
I now turn to Q4 FY26 to determine whether the business confirmed or contradicted these beliefs.
Revenue of $377.7 million, up 46% year-over-year, beating guidance of $341-343 million by an extraordinary 10.4%. This is not a modest beat. This is management systematically underguiding by a wide margin, and the pattern has now been established over multiple quarters with increasing magnitude.
The more telling figure is net new subscription ARR of $115 million — a record, and an acceleration from Q3's $95 million. In the full fiscal year, Rubrik added $369 million of net new ARR, precisely double FY25's $185 million. I have found over many years that the absolute dollar increment of growth is a more reliable indicator than the percentage rate, because percentages inevitably compress while a business that adds increasing dollars of ARR each year is genuinely expanding its economic footprint.
| Metric | Q1 FY26 | Q2 FY26 | Q3 FY26 | Q4 FY26 | Direction |
|---|---|---|---|---|---|
| Revenue ($M) | $279 | $310 | $350 | $378 | Accelerating $ adds |
| Sub ARR ($B) | $1.18 | $1.25 | $1.35 | $1.46 | +34% YoY, stable |
| Net New ARR ($M) | $88 | $71 | $95 | $115 | Record, accelerating |
| Non-GAAP GM % | ~80% | ~81% | 83% | 83.7% | Steady improvement |
| Non-GAAP Op Margin | -33.4% | -30.5% | +2.9% | +1.6% | Positive territory |
| FCF ($M) | $33 | $58 | $77 | $70 | $238M full year |
| SBC % Revenue | 26.4% | 28.6% | 23.6% | 22.5% | Declining — essential |
| $1M+ Net Adds | — | — | 23 | 32 | Record, >50% YoY |
Subscription ARR reached $1.462 billion, growing 34% year-over-year — a rate that has been remarkably stable at 34-38% for four quarters. Cloud ARR is 1.29billion, representing88172 million) is declining as expected.
The contribution margin on subscription ARR reached 11.6% for the full year, up 950 basis points year-over-year. This is the operating leverage story beginning to tell itself in the numbers.
I have always maintained that the quality of management is the single most important factor in a growth investment. Let me assess what this quarter reveals.
Promise-keeping. Every single guidance figure provided at Q3 was exceeded — and not by small amounts. Revenue beat by 10.4%. FCF of $237.8 million exceeded guidance of $194-202 million by 18%. Subscription ARR of $1.462 billion exceeded the $1.439-1.453 billion range. When I examine the full-year raise history — revenue guided at $1,145-1,161 million initially, delivered $1,316 million — I find a management team that has beaten its own guidance by $163 million, or 14%, over the course of the year. This is not conservatism. This is systematic sandbagging that, while it may frustrate analysts attempting to build precise models, is precisely the kind of behaviour I prefer to see. A management that over-promises and under-delivers destroys shareholder value. A management that under-promises and over-delivers creates it.
Candour under pressure. I was pleased to observe Bipul Sinha's handling of the Agent Cloud competitive question. When asked by Keith Bachman of BMO who the competition was, Sinha responded with genuine honesty: "everybody with a mother is jumping into this market." He then articulated why he believes rule-based cybersecurity approaches will prove inadequate for dynamic agent governance — a substantive technical argument, not hand-waving. This is the kind of candour I value in Point 14 of my framework. A management that acknowledges competitive reality while explaining its differentiation earns my respect.
CRO succession planning. The transition from Brian Monahan to Jesse Green as Chief Revenue Officer is exactly how such transitions should be managed. Green was hired three years ago with explicit succession intent, led Americas at MongoDB before joining, and has been "CRO in training" managing the company's largest geography. Sinha described the transition as "very natural and easy." I find this deeply reassuring. A company that plans executive succession years in advance, rather than scrambling when a departure occurs, demonstrates the management depth I require under Point 9.
Long-range thinking. The guidance for FY27 — revenue of $1,597-1,607 million (+27-28% normalised), subscription ARR of $1,829-1,839 million (+25-26%), FCF of $265-275 million — reveals a management team that is investing for the future while allowing profitability to emerge naturally. The contribution margin guidance of ~13% (up from 11.6%) shows measured, sustainable improvement rather than the cost-slashing that sometimes accompanies a deceleration narrative.
Rubrik maintains its position as a Gartner Magic Quadrant Leader for Enterprise Backup and Recovery Software Solutions for two consecutive years, with over 6,600 customers globally. On peer review platforms, customers consistently praise the Zero Trust architecture, immutable file system (Atlas), rapid recovery capabilities, and ransomware detection. The win rate of over 90% against legacy data protection vendors — stated explicitly by Sinha, "the only deal that we are losing is the fight that we are not in" — is extraordinary. Identity Recovery has reached over 200 customers within a few quarters of general availability, with 40% being net-new to Rubrik. This new-buyer-acquisition through product expansion is a hallmark of a great platform company.
I note continued pricing concerns from smaller organisations — approximately $650 per terabyte annually against Cohesity's $500. For a company selling into large enterprises with $100K+ ARR customers comprising 87% of its base, this is not a competitive vulnerability but rather a reflection of the value its enterprise customers perceive.
The Glassdoor rating remains at 3.5/5 with 56% recommending the company — adequate but, I must be candid, not what I would hope to see in a company of this quality. Work-life balance scores of 3.0/5 and culture scores of 3.3/5 concern me. Reports of toxic management pockets and regional disparities (India office receiving lower-priority projects) are the kinds of problems that, left unaddressed, can corrode a company's competitive advantages from within. The engineering teams appear engaged, and the 69% positive business outlook suggests employees believe in the company's trajectory even when the daily experience is uneven. I would watch this closely — if the Glassdoor score deteriorates below 3.3, it would warrant a reassessment of management quality under Point 7.
The Cohesity-Veritas merger has created a formidable competitor with 19% market share and $1.5 billion in ARR, now targeting a 2026 IPO at a valuation rivalling Rubrik's. Cohesity's AI-driven "Gaia" platform, built on Nvidia's AI Enterprise software, represents a credible alternative approach to intelligent data protection. However, two factors give me confidence in Rubrik's positioning: first, Rubrik is winning against legacy vendors at a 90%+ rate, and legacy displacement is the primary growth vector for the next several years; second, the Cohesity-Veritas combination brings integration complexity that often distracts management for 18-24 months post-merger. Commvault remains relevant with its Cleanroom capabilities, but its complexity disadvantages it in the cloud-native market.
Three product pillars deserve separate evaluation:
Core Data Protection: The business is executing with remarkable consistency. Cloud ARR at $1.29 billion growing 47% demonstrates the cloud migration is nearly complete and the installed base is expanding simultaneously.
Identity: This is the product that has exceeded my expectations. Over 200 customers adopted Identity Recovery within quarters of GA. Identity Resilience — protecting Active Directory, Entra ID, and Okta — had 65 deals in its first quarter and is expanding the buyer from CIO/CTO to CISO. The integration with CrowdStrike for surgical rollback of identity attacks is technically differentiated and practically important. This product is opening new budget pools and new customer relationships. It is precisely the kind of product expansion that creates a platform flywheel.
Agent Cloud: Now generally available with integrations into Amazon Bedrock AgentCore and Microsoft Copilot Studio. The market positioning — real-time dynamic guardrails for AI agents, not rule-based security — is thoughtful. But I must be honest: this market is embryonic. Enterprise AI agent deployment is early, and as Sinha himself acknowledged, "everybody with a mother is jumping into this market." I would not assign significant value to Agent Cloud today, but I note the optionality and the management's willingness to invest ahead of the market.
My assessment of Bipul Sinha strengthened this quarter. His responses on the earnings call demonstrated strategic clarity (the "two miles ahead of customers, not 200 miles" framing), competitive awareness (honest about Agent Cloud competition), and succession discipline (the three-year CRO transition plan). CFO Kiran Choudary provided granular normalised metrics, acknowledged the material rights revenue headwind on reported growth, and gave guidance that allows for measurable verification. These are the hallmarks of a management team that respects its shareholders.
Rubrik continues to recruit across engineering (AI and security domains), sales engineering, and identity sales specifically. The investment in R&D remains healthy, and the new Identity Resilience Sales Manager role confirms the company is building dedicated go-to-market capacity around its identity product line. I find no evidence of engineering hiring deceleration, which would be a warning signal.
The macro tailwind is substantial. CISO budgets are growing 12.5% year-over-year to $240 billion globally in 2026, with data protection cited as the #1 priority by 48% of security chiefs. Tool consolidation is a dominant theme — 58% of organisations run more than 25 security tools and are actively seeking platform solutions. Rubrik's positioning as an integrated platform spanning data protection, identity, and AI governance aligns precisely with this consolidation trend.
| Point | Assessment | Evidence |
|---|---|---|
| 1. Growth potential | Strong | 46% revenue growth, $115M record net new ARR, triple-digit bookings growth vs legacy |
| 2. New products | Strong | Identity (200+ customers), Agent Cloud (GA with AWS/MSFT), Sovereign Cloud |
| 3. R&D effectiveness | Strong | Identity scaled faster than expected; Agent Cloud to market in months post-acquisition |
| 4. Sales organisation | Strong | 90%+ win rate, $1M+ customers growing >50% YoY, CRO succession planned |
| 5. Profit margins | Improving | Non-GAAP GM 83.7%, first profitable quarters, contribution margin 11.6% |
| 6. Margin improvement | Strong | SBC declining (22.5% from 51%), FCF $238M from negative a year prior |
| 7. Labour relations | Adequate | Glassdoor 3.5, some toxicity concerns, engineering engaged |
| 8. Executive relations | Strong | Founder-CEO, 3-year CRO succession, management depth across functions |
| 9. Management depth | Strong | CRO transition, CFO articulate, Predibase founder leading AI |
| 10. Accounting controls | Adequate | Standard for stage; normalised metrics provided with transparency |
| 11. Competitive advantages | Strong | Zero Trust architecture, immutable Atlas file system, 90%+ win rate |
| 12. Long-range outlook | Strong | Identity + Agent Cloud expand TAM; platform consolidation secular trend |
| 13. Dilution | Improving | SBC 22.5% and declining; shares ~204M; convertible debt $1.1B outstanding |
| 14. Management candour | Strong | "Everybody with a mother" — honest about competition; systematic beat pattern |
| 15. Integrity | Clean | No insider dealing, no related-party concerns, founder alignment |
Score: 10 Strong, 3 Adequate, 2 Improving. This is a high-quality Fifteen Points profile. The improving trajectory on margins and dilution — the two areas I previously flagged — is exactly what I needed to see.
I must address this directly, as it remains the most legitimate concern. SBC was 85millioninQ4, representing22.51.1 billion outstanding).
My position is this: for a company creating genuine economic value — $238 million of free cash flow in FY26, with $270 million guided for FY27 — dilution that is declining as a percentage of revenue is a cost of building the organisation, not a permanent impairment. The relevant question is whether the per-share value is growing, and with revenue per share growing at approximately 35% year-over-year (adjusting for share growth), it clearly is. I would reassess if SBC were to re-accelerate above 25% of revenue without corresponding acceleration in new product scaling.
This is the central question I ask of every growth company. Is Rubrik merely fortunate — riding the cybersecurity spending wave — or is it fortunate because its management is creating growth through skill and foresight?
The evidence from Q4 FY26 is unambiguous. The identity product expanded to 200+ customers within quarters, opened new buyer relationships (CISO budgets), and is on track to become a material revenue contributor. Agent Cloud moved from acquisition (Predibase) to GA with AWS and Microsoft integrations in under a year. Sovereign Cloud was launched in response to genuine geopolitical demand. These are not the actions of a company waiting for its market to lift it. These are the actions of a management team that is actively expanding its addressable market through product innovation and category creation.
The $115 million of net new ARR in Q4 — accelerating from $95 million in Q3 — puts a fine point on it. The business is not merely maintaining growth; it is adding more absolute dollars of ARR each quarter. The FY27 guide implies $372 million of net new ARR (essentially flat with FY26's $369 million), which I regard as sandbagged given the beat pattern. If FY26 beat guidance by 7.9% on ARR, a similar beat on FY27 would yield approximately $1.97 billion in subscription ARR by January 2027.
I have never believed that precise valuation is possible for an outstanding growth company, and I do not intend to start now. At approximately $53 per share and a market capitalisation of roughly 10.7billion, Rubriktradesatapproximately8xrun − raterevenue(378M × 4 = 1.51B)and6.7xFY27guidedrevenue(1.6B). For a company growing revenue at 27-28% (normalised), with improving margins, 83.7% gross margins, $270M of guided free cash flow, and multiple product vectors, I find this reasonable.
The stock has declined 48% from its 52-week high of $103, and analyst consensus sits at approximately $88-105 — roughly 65-100% above the current price. I am not in the business of predicting short-term stock movements, but I will say this: when an outstanding business trades at a meaningful discount to its intrinsic trajectory because of temporary market anxiety or growth-rate deceleration fears, that is precisely the kind of opportunity I have found most rewarding over my career.
Thesis: Strengthening. Conviction: Very High.
Q4 FY26 confirmed and strengthened every pillar of my investment thesis. Revenue beat massively. Net new ARR accelerated to a record. Management demonstrated candour, succession depth, and long-range thinking. The identity product exceeded expectations. Agent Cloud reached GA with blue-chip partnerships. Margins improved. FCF exceeded guidance by 18%. SBC continued its downward trajectory.
The concern I carry forward is limited to Point 7 — employee satisfaction at 3.5 Glassdoor is adequate but not consistent with a company aspiring to greatness. This is the area I would probe most aggressively in future scuttlebutt. Everything else — growth trajectory, management quality, product innovation, competitive positioning, financial discipline — is tracking at or above what I would require.
If the job has been correctly done — and I believe it has — the time to sell is almost never. Rubrik is a company I would hold through the inevitable quarterly fluctuations and the growth-rate deceleration that accompanies scale. The business is being built by management that is creating its future, not waiting for it.
Sources: