Rubrik, Inc.

Moat: 2/5

Understandability: 3/5

Balance Sheet Health: 4/5

Rubrik, Inc. is a cybersecurity company that provides a cloud data management platform. They specialize in ransomware protection and data recovery.

Investor Relations Previous Earnings Calls

The moat, understandability, and balance sheet health scores reflect a conservative evaluation to ensure a margin of safety in any assessment.

Business Overview: Rubrik’s core offering is a cloud-based data security platform designed to help organizations manage and protect data across various environments including on-premise, cloud, and SaaS applications. Their primary focus is on ransomware protection, data recovery, and security compliance, offering a modern approach to data management that contrasts with legacy methods. The company’s main products include:

Data Protection: Security for all data sources across enterprise, cloud and SaaS, including access controls and secure backups.
Data Threat Analytics: Detects data threats through analytics, patterns, and AI-based threat hunting.
Cyber Recovery: Orchestrates recovery workflows following cyber incidents, including automatic restoration.

Revenue Distribution: The company primarily generates revenue through subscriptions to their data security solutions. These subscriptions may include various components and may vary depending on the specific needs of the customer. Other sources of revenue include professional services. Historically, the company mainly focuses on large enterprises, however, they are slowly starting to focus on more mid-market accounts. This is because of the increasing need for advanced security in mid-sized organizations.

Trends in the Cybersecurity Industry: The broader cybersecurity industry is experiencing rapid growth driven by the increasing frequency and severity of cyber attacks, particularly ransomware, a big growth driver for Rubrik. Moreover, new regulations in data privacy and compliance, and the growing need for digital transformations in various industries are pushing the need for the services like the ones RBRK provides. The demand is high because there are still vulnerabilities in the way businesses are handling data, including a lack of visibility, difficulties in data backup, and lack of fast data recovery.

Competitive Landscape: The cybersecurity sector is intensely competitive, featuring a range of established players and emerging startups.

Large competitors: These include well-established companies, such as Veeam, Cohesity, Commvault, Zerto, Rubrik must compete on different aspects, such as security features, integration options, scalability, automation, and their respective brand recognition.
Smaller companies: In the data protection sphere, there are also newer players using cloud or AI to gain an edge, which means that Rubrik constantly needs to innovate, adapt to latest technologies and trends, and protect itself from new disruptive strategies and technologies.

What Makes Rubrik Different? Rubrik differentiates itself by providing a “Zero Trust Data Security” approach, emphasizing data resilience, threat analytics, and rapid recovery. Their approach centers on providing a single platform that can manage data across multiple environments and has a cloud-native architecture. Also, the company heavily focuses on having the capacity to analyze large amounts of data to detect threats and patterns quickly, and by having “zero trust” elements which reduce the attack surface. This makes them stand apart from traditional solutions that work separately, causing integration problems and more complexity.

Financials: Let’s analyze the financials of RBRK. The main sources of information are their SEC fillings (especially 10-Q’s) and information given during earnings call. The most recent 10-Q that the company filed is for their Q3 fiscal year, ended on October 31, 2024.

Revenue: Rubrik is growing at high pace. Subscription revenue for Q3 was $172 million, up 41% year-over-year. Subscription Annual Recurring Revenue (ARR) was $740 million. Although revenue was high, the company still suffers from negative margins. The subscription revenue accounts for the vast majority of the total revenue.
Cost of revenue: Cost of Revenue is related to subscription services, product support, and professional services. Subscription is by far the biggest component. Costs of subscription are significantly increasing. The Gross margin has decreased 4 percentage points year over year, with a current value of 64% (non-GAAP). It shows that although the revenues are high and growing, they are very costly to maintain.
Operating expenses: R&D expenses are $136 million, compared to sales and marketing expenses which are at $146 million. R&D has a higher growth rate, indicating the company is investing significantly in product development. There was a significant increase in Sales and Marketing costs, which means that they are trying to acquire customers quickly, which is expected in a high growth company. G&A costs were $49.5 million. The total operating expenses are $331 million, which is far more than the revenue, as the company is still not very efficient and profits are still in the future.
Income tax: The company had a 76 percent negative income tax as there were deferred assets.
Net income/loss: The company had a net loss of $154 million, which is a major indicator that profits are still not in the near future. While revenues are high and growing at high pace, the company needs to work on decreasing expenses.
Cash: The company generated a negative cash flow from operations, amounting to $27 million, while spending about $56 million on capital expenditures, which mostly consist of purchases of software and data centers. This creates a negative free cash flow. In order to finance this, the company is taking financing through convertible debt or sales of equity. Cash position was $852 million (including restricted cash).

Recent Concerns:

The company has high operating expenses, and it is currently not profitable. This means that if the revenues do not continue to grow rapidly, the business could fall into distress.
The company is also experiencing increasing pressure from the competitors. They are also facing a high litigation risk.
The company is heavily reliant on its subscription revenue, so if the customer acquisition rate slows down, it could significantly affect performance.
High share-based compensation costs, which do not help the bottom line.

Risks: Several factors could threaten Rubrik’s economic moat:

Technological Disruption: The cybersecurity industry is constantly evolving. New technologies and innovative approaches from competitors can quickly erode Rubrik’s competitive advantages, and render parts of their business obsolete.
Industry Consolidation: If bigger players start to acquire other smaller players, it could lead to an imbalance of power and reduced influence, and even create higher competition for RBRK as a mid-sized company.
Data Security Breaches: Data breaches in their or third-party software could destroy the trust that customers have placed in them. This might lead to loss of clients, and it will be very hard to recover from that.
High Competition: Intense competition from large and established cybersecurity companies who have greater resources and established products, and newer companies with innovative technologies.
Dependence on Key Personnel: The company’s success depends heavily on its senior executives and skilled sales staff. The loss of one or more members could have negative effects.

Balance Sheet Health: The company has a high cash position of about $852 million, most of which is unrestricted. This means that even if they are not able to generate cash flow, they will still be able to operate for a couple of years without external financing. The current assets are also much larger than the total current liabilities. There are significant debt obligations (around $1.2 billion), in both long term debt and short term. All this considered, their balance sheet is reasonably healthy. Rating: 4/5

Understandability: The business itself is easy to understand. They provide a data security platform, which primarily protects from ransomware attacks. While this is clear, the method behind this data security is quite complex, as it involves complicated software. Moreover, their financial results are hard to predict, as they involve projections into the future. Their financials are complicated because they often need adjustments, such as non-GAAP metrics. This makes the company harder to fully understand. Rating: 3 / 5

Finally, it is important to note the company has received a lot of positive feedback on its platform and high growth rates. It is still very early for the company, and while they are generating more revenues, they also need to start showing profitability and efficiency, and also focus on the long-term viability of their economic moat.