Rubrik, Inc.

Good afternoon, ladies and gentlemen, and welcome to the rubric third quarter fiscal year 2026 results conference call. At this time, all lines are in listen-only mode. Following the presentation, we will conduct the question and answer session. If at any time during this call you require immediate assistance, please press bar zero for the operator. This call is being recorded on Thursday, December 4th of 2025. I would now like to turn the conference over to Melissa Franke, VP, Head of Investor Relations. Please go ahead.

Hello, everyone. Welcome to Rubrik's third quarter fiscal year 2026 financial results conference call. On the call with me today are Bipul Sinha, CEO, chairman and co-founder of Rubrik, and Karen Chowdhury, Chief Financial Officer. Our earnings press release was issued today after the market closed. and may be downloaded from the investor relations page at www.ir.ruberk.com. Also on this page, you'll be able to find a slide deck with financial highlights that, along with our earnings release, includes a reconciliation of GAAP to non-GAAP financial results. These measures should not be considered in isolation from or as a substitute for financial information prepared in accordance with GAAP. During this call, we will make forward-looking statements, including statements regarding our financial outlook for the fourth quarter and full fiscal year 2026, our expectations regarding market trends, our market position, opportunities, including with respect to generative AI, growth strategies, product initiatives, and expectations regarding those initiatives, and our go-to-market motions. These statements are only predictions that are based on what we believe today, and actual results may differ materially. These forward-looking statements are subject to risks and other factors that could affect our performance and financial results, which we discuss in detail in our filings with the SEC. Rubrik assumes no obligation to update any forward-looking statements we may make on today's call. With that, I'll hand the call over to Bitful.

Thank you, Melissa, and thank you all for joining us today. Let me start by saying our third quarter results were exceptional. Every quarter for the past several quarters, we have successfully delivered, in many cases, record numbers. In fact, this quarter has been our best ever. We have not only added record net new subscription ARR, but also generated tremendous free cash flow. And I'm happy to report we once again exceeded all guided metrics across top line and profitability. Here are five key numbers. First, subscription ARR reached 1.35 billion, growing 34% year over year. Net new subscription ARR reached a record 94 million. Second, our subscription revenue was 336 million growing 52% year-over-year. Third, our subscription NRR remained strong, once again, above 120%. Fourth, customers with 100K or more in subscription ARR reached 2,638, growing 27% year-over-year. And finally, On profitability, we once again made material improvement in subscription ARR contribution margin up about 1400 basis points year over year. We generated a record 77 million in free cash flow this quarter. This combination of top line growth and cash flow margin at our scale is best in class. We remain confident about the opportunity ahead And thus, we are again raising our outlook for the year. But let me begin by providing some additional context on our market opportunity as well as our areas of focus. Our mission is to lead Rubrik into our next era as the, let me repeat, the security and AI operations company. My discussions with IT and security leaders consistently reveal and assume breach mentality, which means being prepared for the inevitable reality that every enterprise will face a successful cyber breach. This preparation includes two things. First, understanding the risk of a cyber breach in terms of both data content and identities. And second, the ability to remediate and recover from the breach to ensure business continuity. But the landscape in which these threats occur has dramatically evolved. Organizations are now facing a new cyber landscape, with AI potentially enabling threat actors to inflict 10x more damage in one-tenth of the time. Alongside these challenges, enterprises are also focused on modernizing their infrastructure in anticipation of the impending enterprise AI transformation. While AI presents 100 times more risk, the AI transformation promises 100 times more opportunities, much like every big generational shift in enterprise technology. When cloud redefined IT, Rubric ensured simple and reliable recovery. When cyber threats surged, we extended our Rubric Security Cloud product suite across data and identity to deliver true cyber resilience. Now, with the rise of AI agents, a new transformation is underway. AI transformation presents unique challenges. An agent operates within an organization's environment runs business processes, assumes identity, touches critical data, and impacts mission-critical applications at unprecedented speed and scale. These agents are effectively superhuman. But organizations don't yet have the guardrails to monitor and contain what they do. We need to think about AI agents very differently. Through this AI transformation, Rubrik's mission and strategy remains the same to accelerate our customer's journey to AI enterprise. I will delve deeper into our AI agent innovations later in my remarks. As companies shift deeper into cloud and AI, customers continue to turn to Rubrik for complete cyber resilience, which includes two key set of capabilities. First, consistent data and identity security policy controls. And second, rapid and accurate recovery from cyber attacks. While we believe we have a tremendous opportunity in enterprise AI acceleration, we continue to focus on and win the vast cyber resilience market, which includes our core data protection solutions and identity resilience. Let me provide some more details across our three businesses, data protection, identity resilience, and AI operations. Our cyber resilient data protection journey remains in its early stages, particularly as data availability and security become the most crucial element for AI. We continue to add new solutions across data center, cloud and SAS workloads, leveraging the same underlying preemptive recovery engine to deliver complete risk and remediation capabilities. Our unique architecture consistently enables us to outperform both legacy and new gen backup vendors. In fact, In the third quarter, bookings from legacy replacements accelerated year on year, surpassing the growth rate seen in the first half of the year. Let me provide two specific examples of legacy replacements in very large enterprises. First, one of the largest banks in Asia and worldwide selected Rubrik as their strategic cyber resilience partner, replacing a long-standing legacy vendor. We out-competed several new gen backup vendors for this opportunity. Rubrik's platform now provides data protection across its data center and cloud workloads for mission-critical applications. The customer also chose the Rubrik identity recovery solution for over 250,000 users. And the second, a Fortune 250 professional services firm selected Rubrik to displace its 15-year legacy backup vendor. Rubrik again out-competed several new gen competitors for this opportunity. Rubrik will provide a unified cyber resilience platform across the customer's rapidly evolving hybrid and multi-cloud environments. Let me now talk about the momentum we are seeing in cloud protection. When a sophisticated cyber attack inevitably occurs, Organizations need to recover quickly and seamlessly, which is difficult across multiple workloads, tools, and interfaces. Rubric Security Cloud delivers complete cloud and SaaS protection from a single platform that understands the relationship among data, applications, and identities, regardless of where they live. We continue to build upon our Code2Cloud cyber resilience offerings, which delivers protection from the first line of code to full stack application in production across the major hyperscalers. For example, we recently announced Rubik DevOps protection for Azure DevOps and GitHub. This new solution is designed to ensure our customers' most valuable intellectual property and development pipeline are protected and preserved. Now, let me illustrate our momentum in cloud protection with two specific customer wins. A health and wellness technology company chose Rubrik cloud protection to protect a multi petabyte mission critical workload containing user data. Rubrik offered not only cyber resilience, but also a significant cost reduction compared to cloud native backup solutions due to our unique platform. With Rubrik, this customer can confidently meet their minimal viable business plans with our immutable and secure data protection solution. And second, a Fortune 150 biopharmaceuticals company is trending their partnership with Rubrik this quarter by adding cloud protection for its multi petabyte public cloud data estate. We not only replaced native backup solutions, but also out-competed new gen vendors. Rubrik was selected due to the strength of our cyber resilience capabilities, as well as lower TCO with an estimated 30% annual cost savings. Next, let's talk about our identity business. As we have discussed, our comprehensive identity resilience platform uniquely combines identity posture and recovery with the data security posture management or DSPM to deliver complete identity risk and remediation solutions. Our identity line of business has been highly successful in garnering budget from CISOs. extending rubric beyond our traditional CIO and CTO buying personas. This business has achieved significant momentum in just over three quarters of the first general availability, reaching about 20 million in subscription ARR. In Q3 alone, we more than doubled the total number of identity customers. In fact, 40% of those identity customers added in the third quarter were net new to Rubrik. As you might recall, we started our identity journey with the release of Identity Recovery, which provides the rapid recovery of identity services following cyber attacks or operational failures to minimize business disruption. This quarter, we announced support for Okta Identity. making Rubrik the only identity recovery solution to support Okta, Active Directory, and ANTRA ID recovery. We also announced a new identity integration with CrowdStrike this quarter. With this integration, our customers can not only detect identity threats in real time with Falcon Next-Gen Identity Security, but also surgically roll back malicious changes and restore their identity system to a safe operational state with Rubrik Security Cloud. CISOs are increasingly turning to Rubrik for a more comprehensive identity strategy. This quarter, we launched Rubrik Identity Resilience, a higher tier edition above Identity Recovery. This solution monitors and protects both human and non-human identities, tracks misconfigurations, and high-risk or malicious changes within Active Directory and ANTRA ID. It also enhances risk posture and accelerates cyber recovery by linking identity-based information such as privileged access with rubrics DSPMs, sensitive data context, and activity. In just one quarter of selling, we closed 65 deals for identity resilience. This early momentum makes us very excited about what's ahead for identity resilience. Let me share two illustrative customer wins. A UK government agency added identity resilience for its large user base alongside cloud data protection for Azure and AWS as they sought to bolster resilience for critical national infrastructure amid rising cyber attacks in the UK. This agency also consolidated several disparate tools with the Rubrik platform and replaced native cloud backup solution, which proved unescalable for the customer's massive and complex data state. And second, a US state agency turned to Rubrik this quarter after the rise of cyber attacks on governments nationwide. And in particular, after a recent incident that impacted a critical state agency. Seeking to bolster its cyber strategy and reduce recovery times, the agency chose Rubric Identity Resilience and M365 protection for 100,000 users, replacing their native cloud protection and traditional data center identity backup. With Rubric, cyber recovery times will move to mere hours compared to months with the incumbent solution. Lastly, I will talk about our innovations in the AI space. As I mentioned earlier, agentic AI can unlock significant new efficiencies for every organization. but it also introduces considerable risks, including threats by bad actors and the issue of hallucinations. To help accelerate AI transformation, we recently launched Rubric Agent Cloud or RSE, a new product suite that enables enterprises to deploy AI agents safely and confidently at a scale. With the release of Rubric Agent Cloud, Rubrik now operates two complementary product suites built on the same Rubrik platform, which combines application, data, and identity contexts across all enterprise workloads. First, Rubrik Security Cloud for cyber resilience and accelerated cloud adoption. And second, Rubrik Agent Cloud for AI resilience and accelerated AI agent adoption. Our competitive advantage is Rubik's core platform that sits in the center of data application and identity. Following the acquisition of Prediway's last quarter, we now have agent context in the mix as well. Together, this forms Rubik Agent Cloud, the first integrated enterprise control layer for managing the AI agent lifecycle. RHC answers the three most critical questions currently facing every CIO and CISO. Number one, what agents do I have and what are their capabilities and activities? Number two, what data are these agents allowed to access and are they operating within the enterprise guardrails? And number three, if something goes wrong, Can I undo it? RSE provides organization with the ability to answer these questions through its core capabilities, namely agent monitoring, agent governance, and full agent remediation. This includes rubric agent rewind, which we announced last quarter. Agent rewind helps customers undo the mistakes of AI agents, which is crucial for scalable and secure AI adoption. We also recently announced that Rubik Agent Cloud will integrate with Microsoft Co-Pilot Studio and AWS Bedrock. As we have said previously, we are still in the initial phase of a multi-year effort to scale Rubik's AI solutions. Rubik Agent Cloud is currently in beta but we are very excited about the early customer enthusiasm. Looking ahead, we plan to expand our capabilities and investments to enable confident enterprise AI transformation and agentic work adoption. In closing, I would like to share my gratitude to my fellow Rubricans. Rubric continues to win the cyber resilience market And at the same time, we are defining the AI enterprise future. Rubicon's collective focus and disciplined execution always inspire me. Also, I extend my sincere gratitude to our customers and partners. Your confidence in us motivates our continuous effort to lead and shape the future of cybersecurity and enterprise AI. And lastly, of course, thank you to you, our shareholders, for your continued support and trust. A number of you have mentioned to me the consistency with which we have been delivering the beat and raise cadence since our IPO. This is true. We have done so quarter after quarter. We are confident in closing out this year strong and continuing our great momentum into the next year and beyond. With that, I am pleased to pass it over to our Chief Financial Officer, Kiran Chaudhary.

Thank you, Bipol. Good afternoon, everyone, and thank you for joining us today. We had a very strong Q3, marked by record net new subscription ARR and continued improvement in profitability metrics. These results reinforce our leading position in the large and expanding cyber resilience market. We are raising our Q4 outlook as we look forward to a strong close to the fiscal year. Let me start by briefly recapping our third quarter fiscal 2026 financial results and key operating metrics, and then I'll provide guidance for the fourth quarter and full year fiscal 2026. All comparisons, unless otherwise noted, are on a year-over-year basis. We are very pleased to have ended Q3 with subscription ARR of $1.35 billion, growing 34%. We added $94 million in net new subscription ARR, a record amount for Rubrik. We continue to drive adoption of our Rubrik security cloud, which resulted in $1.17 billion of cloud ARR, up 53%. Our differentiated land and expand model benefits from multiple avenues to gain new customers and grow our footprint after the initial contract. Expansion occurs through data growth in existing applications, securing more applications or identities, or adding more security products. As a result, we continue to see a strong subscription net retention rate which remained over 120% in the third quarter. We are very proud of the high customer retention and expansion dynamics of our business. All vectors of expansion are healthy contributors to our NRR, highlighting the meaningful runway we have to more deeply penetrate our customer base. Adoption of additional security products contributed over 40% of our subscription net retention rate in the quarter, up from 32% in the year-ago period. In the third quarter, we saw significant growth in our largest accounts, with the number of customers contributing $100,000 or more in subscription ARR rising 27% to 2,638. These large customers now represent 86% of our subscription ARR, an increase from 83% a year ago. Furthermore, we added a record 23 new customers with subscription ARR of $1 million or more, driving over 50% growth in our $1 million subscription base. For our third quarter, subscription revenue was $336 million, up 52%. Total revenue was $350 million, up 48%. Revenue in Q3 primarily benefited from a strong ARR growth. However, we again had tailwinds from our cloud transformation, resulting in higher non-recurring revenue, which is accounted for as material rights. Material rights contributed approximately $25 million to revenue this quarter, modestly ahead of our expectation. Revenue growth normalized for material rights was approximately 36% in the quarter. Turning to the geographic mix of revenue, revenue from the Americas grew 51% to $256 million. Revenue from outside the Americas grew 41% to $94 million. Before turning to gross margins, expenses, and profitability, I would like to note that I'll be discussing results in a non-GAAP basis going forward. Our non-GAAP gross margin was 83% in the third quarter compared to 79% in the year-ago period. Our gross margin benefited from the revenue outperformance, including higher non-recurring revenue and the improved efficiency of our customer support organization. As a reminder, we look at subscription ARR contribution margin as a key measure of operating leverage. We believe the improvement in our subscription ARR contribution margin demonstrates our ability to drive operating leverage and profitability at scale. Subscription ARR contribution margin was positive 10% in the last 12 months ended October 31st compared to negative 3% in the year-ago period, an improvement of approximately 1,400 basis points. When normalizing for the $23 million in employee payroll taxes associated with the IPO in the prior period, the improvement was approximately 1,200 basis points. The improvement in subscription ARR contribution margin was driven by higher sales, the benefits of scale, and improving efficiencies and management of costs across the business. Free cash flow was $77 million compared to $16 million in the third quarter of fiscal 2025. This increase was driven by higher sales, improving operating leverage, and optimizing our capital structure. Turning to our balance sheet, we ended the third quarter in a strong cash position with $1.6 billion in cash, cash equivalents, restricted cash and marketable securities, and $1.1 billion in convertible debt. Let me now provide some context on our guidance. We are confident in our outlook driven by the robust cyber resilience market and strong demand for our unique offerings. We expect these factors combined with our consistent and effective execution to deliver strong subscription ARR growth ahead. We plan to continue making operational investments across two key areas. First, we'll continue to invest in R&D to accelerate innovation in the large but developing markets of data, security, and AI. Second, we will invest in our go-to market, specifically targeting regions and verticals that offer the most attractive ROI. These go-to market investments will also focus on achieving product market fit and scaling our newer innovations such as identity resilience platform and rubric agent cloud. Now turning to guidance for the fourth quarter and full year fiscal 2026. In Q4, we expect revenue of $341 million to $343 million up 33% or approximately 30% when normalized for material rights. We expect non-GAAP EPS of negative 12 cents to negative 10 cents based on approximately 201 million weighted average shares outstanding. For the full year fiscal 2026, we now expect subscription ARR in the range of 1,439,000,000 to 1,443,000,000, reflecting a year-over-year growth rate of approximately 32%. We expect total revenue for the full year fiscal 2026 in the range of $1,280,000,000 to $1,282,000,000, up approximately 44% or 35% when normalized for material rights. We expect material rights related to our cloud transformation to contribute approximately $68 million to revenue in fiscal year 2026. We expect non-GAAP subscription error contribution margins of approximately 9%. We expect non-GAAP EPS of negative 20 cents to negative 16 cents based on approximately 197 million weighted average shares are standing for the full year. We expect free cash flow of $194 million to $202 million. As we progress through the final stages of our successful cloud journey, our reported revenue growth has seen significant tailwinds from our cloud transformation, including material rights, in fiscal 2026. In fiscal 2027, dynamics related to a successful cloud transformation and a substantial reduction in material rights revenue will represent a headwind to our reported revenue growth. As a result, we anticipate that revenue growth on a reported basis will lack subscription ARR growth by a few percentage points in fiscal 2027. However, normalized revenue growth will be ahead of subscription ARR growth. As we have always communicated, subscription ARR is the primary top line metric to evaluate our business performance as it is not impacted by the aforementioned accounting dynamics related to our cloud transformation. In terms of profitability, we will continue to stay focused on taking advantage of the market opportunity in cybersecurity and AI while balancing growth with improved efficiency. Based on our current investment plans, we expect to deliver modest improvement in our subscription ARR contribution margin and modestly high free cash flow for the fiscal year 2027. In addition, we included some additional modeling notes in our investor presentation. In closing, we are pleased with our strong performance in the third quarter. We look forward to finishing the year strong given our leadership, innovation, and ability to execute on a large and growing market opportunity. With that, we'd like to open up the call for any questions.

Thank you. Ladies and gentlemen, we will now begin the question and answer session. Should you have a question, please press R1 on your touchstone phone. You will hear a prompt that your hand has been raised. Should you wish to decline from the polling process, please press R2. If you're using a speakerphone, Please lift the handset before pressing any keys. In the interest of time, please limit yourself to one question. One moment, please. Your first question comes from Suket Kalia of Barclays. Your line is already open.

Okay, great. Hey, guys, thanks for taking my question, and nice quarter. Thank you. Thank you. Absolutely. Vipul, maybe for you, it's very clear that you're taking share in kind of the core cyber resilience, right, that first of three pillars. But you're also growing other businesses like identity. And so I'm curious, how additive can identity be to an average data protection deal? And maybe relatedly, is identity replacing any established tools Or is that creating new budget as you sell increasingly to CISOs? Thanks.

Identity is completely additive to the deal. So it is a net new buyer for Rubrik. We are selling identity to the CISO organization, to IAM persona. And in some cases, we are replacing legacy or new gen vendor. a new gen identity recovery vendor. In other cases, it's a white space. Nevertheless, it's a net new buyer for Rubrik, which is a CISO organization, and a net new solution that we have created completely from scratch. In fact, this product went into GA, first GA, in December last year. And we are seeing 40% of new customer last quarter is net new to Rubrik. So this is very exciting.

Hi, Saket, this is Kiran. I also wanted to add that in my prepared remarks, I'd mentioned that our NRR was again 120% plus for the quarter. And while all the drivers were good contributors, the security component crossed 40%. And identity is one of the key components of that, the drivers for that.

That's super helpful. I would love to squeeze in just one housekeeping question here and maybe if I can for you. You know, the SAS ARR line really speaks for itself, but I was wondering if you could just comment on the non-SAS ARR line, right? There's an element of there that's conversion. There's also some natural churn. Since we're all together here on the call, can you just talk about how we should think about modeling that going into Q4 and maybe into next year? Thanks.

Sure, Saket. I'll add my thoughts to that. So as you know, we are predominantly a cloud SaaS business now. We are very pleased with how the cloud transformation has progressed in the last few years. This quarter, we were around 87%. Cloud ARR is a percent of the subscription, and we grew 53%. When you look at the non-cloud, Ryan, that is one of the lines which is also contributing to the cloud ARR growth, one of the smaller components but is contributing. So as a result, That declines, and that's declined now for a few quarters, and we'll continue a bit more because we believe there is more room to run in our cloud ARR, the cloud business as opposed to their subscription ARR.

Very helpful. Thanks.

Any second.

Your next question comes from Matt Martino of Goldman Sachs. Your line is already open.

Thanks a lot. Yeah, thanks for taking the question, guys. Vipul, your comment that bookings from legacy replacement accelerated year over year stood out to me. I guess from your perspective, what's driving the acceleration there? Is it the modernization ahead of AI that you flagged in the prepared remarks or maybe a growing recognition from CIOs that they simply can't wait to modernize due to the growing threat factors out there? Thanks.

Thanks. It's both. It's definitely preparing for AI and modernizing the infrastructure. That's a big driver. And the other driver is cyber attacks are inevitable. And Rubrik has a unique platform that delivers cyber recovery, leveraging our preemptive recovery engine that is unique in the marketplace. And our speed of recovery is the key factor in making this decision. So CIOs and CISOs are looking at their legacy landscape, including new gen vendors, and saying that I'm at risk, cyber attacks is going to come to me. And if I can't keep my business up and running, it threatens the very existence of the business. And that's what is also driving legacy replacement. Thanks, Matt.

Your next question comes from Fatima Bulani of Citi. Your line is already open.

Oh, good afternoon. Thank you for taking my questions. This one I want to direct to you. Since your IPO, there has been an absolute avalanche of new product introductions and new capabilities, and you are showing and putting points on the board with respect to install base and new customer uptake and adoption. What I wanted to ask you was just with respect to the platform having expanded so dramatically in the span of the last 18 months, I'm curious how that's influencing your overall sales strategy. And really the spirit of the question here is what's become very en vogue in certainly the companies we cover in the broader enterprise software is this notion of providing flex. or consumption-oriented type vehicles to enable customers to have a more fulsome and frictionless access to the full portfolio. So a long-winded way to ask you, is that something that you would potentially consider just given how quickly and how robustly the platform's expanded and how would you ideate around that? Thank you.

Thanks, Fatima. So if you look at Rubrik from day one, our strategy has been a true platform company. And you might ask, what is a platform company? Our definition of a platform company is a product, a platform when the customer adopts more than one product, their value from the platform goes up. I'll give you an example. When our customers buy Rubik Security Cloud for both data center as well as AWS or Azure Cloud, if there is a threat actor in the cloud and same threat actor is in the data center, we can auto-correlate threat and give you the full cyber resilience intelligence and recovery on that threat actor. You don't have to pull the logs into a splunk and then try to analyze and figure out what's going on. Rubik automatically does that for you. Now the same platform is expanded into identity. So now you can actually see what's happening to your identity with service data when the privilege gets escalated. Now the same platform, we have launched a new product suite in Rubik Agent Cloud. So now we have two distinct product suite, Rubik Security Cloud for cyber resilience, Rubik Agent Cloud for enterprise AI acceleration. So our strategy has always been give customer a comprehensive platform and be the strategic IT vendor for that customer for years and years to come. Obviously, we want to make it easier for our customers to consume Rubik product, try new Rubik product. And we don't easily lose customers because we provide a mission critical solution and customer retention has been one of the hallmarks of Rubik. So we are looking at all avenues going forward to make it easier for our customers to adopt Rubrik, consume Rubrik, because selling is only 5% of my job. 95% of my job is to ensure customer delight, the first use experience, repeated use experience, expansion experience, and providing end-to-end cyber resilience.

Okay, thank you, Katina. Next question.

Your next question comes from John DeFucci of Guggenheim. Your line is already open.

Thank you. Thank you. This is an impressive quarter, and I'd just like to congratulate the extended Ruber team, beyond even those on this call. Bipple, I want to sort of go high level with you on something, because you hit something that everybody's hitting. now, and we are just trying to figure out. It seems really early when it comes to securing AI agents, but things can move really fast. It seems that everybody in security is saying they're best positioned to serve this role, which looks like it can be huge, right? But can you explain why Rubrik is well-positioned to capture this opportunity, or maybe even just part of the opportunity? If that's the case, what else do customers need? What else will they need to have beyond rubric to solve this problem?

Thanks, John. That's a really good question. If you take a step back, rubric is all about data, identity, and business applications. And these are the three main things, even to deliver AI. AI is not a purely security question. Neither it is purely operations question. AI sits at the intersection of security, which is risk management and governance, plus the operations, which is how do you deliver the accurate AI? How do you fine tune the model? How do you create real time operational guardrails and observability and undo action if they misbehave because of cyber compromise or hallucination? And Rubrik is squarely at the intersection of operations and security. So this is a natural place for us to deliver a complete agentic operations platform, agentic management platform. If I can be so bold to call it agentic ERP. And what does agentic ERP means to deliver? Three things. How many agents do I have? including the ones that is sanctioned as well as the ones that are non-sanctioned. What the hell they are doing? What do I want them to do in terms of my operational guardrail? Are they hallucinating? Can I make them more accurate so that humans can be confident of the results of the AI agents? And if they misbehave, can I press the rewind button and take away the effect of them, of misbehaving agents? So this requires an end to end complete platform across monitor govern and remediate. So this is a very natural extension to rubric score strategy. And you know what on top of it rubric is also a secure data lake. So we have additional opportunity to bring rubric data. to do fine tuning of the model to deliver more accuracy with previous acquisition. We have the ability to virtualize GPU to reduce the cost or to multiplex different training model to be able to deliver perfect guardrail for our customers to have confidence in their agentic actions. So we believe that we are strongly positioned to deliver this new infrastructure product suite rubric agent cloud. And then we are integrating this across the ecosystem. You saw our announcement with copilot studio with AWS bedrock. We are extending and expanding this platform across all the tools that users can have can use to build agents. And this is again a surgical and opportunity, just like cyber resilience across all business applications. rubric agent cloud is product suite across all agent tool builders, whether it's AWS, Azure, GCP, M365, Salesforce, Agentforce, no matter whether it is infrastructure as a service agent or platform as a service agent, Rubik Agent Cloud is giving our customers the confidence to do the AI transformation, deploy agents at a scale, and truly take advantage of this AI opportunity.

Thank you, people. That actually, that is the first time I've heard anything about this described in a way that I understand. So, thank you very much.

Thank you, John. Next question.

Your next question comes from Brad Zelnick of Deutsche Bank. Your line is already open.

Excellent. Thank you so much for taking the question, and I echo my congrats as well. What a great quarter. And my question actually follows on what John just asked about rubric agent cloud, you know, across monitor, govern, and remediate. And I reflect on the announcement this week, adding Amazon Bedrock, along with Copilot Studio support. Bibble, how are these partnerships structured with the AI platforms? Is there co-innovation, investment, excuse me, and go-to-market and co-innovation on product? And what are the ways you'll monetize RiverAsian Cloud along with the platforms. Thank you.

Thanks, Brad. We have been working with hyperscalers for a number of years. And our initial, our big partnership started with cyber resilience and we have found tremendous success. We have hundreds, if not thousands of customers with them and joint customers where we are helping hyperscalers deliver a complete business transformation, cloud transformation with confidence of cyber resilience. And now we are expanding on that partnership to bring Rubric Agent Cloud. And so the idea is, If you develop your agents on AWS Bedrock or on Copilot Studio, you can manage that on Rubric Agent Cloud. And so we have pre-built go-to-market partnership with hyperscalers, and we expect to leverage those existing infrastructure with the new teams that are involved on the AI side to expand the go-to-market.

And from a monetization standpoint, Bipul, These are dedicated SKUs that are incremental. The strategy isn't necessarily to, you know, to migrate customers up different tiers of the, you know, of the core product. Is there anything we should know about the way that you'll monetize?

So rubric agent cloud is a completely separate product suite. It is early where the product is in beta. but we are getting very strong customer feedback on these products. I'll give you a couple of examples. A very large healthcare organization said that they are slow to adopt agents because they have yet to find a platform that they can confidently operationalize agents, which means that monitor and have visibility into agents. There was another pharma company where the exec said, that why are we not having a product like Rubric Agent Cloud already? And they said that they see our vision as really enabling them to an agentic future, and this is the right idea. Obviously, all of this is very early, but we are very encouraged by the reaction, and obviously we'll update you as we make progress, but I anticipate this to be a separate product suite that we'll sell.

Very exciting stuff, and again, congrats to everybody. Thank you.

Thank you, Brad. Next question.

Your next question comes from Eric Heath of KeyBank. Your line is already open.

All right, great. Thank you. I wanted to follow up on your comments about the strong B and raise cadence that you've acknowledged and the outlook for Q4. When I look at the guide, it's shown a seasonally stronger growth rate than 3Q, which hasn't historically been the case. So can you just talk about that dynamic there? Is that purely a function of the sales comp change this year, or is it more so a reflection of a strong pipeline you see, or anything else to call out? Thanks.

Thanks, Eric. This is Kiran. I'll take that one. So we're very pleased with the Q2 results we delivered in terms of scale and growth. And that gave us the confidence to raise Q4 as well. It's about a 3% raise on the Net New Year R, 3% plus based on the implied Q4 guide from the last quarter's call. But as you know, we run the business on an annual basis on Net New Year R. We have spoken about that in the past as well. So we look at the total Net New Year R for the year. Really, that's what we plan for and look to deliver. So, you know, the annual comp plan changes have progressed really nicely, but we have to finish the year as well. And we can give you an update on that after Q4. Thanks, Jen.

Thanks, Eric. Next question.

Your next question comes from Greg Moskowitz of Mizuho. Your line is already open.

Great, thank you, and I'll add my congratulations on the strong execution. I'd like to go back to identity because identity recovery is off to a really strong start. And by the way, the feedback is also positive at AWS reInvent this week. Mikkel, when you look ahead, so, you know, Rubrik has many thousands of customers that you can potentially cross-sell into. And as you've noted, you're already landing with identity as well. So when you look at identity recovery and now identity resilience in addition, how are you thinking about penetration rates for this part of the platform going forward?

We believe that identity recovery is a widely applicable horizontal platform in terms of the identity security strategy that we have. And going from identity recovery to identity resilience, we are really adding before and during pieces to ensure that if there is a privilege escalation, what kind of sensitive data gets exposed to. And that's where we are bringing the DSPM capabilities with identity capabilities to expose the full risk. Because if you take a step back, cyber resilience assumes that the attacks will happen to you. So if you know that attacks will happen to you, you have to understand the risk of the attack and be able to remediate. And the risk of the attack, you need to understand data risk, and you need to understand the identity risk. Because you can't understand the full risk without understanding data and identity both. And then in terms of remediation, you have to remediate both. You have to do a cyber recovery on all the data to ensure that your applications are up and running, plus you have to also recover identity system partially or fully. So we believe that for full cyber resilience, both identity and data is applicable everywhere. Obviously, these are early days. We are just over three quarters into it. We are just about 20 million in subscription ARR. We doubled our number of customers in Q3. The customer excitement is very, very high. I'll give you an example. A European consumer technology company, they were really worried about Scattered Spider because one of their suppliers got hit. And as you know, Scattered Spider is... is detrimental to identity systems as well as virtual machines because they are bypassing the traditional EDR. So there is increased awareness of importance of identity systems, both full availability of the identity system plus the escalations which are illegal and how data gets impacted. So we have a full vision to really create full cyber resilient solution. And as we said, we are also partnering with CrowdStrike ITDR solution to provide end-to-end confidence for our customers saying that Falcon will detect and will help roll back bad changes. Super helpful. Thank you, Debo.

Thank you, Greg. Next question.

Your next question comes from Todd Hoopland of CIBC. Your line is already open.

Oh, great. Good evening, everyone. I wanted to ask about net new. That's been a little bit lumpy the last few quarters, and I'm just wondering if the acceleration that you experienced this quarter in going into Q4, is that the new normal or should this still be considered an area of volatility as we think about 27? Thanks a lot.

This is Kiran. I'll take that one. So we're pleased with the Q3. Net New Yard was a record for the company, 94 million. But the way to look at Net New Yard really in our business is on an annual basis. And that's the number we plan for when we start a year. And there's obviously shifts between quarter to quarter. because of deals, pipeline, et cetera. So I would focus on the annual number, including the guide, and then there's going to be some quarterly movements because of compares to previous years and timing.

Thank you. Thank you, Todd. Next question.

Your next question comes from Junaid Tadiki of Truist. Your line is already open.

Great. Perry, thank you for taking my question. People with cyber insurance requirements tightening and ransomware costs increasing, are you seeing Rubrik's platform play a role in lowering those insurance premiums for customers? And do you see this convergence of identity and data security becoming a differentiator for cyber insurance and compliance frameworks?

Thanks, Junaid. Absolutely. You need to have both identity resilience and cyber recovery to be able to drive complete cyber resilience. And for insurance company to underwrite, there is a asymmetry of information. And for them to have confidence that the customers have the right technology, it is definitely attractive for them to actually recommend Rubrik. In fact, one of the insurance companies, which is our customer, actually became our reseller. to their customer base based on that same thesis. We believe that we are still in the early innings of cyber resilience as the very large segment. And I would argue that the most important segment of cybersecurity. And we believe that as As this market continues to expand and as we continue to lead this market into the future around full cyber resilience across data and identity, we believe that there are lots of opportunities, including around insurance for us.

Your next question comes from Keith Bachman of BMO. Your line is already open.

Yes, ma'am. Thank you very much. I wanted to go back to the agent market. The identity market seems like a tremendous opportunity and a natural adjacency. I still struggle a little bit with the opportunities associated with the agent market, and so I wanted to just ask it in maybe some different threads. Is the go-to market going to be different for the identity? That is to say, do you anticipate it being a different buyer? in the agent market. It would seem to me that it's a different buyer, but I just wanted to get your perspective. And B, how do you think the competitive landscape is going to shape up? It's super early, and there's probably going to be more than one winner. And then finally, you know, is there any thoughts about when you might emerge from beta to actually have production environments or, you know, GA into the market? Thanks very much.

so if you look at agents they assume identity they work on data and they operate on many applications at a scale and as i said before the rubric platform is a combination of data identity and applications so we are naturally positioned to take advantage of of this agentic opportunity We are not building a platform for people to build agents. There are many platforms for them to build agents. We are helping our customers operationalize agents and have confidence and governance controls to be able to deliver the agentic outcome because that's the biggest inhibitor in terms of AI going into production. And that's what we are focused on. In terms of the market, obviously, we are early. As I said, we are still in beta. We expect to go GA not too far in future. We'll continue to learn from this market, continue to enable our customers on this journey. So far, it feels like operations team, which is CIO organization, would be responsible for a genetic work transformation across line of businesses. So there is a convergence in the buying persona. But again, it's very early. We learn in the market, but we believe that we have a very strong vision for this market. And again, as this market evolves, we want to really take our customers on this agentic journey.

Many thanks, Bipul.

Thank you, Keith.

Next question. Your next question comes from Shranik Kothari. from Baird. Your line is already open.

Yeah, thanks for taking my question and many congrats on the great execution. Bipol, you, of course, you mentioned we're launching the identity resilience this quarter and already noted pretty strong early adoption. Can you speak to the uplift versus identity recovery? And just on that note, Kiran highlighted that security represents over 40% now and was a major contributor to sustaining NRR above 120%. Just with these modules that you're adding resilience and agent cloud adding more breadth, like just how should we think about the durability of that NRR? Thanks.

Kiran, do you want to take the question?

Yeah. So, Srinik, this is Kiran. I'll just give you some thoughts on how to think about the NRR. NRR. So obviously we have had and continue to have strong NRR, 120% plus, which we see as best in class. And our business lends itself to strong NRR. We have a very strong gross retention. And this has been the case historically. And on top of that, we have multiple expansion vectors through different products. And that helps drive the strong NRR. But at the same time, we are scaling as a business with the strong growth rates and, you know, what, 1.35 billion in subscription error this quarter. So naturally, NRR tends to moderate over time at scale, but it'll be a strong NRR just given the drivers of the business. And then on the question you have on identity resilience, I would say it's early. We have just launched it. Obviously, that has got more features packed into it, so there will be a price uplift, but I think we need more data points to give you a sense for the amount of uplift.

Great. Very helpful. Thanks a lot. Congrats again.

Thank you. There are no further questions at this time. I would hand over the call to Bipul Sinha for closing remarks. please go ahead.

In closing, I would say thank you, everyone, for continuing to be on rubric journey. As I've mentioned before, our ambition is to build the next 100 year plus company. And that 100 year plus company will be built based on all participants in the ecosystem to our customers to our partners, all the rubricans, and our ability to continue to lead the market, imagine new product, validate that vision and produce the product. I'm very excited that Rubrik is able to organically create products such as identity resilience and identity recovery and create an independent product line and business. We want to continue to be on this journey with you. Thank you so much for your support. It's still early days for Rubrik. Look forward to talking to you soon.

Ladies and gentlemen, this concludes today's conference call. Thank you for your participation, and you may now disconnect.