Rubrik reported Q3 2026 earnings after the market close on 4th December 2025.
Revenue: $350.166M v $320.51M est. (+48% YoY, +13% QoQ) 🟢
EPS (Non-GAAP): $0.10 v -$0.17 est. (+148% YoY, +433% QoQ) 🟢
Selected Key Metrics
2,638 customers with $100K or more in subscription ARR, up 27% year-over-year
GAAP Gross Margin: 80.5%, 6th consecutive quarter of increase
NPS remains in the top 1% of SaaS businesses
Table of Contents
Introduction
Financials
Guidance
Product Development
Management Commentary
Concluding Thoughts
1. Introduction
Rubrik is an American cloud data management and data security company based in California. It started as a challenger to traditional storage and disaster-recovery vendors, but has since evolved into a cybersecurity-driven data protection platform.
Rubrik helps companies to stay resilient against attacks and recover fast when disaster strikes, protecting enterprise workloads across on-premise, cloud, and SaaS environments.
Rubrik was first pitched to subscribers on 22 September at $80 following the earnings drop of 18% in Q2’26. This is the first earnings report since owning the business. Since the initial pitch, we have added to the position and now sit in a comfortable profit.
It is now my 6th largest position, just outside my 5 core positions in the portfolio. Let’s break down the earnings result.
2. Financials
Subscription ARR
This refers to the annual run rate from subscription contracts. For Rubrik this is the core recurring business coming from Security Cloud subscriptions, SaaS protections, and legacy subscription contracts tied to appliances or software. It excludes one-time services and hardware sales, so it is the cleanest signal of recurring scale.
Rubrik’s subscription ARR for Q3 2026 was $1.347B, up 34% YoY. However, as can be seen above, growth has slowed remarkably since, which is to be expected with the law of large numbers.
As I discussed in my deep dive, the key will be to see if Rubrik can maintain growth rates of over 30% that would solidify the business as a best-in-class leader and set it on a path to dominance.
Cloud ARR
Cloud ARR isolates the portion of subscription ARR coming from Rubrik’s cloud native products, principally Security Cloud and other SaaS protections. This is the revenue that validates Rubrik’s move from on-prem backup into cloud first security services.
Cloud ARR this quarter came in at $1.175B and grew faster than total ARR again (52.8% v 34%). This is a strong sign for Rubrik that customers are buying the cloud offering at scale and that the cloud portfolio is driving a majority of the company’s growth.
Again, this is key as cloud ARR typically has better land-and-expand mechanics and lower cost-to-serve over time. This leads to higher margins moving forward.
Average Subscription Dollar-Based NRR
Rubrik has not disclosed its exact NRR but it maintains >120% NRR for a nth consecutive time. Since disclosing this metric from the S-1, it has never went below 120%. This is a key indicator of strength for the business as it implies existing customers are expanding well beyond what is lost to churn.
Customers with $100K+ in Subscription ARR
Another key indicator is the number of high-value customers where Rubrik is most likely to land strategic, high-value contracts. For Rubrik these are the accounts most likely to be mission critical and to adopt multiple modules.
As of Q3, Rubrik has 2,638 customers with $100k or more in subscription ARR, up from 2,085 last year. This represents 27% YoY growth, which is a slight drop from prior quarters numbers but is to be expected.
Non-GAAP Gross Margin
Rubrik’s non-GAAP gross margin strips out certain non-cash or one-time items and shows the profitability of subscription delivery after direct costs like cloud hosting, third-party licenses, and support.
Rubrik reported an 82.8% non-GAAP gross margin. That is an increase from the prior year’s number of 79.2%. Very healthy numbers.
Material Rights Revenue
This came in at $25M, which certainly contributed to the revenue beat this quarter. As management shared in the earnings call, this came in modestly above expectations.
For Q4’26, Rubrik expects $16M in non-recurring revenue related to material rights, somewhat of a normalisation from this quarter’s anomaly. It is important to take this into consideration regarding the big beat this quarter.
3. Guidance
Management guided for a midpoint revenue of $342M which implies 32.5% YoY growth. Again, I expect it to be materially higher as management likes to set low expectations and blow it out. For instance, Rubrik’s expectations was for $320M this quarter which implied 35% growth. Instead Rubrik reported $350M revenue for the quarter (48% YoY growth).
I expect FY2026 revenue to hit at least $1.3B. Notably Subscription ARR Contribution Margin guidance has been raised to 9% for FY2026, up from 7% in the last Q.
Q3 saw a weighted-average shares outstanding of 198.4M, and it is expected to continue climbing to 201M in Q4’26. As discussed, this is one of the risks for Rubrik shareholders. The stock-based compensation is hefty and will undoubtedly dilute shareholders, but only comes with stellar stock price performance. This aligns Bipul and Co. well with shareholders.
4. Product Development
Rubrik Agent Cloud
Rubrik recently introduced Rubrik Agent Cloud, a new product built to help enterprises manage risk and speed up the use of AI agents. It is designed to monitor and audit agent behaviour, apply real time guardrails, improve accuracy, and reverse agent mistakes.
The system automatically detects agents built on platforms such as OpenAI, Microsoft Copilot Studio, and Amazon Bedrock. After discovery, Rubrik tracks all actions the agents take. It stores every event in an immutable audit log and shows which data, identities, and applications each agent interacted with. Companies can set rules that control what an agent is allowed to do and how it should operate.
A key feature is Agent Rewind. If an agent makes a wrong decision, updates the wrong information, or performs a harmful action, Rubrik can undo it with no downtime and no loss of data.
As far as I can tell, no other major cybersecurity vendor has released something that discovers agents, governs them in real time, and rolls back their actions in a single platform. Rubrik looks like the first to offer full control and safe recovery for AI agents.
I believe this is critically important because companies are deploying AI agents at a rapid pace. These agents can now change records, move data, update systems, or modify code without human review at every step. If they make mistakes, the impact can be significant.
Rubrik Okta Recovery
It also introduced Rubrik Okta Recovery, a tool that helps companies protect and restore their Okta setup. Okta controls who can sign in to apps and systems inside a business. If something goes wrong in Okta, people can lose access, apps can break, and security can be at risk.
Rubrik makes regular backup copies of users, groups, apps, and settings inside Okta. These copies are stored in a safe place that cannot be changed by an attacker. If someone deletes users by mistake, changes permissions, or breaks a configuration, Rubrik lets you restore what you lost in a few clicks.
The main idea is very simple. Okta is a critical part of identity in a business. If identity breaks, everything breaks. Rubrik gives you a way to undo damage and recover fast. It lets you treat identity as something you can protect and restore just like data.
This helps during attacks and also helps with everyday mistakes. It gives teams peace of mind while they use Okta to manage more and more access across the company.
Expanded Crowdstrike Integration
In late September, Rubrik expanded its integration with CrowdStrike to let companies detect identity attacks and fix the damage faster in one workflow. CrowdStrike identifies suspicious changes in systems like Active Directory and Okta, and Rubrik can roll those changes back to a clean state.
This means if an attacker escalates privileges, adds a user to a sensitive group or compromises a machine identity, security teams can undo it without rebuilding the environment. The update also lets teams trigger a rollback directly from the CrowdStrike console, which removes manual handoffs during an incident.
Rubrik is using this integration to move beyond backup into full identity and data resilience. Identity attacks are growing fast in hybrid cloud environments, and most tools only detect problems without a clear recovery path.
Rubrik offers the restoration layer that returns the identity system to a known good configuration, while CrowdStrike provides real time detection and context. The combination is aimed at reducing downtime and limiting damage during identity based ransomware or lateral movement attacks. I think it’s a great deal for both parties and shows Rubrik’s importance.
5. Management Commentary
CEO Bipul Sinha described Q3 as another exceptional quarter, with record net new subscription ARR and free cash flow generation. He emphasised that as the AI transformation unfolds, organisations globally are increasingly turning to Rubrik to stay “secure and AI ready”.
Bipul described Rubrik’s capabilities as 2 key sets:
Consistent data and identity security policy controls
Rapid and accurate recovery from cyber attacks
Here are some key highlights of the earnings call, the answers are quite long so I have shortened them for ease of reading and highlighted key points:
On Rubrik’s Platform Strategy
“So if you look at Rubrik from day 1, our strategy has been a true platform company. Our definition of a platform company is when the customer adopts more than 1 product, their value from the platform goes up.
When our customers buy Rubrik Security Cloud for both data center as well as AWS or Azure cloud, if there is a threat actor in the cloud and the same threat actor is in the data center, we can auto correlate threat and give you the full cyber resilience intelligence and recovery. Rubrik automatically does that for you.
Now the same platform is expanded into identity so you can actually see what is happening to your identity vis-a-vis data when the privilege gets escalated. Now the same platform we have launched a new product suite in Rubrik Agent Cloud. So we have 2 distinct product suites. Rubrik Security Cloud for cyber resilience, Rubrik Agent Cloud for enterprise AI acceleration.
Our strategy has always been give customer a comprehensive platform and be the strategic IT vendor for that customer for years to come. We want to make it easier for our customers to consume Rubrik, try new Rubrik products, and we do not easily lose customers because we provide a mission-critical solution and customer retention has been one of the hallmarks of Rubrik.”
On Rubrik’s Positioning to Secure AI Agents
“If you take a step back, Rubrik is all about data, identity and business applications, and these are the 3 main things even to deliver AI. AI is not a purely security question, neither it is purely operations question.
AI sits at the intersection of security, which is risk management and governance, plus the operations, which is how do you deliver the accurate AI, how do you fine-tune the model, how do you create real-time operational guardrails and observability and undo action if they misbehave because of cyber compromise or hallucination.
Rubrik is squarely at the intersection of operations and security, so this is a natural place for us to deliver a complete agentic operation platform, agentic management platform, if I can be so bold to call it agentic ERP.
What does agentic ERP need to deliver: how many agents do I have, including the ones that are sanctioned and non-sanctioned, what they are doing, what do I want them to do in terms of my operational guardrail, are they hallucinating, can I make them more accurate so that humans can be confident of the results, and if they misbehave, can I press the rewind button and take away the effect of the misbehaving agent.
So this requires an end-to-end complete platform across monitor, govern and remediate. We believe that we are strongly positioned to deliver this new infrastructure product suite, Rubrik Agent Cloud, and we are extending and expanding this platform across all the tools that users can use to build agents, whether it is AWS, Azure, GCP, M365, Salesforce or Agentforce, to give our customers the confidence to do the AI transformation, deploy agents at scale and take advantage of the AI opportunity.”
If you’re too lazy to read all that, here’s a summary:
In essence, Rubrik wants to be the platform that lets companies use AI agents safely and with confidence. It will discover every agent employees create, watch what they touch, set guardrails, and undo any mistakes if an agent does something wrong.
Rubrik sits between security and operations, so it can manage agent behaviour across all clouds and apps, not just one vendor. In short, Rubrik is building the control layer for enterprise AI agents.
On Rubrik Agent Cloud’s Monetisation
“We have been working with hyperscalers for a number of years and our big partnership started with cyber resilience, and we have hundreds, if not thousands of customers where we are helping hyperscalers deliver a complete business transformation with confidence of cyber resilience. Now we are expanding on that partnership to bring Rubrik Agent Cloud. If you develop your agents on AWS Bedrock or on Copilot Studio, you can manage that on Rubrik Agent Cloud.
We have prebuilt go-to-market partnerships with hyperscalers, and we expect to leverage those existing infrastructure with the new teams that are involved on the AI side to expand the go-to-market. Rubrik Agent Cloud is a completely separate product suite. The product is in beta, but we are getting very strong customer feedback. A very large healthcare organization said they are slow to adopt agents because they have yet to find a platform that they can confidently operationalize agents, and another pharma company said that they see our vision as enabling them to an agentic future. I anticipate there to be a separate product suite that we will sell.”
On Identity Recovery and Resilience
“We believe that Identity Recovery is a widely applicable horizontal platform in terms of the Identity Security strategy that we have. Going from Identity Recovery to Identity Resilience, we are adding before and during pieces to ensure that if there is a privilege escalation, what kind of sensitive data gets exposed to, bringing the DSPM capabilities with identity capabilities to expose the full risk.
Cyber resilience assumes that attacks will happen, so you have to understand the risk of the attack and be able to remediate. You need to understand data risk and identity risk because you cannot understand the full risk without both. In terms of remediation, you have to remediate both, doing cyber recovery on all the data to ensure applications are up and running plus recover the Identity system partially or fully.
We believe that for full cyber resilience, both identity and data is applicable everywhere. These are early days, we are just over 3 quarters into it, just about $20 million in subscription ARR and we doubled our number of customers in Q3. The customer excitement is very high with increased awareness of the importance of identity systems, both full availability plus escalations and how data gets impacted. We have a full vision to create full cyber resilience solution and we are partnering with CrowdStrike ITDR solution to provide end-to-end confidence for our customers.”
On Full Cyber Resilience and Underwriting Confidence for Insurers
“Absolutely, you need to have both identity resilience and cyber recovery to be able to drive complete cyber resilience. And for insurance company to underwrite, there is asymmetry of information and for them to have confidence that the customers have the right technology, it is attractive for them to recommend Rubrik.
In fact, one of the insurance companies, which is our customer, became our reseller to their customer base based on that same thesis. We believe we are still in the early innings of cyber resilience as very large segment, and the most important segment of cybersecurity. As this market continues to expand and as we continue to lead this market into the future around full cyber resilience across data and identity, we believe there are lots of opportunities, including around insurance for us.”
On Operationalising AI Agents
“So if you look at agents, they assume identity, they work on data and they operate on many applications at a scale. And the Rubrik platform is a combination of data, identity and applications, so we are naturally positioned to take advantage of this agentic opportunity.
We are not building a platform for people to build agents, we are helping our customers operationalize agents and have confidence and governance controls to deliver the agentic outcome because that is the biggest inhibitor in terms of AI going into production.
We are early and still in beta, we expect to go GA (General Availability) not too far in the future, and continue to learn from this market and enable our customers on this journey. So far, it feels like operations team, which is CTO, CIO organization, would be responsible for agentic work transformation across line of businesses. It is very early, but we believe that we have a very strong vision for this market and want to take our customers on this agentic journey.”
6. Concluding Thoughts
Rubrik delivered a very strong Q3 which I believe was reassuring to the market after Q2’s showing. Revenue grew 48% YoY and 13% QoQ, and non-GAAP EPS turned positive much earlier than I expected. (Though it is key to note that material rights did contribute, which is one-off)
The fundamentals behind those headline numbers also looked healthy to me. Cloud ARR remains the primary growth engine, expanding faster than total ARR, and Rubrik continues to achieve dollar-based NRR well above 120%. On the customer side, the number of accounts above $100K in subscription ARR grew 27% despite the higher base.
I think it was a great quarter overall, and for a business at Rubrik’s scale, it is impressive that they can keep growing this fast. That being said, revenue is decelerating and it remains to be seen if the new product innovations can spur another round of growth.
My long term thesis remains unchanged after this report. If Rubrik can sustain growth above 30% with a rising cloud mix, I believe it has a credible path to becoming the category leader in cyber resilience. The story is still fairly simple in my view. Cyber resilience is moving from a reactive backup product to a strategic layer that insurers, CIOs and boards care about. Rubrik is positioned right in the middle of that shift.
This quarter, management has positioned itself more around identity and AI. It is leaning into a narrative that combines data, identity and applications as one operating surface for resilience and agent safety. I think it’s smart to position themselves this way, but it remains to be seen if it sticks.
Companies will not deploy agents at scale unless they have a way to watch what they do, set guardrails and reverse mistakes. Rubrik Agent Cloud, Okta Recovery and the expanded CrowdStrike integration are early proof points, but the market will need more evidence that a real product layer is emerging. Whether “agentic ERP” becomes a meaningful category is still uncertain, but I find Rubrik’s position at the intersection of governance, observability and recovery quite interesting.
The risks remain the same as when I initiated my position. Rubrik is still a young public company with meaningful stock based compensation that will dilute shareholders over time. It was one of the reasons I sized it just outside my core holdings. I want to see the company show more discipline on dilution while still investing for growth. There is also the simple reality that growth will slow as scale increases, so the next few quarters will be important to watch. I want to see cloud ARR continue to outpace total ARR and the customer base deepen at the high end.
Overall, I came away from Q3 more confident in the business. I like the way Rubrik is expanding its product footprint without drifting away from its core value. Data resilience is still a massive market and Rubrik is merely scratching the surface of it. If it can continue growing quickly in that market while expanding its optionality into other verticals, I think it has a shot of becoming a critical piece in the security stack.
Thanks for reading!
-Gab
Great review!! Thanks!