Prospectus Summary
PROSPECTUS SUMMARY This summary highlights selected information contained elsewhere in this prospectus. This summary does not contain all of the information you should consider before investing in our Class A common stock. You should read this entire prospectus carefully, including the sections titled “Risk Factors,” “Special Note Regarding Forward-Looking Statements,” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” and our consolidated financial statements and the related notes included elsewhere in this prospectus, before making an investment decision. Unless the context otherwise requires, all references in this prospectus to “we,” “us,” “our,” “our company,” and “Rubrik,” refer to Rubrik, Inc. and its consolidated subsidiaries. Unless otherwise indicated, references to our “common stock” include our Class A common stock and Class B common stock.RUBRIK, INC.
Overview
We are on a mission to secure the world’s data.
Cyberattacks are inevitable. Realizing that cyberattacks ultimately target data, we created Zero Trust Data Security to deliver cyber resilience so that organizations can secure their data across the cloud and recover from cyberattacks. We believe that the future of cybersecurity is data security—if your data is secure, your business is resilient.
We built Rubrik Security Cloud, or RSC, with Zero Trust design principles to secure data across enterprise, cloud, and software-as-a-service, or SaaS, applications. RSC delivers a cloud native SaaS platform that detects, analyzes, and remediates data security risks and unauthorized user activities. Our platform is architected to help organizations achieve cyber resilience, which encompasses cyber posture and cyber recovery. We enable organizations to confidently accelerate digital transformation and leverage the cloud to realize business agility.
Traditional cybersecurity approaches have failed to not only prevent but also provide recovery from increasingly rampant and sophisticated cyberattacks. At the same time, legacy backup and recovery solutions have significant shortfalls in addressing cyber recovery and data security as they were primarily built for operational and natural disaster recoveries. They were not designed to enable reliable recovery from cyberattacks, nor were they designed to natively deliver cyber threat analytics and event response.
Architecture matters when it comes to securing data. We built a unique SaaS architecture that combines data and metadata from business applications across enterprise, cloud, and SaaS applications to create self-describing data as a time-series. Self-describing data contains information such as application context, user identity, data sensitivity, and application lineage. This allows us to apply artificial intelligence and machine learning directly to business data to understand emergent data security threats and deliver cyber recovery.
Our Zero Trust Data Security platform assumes that information technology infrastructure will be breached, and nothing can be trusted without authentication. Our data threat engine powered by artificial intelligence and machine learning analyzes the self-describing data time-series to derive security intelligence from data and provide remediation recommendations. Automation is at the core of our architecture ethos. Our automated policy-driven platform delivers data security enforcement, incident response orchestration, and API integrations with the broader security ecosystem.
We use the following guiding principles to design our RSC platform and products:
Our business is indexed to business data growth. Our customers’ need for our solutions grows in lockstep with their business data growth and their need for additional data security capabilities. We primarily sell subscriptions to RSC through our sales team and partner network by employing a land and expand sales strategy. We land new customers by selling subscriptions to RSC to secure any one of four distinct types of data: private cloud (which we refer to as enterprise), enterprise NAS(1) (which we refer to as unstructured data), cloud, and SaaS applications. Expansion happens along three vectors: the growth of data from applications already secured by Rubrik; new applications secured; and additional data security products. This expansion is driven by a natural flywheel effect in which the value of our platform increases as our customers’ data grows across various applications. As organizations manage more data with RSC, they gain deeper insights into their data, strengthen their overall security posture, and reduce compliance risk. Our average subscription dollar-based net retention rate was 133% as of January 31, 2024. See the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations—Key Business Metrics” included elsewhere in this prospectus for our definitions of these metrics.
Our platform’s broad applicability allows us to serve organizations of all sizes across a wide range of industries and geographies. As of January 31, 2024, we had more than 6,100 customers, increasing from over 5,000 customers as of January 31, 2023.
Organizations around the world rely on Rubrik to achieve business resilience in the face of cyberattacks, malicious insiders, and operational disruptions. As a result, we have experienced rapid growth, with our subscription annual recurring revenue, or Subscription ARR, increasing from $532.9 million as of January 31, 2023, to $784.0 million as of January 31, 2024, representing a 47% increase, and our total revenue increasing from $599.8 million in the fiscal year ended January 31, 2023, or fiscal 2023, to $627.9 million in the fiscal year ended January 31, 2024, or fiscal 2024. We measure our business on the basis of Subscription ARR. Subscription ARR illustrates our success in acquiring new subscription customers and maintaining and expanding our relationships with existing subscription customers. As of January 31, 2024, we had 1,742 customers generating more than $100,000 in Subscription ARR and 99 customers generating more than $1,000,000 in Subscription ARR. We have continued to invest in growing our business and advancing our solutions to capitalize on our market opportunity. As a result, in fiscal 2023 and fiscal 2024, we incurred net losses of $(277.7) million and $(354.2) million, respectively. In fiscal 2023 and fiscal 2024, operating cash flow was $19.3 million and $(4.5) million, respectively, and free cash flow was $(15.0) million and $(24.5) million, respectively.
Industry Background
We believe that data is every organization’s most important asset, and that the following industry trends are driving a need for a new approach to data security:
Due to accelerated digitization, cloud adoption, and rapid data growth, organizations manage extensive, valuable data estates that are vulnerable to malicious actors.
Recent AI progress forces organizations to contend with new data security, privacy, and compliance risks.
The digital economy demands organizations to have 24x7 application availability and resilience against cyberattacks, faults, and failures.
perimeter-guarding security approach to a more stringent Zero Trust infrastructure security model that denies access by default. Despite this, cyberattacks continue to occur, and infrastructure security solutions cannot help reconstitute the business in the event of a cyberattack.
Organizations must comply with a growing and ever-evolving data compliance and regulatory landscape.
The culmination of these trends places organizations and their data assets at continuous risk. While organizations have increased security budgets and adopted advanced defenses, keeping up with evolving cyber threats remains a challenge as infrastructure continues to be compromised and data is breached. Securing data necessitates a new approach.
Limitations of Current Technologies
Current products and technologies struggle to meet the data security needs of today’s organizations and are limited by some or all of the following:
Our Data Security Platform
Rubrik has a unique Zero Trust Data Security approach to help organizations achieve business resilience against cyberattacks, malicious insiders, and operational disruptions. We believe a comprehensive cybersecurity strategy requires data security in addition to traditional infrastructure security approaches. We enable organizations to implement a Zero Trust framework at the data layer, deliver data availability that withstands the aforementioned adverse conditions, and uphold data integrity even when infrastructure is compromised.
RSC is a cloud native SaaS platform that secures data across disparate sources, allowing customers to have a single point of control from one user interface. RSC is built on a proprietary framework that represents time-series data and metadata generated across enterprise, cloud, and SaaS applications. We build products on top of RSC to address a myriad of use cases that help our customers achieve cyber resilience, from hardening their data security posture to cyber recovery. These use cases include protection and recovery from cyberattacks, malicious insiders, and operational disruptions; orchestration of cyber and operational recovery, failover/failback testing, and cloud migration; sensitive data classification and over-privileged data access; monitoring for governance, regulatory compliance, and data breaches; and identification, containment, and remediation of ransomware and other security threats. Our access to time-series data and metadata allows us to deliver a breadth of products that span the following areas:
In addition, we offer Ruby for AI data defense and recovery. Ruby is designed to augment human efforts with its generative AI capabilities, helping customers scale their data security operations with automation, boosting productivity, and bridging the users’ skills gap. Ruby uses Microsoft Azure OpenAI Service in combination with our own proprietary, internally developed software. Our proprietary software augments user queries to generate prompts that are submitted to the Azure OpenAI model and also enhances the model output to generate responses presented back to the user. We chose to use Microsoft Azure OpenAI Service based on its security features and because it offers an advanced AI model provisioned in Rubrik’s Azure environment such that the data stays within Rubrik’s control. For more information regarding the risks related to the use of AI in our business, see the risk factor titled “Our use of generative artificial intelligence tools may pose risks to our proprietary software and systems and subject us to legal liability” in the section titled “Risk Factors.”
Our RSC platform is built to be highly flexible and scalable, enabling us to innovate and deliver new products in the future.
RSC secures data across enterprise, cloud, and SaaS applications, including:
Architecture Matters
We believe the following attributes of our platform architecture allow us to offer a differentiated approach to data security:
Our Competitive Advantages
Key differentiating elements of our platform and approach include:
Key Benefits to Our Customers
Organizations choose Rubrik to:
Our Opportunity
We believe our total addressable market opportunity for our platform will be approximately $36.3 billion by the end of calendar year 2024 and approximately $52.9 billion by the end of calendar year 2027, based on market estimates in Gartner® research, representing an average 13% compounded annual growth rate.(2) These market estimates are as follows:
$1.9 billion in Archive Software.(3) According to market estimates in Gartner® research, these markets will increase to $15.4 billion by the end of calendar year 2027.(4)
Our Growth Strategy
Key elements of our growth strategy include:
Risk Factors Summary
Investing in our Class A common stock involves numerous risks, including the risks described in the section titled “Risk Factors” and elsewhere in this prospectus. You should carefully consider these risks before making an investment. Below are some of these risks, any one of which could materially adversely affect our business, financial condition, results of operations, and growth prospects.
If we are unable to adequately address these and other risks we face, our business may be harmed.
Channels for Disclosure of Information
Following the closing of this offering, we intend to announce material information to the public through filings with the Securities and Exchange Commission, or the SEC, the investor relations page on our website, press releases, public conference calls, public webcasts, our blog posts on our website, and our X (formerly Twitter) (@rubrikInc) and LinkedIn (www.linkedin.com/company/rubrik-inc) accounts. Information contained on, or accessible through, our website and accounts is not a part of this prospectus, and the inclusion of our website and account addresses in this prospectus is only as inactive textual references.
The information disclosed through the foregoing channels could be deemed to be material information. As such, we encourage investors, the media, and others to follow the channels listed above and to review the information disclosed through such channels. Any updates to the list of disclosure channels through which we will announce information will be posted on the investor relations page on our website.
Corporate Information
We were initially incorporated under the laws of the State of Delaware in December 2013 under the name ScaleData, Inc. We changed our name to Rubrik, Inc. in October 2014. Our principal executive offices are located at 3495 Deer Creek Road, Palo Alto, California 94304. Our telephone number is (844) 478-2745. Our website address is www.rubrik.com. Information contained on, or accessible through, our website is not a part of this prospectus, and the inclusion of our website address in this prospectus is only as an inactive textual reference.
The Rubrik design logos, “Rubrik,” and our other registered or common law trademarks, trade names, or service marks appearing in this prospectus are the property of Rubrik, Inc. or its affiliates. Other trademarks, trade names, and service marks used in this prospectus are the property of their respective owners. Solely for convenience, trademarks, trade names, and service marks referred to in this prospectus may appear without the ®, ™, or SM symbols.
Implications of Being an Emerging Growth Company
As a company with less than $1.235 billion in revenue during our last fiscal year, we qualify as an “emerging growth company” as defined in the Jumpstart Our Business Startups Act, or JOBS Act, enacted in April 2012. An emerging growth company may take advantage of reduced reporting requirements that are otherwise applicable generally to public companies. These provisions include, but are not limited to:
We may take advantage of these provisions until the last day of our fiscal year following the fifth anniversary of the date of the first sale of our Class A common stock in this offering. However, we will cease to be an emerging growth company prior to the end of such five-year period if (i) we become a “large accelerated filer,” with at least $700 million of common equity securities held by non-affiliates; (ii) our annual gross revenue exceeds $1.235 billion; or (iii) we issue more than $1.0 billion of non-convertible debt in any three-year period, whichever occurs first.
We have elected to take advantage of certain of the reduced disclosure obligations in the registration statement of which this prospectus is a part and may elect to take advantage of other reduced reporting requirements in future filings. As a result, the information that we provide to our stockholders may be different than you might receive from other public reporting companies in which you hold equity interests.
In addition, the JOBS Act provides that an “emerging growth company” can take advantage of an extended transition period for complying with new or revised accounting standards. This provision allows an emerging growth company to delay the adoption of some accounting standards until those standards would otherwise apply to private companies. We have elected to use this extended transition period to enable us to comply with certain new or revised accounting standards that have different effective dates for public and private companies until the earlier of the date we (i) are no longer an emerging growth company, or (ii) affirmatively and irrevocably opt out of the extended transition period provided in the JOBS Act. As a result, our financial statements may not be comparable to companies that comply with new or revised accounting pronouncements as of public company effective dates.