Rubrik S-1 Teardown
Founded in 2013, Rubrik Inc. (the “Company” or “Rubrik”) has developed a data management and security SaaS platform for enterprises and has become a market leader in cyber-resilience. The Company’s tools help its customers understand emerging data threats and enable data recovery. Pre-IPO, the Company has raised $715.1 million from a host of blue-chip investment firms as well as Microsoft, which is a strategic investor and partner, at a valuation of $4 bn at the most recent round in 2021, according to Pitchbook. The Company went public on the NYSE under the “RBRK” ticker on April 25, 2024, raising $752m at an implied valuation of $5.6b (i.e., 6 times forward sales). The Company’s stock price rose by 16% on its first day of trading.
I want to break down its S1 filing for several reasons:
· This will be the first software IPO in 2024 and the performance could provide broader insight into the appetite for tech public offerings.
· The Company’s core business has been radically overhauled over the past decade, transitioning over several stages from one-time sales of a hardware-based security appliance to a full cloud-based subscription model.
· Investors will only have limited historical data on this new model, which is producing tremendous ARR growth but also growing losses. This IPO is critical for seeing whether investors will value growth (especially efficient growth) over profitability, after emphasizing the latter in recent months.
· The Company has a “strategic agreement” with Microsoft, according to the S-1, which gives it a potentially important link to such GenAI leaders as OpenAI.
· Private cybersecurity companies are going through tough times. Funding for private cybersecurity companies has been steadily declining, from $22.7 billion invested in security startups in 2021 to $10.1 billion in 2023, according to PitchBook.
To understand the sustainability of Rubrik’s business, I’ll apply our firm’s Advanced Growth Intelligence (AGI) methodology to challenge the Company’s value levers, and in particular, its prospects for durable growth, and resilience. The goal is to help an investor ask the right questions to challenge an asset’s durable growth and make an investment with confidence.
Let’s start with a quick overview of some of the main characteristics of the company’s business model:
Product: The Rubrik Security Cloud (RSC), is a cloud-native SaaS platform that centralizes control of security and data through a single interface (cf. graph below). Automation is key, enabling a wide range of features — from data policy management to threat analytics to recovery. The Company attempts to find an entry point with a portion of its product and then uses its sales team to expand its footprint with a client.
Customers can select from a menu of features within the platform, including a recent GenAI product — Ruby — on which we have little visibility. RSC represents an evolution of the company for a full SaaS model but was only released in its current form in FY 2023 (ending Jan. 31) (n.b. the Company started its commercial activity in 2016).
Customers: Rubrik addresses enterprise customers of all sizes though growth is being driven by mid-large customers, with the number of customers generating more than $100k ARR rising rapidly. We are not provided in the S1 with the split between “Enterprise” customers (i.e., with an ACV > 50k$) and the others.
Go-to-market: A sales-led approach with a mix of direct sales via its large sales team (42% of all employees are in sales and marketing), as well as channel partners, and inside sales for smaller non-Enterprise customers. The three largest channel partners accounted for more than 75% of revenue over the past two fiscal years.
Pricing: Rubrik offers three subscription tiers, with the highest being the edition which includes the full suite of cloud-based products.
Rubrik is the kind of high-growth tech business that has traditionally made public market investors enthusiastic until the IPO markets shut and emphasis went from growth at all costs to profitability. In this case, it’s easy to see why: the transition from its legacy business to a subscription appears impressive, with $784m of subscription ARR for FY 2024, up 47% YOY, making it one of the fastest (if not the fastest) high-growth public SaaS companies.
Yet, Rubrik also reported a FY 2024 loss of $354.2m, up substantially from $277.7m in FY 2023.
Deciphering the economics here is complicated by the presence of revenue from legacy businesses, the various product evolutions, and the subscription model which will likely determine its long-term prospects.
Let’s see how Rubrik fits into the four pillars of our AGI methodology:
1. Quality of Revenue
In assessing the quality of a company’s revenue, we challenge its recurrence and “technological” component, as well as the quality of a company’s customer base and its control over it.
With the move from perpetual licenses to a subscription-based model, and with the launch of the RSC platform in FY23, the Company has consistently increased its share of “recurring” revenue, either related to term-based subscriptions or to SaaS subscriptions (from c.64% of total revenue in FY23 to c.86% in FY24).
The Company’s Subscription revenue commands a high gross margin (c.82% in FY24 adjusted from stock-based compensation expense) suggesting that it is indeed “license” revenue with a limited (if existent) share of services revenue within it.
Hence, the Company’s revenue is high quality considering both aspects, though we lack information on the second point.
Moving on to the quality and the control of the customer base, a critical point underlined in the S1 is that the Company derived a substantial amount of its revenue from sales through Channel Partners over FY23 and FY24, with a high proportion of sales through a limited number of these partners. Though this is not negative per se, it points to a lower control over its customer base and leaves the Company dependent on moves from these latter that could undermine revenue or hurt margins. Also, this implies lesser visibility on final customers (Darktrace, for example, was recently attacked for this reason by short sellers who alleged the existence of “phantom” customers).
The Company had 6,100 customers in FY 2024, up 22% from 5,000 in FY 2023. We do not have a view on whether the Company potentially depends on a limited number of customers, though this seems unlikely.
Quality of Revenue is 4/5.
This notation is based on the assumption that i) the Company has full visibility on its end-customers in the case of indirect sales and ii) there is no customer concentration.
***
2. Quality of Growth
In assessing the quality of a company’s growth, we break down the company’s growth into an equation and challenge the quality behind each one of the levers by both looking at the numbers themselves and understanding to which extent their respective growth was “efficient”.
The Company experienced sluggish growth of less than 5% over FY24 with reported revenue of $627.9 million in FY2024, up from $599.8 million in 2023.
However, as the Company is in the process of transitioning from a perpetual license to a SaaS-based model, looking at its “Subscription” based-ARR appears to be a better proxy for assessing growth quality, keeping in mind that Subscription is broader than just SaaS-based revenue and includes term-based licenses pre-launch of the RSC platform. Though this has implications for revenue numbers, it is neutral when looking at ARR figures.
The Company’s Subscription ARR grew by 96% in FY23 and 47% in FY24, which seems impressive given the sharp decline in net new ARR growth witnessed over the last year as a result of a return to normal post-pandemic and adverse macro-economic conditions. Adjusted from growth derived from the transition of existing maintenance customers to subscriptions, the S1 states that growth was still 80% in FY23 and 43% in FY24, above other public peers. This level of growth reflects how well the Company seems to have executed its business model transition.
Beyond absolute levels, it is critical to understand to what extent that growth was efficient, which is ultimately what is valued by the public markets looking at the best SaaS companies from a valuation perspective (the “10X” club).
The Company does not reveal what share of new ARR derives from new customers or from expansion of existing ones.
It details its expansion strategy as a mix of upsell from increased usage (both from growth of data and perimeter of applications secured), upsell from tiering changes and cross-sell from other solutions: “We utilize a land and expand approach, acquiring new customers and expanding with existing customers. We sell our products through subscription editions and can land in four distinct ways by securing private cloud (which we refer to as enterprise), enterprise NAS(1) (which we refer to as unstructured data), cloud, and SaaS applications. After the initial purchase, our customers often expand the adoption of our platform within their organization. Expansion happens along three vectors: the growth of data from applications already secured by Rubrik, new applications secured, and additional data security products. This expansion is driven by a natural flywheel effect in which the value of our platform increases as our customers’ data grows across various applications. As organizations manage more data with RSC and adopt additional data security products, they gain deeper insights into their data, strengthen their overall security posture, and reduce compliance risk, thereby increasing their overall affinity with Rubrik and driving further adoption.”
In our view, upsell from increased usage is a highly efficient growth lever: growth will naturally occur as the company’s customers’ data grows, as long as customers remain satisfied (reflected today in their high NPS score). Though this is not indicated per se in their plans comparison, we understand that upselling from tiering changes is independent from upselling from increased usage: a customer can thus both expand its usage of the platform and benefit from new additional features (e.g., threat monitoring, threat hunting, etc.), both resulting in upsell. Cross-sell then refers to the sale of additional data security products.
We understand that the Company has large expansion potential reflected by its growing share of customers generating $100k and $1m in Subscription ARR. As of January 31, 2024, Rubrik had 1,742 customers generating more than $100k in Subscription ARR (up from 1,204 in FY 2023) and 99 customers generating more than $1m in Subscription ARR. Based on the 6,100 customer count presented in the S1, this represents a share of a bit less than 30% and 2% respectively of customer count, but over 80% of total Subscription ARR for both categories combined per the S1.
Having such customers is critical in forming a solid ground for expansion and is a common characteristic of best-in-class efficient SaaS growers. In the case of the Company, building a conviction on the its expansion equation on its >100k$ customers (through the levers mentioned above), and ensuring its consistency over time, is key as expansion on this specific customer segment will be a key driver in efficient growth in our view (more so than the $1m + customers who remain marginal to date). Without providing detailed figures, the S1 simply states that revenue from “largest customers” is growing at 45% year-over-year compared to 22% for total customers.
Also, the Company’s best-in-class NRR figures evidence a strong expansion pathway as the company exhibits an average dollar-based Subscription NRR of 133% in FY24, similar to that of Snowflake (the top performer on this metric). As a comparison point, the median NRR for best-in-class SaaS companies stands at 119% in FY24. Note that the Company’s NRR decreased in FY24 (from 150% in FY23) with no specific explanation contained in the document.
However, in the absence of GRR and churn figures, it is not possible to reach a definitive conclusion about the Company’s growth efficiency because strong NRR figures could reflect (very) strong expansion on existing (and remaining) customers but high churn. Given the high levels of NRR, this is rather unlikely but cannot be excluded at this point. GRR analysis should be conducted per customer segment, with vigilance on customers with less than <100k$ of ACV whose contraction and/or churn to high degrees could impact the overall efficiency of the Company’s growth.
Quality of Growth is 4/5.
This notation is based on the assumption that i) GRR level is satisfactory ii) that CAC efficiency measurements (LTV/CAC, CAC payback, etc.) not calculated here are satisfactory.
***
3. Quality of Margins
In assessing the quality of a company’s margins, we challenge the composition of the company’s different operating expense buckets and their normativity with peers to identify potential margin “leakages” or in reverse, an underweight cost structure potentially resulting in hampered growth over the long term or inaccurate definitions of the aggregates at stake.
Below are some of the company’s key figures:
· Operating losses of $330.79m in FY 2024, up from $254.6m in 2023
· Operating margin fell to -48% in 2024, from -42% in 2023
· S&M expenses grew to 77% of revenue in FY 2024, up from 70% in 2023
· G&A expenses grew to 16% in 2024 from 14% in 2023
· R&D spending grew to 33% from 29%
· Cash on the balance sheet fell in FY 2024
The Company’s gross margin is 77% in 2024, up from 70% in 2023. This is in line with the median gross margin of best-in-class high-growth SaaS companies (77%).
The Company’s subscription growth margin appears healthy at c.82% of Subscription sales, though we are not provided with an explanation for its 2pp decrease between FY23 and FY24. Beyond personnel costs, COGS mainly include public cloud expenses and ensuring that the Company can pass on potential price increases to its final customers, both of which are critical for maintaining healthy gross margins.
Looking beyond gross margin, the Company has an unusually heavy OPEX structure which raises questions on the achievability of its path to profitability.
LTM Gaap operating margin stands at (49) %, ranking Rubrik among the very low performers alongside Confluent, SentinelOne, and C3. LTM FCF margin stands at (4) %.
Whereas G&A and R&D costs appear normal regarding peers, S&M costs as a % of total revenue are the biggest of any publicly listed company and increased between FY23 and FY24 from c.70% to c.77% of net sales. As a comparison, 10X companies had a median LTM S&M spend of 30% of LTM revenue, while GitLab and Confluent, the two highest spenders, put 50% of LTM revenue in S&M spend. The company’s level of S&M spend is unusually high, and well above the average spend of high-growth private SaaS companies.However, this ratio can be partially misleading due to the SaaS transition.
To put numbers in perspective with subscription growth, the Company reports margins through a company-specific metric: Subscription ARR Contribution. Subscription ARR Contribution is defined as “Subscription ARR at the end of the period less: (i) our non-GAAP subscription cost of revenue and (ii) our non-GAAP operating expenses for the prior 12-month period ending on that date.” Though negative in FY24 ((12) % of Subscription ARR), it has largely improved from FY22 where it stood at (117) %.
Subscription ARR Contribution aims to demonstrate a form of run-rate revenue to reflect what would have been the absorption of the subscription cost structure had full subscription ARR been recognized as revenue within the year. While it can be a helpful “economic” indicator, it does not erase the huge loss incurred by the Company to reach its FY24 GAAP revenue.
In our view, the company is still burning a lot of cash though margins have improved: losses are growing as the company appears to be spending heavily to acquire customers and manage its product transition.
Approaching the overall OPEX spend through the proxy of ARR per FTE, the conclusion remains the same: the Company has a very high cost structure to support current growth trends. As of last quarter, the Company’s ARR per FTE was $253k, well below the median of 10X companies of $395k. To build an efficient business able to grow durably at scale, improving that ratio will be critical.
Last, looking at Rule of 40, the Company stands at 43% using Subscription ARR growth (vs. revenue growth). This puts it within the best performers.
Quality of Margins is 3/5.
***
Note that for the purpose of this exercise, we have not developed our fourth AGI pillar: Balance Sheet Strength.
Finally, this breakdown would not be complete without an assessment of Rubrik’s resilience to genAI. The Company does not hype genAI in its S1, even though there are 81 mentions of the new technology.
Though the Company mentions its new AI product in the name of Ruby, there is very little disclosure here. We understand at this point that the Company has designed a vertically integrated app to augment human efforts with its generative AI capabilities, helping customers scale their data security operations with automation, boosting productivity, and bridging the users’ skills gap. Overall, the genAI story could be clearer to ensure that genAI does not constitute a single point of failure for the company.
***
With an ARR that should approach the $1b mark in FY25, we can see why Rubrik was a strong software IPO candidate. Its IPO is not an easy one to analyze due to the business model transition still going on and heavy operating losses, in sharp contrast to Klavyio, which has better metrics but is trading below its listing price as of today.
Still, Rubrik’s 47% growth rate at scale in this period is phenomenal! So, it’s not surprising that investors reacted positively as the Rubrik IPO was priced above its expected range, and still traded up 16% on the first day. We’ll see if that sentiment holds. Without a doubt, this IPO will allow us to see if investors continue to put a premium on (high) growth vs profitability.
