Rubrik's pivot to subscription security

Rubrik stopped getting paid mainly for boxes in the data center and started getting paid for ongoing protection of the data inside them. Early on, the sale was an appliance with upfront license, maintenance, and services revenue. By 2019, all new customers were put on subscription pricing, and by 2023 subscriptions were 86% of trailing revenue, with higher 82% gross margins in the subscription business because the value had moved to cloud software, ransomware recovery, and compliance workflows.

• The practical change was from a one time infrastructure purchase to a recurring security product. Instead of buying a bundled box and software license, customers increasingly buy Rubrik Security Cloud to monitor backups across cloud apps, virtual machines, and on prem systems, then pay every year for recovery, threat monitoring, and policy enforcement.
  1 sacra 2 sacra
• This was an industrywide shift, not just a Rubrik story. Veeam now gets 86% of revenue from subscriptions, and Commvault used SaaS to win net new customers, showing that backup vendors learned the durable margin sits in software and security layers, not in commodity storage hardware.
  4 sacra
• The financial result is that Rubrik now looks much more like a cybersecurity SaaS company than an appliance vendor. Gross margin rose from 69% in 2022 to 77% in 2023, subscription revenue grew from $385M to $538M in 2023, and license revenue had declined by about $100M since 2021 as the old model was intentionally retired.
  1 sacra 3 sacra

The next leg is selling more security and data governance on top of backup. Once Rubrik already sees a company’s Microsoft 365, Azure, SaaS apps, and on prem workloads, backup becomes the entry point, and cyber recovery, sensitive data monitoring, and compliance become the larger recurring revenue pool attached to that installed base.