Rubrik — Blitz Index 58 (C)

Subscription ARR +33% with net retention above 120% — a real data-security blitz whose market price already sits above its own growth bar.

Last re-scored: October 21, 2026.

Score breakdown

Think we scored it wrong? Score it yourself →

Radar axes (0–100): Moat 60 · Speed 72 · Creative 66.7.

Watch item

Gates: G1 ✓ · G2 ✓ (estimate — the 10-K discloses no quantified TAM). Bar ≈ $16.9B (FY2027E guidance × 10); the ~$23.5B market cap already prices past it — a valuation note, not a gate factor.

Strengths

• Subscription ARR +33% to $1,660.9M and Cloud ARR +39% — growth held through the end of the transition
• Net retention above 120% — expansion inside the installed base is the engine
• RPO $2,400M (+32.5%) gives contracted visibility into FY2027
• GAAP gross margin normalized to 80.1% in FY2026 once IPO vesting rolled off

Concerns

• Market cap ~$23.5B vs a $16.9B bar — the price has prepaid growth the filings have not delivered yet
• FY2027 guidance (+28% revenue) already decelerates; ARR growth is gliding 39% → 33%
• GAAP operating losses persist and SBC is the bulk of them — dilution is the real cost
• CrowdStrike, Palo Alto Networks and Veeam all contest the same data-security budget

Research notes

Thesis: a company that destroyed its own first business, and now offers the ability to survive being attacked

Rubrik, Inc., listed on the New York Stock Exchange under the ticker RBRK, scores 58 out of 100 under the BlitzLab v1.0 model, grade C, made up of Speed 18 out of 25, Moat 36 out of 60, Creative Destruction 10 out of 15, and deductions of 6 points. The score is seven points below the 65-point threshold, and no FLAG applies, because total deductions of 6 fall below the 15-point FLAG trigger. This is a first scoring, with no blind assessment behind it, and it is scored as of 20 October 2026, on the basis of second-quarter fiscal 2027 results released on 27 August 2026. Third-quarter fiscal 2027 results, expected on 3 December 2026, fall after the as-of date and are excluded from the score; they appear in this draft only as a future marker, not as an anticipated outcome. The confidence level recorded in the score file is high, because the underlying filings — the 10-K, 10-Q, 8-K releases, and DEF 14A proxy statement — were reviewed directly from SEC EDGAR. Rubrik is classified as mature, on trailing-twelve-month revenue of approximately 1,542 million dollars, calculated in the score file as fiscal 2026 revenue of 1,316.2 million dollars, less first-half fiscal 2026 revenue of 588.3 million dollars, plus first-half fiscal 2027 revenue of 814.3 million dollars. Its fiscal year ends in January: fiscal 2026 ran from 1 February 2025 to 31 January 2026, and fiscal 2027 runs from 1 February 2026 to 31 January 2027.

The thesis of this draft can be stated in one sentence, and everything that follows is an attempt to test it against the filings. Rubrik's blitz was not a race to acquire users before competitors did; it was a deliberate, self-inflicted conversion, in which the company wound down the perpetual-licence and appliance business that had built it, accepted a year of near-flat growth while it did so, and emerged as a subscription business growing at close to 50 percent, offering not backup as insurance but cyber resilience as an operating capability — the ability to keep a business running after an attack has already succeeded. That distinction, between preventing an attack and recovering from one, is the category claim on which the whole score rests. Prevention-centric security plus traditional backup is the old order; Zero Trust Data Security, in Rubrik's framing, is the replacement, and in 2026 the company extended that framing to Agentic Cyber Resilience, covering the observation, control, and rollback of artificial intelligence agents through products including Rubrik Agent Cloud, Agent Rewind, and SAGE.

Two features of the score deserve attention before any of the detail, because they explain why a business growing this fast stops at 58 rather than crossing 65. The first is that the business score before deductions is 64 — one point short of the threshold on operations alone. The second is that the six points of deductions are split exactly evenly between two structural charges that have nothing to do with quarterly execution: three points for dilution, in the form of stock-based compensation equal to 25.0 percent of fiscal 2026 revenue and a share count that rose from 154.3 million to 206.1 million across the periods measured, and three points for governance, in the form of a dual-class structure in which Class B shares carry twenty votes each against one vote for Class A shares, with the officer and director group holding 46.2 percent of voting power. The score file's own summary of the position is blunt: the business is not what holds Rubrik below the line; capital structure and control structure are. A reader who skips the deductions section of this draft will therefore misunderstand the score by exactly the margin that matters.

The gate verdicts frame the rest of the assessment. Gate G1, sustained growth or a second growth curve, passes on confirmed figures: subscription annual recurring revenue of 1,660.9 million dollars at July 2026, up 33 percent year on year, subscription revenue at 96.0 percent of the fiscal 2026 mix, and a completed subscription conversion that the 10-K describes as largely completed. Gate G2, a ten-year ceiling in a new market at least ten times current revenue, passes on an estimate, and on a borderline one at that. The bar is approximately 16.9 billion dollars, derived from the fiscal 2027 guidance revenue midpoint of approximately 1,689 million dollars multiplied by ten; on the fiscal 2026 confirmed revenue base the bar would be 13.2 billion dollars, and on the trailing-twelve-month base 15.4 billion dollars, and the verdict is the same on any of the three bases. What makes the G2 pass borderline is the quality of the evidence behind it. The 10-K discloses no quantified total addressable market, stating instead that the data security market is at an early stage and evolving rapidly, so that its size is difficult to estimate, and the datapack behind the score contains no third-party market estimate either. The pass therefore rests not on a number but on a structural judgement: that the company's own market definition is expanding from data protection and cyber resilience into data security posture management, identity resilience, and artificial intelligence agent security, that current penetration is low, and that the sum of those adjacent markets can structurally exceed the bar. That judgement is recorded as borderline, with re-examination required if quantified market evidence appears, and it directly caps the market-size subscore, as discussed below. The honest way to read Rubrik's 58 is thus as a score with a strong confirmed core — growth, margins, retention, and cash generation — wrapped in two layers of explicitly labelled estimation: a market ceiling that is argued rather than measured, and a second growth curve, Rubrik Agent Cloud, commercialised in February 2026, whose revenue contribution is undisclosed and which the score file deliberately does not need for the G1 pass.

Speed: the re-acceleration after the conversion year

The speed section, 18 out of 25, converts to 72.0 on a 100-point scale, and it is the strongest of the three radar axes. Its shape is unusual, and the shape is the story. Revenue grew only 4.7 percent in fiscal 2024, to 627.9 million dollars, then 41.2 percent in fiscal 2025, to 886.5 million dollars, then 48.5 percent in fiscal 2026, to 1,316.2 million dollars. The fiscal 2024 stall was not a demand failure; it was the conversion year, in which perpetual licences and maintenance gave way to subscription, and legacy maintenance revenue fell from 90.0 million dollars to 52.3 million dollars across the transition. The score file treats that sequence as the textbook order of operations for a blitz that destroys its own business first: pay the cost in the growth rate, complete the conversion, and then re-accelerate from a subscription base. By fiscal 2026 the subscription share of revenue was 96.0 percent, and the conversion was, in the company's words, largely completed. The re-acceleration is therefore not a rebound from a cyclical dip but the emergence of a different revenue model, and that is why the growth subscore, 8 out of 10, is set where it is: high, but with the top points withheld.

The recurring-revenue detail supports the headline. Subscription annual recurring revenue rose from 1,092.6 million dollars in January 2025 to 1,462.1 million dollars in January 2026, up 34 percent, and then to 1,660.9 million dollars in July 2026, up 33 percent year on year. Cloud annual recurring revenue reached 1.48 billion dollars, up 39 percent. Remaining performance obligations stood at 2,400 million dollars, up 32.5 percent, and customers with more than 100,000 dollars of subscription annual recurring revenue numbered 3,084 in July 2026, up 23 percent year on year, from 2,805 in January 2026 and 2,246 in January 2025. Average subscription dollar-based net revenue retention exceeded 120 percent in both January 2025 and January 2026. Two cautions attach to those figures, and both are stated in the score file rather than added here. First, the company itself discloses that the retention figure includes the effect of maintenance-to-subscription conversion, so part of the measured expansion is migration rather than pure organic upsell, and the score records that as a discounting factor. Second, the most recent quarters' reported total revenue growth rates of 39 percent and 38 percent are flattered, or rather complicated, by the inclusion of material rights revenue — subscription credits — of between 4.7 million and 18.0 million dollars per quarter; on the company's separately disclosed excluding basis, growth was 43 percent in both the first and second quarters of fiscal 2027. The score file treats the material rights item as disclosed noise, not as a quality deduction, for reasons set out in the deductions section, but the distinction between the reported rate and the excluding rate is worth keeping in mind whenever a single quarterly growth figure is quoted.

The reason the growth subscore stops at 8, rather than rising to 9, is forward-looking, and it is the single most important tension in the speed section. Fiscal 2027 guidance points to revenue of 1,685 to 1,693 million dollars, approximately 28 percent growth year on year, and subscription annual recurring revenue of 1,880 to 1,885 million dollars, approximately 29 percent growth — a clear deceleration from the 48.5 percent of fiscal 2026 — and the annual recurring revenue growth rate itself has already eased from 39 percent to 33 percent. The score file places Rubrik alongside Figma at 8, on 48.3 percent growth and a trailing-twelve-month base of approximately 1.28 billion dollars, and alongside Datadog, Zscaler, and Cloudflare at the same level, and it withholds 9 points precisely because the next growth rate, not the last one, is the object of judgement. The question the next filing must answer is whether the guided deceleration is the natural normalisation of a business now operating at a 1.7 billion dollar revenue scale, or the first sign of a category that is maturing faster than the company's market-expansion narrative assumes. The score file is explicit that this is a question for the third-quarter fiscal 2027 results, expected on 3 December 2026, and no view on the answer is offered here.

Capital velocity, scored 3 out of 5, is a story of proven access rather than repeated use. Rubrik raised net proceeds of 815.2 million dollars in its initial public offering in April 2024, and then issued 1.15 billion dollars of 0.00 percent convertible notes in June 2025, with net proceeds of approximately 1.13 billion dollars, simultaneously repaying and terminating an existing credit facility of 327.9 million dollars. Cash plus short-term investments stood at 1.75 billion dollars in July 2026, and free cash flow was 237.8 million dollars in fiscal 2026, with guidance raised to a range of 323 to 333 million dollars for fiscal 2027, so that internally generated cash now backs the financing story rather than depending on it. The limitation is one of frequency: since listing, there has been a single convertible episode, and there is no share repurchase programme, so the pattern is not one of repeated, multi-round capital deployment. The score file places Rubrik in the same band as Datadog and Zscaler, each at 3, on the grounds that access is demonstrably top-tier while activity is limited. The zero coupon is doing real work here, as it does in the debt assessment below: capital was obtained without an interest burden, which means the fuel does not consume the engine, but it also means the eventual cost, if any, will arrive through conversion and dilution rather than through interest payments, and that is where the deduction for stock-based compensation re-enters the picture.

Hiring and productivity, scored 3 out of 5, rests on a thinner evidence base than the revenue figures, and the score file says so. Headcount was approximately 3,797 employees at 31 January 2026, with a substantial portion located outside the United States, and revenue per employee in fiscal 2026 was approximately 347,000 dollars on the score file's calculation, placing Rubrik in the same productivity band as Zscaler at approximately 385,000 dollars and Datadog at approximately 470,000 dollars, each scored 3. The more dynamic evidence is the subscription annual recurring revenue contribution margin, which improved for seven consecutive quarters, from 2.1 percent in the fourth quarter of fiscal 2025 to 11.6 percent in the fourth quarter of fiscal 2026 and then to 14.0 percent in the second quarter of fiscal 2027, with fiscal 2027 guidance of approximately 15.5 percent. That is a genuine productivity signal: the subscription business is becoming more profitable per dollar of recurring revenue even as it scales. What is missing, and what holds the subscore at 3 rather than 4, is the year-on-year growth rate of headcount itself, which is not disclosed, so the speed of hiring — as opposed to the productivity of the people already hired — cannot be verified. A reader should therefore treat the hiring item as a productivity score with a hiring-speed gap, not as a claim about recruitment velocity.

Share-of-market momentum, scored 4 out of 5, is where speed meets position. The customer count evidence is the same sequence already cited — 2,246 large subscription customers in January 2025, 2,805 in January 2026, 3,084 in July 2026 — and the score file draws the same comparison as for growth, placing Rubrik alongside Datadog, whose large-customer growth of 23 percent also earns 4. Category standing reinforces the count: Rubrik has been named a Leader in the Gartner Magic Quadrant for backup and data protection platforms for seven consecutive years, positioned furthest on vision in the 2026 edition, and a Leader in the IDC MarketScape for Worldwide Cyber-Recovery in 2025, both as announced by the company. International reach is also recorded: revenue outside the United States was 30 percent of fiscal 2026 revenue, and in the second quarter of fiscal 2027 the company announced a 375 million pound investment in the United Kingdom and designated London as its Europe, Middle East, and Africa headquarters. The fifth point is withheld because a quantified market share has not been confirmed, and that withholding is consistent across the score: Rubrik's standing within its category is well attested by third-party rankings, but its share of the wider market it claims to be expanding into is not measured. A final structural observation from the score file ties the speed section together: annual recurring revenue growth of 33 percent exceeds large-customer growth of 23 percent, which means the main engine of growth is expansion within existing customers, at retention above 120 percent, rather than new-logo landing. That is a high-quality form of speed, because it compounds on relationships already won, but it is also a form of speed that depends on the retention figure surviving the end of the conversion effect that currently flatters it.

Moat: data gravity, not network effects

The moat section, 36 out of 60, converts to 60.0 on a 100-point scale, and it is one point behind CrowdStrike and Zscaler, each at 37 — a gap that turns out to be entirely attributable to the evidence quality of the market-size item, as explained below. The moat's character is the most analytically interesting part of the Rubrik case, because it forces a distinction that the blitzscaling literature sometimes blurs: between a network effect, in which each additional customer makes the product more valuable to every other customer, and data gravity, in which each additional unit of protected data makes the product harder to leave. Rubrik, on the score file's structural judgement, has the second and not the first, and the scoring is built around that distinction rather than around it.

Network effects, scored 8 out of 18, are explicitly recorded as absent in the classical sense. What exists instead is data gravity plus recovery-workflow switching costs: as protected data and its metadata accumulate inside Rubrik's system, the value of resilience grows, and replacement would force a customer to re-protect its data and migrate its recovery workflows, a friction that the score file argues is structurally larger in data protection than in ordinary software-as-a-service. The expansion pattern described in the 10-K supports the mechanism: a customer typically begins by protecting a single application and then extends across data sources and products, into data security posture management, identity, and artificial intelligence, and the retention figure above 120 percent is the quantitative footprint of that expansion. The subscore sits at the top of the 5-to-9 anchor band for data and ecosystem effects, alongside Zscaler and Datadog at 8, and one point below CrowdStrike at 9, whose Threat Graph is treated as a genuine customer-to-customer network, because threat intelligence circulates between customers. That one-point gap is a precise statement of the difference: CrowdStrike's customers make each other safer; Rubrik's customers make themselves harder to move. Both are durable advantages, but only the first compounds across the customer base, and the score reflects that. The discounting factors are also stated plainly: the retention figure includes the conversion effect already noted, and the revenue contribution of newer axes such as Rubrik Agent Cloud is undisclosed, so the expansion story beyond the core platform is not yet quantified.

Distribution scalability, scored 9 out of 18, describes a go-to-market model that is enterprise-grade and deliberately high-touch. The model combines enterprise direct sales with channel partners and hyperscaler and marketplace partnerships, including Google Cloud, Microsoft, CrowdStrike, Deloitte, NTT DATA, and Cognizant, as confirmed in the 10-K. Subscriptions typically carry a three-year initial term and are prepaid, which gives annual recurring revenue a structural visibility that shorter, monthly contracts do not. The repeated-expansion evidence is the same set of figures that runs through the speed section — remaining performance obligations of 2,400 million dollars, up 32.5 percent, cloud annual recurring revenue up 39 percent, large customers up 23 percent — and inorganic expansion is recorded through the completed Predibase acquisition in 2025 and the Strata.io acquisition in 2026, in both cases with amounts unconfirmed. The subscore sits at the top of the 5-to-9 anchor band for paid-sales-dependent but repeatedly expandable distribution, level with CrowdStrike at 9. What blocks entry to the 10-to-14 band is stated numerically: there is no self-serve or viral element, and distribution is expensive, with sales and marketing expense of 769.0 million dollars in fiscal 2026, approximately 58 percent of revenue on a generally accepted accounting principles basis including stock-based compensation, on the score file's calculation. That is the cost of a high-touch enterprise motion, and it is the reason the distribution score, while strong, cannot be mistaken for the near-zero-marginal-cost distribution of a consumer or developer-led product. The score file also notes the absence of the kind of hard evidence that supports Zscaler's 10 — an explosion in customer counts for a flagship motion with total contract value to match — and the absence is treated as a gap in evidence, not as a claim that Rubrik's distribution is failing.

Market size, scored 9 out of 12, is the item where the evidence hierarchy does the most work, and it deserves a careful reading because it is also the item that costs Rubrik its point against CrowdStrike and Zscaler. The gate verdict is a borderline pass on an estimate, as described above: the core market of data protection and cyber resilience, plus the adjacent markets of data security posture management, identity resilience, and artificial intelligence agent security, can structurally exceed the approximately 16.9 billion dollar bar, and current penetration, at 1,660.9 million dollars of subscription annual recurring revenue, is low. But the company discloses no quantified market size, and the datapack contains no third-party estimate, so the score file caps the item at the top of the borderline band, level with Zscaler at 9, whose third-party market estimate is 1.3 times its bar plus adjacent markets. By contrast, Datadog and Cloudflare, each at 10, have quantified market sizes backing their scores, and CrowdStrike at 11, resting on qualitative assertion in a thinner datapack, is explicitly recorded as not available as a ceiling for Rubrik on the evidence hierarchy — a thinner file cannot set the standard for a thicker one. The rule that emerges, and that the score file proposes for the model's next version, is worth stating generally: where a company discloses no quantified market size and the datapack contains no third-party estimate, the gate may still pass on a structural judgement, but the market-size subscore is capped at 9 pending quantified evidence. That is an evidence price, not a business judgement, and it is reversible: quantified market evidence would trigger re-evaluation. Readers who quote Rubrik's market opportunity should therefore quote it as the score file does — as a structural possibility across an expanding market definition, not as a measured market size.

Gross margin, scored 10 out of 12, is the moat item that most directly validates the conversion story, and its trajectory contains a cautionary detail that is easy to miss. Generally accepted accounting principles gross margin was 76.9 percent in fiscal 2024, fell to 70.0 percent in fiscal 2025, and recovered to 80.1 percent in fiscal 2026, on gross profit of 1,054.3 million dollars, then printed at 80.5 percent in the first quarter of fiscal 2027 and 78.4 percent in the second quarter, with a non-generally accepted accounting principles figure of 81.0 percent for that quarter. The fiscal 2025 dip is explained, not hidden: stock-based compensation of 67.0 million dollars inside cost of revenue, inflated by initial-public-offering vesting, distorted the margin, and the normalisation of that figure to 18.9 million dollars in subscription cost of revenue is identified as the main driver of the recovery. At a subscription mix of 96 percent, a gross margin around 80 percent places Rubrik in the elite band, level with Datadog at a 79 to 82 percent band and Zscaler at 76.8 percent, each scored 10. Free cash flow of 237.8 million dollars in fiscal 2026, a margin of approximately 18 percent, and the subscription contribution margin improvement to 14.0 percent, already discussed, corroborate the margin story from the cash side. The eleventh point is withheld for a reason that leads directly into the deductions section: the generally accepted accounting principles operating loss was 345.4 million dollars in fiscal 2026, an operating margin of negative 26 percent, most of which is stock-based compensation of 329.4 million dollars, so that excluding that compensation the operating result is approximately negative 16 million dollars, close to breakeven but not yet demonstrating a generally accepted accounting principles operating profit. The margin is elite; the operating profit, on the accounting basis, is not yet proven. Both statements are true at once, and the score holds them apart.

Creative destruction: replacing backup with resilience

The creative destruction section, 10 out of 15, converts to 66.7 on a 100-point scale, and its three items describe different stages of the same substitution: a category redefinition that is clearly articulated, a behaviour change that is underway but not yet proven at full scale, and a cost-structure change that is real for customers but not yet demonstrated in unit economics.

The order being replaced, scored 4 out of 5, is the clearest of the three. The old order is prevention-centric security plus backup: deploy security products to stop attacks, and keep backups as an insurance-like store in case prevention fails. Rubrik's replacement, as stated in the 10-K and earnings releases, is Zero Trust Data Security and cyber resilience — the capability to restore the business after an attack, treated as an operating discipline rather than a back-office insurance policy. In 2026 the company extended the same logic to artificial intelligence agents, under the banner of Agentic Cyber Resilience, covering the observation, control, and rollback of agents. The self-destruction evidence is unusually clean, because the thing being destroyed includes Rubrik's own past business: perpetual licences and maintenance, and appliance sales, were the company's own earlier model, and the company completed the subscription and software-as-a-service transition and the appliance migration across fiscal 2025 and fiscal 2026. A company that destroys a competitor's business model is disruptive; a company that destroys its own, and then grows faster afterwards, has demonstrated the willingness that the blitzscaling framework treats as the hardest test. The fifth point is withheld for a reason the company itself supplies: it describes its market as being at an early stage, so penetration of the new order is still in progress, and the score places Rubrik level with CrowdStrike and Zscaler at 4, close to the top anchor but not at it.

Irreversible behaviour change, scored 3 out of 5, is the item where the evidence is contractual rather than cultural. The behaviour change itself is concrete: backup as insurance-like storage gives way to resilience as an operating model, and perpetual licences give way to a three-year subscription and prepaid structure, with remaining performance obligations of 2,400 million dollars, up 32.5 percent, as the footprint of that commitment. A customer that has rebuilt its recovery workflows around a subscription resilience platform has structurally little incentive to return to an appliance-plus-maintenance model, and the score file treats that asymmetry as real. What is missing, and what holds the item at the anchor for behaviour change in progress, is hard evidence of accelerating adoption at the scale that supports Zscaler's 4, where a flagship motion's customer count exploded from 350 to more than 950, and the fact that the newest behaviour change — governance of artificial intelligence agents — dates from 2026 launches and therefore cannot yet be measured. The score file places Rubrik level with CrowdStrike at 3, and the judgement is best read as a statement about timing: the old behaviour has been abandoned by Rubrik's customers in the sense that the contract structure has changed, but the new behaviour has not yet been demonstrated at the scale and speed that would justify a higher score.

Cost-structure change, scored 3 out of 5, follows a similar pattern of real but incompletely measured change. The structural change is genuine: for customers, appliance capital expenditure plus perpetual licences give way to software-as-a-service subscription, and for Rubrik itself, appliance sales were moved to a contract manufacturer, lightening the company's own asset structure. The cash-flow record provides indirect evidence of the transition: operating cash flow moved from negative 4.5 million dollars in fiscal 2024 to 282.9 million dollars in fiscal 2026, and free cash flow from negative 24.5 million dollars to 237.8 million dollars, with guidance of 323 to 333 million dollars for fiscal 2027. What is not disclosed, and what holds the item at the standard software-as-a-service band of 3, level with CrowdStrike, Zscaler, and Cloudflare, is any company-published measurement of collapsing cost per protected unit — for example, cost per data source — that would demonstrate the kind of unit-cost disruption the higher anchor requires. The change in who bears capital expenditure, and in what form, is proven; the collapse in unit cost is not yet measured. Across all three creative-destruction items, the pattern is consistent: the direction of substitution is clearly defined and partly self-inflicted, the contractual lock-in is forming, and the quantitative proof of a cost revolution is the least developed part of the case.

Deductions and risks: the six points that decide the grade

Total deductions are 6 points, from debt at negative 3, revenue quality at 0, governance at negative 3, and regulatory and social cost at 0. Each deduction, and each zero, deserves separate treatment, because they are not the same kind of risk, and because the two threes together explain the entire gap between the business score of 64 and the final score of 58.

Debt, scored negative 3 out of a possible negative 10, is a study in how a balance sheet can be simultaneously light and worrying. The financial debt itself is light: 1.15 billion dollars of 0.00 percent convertible notes, unsecured, maturing on 15 June 2030, carried at 1,130.7 million dollars, plus operating lease liabilities of 37.0 million dollars. Cash plus short-term investments of 1.75 billion dollars cover the note principal approximately 1.5 times, there is no interest burden, and free cash flow is positive and guided higher. On those facts alone, the debt item would score close to zero. The deduction comes from two other facts. The first is negative equity: shareholders' equity was negative 519.6 million dollars in January 2026 and negative 499.4 million dollars in July 2026, a capital erosion that reflects accumulated losses and the convertible structure, and total liabilities of 3,286.1 million dollars rising to 3,345.5 million dollars include deferred revenue and other operating liabilities alongside the financial debt. Cash cover mitigates the negative equity, but it does not erase the structure. The second, and larger, fact is dilution through stock-based compensation: 329.4 million dollars in fiscal 2026, equal to 25.0 percent of revenue, and 174.4 million dollars, or 21.4 percent, in the first half of fiscal 2027, with the weighted average share count rising from 154.3 million in fiscal 2025 to 196.5 million in fiscal 2026 and then to 206.1 million in the second quarter of fiscal 2027. The score file follows the Zscaler precedent in treating stock-based compensation here, as dilution, rather than double-counting it under revenue quality, and it records the combination — compensation around 25 percent of revenue, zero-coupon notes, and cash cover — as the anchor case for a deduction of 3. The offsetting factors are also recorded: the 2030 maturity is distant and diversified in the sense of being a single, long-dated instrument rather than a near-term wall, the coupon is zero, and cash covers the principal. The resulting picture is a company whose growth has been substantially funded in equity rather than in interest-bearing debt, and whose shareholders' per-share claim has therefore grown more slowly than its revenue — the score file's own summary of the maximum risk in the blitzscaling assessment is precisely this, that the numbers grow while the stake thins.

Revenue quality, scored 0, is a clean sheet with a disclosed footnote, and the distinction between the two is important. There is no revenue restatement and no audit issue, no material litigation beyond matters in the ordinary course as recorded in the 10-K, and the company has obtained Federal Risk and Authorization Management Program authorisation for its government offering, Rubrik Security Cloud for Government. The footnote is the material rights item already discussed: subscription credits contributing between 4.7 million and 18.0 million dollars per quarter to reported revenue, with the company disclosing the excluding growth rates alongside the reported rates — 43 percent against 38 percent in the second quarter of fiscal 2027 — and stating that the item declines through fiscal 2027 and is expected to expire. The score file's rule, proposed for formal adoption in the model's next version, is that disclosed accounting noise of this kind, where the company publishes the excluding figure and a wind-down schedule, is not a quality deduction. That rule is applied consistently: stock-based compensation is charged once, under debt and dilution, and not again here. A reader who treats the material rights disclosure as a red flag would therefore be double-counting a disclosure that the score file treats, deliberately, as evidence of transparency.

Governance, scored negative 3 out of a possible negative 5, is the second half of the six-point gap, and it is the more structural of the two. The dual-class structure gives Class A shares one vote each and Class B shares twenty votes each, with 44,871,803 Class B shares outstanding — a multiple twice that of the ten-vote structures at Datadog and Cloudflare. Voting power as of 31 March 2026, as disclosed in the DEF 14A proxy statement dated 15 April 2026, is concentrated: co-founder, chief executive, and chair Bipul Sinha accounts for 25.2 percent of voting power, on 14,068,144 Class B shares; co-founder Arvind Jain accounts for 21.1 percent; Arvind Nithrakashyap accounts for 19.7 percent; Lightspeed affiliates account for 18.0 percent, on 9,525,413 Class B shares; and the officer and director group together accounts for 46.2 percent. The chief executive also serves as chair, with Lead Independent Director John W. Thompson recorded as a partial offset. The score file places Rubrik level with Cloudflare at negative 3, whose founder group holds 52.4 percent under a ten-vote structure, and more heavily than Datadog at negative 2, whose founder group holds 32.8 percent under a ten-vote structure — the judgement being that the twenty-vote multiple combined with a 46.2 percent insider group is heavier than a ten-vote structure at a lower concentration, even though no single shareholder holds a majority. The fourth point is withheld because there is no majority control by a single shareholder and no conflict-of-interest trigger. A monitoring item is also recorded: leadership transition in the revenue organisation, including the promotion of Jesse Green to Chief Revenue Officer in March 2026. The governance deduction is not a claim of misconduct; it is a claim about the durability of control, and about who decides, if the interests of the controlling group and the wider shareholder base ever diverge.

Regulatory and social cost, scored 0, records the absence of a trigger rather than the absence of risk. There is no material pending litigation and no fine, as confirmed in the 10-K, and the Federal Risk and Authorization Management Program authorisation is a positive factor for public-sector sales. The execution risks that a reader might be tempted to place here — the fixed-cost expansion implied by the 375 million pound United Kingdom investment and the London headquarters designation, the integration of the Predibase and Strata.io acquisitions, and whether the artificial intelligence initiatives succeed — are recorded in the score file as business execution watch items, not as regulatory or social costs, and they are therefore not scored in this item. That discipline matters: it keeps the deductions section honest about what kind of risk each item measures, and it prevents a general sense of execution risk from inflating a regulatory score that has no regulatory facts behind it. A further caution applies to the fiscal 2025 figures quoted anywhere in this draft: stock-based compensation reached 913.9 million dollars in that year, inflated by initial-public-offering vesting, so year-on-year comparisons that include fiscal 2025 are distorted, and the score file flags that distortion explicitly. The fiscal 2026 figures, on which this draft principally rests, are free of that particular distortion, which is one reason the score file's confidence is recorded as high.

What to watch: deceleration, dilution, and the proof of the second act

What to watch for Rubrik reduces to a small number of observable tests, each of which can be checked against a filing rather than a press release, and each of which maps to a specific subscore that would move if the test resolved in one direction or the other.

The first test is the character of the deceleration. Fiscal 2027 guidance implies revenue growth of approximately 28 percent, against 48.5 percent in fiscal 2026, and subscription annual recurring revenue growth of approximately 29 percent, against the 33 to 34 percent recent prints. The third-quarter fiscal 2027 results, expected on 3 December 2026, are the first post-as-of-date checkpoint, and they should be read for three things: whether reported growth tracks the guided rate or departs from it, whether the excluding-basis growth rate continues to exceed the reported rate as the material rights item winds down, and whether the retention figure, once the maintenance-to-subscription conversion effect has fully washed out, remains above 120 percent on a pure expansion basis. The score file proposes, for the model's next version, a formal procedure for exactly this situation: where conversion flatters retention, the post-conversion pure expansion rate should be separately confirmed. Until that confirmation exists, the retention claim should be quoted with its conversion caveat attached, as this draft has done.

The second test is dilution against cash generation. Stock-based compensation was 25.0 percent of revenue in fiscal 2026 and 21.4 percent in the first half of fiscal 2027; the direction is favourable, but the level remains high, and the share count has risen from 154.3 million to 206.1 million across the measured periods. The relevant observations for future filings are whether the compensation ratio continues to fall toward the levels that would narrow the debt deduction, whether free cash flow guidance of 323 to 333 million dollars for fiscal 2027 is delivered and then extended, and whether negative equity of 499.4 million dollars at July 2026 narrows or persists despite positive free cash flow. The convertible notes do not mature until 15 June 2030 and carry no coupon, so there is no near-term refinancing test; the test is instead whether growth can be funded increasingly from cash flow rather than from equity, and whether per-share claims begin to grow at something closer to the rate of revenue growth. The score file's framing of the maximum risk — numbers growing while the stake thins — is the right lens for this test, because it is the only risk in the file that operates even if the business executes perfectly.

The third test is the proof of the second act. Rubrik Agent Cloud was commercialised in February 2026, and the company is expanding its market definition into data security posture management, identity resilience, and artificial intelligence agent security, but the revenue contribution of the new curve is undisclosed, and the score file records that the company guides fiscal 2027 growth as still driven principally by the core Rubrik Security Cloud platform. The observable questions are therefore whether future filings begin to disclose a revenue contribution, a customer count, or a retention figure for the agent and adjacent products, whether the Predibase and Strata.io acquisitions produce identifiable product or customer evidence, and whether any quantified market size — from the company or from a third party — appears that would allow the borderline gate verdict and the capped market-size subscore to be re-evaluated. The proposed model rule for companies with no quantified market size, capping the market-size subscore at 9, means that this single disclosure could move the score by up to three points on its own, before any change in the business. Equally, the absence of such disclosure across several more quarters would leave the market case as a structural argument rather than a measured one, and readers should weigh it accordingly.

The fourth test is governance durability. The dual-class structure, at twenty votes per Class B share, and the 46.2 percent voting concentration of the officer and director group, will not change quickly, and no single-shareholder majority exists that would justify a heavier deduction today. What can change, and what should be monitored, is the leadership transition in the revenue organisation, the role of the Lead Independent Director as a counterweight to the combined chief executive and chair roles, and any future disclosure of related-party or conflict matters, of which the score file records none. The governance deduction is structural rather than event-driven, so the expectation should not be that it disappears in a single quarter; the question is whether it remains a stable three points or whether concentration or a trigger moves it in either direction.

The fifth test is execution of the international and inorganic expansion already announced: the 375 million pound United Kingdom investment, the London designation as Europe, Middle East, and Africa headquarters, and the integration of two acquisitions whose amounts are unconfirmed. These are recorded as watch items, not scored deductions, and the right way to track them is through the revenue mix — whether the 30 percent non-United States share of fiscal 2026 revenue rises, whether large-customer growth continues at or above the 23 percent rate, and whether sales and marketing expense, at approximately 58 percent of revenue, begins to fall as a share of revenue as the subscription base scales, which would support a higher distribution subscore in time. A falling sales-and-marketing ratio alongside sustained retention would be stronger evidence of distribution scalability than any partnership announcement, and the partnership list itself — Google Cloud, Microsoft, CrowdStrike, Deloitte, NTT DATA, Cognizant — should be tracked for customer evidence rather than for its length.

Rubrik at 58/C is, on this evidence, a company that has already passed the hardest test in its own story and has not yet passed the tests that remain. The conversion is complete, the subscription model is proven at 96 percent of revenue, the gross margin is around 80 percent, retention exceeds 120 percent on the disclosed basis, and free cash flow is positive and guided higher. The deceleration in guidance, the dilution that has accompanied the growth, and the control structure that fixes decision-making with the founding group are the reasons the score stops seven points short of the threshold, and they are also the reasons the next chapters are checkable rather than speculative. If the guided deceleration proves to be scale normalisation, if the stock-based compensation ratio keeps falling while free cash flow rises, and if the adjacent markets and the agent platform begin to produce disclosed revenue, the path toward 65 is visible in the arithmetic itself: the business score needs one more point, and the deductions need to narrow. If, instead, retention fades once the conversion effect ends, or dilution persists at a quarter of revenue, or the second act remains undisclosed, the score will have described the ceiling accurately. Either way, the filings to watch are named, the dates are known, and the figures that would change the judgement are specified in advance — which is, for a research score, the most useful thing a draft can offer.

More Platforms companies

Other Platforms names on the Blitz Index, highest score first: Alphabet (83/A), Meta (78/B), Airbnb (76/B).

Next earnings

Dec 3, 2026 · Expected

Coverage

Rubrik, Inc. · Q3 FY2027 due Dec 3, 2026 (expected) · Score 58 · Grade C

Embed this score

Copy the HTML below to show this score on your site. The badge links back to this page and updates automatically when the score changes.

<a href="https://blitzlab.app/companies/rbrk/"><img src="https://blitzlab.app/badge/rbrk.svg" alt="Rubrik Blitz Index 58/C — BlitzLab"></a> Copy HTML

Preview:

BlitzLab scores businesses against a scholar’s standard — not investment advice. No price targets, no buy/sell recommendations. Figures are from SEC filings (XBRL) as labeled in the source scorecard.