Rubrik (RBRK) Q2 2026: Subscription ARR Jumps 36%, Cloud Security Expansion Drives Margin Upside

September 9, 2025 | By EarningsIQ Research

Rubrik’s Q2 showcased broad-based momentum in cyber resilience and cloud security, with subscription ARR climbing sharply and cash flow inflecting positive for the fourth straight quarter. The company’s evolving platform strategy, spanning identity, data, and AI, is yielding higher-value customer expansions and margin leverage, prompting a guidance raise. Investors should focus on Rubrik’s ability to sustain high net retention and multi-product adoption as the business pivots deeper into enterprise AI and security orchestration.

Summary

• Cloud Security Gains: Rubrik’s platform approach is converting legacy and new-gen competitors as customers prioritize cyber resilience.
• Margin Expansion: Operating leverage and capital structure optimization are driving a rare combination of scale and profitability.
• AI and Identity Integration: The company is positioning to lead in enterprise AI by fusing secure data, identity, and recovery capabilities.

Business Overview

Rubrik is a security and AI company delivering cyber resilience solutions through its Rubrik Security Cloud (RSC), a unified SaaS platform for data protection, identity resilience, and rapid cyber recovery. The company monetizes via subscription annual recurring revenue (ARR), with major segments in cloud data protection, identity recovery, and emerging AI-driven security offerings. Its customer base is weighted toward large enterprises, with a land-and-expand model that grows through new workloads, expanded security features, and increased data volumes.

Performance Analysis

Rubrik delivered a robust quarter marked by 36% year-over-year growth in subscription ARR, with net new ARR of $71 million and a subscription net retention rate (NRR) above 120%. Subscription revenue rose significantly, and cloud ARR, now 85% of total subscription ARR, grew 57% as customers accelerated migration to cloud-native protection. Notably, the company crossed 2,500 customers with $100,000+ in subscription ARR, who now account for 85% of total subscription ARR—reflecting deeper enterprise penetration.

Profitability inflected sharply, with free cash flow of $57.5 million and a 1,800 basis-point improvement in subscription ARR contribution margin year-over-year. Drivers included higher sales, improved cost management, and a one-time hosting credit, alongside capital structure optimization. Revenue benefited from non-recurring material rights tied to the cloud transformation, contributing seven percentage points to growth this quarter, though management noted this tailwind is temporary and will fade in fiscal 2027.

• Cloud-Driven Revenue Mix Shift: Cloud ARR now dominates, with non-cloud ARR declining as legacy migrations complete.
• Multi-Product Expansion: Additional security features and identity solutions contributed 35% of NRR, signaling success in cross-selling.
• Early Renewals and Contract Duration: Multi-year and early renewals, often tied to expansions, boosted billings and cash flow, but management expects duration compression to resume.

Customer wins included major replacements of legacy and next-gen vendors, with Rubrik’s preemptive recovery engine and unified platform cited as key differentiators. The company continues to see high win rates across both legacy and emerging competitors, supporting its claim to leadership in the cyber resilience market.

Executive Commentary

Strategic Positioning

1. Cyber Resilience Platform Dominance

Rubrik’s preemptive recovery engine and unified RSC platform are displacing both legacy and next-gen backup vendors, as customers prioritize rapid recovery and uniform security controls. The company’s ability to deliver fast, accurate recovery—validated by high-profile customer wins—positions it as a go-to partner for enterprises facing inevitable cyber threats.

2. Multi-Product and Identity Expansion

Identity resilience is emerging as a critical growth lever, with over 200 customers adopting Rubrik Identity Recovery Solutions in just a few quarters of general availability. The integration of data security posture management (DSPM) with identity intelligence is unique, offering customers a holistic view of risk, privilege, and remediation in hybrid environments. This cross-product synergy is deepening Rubrik’s strategic relevance within large accounts.

3. Enterprise AI Enablement

The PrediBase acquisition and launch of Agent Rewind signal a concerted push into enterprise AI acceleration, leveraging Rubrik’s secure data platform to provide clean, permissioned data for generative AI. The company is building an agentic AI stack that addresses not just security but also operational efficiency and error recovery, aiming to move AI initiatives from proof-of-concept to production.

4. Land-and-Expand Model Fuels Growth

Rubrik’s business model is anchored in initial landings—often with Foundation or Business Edition—and subsequent expansion into higher tiers, more workloads, and additional security features, including cloud, SaaS, and identity. This model supports high NRR and provides a clear runway for continued ARR growth as customers adopt more of the platform over time.

5. Federal and Regulated Market Investment

Rubrik continues to invest in the federal sector, recently achieving FedRAMP Moderate and winning competitive takeaways from both legacy and next-gen vendors. While still a small part of the business, federal contracts are seen as a long-term opportunity given the sector’s acute focus on cyber resilience.

Key Considerations

This quarter underscores Rubrik’s ability to deliver high growth at scale while expanding margins, but also highlights the importance of sustaining multi-product adoption and navigating revenue tailwinds that will not persist into future periods.

Key Considerations:

• Material Rights Revenue Tailwind: Temporary non-recurring revenue from cloud transformation credits boosted growth but will diminish in fiscal 2027.
• Seasonality from Sales Compensation Shift: Moving to annual sales comp plans will make Q4 seasonally strongest, with Q2 and Q3 now similar—investors should model accordingly.
• Cloud Migration Nearing Maturity: With 85% of ARR now cloud, future growth will rely more on new workloads and cross-product expansion than legacy migrations.
• AI Product Market Fit Still Early: The Agent Rewind and PrediBase initiatives are in the early stages of adoption, with material revenue contribution likely several quarters out.
• Operating Leverage Sustainability: Recent margin gains benefited from one-time credits and favorable renewal timing; ongoing improvement will require continued cost discipline.

Risks

Key risks include the fading of non-recurring material rights revenue, potential compression in contract duration as cloud-native deals proliferate, and the challenge of maintaining high NRR as the base grows. AI and identity solutions are still finding product market fit, and competitive intensity remains high, especially as larger cybersecurity vendors expand DSPM and identity offerings. Federal market penetration, while promising, requires continued investment and carries long sales cycles.

Forward Outlook

For Q3 2026, Rubrik guided to:

• Revenue of $319 million to $321 million, up 35% to 36%, including a few percentage points from material rights.
• Non-GAAP subscription ARR contribution margin of approximately 6.5%.
• Non-GAAP EPS of negative $0.18 to negative $0.16.

For full-year 2026, management raised guidance:

• Subscription ARR of $1.408 billion to $1.416 billion, up 29% to 30%.
• Total revenue of $1.227 billion to $1.237 billion, up 38% to 40% (32% to 34% ex-material rights).
• Non-GAAP subscription ARR contribution margin of approximately 7%.
• Free cash flow of $145 million to $155 million.

Management emphasized continued investment in R&D and go-to-market, with Q4 expected to be seasonally strongest due to comp structure changes and ongoing cloud transformation tailwinds.

• Material rights revenue will diminish in fiscal 2027.
• Operating margin improvement depends on scaling efficiencies as one-time credits roll off.

Takeaways

Rubrik’s Q2 results confirm its leadership in cyber resilience, cloud security, and emerging AI-driven protection, but the company’s next phase will hinge on sustaining high-value expansion and moving early-stage AI solutions to scale.

• ARR and Margin Upside: Subscription ARR and cash flow inflected positively, but investors should model for normalization as one-time revenue fades.
• Multi-Product Penetration: Identity and cloud security cross-sell are key levers for maintaining high net retention and deepening enterprise relationships.
• AI and Orchestration Opportunity: Early traction in AI agentic solutions positions Rubrik for future growth, but material contribution is still several quarters out.

Conclusion

Rubrik’s Q2 was a showcase of operational discipline and platform expansion, with robust ARR growth, margin leverage, and early AI innovation. The challenge ahead is to sustain this momentum as non-recurring tailwinds fade and to convert AI and identity investments into durable, high-margin revenue streams.

Industry Read-Through

Rubrik’s results highlight intensifying enterprise demand for unified cyber resilience platforms that span data, identity, and AI security. The company’s success in displacing both legacy and next-gen vendors signals that point solutions are losing ground to integrated platforms, especially as cloud and SaaS adoption accelerates. Identity resilience and DSPM are emerging as critical battlegrounds, and Rubrik’s early moves suggest that the future of cybersecurity will be defined by vendors who can combine recovery, posture management, and AI-driven remediation in a single stack. Larger cybersecurity and cloud infrastructure players will likely accelerate investments in these areas to defend share and close product gaps.

RBRK Technology Cybersecurity Cloud AI Identity Subscription ARR