Rubrik goes public
Public markets thaw a bit in H12024
Reading time: 12 mins
Topic: Financial
The public markets have thawed this year. As of May 2024, the New York Stock Exchange has listed 25 stocks after a drought of public listings in 2023. Included in the listings are Ibotta (IBTA), Reddit (RDDT), and Rubrik (RBRK).
Rubrik is a data security and data recovery company based in Palo Alto. They listed on the NYSE on April 25, 2024 under the symbol “RBRK.” After the public listing, there’s been a slight drop from the initial price of $37 per share. They also have an employee 6-month lock-up so it’ll be interesting to see the stock performance on October 25, 2024 (keep your calendar hold~).
While I have no background in cybersecurity, there’s been some interesting new start-ups within the space: Abnormal Security (Series C, ~687 employees), Wiz (Series E ~1,5k employees), and Cyera (Series C, ~250 employees).
As someone who works in tech, it’s been reassuring to see more tech companies go public since the beginning of the year for a few reasons:
This provides more data to better understand what is the standard for financial health for a tech company and the future exit opportunities for founders
This provides an aperture for liquidity for employees. If companies are taking the public markets route, a more cash rich route than an acquisition. In an acquisition, if the company is acquired by another private company, employees might be solely transferring risk exposure from one private company to another private company
Employees from these success stories have the personal wealth are most likely to invest in another generation of start-ups and provide great support as angel investors
I’m not as familiar with the cyber security space so it was interesting doing a deeper dive into Rubrik.
Company leadership
The founder of Rubrik was an operator turned investor before starting Rubrik. He worked at Oracle for 9 years before transitioning into venture investing for 6 years. While an investor at Lightspeed, he discovered the opportunity within cyber security. His tenure at Lightspeed also translated into Lightspeed’s investment into Rubrik’s Series A, a big vote of confidence of the partnership, and an investment that paid off for the fund.
The CEO, Bipul Sinha, has interesting definition of maximal thinking. He shares that he likes “constantly imagining a limitless, extraordinary future while accepting contradictions and maximizing present opportunities.”
As an operator myself, I found his maxim inspiring and I love when founders think of the limitless opportunity in front of them. Getting something off the ground at the beginning requires a reality distortion field and combating major industry inertia. I can imagine what fun there would have been building alongside Bipul at the beginning of Rubrik.
Company’s vision and product
Rubrik’s mission is to “secure the world’s data.”
They promise customers to be a “Cloud native SaaS platform that detects, analyzes, and remediates data security risks and unauthorized user activities” according to their S1 filing. Let’s break down this product definition to better what they’re offering and the JTBD it fulfills:
Cloud: The product doesn’t require any on-premise data centers to use the product
SaaS: Hand in hand with cloud, the product is charged on a monthly/annual cadence for when the customer uses the product. We’ll talk about this later, but it is a good revenue model for Rubrik and a tablestake business model revenue line for tech companies.
Detect, analyze and remediate: Helps companies identify potential risk and immediately solve for them. From a product perspective, it’s helpful seeing a comprehensive use case from identifying a risk to putting it down. This is the solution they’re offering.
Data security risks and unauthorized user activities: This is the pain point that customers currently have that Rubrik is looking to solve.
The unique insight from Rubrik was that companies needed a single product for both security and back-up and recovery, where most companies only provided security. Their bundled solution provided a more holistic solution for customers.
Market landscape & industry changes
Rubrik became successful because of timing based on two external factors:
Competitors were slow to adapt
Customers were expanding fast and growing business data
These two factors made the opportunity a blue ocean for Rubrik when they started in 2014.
Competitors weren’t able to evolve fast enough, these are three areas where they moved too slowly:
Lack of remediation for companies: most companies would identify the risk but couldn’t remediate the attack
Inability to adapt to more and more sophisticated attacks: This is most likely due to the fact that hackers are becoming more sophisticated and evolving faster than the security software could
Lack of data recovery: Most legacy players were focused on data recovery from natural disasters, not from cyber attackers. I would imagine with Covid and the more rampant fraudulent online activities, this pain became more acute
At the same time, companies continued to expand their business data for a few reasons:
Accelerated digitization. For the companies that were still being manually run in 2014, they were laggards and knew they needed to continue to digitize customer experiences, and operations.
Data regulation. Companies were being held more accountable to keeping their data safe and reprimanded with financial penalties if they didn’t keep it safe. With a $ more clearly associated with lack of protection of customer data, customers could clearly tie a budget $ to protecting data.
The advent of GenAI. Data has become more important to provide a strong competitive advantage over other competitors. Procuring more data is critical for business growth as GenAI is trained on data. Both the importance of data and the potential growth in the data volume, means that data security is paramount. Considering how tech companies are seeing AI as tablestakes, this puts Rubrik in a great position as a data security company. Training data for LLM and ML models requires a lot of data and data processing. As customers built a flywheel to gather more proprietary data and build a data moat, this became a larger risk vector as competitors and bad actors were interested in compromising or threatening what the customer considered valuable.
This blue ocean translated into a measurable total addressable market opportunity of ~$36.3 billion by the end of calendar year 2024 and approximately $52.9 billion by the end of calendar year 2027, based on market estimates in Gartner research. A 44% market growth rate over a 3-year period is a great market to build products for.
Company’s business model and financials
From a financial perspective, the company has translated a viable product and big market opportunity into great econommics.
The business model has many positive aspects:
Stable and predictable because of the SaaS model
The more successful companies are, the more business data they store, the more likely Rubrik is to become successful
Their metrics are an interesting barometer of what “good” looks like for a public listing today:
>130% Average Subscription Dollar-Based Net Dollar Retention: Super impressive. On average, for $1 subscription a customer pays for Rubrik, they pay $1.30 the following year for the same/more products & services
6,100 customers with 99 customers >$1M in subscription ARR. While they have a large array of customers, they don’t have a major revenue concentration in large customers. This means a lower customer risk, but also an opportunity for further enterprise expansion.
Annual recurring revenue at $784M as of Jan 1, 2024, 47% annual growth rate
Their free cash flow was ($24.5M). While a small gap, still negative. However, since they have such a strong growth story with 47% annual revenue growth rate, investing back into the business to support this growth rate is reasonable.
Gross margin of 76.9% for the business. Great margins for a software business and clearly great unit economics. There’s a large investment in R&D and sales and marketing that translates into a net loss of $354M. Sales & marketing is 2x of R&D, which shows an investment in their GTM distribution and a focus on growing into larger accounts.
At ~$6.1B market capitalization, they’re trading at 9.7x multiple of FY2024 revenue. That’s a pretty high multiple.
They emphasize their subscription revenue, however in 2023, only 64% of their revenue came from subscription. 13% of revenue came from maintenance and 23% came from “other.” “Other” highlights the professional services and one-off nature of the revenue from customers. This is non-recurring and a large risk to be able to continue to expand the company’s revenue going forward. That’s most likely why in 2024, one of Rubrik’s goals is to increase the revenue attribution of software from 64% to 84% in subscription by the end of 2024.
They have 99 customers with >$1M in ARR and the goal is to be able to expand within current customers and capture bigger contract. It’ll be interesting to understand their customer segment and whether they are able to expand into larger ACVs with this more enterprise customer base and also explains why their investment in sales & marketing is 2x than R&D in the FY2024.
According to Meritech’s IPO analysis, there’s a “size premium” for larger SaaS companies. At $784M, Rubrik' sits comfortably in the middle.
In conclusion, there’s a light at the end of the tunnel and it looks like we have some private companies that have healthy financials and growth trajectory to IPO. This will provide more liquidity to employees and provide more incentive for public investors to invest in the tech industry beyond FAANG + Nvidia. It’s always interesting to see how a static picture of a company (revenue, growth margins, profitability) interact or influence the dynamic part of a company (e.g. stock price, investor interest).
I haven’t done an analysis in a while and I’m quite rusty but this was indeed a fun exercise as I push myself to write more publicly!
References: