They got in through a compromised identity. As they so often do. Within hours, encryption keys were deployed across thousands of endpoints, and the hospital's electronic health records system went dark. This scene plays out somewhere in the world every single day — Sophos reports that 56% of ransomware attacks still succeed in encrypting data, and the average recovery tab now runs $1.7 million per incident. The cybersecurity industry has spent two decades building taller walls. The problem is that attackers have only gotten better at climbing them.
Rubrik is building something different: a recovery-first architecture that assumes the perimeter will be breached. The company's thesis — that data resilience is splitting away from the broader cybersecurity budget to become its own boardroom line item — is showing up in financial results that have turned skeptics into believers.
Subscription annual recurring revenue hit $1.57 billion in the fiscal first quarter, up 32% year over year. Total revenue of $387 million climbed 39%, easily clearing the Street's estimates. Those numbers impress in isolation. What makes them structural is the margin story underneath. Free cash flow margin expanded to 19%, up from 12% a year ago, and the subscription ARR contribution margin — a measure of how efficiently the company converts new bookings into profitable recurring revenue — swung from negative 11% to positive 13.2% in the span of twelve months.
The bull case for this stock has never been about stealing market share from legacy backup vendors. It is about category creation. Rubrik is positioning data resilience as the fourth pillar of enterprise security alongside network, endpoint, and identity. The logic is straightforward: even the best prevention eventually fails. When it does, recovery speed and data integrity determine whether a ransomware event is a disruption or an existential crisis.
The addressable market backs up the ambition. The global data resiliency market was valued at $22.8 billion in 2025 and is forecast to reach $96.6 billion by 2035, a compound annual growth rate of nearly 17%. That trajectory is being fueled by regulatory mandates like the EU's Digital Operational Resilience Act and the NIST Cybersecurity Framework 2.0, which for the first time introduced "Govern" and "Recover" functions that push cyber resilience into boardroom oversight.
McKinsey estimates that 15% of enterprise cybersecurity spend now originates outside the CISO's office — from risk committees, audit functions, and even the CFO — and that share is growing at 24% annually. This is Rubrik's natural constituency: executives who want proof that their organization can actually recover, not just a report on how many threats were blocked.
The competitive picture is evolving fast. Cohesity-Veritas leads the broader market at roughly 19% share, backed by Nvidia and headed for an IPO. Veeam remains strong in the mid-market. But Rubrik leads in brand momentum and wallet-share growth among enterprises spending more than $100,000 annually on subscription ARR — now more than 2,900 customers deep, growing 24% year over year. The company has been named a Gartner Leader for six consecutive years and an IDC MarketScape Leader for Cyber Recovery.
The technological moat lies in Rubrik's zero-trust data security architecture. The platform runs on a proprietary append-only file system that prevents ransomware from encrypting or deleting backups. A logical air gap isolates recovery data from the production network, and quorum authorization ensures that no single administrator — or compromised credential — can destroy an organization's last clean copy. These are not features bolted onto a legacy product. They were architected from the ground up for a world where attackers go after backups first. Gartner finds that 78% of organizations are now implementing isolated recovery environments, yet 53% still lack immutable backups — a gap that represents both risk and opportunity for the category leader.
Rubrik is leaning into the moment with product velocity. The company launched Rubrik AI at its Forward conference in June 2026, delivering an agentic cyber recovery experience that reasons across data, identity, and deployed agents to orchestrate recovery sequences that once took human teams weeks. In February, it commercially launched Rubrik Agent Cloud, extending data resilience to the AI infrastructure layer. Strategic partnerships with MEDITECH in May and Internet2 in July have opened channels into healthcare and higher education — two sectors where ransomware downtime carries consequences far beyond the balance sheet.
The structural bull case for Rubrik rests on a simple idea that is gaining urgency every quarter: when prevention fails, recovery is the last line of defense. The company owns that conversation, and the numbers suggest it is only getting started.
Disclosure: The Signal holds no position in RBRK. Positions may change. This is not financial advice.
