Rubrik stock (RBRK) is up 210% since April. Just backup?

0:00 Rubrik stock is up 205%. How many customers pay for the AI?

Rubrik's stock closed near its record, up two hundred and five point oh two percent since April. It calls itself 'the Security and AI Operations Company.' So is the hype real? How many customers pay for the AI?

"Over fifteen." So not twenty? You would say twenty if it was twenty. So what is it, sixteen, seventeen paying customers? You had six months to sell it to more than six thousand customers who already pay you. Over fifteen bit. I call that a pilot, at best.

Hang on, and we'll check what it takes for Rubrik to pull it off. Three stops: the label, the backup and its price, and the race. We read fifty-four reports to the SEC, the US stock regulator, and transcribed twelve calls and TV interviews.

People google Rubrik as a stock. Commvault, a rival also on the stock market, they google as backup. So with Rubrik, people look up the price before the product. If you own it, you own the product, so let's start there.

1:00 What is Rubrik? Backup for servers, the cloud and Microsoft 365

Ten years in data centers taught me one thing: the disaster plan sits in a drawer until the worst day. That's the day the servers die, or hackers lock your data. Rubrik sells the backup, the copies that bring it back. It covers three places a company keeps data: its own servers, the cloud, and apps like Microsoft 365.

1:22 The label: is Rubrik an AI company?

In twenty twenty-four, Rubrik called itself 'the Zero Trust Data Security company.' Now AI is on the label too. Customers pay for the copies first. Of what they pay Rubrik in subscriptions each year, at least sixty-three point two two percent is for the copies.

The AI product, RAC, is a tool that watches companies' own AI agents and undoes their mistakes. On its August call, Rubrik's CEO said 'while early,' and that 'proof of concept' deals 'convert into production deployment.' And Rubrik said: 'minimum assumption of RAC in this year's ARR.' So this year's plan barely counts on it.

How much is AI? It doesn't say. Rubrik's own slide of what customers pay for has no line for it. Everything not on that slide was at most four point one six percent at the end of April, by my calculation. That's pretty weird for an 'AI' Operations Company. Rubrik's CEO is smart. AI sells. I hunt hype, and the hype comes with AI on the label.

Rubrik likes the word 'over.' It reports net retention: what last year's customers pay now, as a percent of what they paid then. Over a hundred nineteen percent. So a hundred dollars became a hundred nineteen. In its papers for listing its stock, that was a hundred thirty-three. Then 'over a hundred twenty.' 'Approximately a hundred twenty.' 'Over a hundred nineteen.' So customers add less than they did. Commvault's was a hundred fourteen in June, so that's still good. But 'over' is working hard.

Over fifteen. And there's still no number. It's backup, boys and girls. Not AI. Yet.

3:02 The backup: why hackers go after it, and what Rubrik backup adds

So what's a backup worth? It's the customer records, the orders, everything a company can't lose. CISA, the US cyber agency, writes that most hackers who lock data for ransom go after the backups. Why?

In ten years of data centers, I learned why. When hackers get in, the backup is the company's last way back. Take it away, and what's left is paying the ransom, or rebuilding from scratch. Until then, the whole business can stand still, and that costs money every hour. It's the game-ending move.

Sophos, a security company, asked two thousand nine hundred seventy-four victims. In ninety-four percent of them, the hackers went for the backups. Fifty-seven percent of those tries got through. Where the backups were hit, the middle case, the median, cost three million dollars to recover from. Eight times the three hundred seventy-five thousand where they weren't.

And that's only what gets counted. The FBI says the losses reported to it don't normally include lost business, and some companies report no amount at all. We found no number that shows what it costs when a company has to tell you your bank details are in a hacker's database. And no backup gets them back.

What a backup can fix is the lockout, with a copy nobody can delete. Amazon's cloud sells one. Veeam, Cohesity and Commvault, all backup sellers, sell one too. You don't need Rubrik for that.

So what's left? Scale. In a big company, the job is finding the clean copy and bringing every system back in the right order. That's what Rubrik sells: one set of rules for every system, and the clean copy back fast.

How fast? 'Rapid' is Rubrik's word. Veeam promises 'up to 5x faster.' We found no independent test. Veeam's CEO says 'the only platform.' Rubrik's annual report says it's 'not aware of other companies' with a similar approach. Until someone tests both, neither claim is an edge you can count on.

Rubrik also sells security software on top of the backup: tools that watch the copies for attacks and find sensitive data. At the end of April, customers paid over four hundred million dollars a year for them. That's real money. Gartner, a research firm, as published by Rubrik, puts that kind of watching in fifty-five percent of backup products in twenty twenty-five. By twenty twenty-nine: ninety-five percent. So it doesn't set Rubrik apart.

So what does Rubrik save you? An FTE is one full-time job. An admin at one university wrote this on PeerSpot, a review site. With Rubrik, the university's backup went from 'almost a full FTE's job' to 'under a quarter of an FTE.' A US systems administrator's median pay is ninety-nine thousand one hundred thirty dollars a year. Three quarters of that is seventy-four thousand three hundred forty-eight, by my calculation. Your own backup also takes a server and a license, but for an IT department that's peanuts. So I'm not counting it, and that goes against Rubrik. Rubrik's smallest package on Amazon's marketplace is fifty thousand a year, for six terabytes. At that size, Rubrik pays for itself, if your admin saves what this one did.

But three thousand eighty-four customers pay a hundred thousand dollars or more, and they bring eighty-eight percent of what customers pay in subscriptions. Say a customer has two hundred fifty terabytes. At a reseller's list price, that comes to three hundred sixty thousand a year, by my calculation. That's three point six three administrators. At that price, you're buying insurance for the worst day. And you only buy insurance if you believe that day is coming.

6:31 The price: Rubrik stock against Commvault and growth software

Now the price, the thing people look up first. Today's price pays ninety-six dollars seventy-eight for each dollar of free cash flow Rubrik makes in a year. That's the cash left after costs and paying for equipment and software. Mature software, big names like Adobe and Salesforce: eleven dollars seventy-two. Commvault, the backup rival: twenty-seven dollars fifty-two. The growth software we compared, like CrowdStrike and Zscaler: a median of eighty-eight dollars ninety-eight.

Fast growth is what stock buyers pay more for. In the year to July, Rubrik's subscriptions grew thirty-three percent. Commvault's, in the year to September: twenty. Each counts them differently, and Rubrik widened its count this year without saying how much that adds. Either way, if you buy today, you pay for growth that keeps coming.

Next to growth software, that price looks normal. But at least sixty-three point two two percent of what customers pay Rubrik in subscriptions is backup. Commvault: twenty-seven dollars fifty-two. Rubrik: ninety-six dollars seventy-eight. That's three point five two times the price, for thirteen more points of growth. Still backup, boys and girls.

7:38 The race: PHP2Shell, hackers and security teams

Stop three: the race, hackers against security teams. Where would that growth come from? So far, big customers. In the year to January, Rubrik's subscriptions grew thirty-four percent, Rubrik's own number. From customers under a hundred thousand dollars: eight point seven three percent, by my calculation. Rubrik rounds the big customers' share, so that number could be as high as sixteen point five five. Still under half of thirty-four. Some may have grown past a hundred thousand and moved over, so the gap can look bigger than it is. My speculation: three thousand eighty-four big customers only go so far, and customers already add less than they did. So for growth that keeps coming, Rubrik needs the companies that settle for their own backup.

What could change their minds? Not much, except more news like this. On October twentieth, news leaked of two critical vulnerabilities in PHP, software websites are built on. Those are flaws an attacker can use to get in. They're called PHP2Shell. AI helped find them. Wiz, one of the companies that reported them, wrote: 'It marks an AI inflection point.' It was all over the headlines, and that talk is exactly what Rubrik needs.

I've built these networks. Say a company hosts its own website, on its own servers, inside the company network. A vulnerability like PHP2Shell can let an attacker run commands on that web server. From there, they hop from server to server, until they reach the backup.

So will more headlines come? AI is a double-edged sword, for hackers and for security teams. An exploit is the code that uses a vulnerability. Researchers had an AI system build working ones for four hundred twenty-eight of eight hundred forty-one known vulnerabilities, at an average of two dollars seventy-seven each. In a contest run by DARPA, the US military's research agency, AI systems found fifty-four of sixty-three planted vulnerabilities and fixed forty-three. And AI writes code too. At Stanford, on one task, three percent of people with an AI assistant wrote a secure solution, against twenty-one percent without. That's forty-seven people, a 2022 model and mostly students, so it's a hint. More gets found, by everyone. So it's one of two things. A hacker finds the flaw first and uses it. Or someone else finds it first and patches it.

So who gets there first, the attacker or the patch, the software fix? Mandiant, Google's security firm, estimates that the vulnerabilities attackers do exploit are now hit, on average, seven days before the patch. Verizon counted the ones already being exploited: a median of forty-three days to fully patch them, up from thirty-two. Qualys, which sells patching tools and supplied Verizon's data, counts each single fix: a median of nine days. Different measurements. Nobody can show who's ahead. With no clear winner, every new flaw is a headline, and Rubrik needs them.

Google's threat intelligence team, the people who track attackers, counted ten point five exploited vulnerabilities a month in twenty twenty-five. This year: eighteen a month. AI made the exploit cheap. Threat actors scan for vulnerabilities with AI and weaponize them with AI. The patch still has to be tested and deployed. Meanwhile they're in: they encrypt your data, delete it or steal it, and they go after the backup too. That sounds terrible for a company. That's good for Rubrik.

And do headlines sell? We have a test. The last alarm over AI and hacking was Mythos, an AI model from Anthropic, in April. Rubrik's CEO wrote that Mythos and frontier AI models 'have fundamentally changed the cybersecurity landscape.' Rubrik raised its forecast twice. What it added to its subscriptions in the quarter to July was up thirty-five percent from a year earlier. But growth in all its subscriptions barely moved: thirty-four percent in January, thirty-two in April, thirty-three in July. So one quarter in, the forecast and the new subscriptions went up, though these numbers don't say which customers it was. How fast Rubrik grows didn't, yet. The stock did: up two hundred and five point oh two percent since April.

The worst day already hits smaller companies: Verizon says about ninety-six percent of ransomware victims, where the size is known, had under a thousand employees. They still have to believe it hits them. And not every flaw shows up in the code. You don't know you're exposed until you're hit! That sword cuts both ways. If security teams get there first, the drawer stays shut more often, and Rubrik has less to sell. If hackers get there first, more companies open it, and the headlines do the selling, for Rubrik and its rivals.

12:10 The answer: is the Rubrik hype real?

So is the hype real? Not yet. The growth has to keep coming, because at ninety-six dollars seventy-eight, you've already paid for it. Here's what I take from Rubrik. Ask what has to go wrong in the customer's world for the product to sell. Then ask how many customers believe it will.

Rubrik has grown a small product fast before. Identity protection, its tool for company logins, went from twenty million dollars to over fifty million in two quarters, and Rubrik's CEO calls RAC 'early.' So the next report can change this. It's expected in early December. Three lines to read. Does 'over fifteen' become a number? And do last year's customers still pay over a hundred nineteen? And does the big customers' eighty-eight percent come down? Until then, Rubrik: not AI, yet. We need more proof of your concept.

If all three say yes, and the news starts moving the growth, Rubrik gets a seat in the Hype Fund, the stocks I buy for real. Drop your hype in the comments. Like, comment, subscribe.

To the moon! Haha hahaha!