Rubrik

• Cohesity, Commvault, Veeam, or Druva could win price-sensitive backup refresh cycles on the same axis, compressing Rubrik's growth in its core data-protection market before the AI lines mature.
• A platform owner such as Microsoft or Google could make immutable backup and cyber recovery native to its own cloud and identity surfaces, eroding the cross-platform recovery position over three to five years.
• A buyer security review could weigh Rubrik's own incident history, the 2023 GoAnywhere data theft and a critical remote-code-execution flaw in Rubrik CDM, against its data-security positioning.
• Rubrik's newer AI bets, Agent Cloud and the Predibase-powered Agent Rewind, could absorb investment without converting into named production revenue.

Rubrik sells to the security and IT leaders accountable for restoring the business after a ransomware or identity attack. Gartner renamed its backup category to Backup and Data Protection Platforms in 2025, a shift toward cyber-resilient, ransomware-aware recovery that places Rubrik's problem in an analyst-defined budget line rather than a vendor pitch.

The pain is corroborated outside Rubrik's own pages. The 2023 Clop campaign that exploited the Fortra GoAnywhere file-transfer tool reached Rubrik itself and, by the gang's claim, more than 130 organizations, evidence that ransomware-driven data theft is an active, large-scale threat to exactly the enterprises Rubrik serves.

The buyer is the large enterprise, including regulated sectors, reached through direct and partner motions. The American Hospital Association selected Rubrik as a Preferred Cybersecurity Provider with access for nearly 5,000 member hospitals, a concrete healthcare channel. [s4, s7, s14]

Rubrik Security Cloud spans the data lifecycle from immutable backup to clean recovery. Rubrik Data Protection keeps air-gapped, immutable backups of on-premises, cloud, and SaaS data, secure from deletion, modification, or encryption by attackers, and Rubrik DSPM identifies sensitive-data risks and reduces blast radius, a posture capability Rubrik expanded by acquiring the DSPM vendor Laminar in 2023.

The recovery capability is documented by third parties, not only by Rubrik. Gartner credits Rubrik with in-line anomaly detection, malware scanning, and prioritized identity recovery, and Rubrik reports patented Turbo Threat Hunting that scans 75,000 backups in 60 seconds to find a clean snapshot.

Identity and AI recovery extend the same substrate. Rubrik Identity Recovery restores identity services, and Rubrik Agent Cloud applies the SAGE governance engine and Agent Rewind, powered by the acquired Predibase infrastructure, to reverse destructive actions by AI agents. [s11, s3, s6, s4, s10, s13, s15, s16]

Rubrik competes head-on with the modern cyber-resilience vendors and the legacy backup incumbents. In the 2025 Gartner Magic Quadrant for Backup and Data Protection Platforms, Rubrik leads on completeness of vision and Veeam leads on ability to execute, and the two sit closely grouped with Commvault and Cohesity, with Dell Technologies and Druva in the same top group.

Rubrik's positioning is breadth of recovery. The platform unifies data, identity, and SaaS recovery, and Gartner places Rubrik highest on completeness of vision among the Leaders.

The structural risk is shared and platform-level. Rubrik's own filings call the data security market new and intensely competitive, and the cloud and identity platforms whose workloads Rubrik protects could build immutable backup and recovery into their own surfaces. [s4, s10, s2]

Rubrik's traction is unusually well evidenced for the category, and the strongest proof is regulatory. Its April 2026 quarterly filing reports 2,946 customers each paying $100,000 or more in subscription ARR, up from 2,381 a year earlier, the kind of customer-scale figure most private vendors never disclose.

The financial scale is publicly reported. First-quarter subscription ARR reached $1.57 billion growing 32 percent year over year, revenue grew 39 percent to $387.1 million, and free cash flow margin was a positive 19 percent.

Analyst and sector channels reinforce the direct motion. Rubrik holds Leader placements from both Gartner and IDC, INTEGRIS Health speaks on the record about identity recovery, and the American Hospital Association preferred-provider selection opens a healthcare channel. [s1, s9, s4, s12, s14]

Rubrik is led by a founder with a verifiable build in the exact domain. Co-founder and CEO Bipul Sinha started Rubrik in 2014 and took it public on the NYSE in April 2024, where it priced at $32 a share and raised $752 million at a $5.6 billion valuation, and he serves as chairman and CEO.

The leadership has operated at scale. Sinha has run Rubrik to public-market size over more than a decade in backup and recovery, the domain the whole-company scope assesses, and reports quarterly results in the company's public disclosures.

The public record documents a strong operating run rather than a prior category-defining exit. On that evidence the team reads as a proven operating group, on par with the founder-led public peers in data security. [s5, s9]

Rubrik reads as production-grade across a large enterprise install base. Its identity-recovery practice cites more than 6,000 organizations, INTEGRIS Health speaks on the record, and Gartner and IDC both place Rubrik among the Leaders in their backup and cyber-recovery assessments.

The recovery model is built for assurance. Air-gapped immutable backups, threat containment that isolates infected snapshots, recovery simulation in isolated environments, and prioritized identity recovery are the controls a careful security review looks for.

A data-security vendor's own posture is part of the assurance question, and Rubrik's record is mixed. In 2023 attackers used the Fortra GoAnywhere zero-day to steal Rubrik internal sales data, after a 2019 lapse exposed a customer database, and the National Vulnerability Database records a critical flaw in Rubrik CDM that allowed remote code execution. A buyer validates both the recovery claims and Rubrik's own security practices against its environment. [s12, s11, s17, s4, s7, s8]

Add analyzed competitors to compare them side by side with Rubrik.

Rubrik sells to the large regulated enterprise that must restore operations after ransomware or an identity attack. Independent reporting on the 2025 Gartner Magic Quadrant places Rubrik in the top group for backup and data protection, and the American Hospital Association preferred-provider selection puts the buyer concretely in regulated healthcare.

The segment is broad across data, identity, and SaaS estates. Rubrik Data Protection covers on-premises, cloud, and SaaS data, Identity Recovery covers identity services, and DSPM covers sensitive-data exposure and blast radius, so the company addresses the full resilience surface rather than one slice.

Demand is evidenced at scale and by sector. Rubrik's regulatory filing reports 2,946 customers paying $100,000 or more, up from 2,381 a year earlier, and the healthcare channel through the American Hospital Association reaches nearly 5,000 member hospitals where recovery downtime carries the steepest cost.

Rubrik Security Cloud spans immutable backup, threat detection, and clean recovery. Gartner credits Rubrik with in-line anomaly detection, malware scanning, and prioritized identity recovery, and Rubrik reports patented Turbo Threat Hunting that scans 75,000 backups in 60 seconds to find a clean snapshot, on top of air-gapped immutable backups secure from attacker deletion or encryption.

The recovery model is the differentiating engineering. Rubrik Cyber Recovery adds recovery simulation in isolated environments and threat containment that isolates infected snapshots during a restore, and Identity Recovery brings clean recovery of identity services, built from the same backup substrate.

The AI layer extends the same recovery thesis. Rubrik DSPM reduces sensitive-data blast radius, a posture capability Rubrik expanded by acquiring DSPM vendor Laminar in 2023, and Rubrik Agent Cloud applies the SAGE governance engine and Agent Rewind, powered by the acquired Predibase infrastructure, to reverse destructive AI-agent actions.

Rubrik runs an enterprise motion with public, independently verifiable customer proof. Its April 2026 regulatory filing reports 2,946 customers paying $100,000 or more in subscription ARR, up from 2,381 a year earlier, with INTEGRIS Health speaking on the record, the kind of traction a private vendor rarely discloses.

Analyst and sector channels reinforce the motion. Rubrik holds Leader placements from both Gartner and IDC, and the American Hospital Association selected it as a Preferred Cybersecurity Provider, opening a healthcare channel to nearly 5,000 member hospitals.

The financials show a self-funding growth engine. Q1 FY27 subscription ARR reached $1.57 billion growing 32 percent on revenue up 39 percent, with a positive 19 percent free cash flow margin.

Rubrik does not publish list pricing on its product pages, routing buyers to sales in the enterprise subscription model typical of the category. Rubrik sells through subscription contracts measured as subscription ARR, the recurring-revenue structure its regulatory filings report rather than a transactional rate card.

The deal-shaped model fits the segment but hides unit economics from an outside reader. A buyer cannot compare a negotiated Rubrik quote against the marginal cost of backup and recovery bundled by a cloud platform it already pays for, the comparison that sharpens if the major clouds add native immutable backup.

The pricing anchor is value at the moment of crisis. Rubrik positions recovery speed and clean-snapshot certainty against the revenue, reputation, and regulatory cost of downtime, so the negotiated price competes against the cost of a slow recovery rather than a transparent rate card.

Rubrik delivers as a control layer over its backup and recovery substrate. The platform protects on-premises, cloud, and SaaS data, with policy-driven protection across the data lifecycle.

Operations span protection, detection, and recovery in one place. The customer runs immutable backup, Turbo Threat Hunting to identify a clean snapshot, recovery simulation to validate plans, and orchestrated restore of data and identity, so protection and recovery share one operational surface rather than stitched point tools.

The heavier operational question is recovery fidelity under load. The speed claims, such as 75,000 backups scanned in 60 seconds, are vendor and analyst-reported rather than independently benchmarked against a live ransomware event, so a buyer validates false-clean rates and restore fidelity in its own environment.

Rubrik reads as production-grade across a large enterprise install base. The company cites more than 6,000 organizations and holds Leader placements from both Gartner and IDC, evidence of enterprise-grade operations at scale.

The recovery architecture is built for assurance. Air-gapped immutable backups secure from attacker modification, threat containment that isolates infected snapshots, recovery simulation in isolated environments, and prioritized identity recovery are the controls a careful security review expects.

A data-security vendor's own posture is part of the trust question, and Rubrik's record is mixed. In 2023 attackers used the Fortra GoAnywhere zero-day to steal Rubrik internal sales data, after a 2019 lapse exposed a customer database, and the National Vulnerability Database records a critical remote-code-execution flaw in Rubrik CDM, so a buyer confirms both the recovery claims and Rubrik's own security practices.

Rubrik positions Security Cloud as a cross-environment platform rather than a single-cloud feature. The product protects on-premises, cloud, and SaaS data, so a buyer governs and recovers data and identity that span multiple clouds and SaaS apps rather than one vendor's surface.

The lines span built and acquired components. Data Protection, Cyber Recovery, and Identity Recovery reuse the immutable-backup and recovery foundation Rubrik already operates, while DSPM and the Agent Cloud rewind capability came through the Laminar and Predibase acquisitions, so the platform combines a shared backup foundation with acquired technology.

The same cloud breadth is the dependency risk. The cloud and SaaS vendors whose workloads Rubrik protects each control the surfaces it sits on, so Rubrik's cross-platform independence competes against native immutable-backup and recovery features the platform owners can build into their own products.

Rubrik is led by a founder with a verifiable build in the exact domain. Co-founder and CEO Bipul Sinha started Rubrik in 2014 and took the company public on the NYSE in April 2024, where it priced at $32 a share and raised $752 million at a $5.6 billion valuation, and he serves as chairman and CEO.

The leadership operates a public company at scale. Rubrik reports quarterly results in its public disclosures, the executive depth of a public organization rather than a thin startup roster.

The recognized record sits in data resilience and cyber recovery. Rubrik built its standing in backup, recovery, and identity resilience over more than a decade, the domain this whole-company scope assesses, and the public record documents that operating run rather than a prior category-defining exit, so the team reads as proven operators.