루브릭(RBRK) 2027 회계연도 2분기 실적 발표회: ARR 성장 가속화, 전망 상향

핵심 요약

• 구독 ARR은 16억 6,000만 달러를 기록해 전년 동기 대비 33% 증가했으며, 순신규 구독 ARR은 약 9,600만 달러로 전년 동기 대비 35% 성장했습니다.
• 구독 매출은 37% 증가한 4억 720만 달러를 기록했습니다. 총매출은 38% 증가해 4억 2,730만 달러를 기록했으며, 중요 권리를 조정한 기준으로는 43% 증가했습니다.
• 구독 순유지율은 119%를 상회하는 수준을 유지했습니다. 연간 구독 ARR 10만 달러 이상 고객은 23% 증가한 3,084개를 기록했고, 100만 달러 이상 고객은 57% 이상 증가했습니다.
• 영업 레버리지가 개선되었습니다. 최근 12개월 구독 ARR 기여 마진은 460bp 상승하여 14%를 기록했고, 2분기 잉여현금흐름은 6,570만 달러에 달했습니다.
• 루브릭은 2027 회계연도 전망치를 구독 ARR 18억 8,000만~18억 8,500만 달러, 총매출 16억 8,500만~16억 9,300만 달러로 상향 조정했습니다.
• 경영진은 사이버 복원력, 아이덴티티 복원력 및 소버린 배포에 대한 수요를 성장의 동인으로 꼽았습니다. 루브릭 에이전트 클라우드는 유료 고객이 15개 이상으로 아직 초기 단계이며, 연간 전망에는 최소한의 ARR만 반영되어 있습니다.

주요 재무 데이터

미주 지역 매출은 33% 증가한 2억 9,900만 달러를 기록했으며, 미주 외 지역 매출은 52% 증가한 1억 2,900만 달러를 기록했습니다. 중요 권리는 구독 매출에 약 470만 달러를 기여하여 전 분기의 850만 달러에서 감소했습니다.

사업 및 영업 실적

루브릭은 데이터 보호, 아이덴티티, 클라우드, SaaS 및 에이전트 보안을 아우르는 다중 제품 고객 확보 및 확장 모델을 실적의 원동력으로 꼽았습니다. 대형 고객이 구독 ARR의 88%를 창출하여 엔터프라이즈 계정이 확장의 중심을 유지하고 있음을 보여주었습니다.

루브릭 보안 클라우드는 사이버 복구 및 플랫폼 통합에 대한 고객 수요의 수혜를 계속 입었습니다. 경영진은 온프레미스 인프라, 클라우드, Microsoft 365, 비구조화 데이터 및 아이덴티티를 아우르는 고객 수주를 강조했습니다. 여러 기능을 아우르는 회사의 통합 계약인 루브릭 플렉스는 초기 계약 몇 건을 체결했으며, 경영진은 향후 이 방식이 대형 전략 고객의 기본 계약 방식이 될 것으로 기대하고 있습니다.

아이덴티티 복원력은 루브릭에서 가장 빠르게 성장하는 제품군 중 하나로 유지되었으나, 경영진은 기존 고객 기반 침투율이 여전히 초기 단계라고 밝혔습니다. 회사는 아이덴티티 롤포워드 기능을 추가했으며 스트라타 아이덴티티 인수로 오케스트레이션 기능이 가속화되었다고 밝혔습니다. 스트라타는 2분기에 ARR 기여가 없었으며, 2027 회계연도 가이던스에서도 ARR 기여가 없는 것으로 가정되었습니다.

루브릭 에이전트 클라우드는 에이전트 가시성, 아이덴티티, 런타임 보안 및 에이전트 리와인드를 지원합니다. 회사는 15개 이상의 유료 고객을 확보했으며, 개념 검증(PoC) 프로젝트가 실제 운영 환경 배포로 전환되고 있다고 발표했습니다. 경영진은 단기적인 실질적 ARR 기여보다는 현재 제품-시장 적합성과 고객 성공에 집중하고 있습니다.

클라우드는 사업의 약 89%를 차지했습니다. 이관 수치를 제외한 조정 클라우드 순신규 ARR은 전년 동기 대비 20% 성장했습니다. 규모가 더 작은 비클라우드 사업도 정부, 규제 산업 및 소버린 인프라 요건에 힘입어 성장하고 있습니다. 경영진은 고객이 소프트웨어를 직접 호스팅하기 때문에 자체 호스팅 배포의 마진이 더 높다고 설명했습니다.

경영진 가이던스

경영진은 수정된 연간 구독 ARR 전망치가 이전 가이던스보다 약 2,400만~2,500만 달러 상향 조정되었다고 밝혔습니다. 회사는 아이덴티티 복원력 및 루브릭 에이전트 클라우드를 포함해 R&D와 표적화된 시장 진출 확장에 대한 투자를 지속할 계획입니다.

리스크 및 관전 포인트

• 중요 권리 매출의 상당한 감소는 2027 회계연도 보고 매출 성장에 계속 부담으로 작용할 것입니다.
• 루브릭의 클라우드 이관 프로그램이 마무리 단계에 접어들면서 순신규 클라우드 ARR 성장의 구성이 변화하고 있습니다. 향후 구독 ARR 성장은 클라우드와 비클라우드 배포를 모두 반영할 것입니다.
• 루브릭 에이전트 클라우드는 개발 초기 단계에 있습니다. 경영진은 2027 회계연도에 해당 제품의 ARR 기여가 최소 수준일 것으로 가정하고 있습니다.
• 하반기에는 회사의 파이프라인 대비 2개 분기의 실행 실적이 여전히 필요합니다. 경영진은 분기별 실적보다는 연간 순신규 ARR을 중심으로 사업을 관리하고 있음을 강조했습니다.
• 하드웨어 인플레이션과 공급 제약은 2분기 구독 ARR에 실질적인 영향을 미치지 않았습니다. 루브릭은 주로 소프트웨어 기업으로 남아 있으며, 직접적인 하드웨어 판매는 주로 일부 아시아 태평양 시장으로 제한되어 있습니다.

애널리스트 Q&A 주요 내용

경영진은 2분기 구독 ARR과 2027 회계연도 가이던스에 스트라타 아이덴티티 인수로 인한 ARR이 포함되지 않았음을 확인했습니다. 이는 보고된 성장 가속화와 상향된 전망이 기존 사업에 기반하고 있음을 나타냅니다.

암시된 하반기 성장 프로필과 관련해 키란 초다리 CFO는 루브릭이 초기 회계연도 전망에 비해 상반기 2개 분기 동안 연간 순신규 ARR 예상치를 4,500만 달러 상향 조정했다고 말했습니다. 경영진은 파이프라인에 대한 신뢰를 표명하면서도 연간 계획 및 보상 체계를 유지했습니다.

루브릭 에이전트 클라우드와 관련하여 비풀 신하 CEO는 이 제품이 광범위한 엔터프라이즈 도입을 위한 준비가 되었으며, 에이전트 가시성, 아이덴티티 제어, 런타임 보안 및 에이전트 리와인드를 결합하고 있다고 말했습니다. 15개 이상의 고객이 플랫폼 비용을 지불하고 있지만, 경영진은 단기 재무 기여도에 대해서는 신중한 태도를 유지하고 있습니다.

경영진은 또한 이전에 클라우드 이관의 영향을 받던 비클라우드 구독 ARR이 다시 성장에 기여하기 시작했다고 설명했습니다. 수요는 규제 대상 산업, 정부 및 소버린 또는 자체 호스팅 인프라를 필요로 하는 고객으로부터 발생하고 있습니다.

아이덴티티 복원력에 대한 수요에는 경쟁 제품 교체와 아이덴티티 복구 또는 복원력을 처음 도입하는 고객이 모두 포함됩니다. 경영진은 아이덴티티 시스템 복구 속도, 오설정 리스크, 권한 승격 및 악성 지속성 제거를 고객의 핵심 요구 사항으로 꼽았습니다.

실적 발표 컨퍼런스 콜 전문

전체 실적 발표 컨퍼런스 콜 녹취록

경영진 발표

Operator

Hello, everyone. Thank you for joining us, and welcome to the Rubrik Second Quarter Fiscal Year 2027 Results Conference Call. [Operator Instructions] I will now hand the conference over to Melissa Franchi, Vice President of Investor Relations. Please go ahead.

Melissa Franchi

Hello, everyone. Welcome to Rubik's second quarter fiscal year 2027 financial results conference call. On the call with me today are Bipul Sinha, CEO, Chairman and Co-Founder of Rubrik, and Kiran Choudary, Chief Financial Officer. Our earnings press release was issued today after the market closed and may be downloaded from the Investor Relations page at www.ir.rubrik.com. Also on this page, you'll be able to find a slide deck with financial highlights that, along with our earnings release, includes a reconciliation of GAAP to non-GAAP financial results. These measures should not be considered in isolation from or as a substitute for financial information prepared in accordance with GAAP.

During this call, we will make forward-looking statements, including statements regarding our financial outlook for the third quarter and full fiscal year 2027. Our expectations regarding market trends, our market position, opportunities, including with respect to generative and agentic AI, growth strategy, product initiatives and expectations regarding those initiatives and our go-to-market motion. These statements are only predictions that are based on what we believe today, and actual results may differ materially. These forward-looking statements are subject to risks and other factors that could affect our performance and financial results which we discuss in detail with our filings with the SEC.

Rubrik assumes no obligation to update any forward-looking statements that we may make on today's call. And with that, I'll hand the call over to Bipul.

Bipul Sinha

Thank you, Melissa. And thank you all for joining us today. I'm pleased to report that our second quarter results were truly outstanding. Once again, we exceeded all guided metrics across top line and profitability. And this is not the first time. In fact, it is our tenth consecutive quarter of outperformance as a public company. And this quarter, we accelerated. Yes, let me repeat, accelerated net new subscription ARR growth. This is a testament to the strength of our platform and the continued durability of demand for Rubrik's agentic cyber resilience. Here are the key numbers.

First, subscription ARR reached $1.66 billion, growing 33% year-over-year. Second, net new subscription ARR reached approximately $96 million in the second quarter. Third, our subscription revenue was $407 million, growing 37% year-over-year. Fourth, our subscription NRR remained strong at over 119%. And I'm not done yet. There are 2 more key numbers. Customers with 100,000 or more in subscription ARR reached 3,084, growing 23% year-over-year. And finally, on profitability, we once again made material improvement in subscription ARR contribution margin, up about 460 basis points year-over-year. We generated $66 million in free cash flow this quarter. Very few companies at Rubrik's scale can drive this level of growth plus expanding margins and strong free cash flow generation.

I'm pleased to report we are once again raising our outlook for the year. Let me start by giving you some context on how the market is evolving and what is driving our confidence in the future of our business. Needless to say, AI is the most transformative technology of our lifetime. What is fascinating to us is that the scale of productivity that AI creates is matched only by the scale of new risks that AI. Mythos and Frontier AI models are proving it every day. Rubrik is a participant in Anthropic's Project Glasswing. We built a complete harness to close the loop from vulnerability discovery to core patient. The reason I bring this up is because our Project Glasswing findings underscore our belief that we are in a singularity moment with AI and cybersecurity.

As you might recall from my comments earlier this year, we are no longer in a world of human speed. A few years ago, humans we are attacking us and humans were running our business processes. Enterprises have spent billions across thousands of security tools, trying to detect and prevent those threats from materializing. These investments are not proving to be relevant anymore. Today, AI agents are attacking us. These autonomous agents use AI for vulnerability chaining to find the right malicious combination to intrude, breach and encrypt at machine speed. If you have yesterday's super security tools with human speed response, you have a huge mismatch.

And at the same time, AI agents are increasingly running business processes, workflows that assume identities, access sensitive data and take autonomous action. Both threat actors and business operators are now agentic. We have witnessed vivid real-world illustrations of the unprecedented risk that these dynamics pose. This includes the recent hugging phase incident in which we saw an autonomous AI agent exploit a zero-day vulnerability and gained unauthorized access to live systems all without human direction. This clearly demonstrated both halves of the risk companies are grappling with an AI orchestrated attack moving faster than any human speed response and an agent operating well outside the guardrails, anyone intended for it.

In this new reality, prevention and detection are no longer enough. At the same time, you can't fight AI with the same legacy software you have been using. What you will need is a new approach, preemptive risk assessment, real-time guardrail and AI speed recovery. In short, agentic cyber resilience. No wonder businesses around the world are turning to Rubrik for agentic cyber resilience. We delivered Rubrik as an AI agent because an agent is the only way to respond to AI speed attacks. Rubrik as an agent is designed to autonomously collect, monitor and understand information create recovery plans, ask humans for permission and create outcomes. Rubrik also has agentic governance and security built onto our platform to create runtime guardrails for agentic work. This is the same capability we are delivering to our customers with Rubrik Agent cloud, which governs and secures our customers' own AI agents.

As you may know, we operate 2 complementary product suites onto our single platform. Rubrik Security Cloud for Cyber Resilience and Rubrik Agent Cloud for agentic security and governance. These 2 suites map directly to the 2-sided risk enterprises face as they adopt AI assuming AI-powered breach and assuming agentic overreach. Let me first discuss our opportunity with Rubrik Security Cloud or RSC. Our proprietary preemptive recovery engine is the backbone of Rubrik agentic cyber resilience. Our architectural advantage, which combines time series data and meta data allows us to continuously precalculate clean points of recovery across on-prem, cloud, SaaS, unstructured data and identity before an attack occurs.

Rubrik's preemptive recovery engine does the work in peace time to be able to achieve recovery at AI speed in war time. This is how we deliver record fast recoveries with RST when our customers are eased or their agents get compromised. And this is why we continually deliver extremely high competitive win rate. Our cyber resilient data protection business continues to benefit from the ongoing transformation towards cyber resilience and consolidation to platforms, not point solutions. Amid an increasingly malicious cyber environment, customers increasingly view Rubrik's unified single platform approach to cyber resilience as a Board level mandatory requirement rather than a discretionary purchase.

Customers can initially adopt Rubrik in many different ways. Cloud, on-prem, unstructured data, identity M365, Agent cloud but we initiate the same single policy engine on our single Rubrik platform. When a customer adopts Rubrik, they are not just buying a solution. They are stepping into an ecosystem where each additional product adopted makes all existing Rubrik products more powerful. This is a testament of a true platform built on complementary network effects. Let me share 2 of the many illustrative customer wins from the quarter. First, we landed a new logo deal with the U.S. state government agency which displaced its legacy incumbent after concerns around cyber recovery time amid the rise of cyber threats. The agency chose Rubrik for enterprise and M365 protection, noting our reliability, compliance fit and the speed of cyber recovery.

And second, we won a new Global 2000 financial services customer displacing a legacy vendor and outcompeting a NuGen competitor. This customer selected Rubrik to protect its full data environment, including on-premises, data centers, cloud, M365 unstructured data and identity with Rubrik winning due to the strength of our cyber resilience capabilities across a single platform. In addition to cyber resilience, Rubrik solved for the customer's tool consolidation needs amid growing...

Turning to Rubrik Flex. our unified platform contract vehicle, which we introduced at Forward in June. Rubrik Flex is 1 license, 1 contract, 1 commitment for complete agentic cyber resilience. We are pleased with the early reception and have already closed a handful of Flex deals. As an example, one of our largest expansion deals of the quarter was a Flex deal with a large U.S. health care system extending our platform beyond its existing on-premises footprint to cover M365, cloud and identity data under a single enterprise agreement. This win came against cloud-native backup tools with customers citing a single pane of glass across on-prem, cloud, SaaS and identity data as the deciding factor for true cyber resilience.

We believe Flex will become the default motion for our largest strategic accounts over time. Turning to identity. Our identity resilience business continues to be one of the fastest-growing product lines in the company's history. As you might recall, we started our identity journey with the release of identity recovery, which provides the rapid recovery of identity services following cyber attacks or operational failures. We then launched Rubrik Identity Resilience, which enhances risk posture by tracking misconfigurations and high risk or malicious changes within identity services. We continue to rapidly disrupt the identity protection market with our recent announcement of the identity roll forward in Identity Resilience. With these capabilities, Identity Resilience now gives our customers the ability to recover identity systems to a clean current state without losing legitimate business progress and without leaving attackers persistence behind. We have been building towards Identity for years.

Our recent acquisition of Strata Identity only accelerated, bringing orchestration capabilities that makes our platform complete. There is nothing like this in the market. Let me share one specific example of an identity win. In the second quarter, we won an Identity Resilience cloud data and SaaS protection deal with a large online fashion retailer, displacing its incumbent native backup tools and beating out a point solution competitor. The customer chose Rubrik for its mission-critical applications across M365, Active Directory and its e-commerce platform in Azure, citing our AerCap immutable backups and the speed of clean recovery in case of a cyber incident.

Let me turn to Rubik Agent Cloud or RAC. As we have discussed in detail at our Analyst Day, RAC is built around 3 pillars. Continuous monitoring and observability of sanctioned and unsanctioned agents, dynamic runtime security and governance through our semantic AI governance engine, or SAGE, and agent rewind, which allows our customers to surgically undo destructive agent actions. More recently, we unveiled Rubrik agent identity, the access plane for that. It governs who can do what with agents, which users and groups can use which agent, with MCP servers and tools those agents can reach and what is scoped access each individual tool calls received at the moment of action. Agent identity extends existing identity infrastructure that customers already run and federate with Okta and Microsoft Andra ID.

This brings user and group context into every access decision. Rubrik Agent Identity completes the RAC governance model. As a reminder, in RAC, we are building a complete agent security and governance platform across agent visibility, agent identity, agent runtime security and agent rewind. This is extremely valuable for our customers as they don't have to buy point solutions from many vendors than is season together by themselves. While early, we are pleased with the momentum of RAC and continue to see proof-of-concept engagements convert into production deployment. We now have over 15 and growing RAC customers. One of our larger RAC wins came from a long-time platform customer already relying on Rubrik for cyber resilience across on-prem, cloud and M365 workloads.

As these large retailer scales AI coding agents across engineering, the customer expanded on to RAC, extending the same platform is already trust for recovery into agentic governance. The customer noted the appeal of agent rewind to undo destructive agent actions at machine speed and SAGE to secure those same agents in real time with AI. In summary, as I look back on to the quarter, 3 things stand out. Number one, AI speed breaches and agentic overreach are no longer hypothetical. They are inevitable. Companies are waking up to a new reality that AI agents can and will attack at machine speed and increasingly compromised enterprise agents, resulting in massive insider attacks. This is exactly why agentic cyber resilience, not legacy prevention, detection and recovery is becoming the Board level standard.

Number two, every part of our platform is compounding on the power of complementary network effect. Data protection, identity resilience and agent security and governance are in 3 separate beds, they are 1 flywheel. This quarter shows customers consolidating onto the Rubrik platform rather than buying another point solution. And finally, number three, the results prove the model, not just the moment. accelerating net new ARR, expanding margins and raised outlook show our confidence that this is a durable execution at scale. With Agentic AI adoption still early, our opportunity ahead is far larger than what we have capped so far. In closing, as always, I want to thank my fellow Rubrikan for outstanding innovation and execution. I also want to thank our customers and partners for their continued trust and of course, you, our shareholders, for your continued support.

It is still early innings in this era of agentic cyber resilience, and I strongly believe Rubrik's best is yet to come. With that, I'm pleased to pass it over to our Chief Financial Officer, Kiran Choudary.

Kiran Choudary

Thank you, Bipul. Good afternoon, everyone, and thank you for joining us today. We had a strong second quarter, exceeding all our guided metrics and demonstrating continued execution in the large and growing cyber resilience market. We are pleased to once again raise our outlook for the year. Let me start by briefly recapping our second quarter fiscal 2027 financial results and key operating metrics and then I'll provide guidance for the third quarter and full year fiscal 2027. All comparisons, unless otherwise noted, are on a year-over-year basis. We are very pleased to have ended the second quarter with subscription ARR of $1.66 billion, growing 33% year-over-year. We added approximately $96 million in net new subscription ARR in the quarter. We did not see any material impact to our subscription ARR from rising hardware costs or supply constraints. As a reminder, we are primarily in the business of selling software, either in the cloud or self-hosted. Moving along, our differentiated land-and-expand model benefits from multiple avenues to gain new customers and grow our footprint after the initial contract.

Expansion occurs through data growth in existing applications, securing more applications and identities, adding more security products or adding Rubrik agent cloud. As a result, we continue to see strong subscription net retention rate of over 119% in the second quarter. We are very proud of the high customer retention and expansion dynamics of our business. All vectors of expansion are healthy contributors to our NRR, highlighting the meaningful runway we have to more deeply penetrate our customer base. We ended the second quarter with 3,084 customers with subscription ARR of $100,000 or more, up 23%. These larger customers now contribute 88% of our subscription ARR, which continues to grow as we become an increasingly strategic partner to our enterprise customers. Customers with subscription ARR of $1 million grew over 57%.

For the second quarter, subscription revenue was $407.2 million, up 37%, and Subscription revenue in the second quarter primarily benefited from stronger ARR growth as well as more upfront revenue in the quarter, including higher RSCP and material rights. Material rights related to our cloud transformation contributed approximately $4.7 million to subscription revenue in the quarter compared to $8.5 million in the prior quarter. Our other revenue category includes services as well as hardware sales in some regions such as APAC that have not been fully transitioned to our partners. In Q2, Other revenue benefited from the higher price and volume of hardware due to business strength in those regions. Please note that our subscription ARR does not include sales related to other revenue.

Total revenue was $427.3 million, up 38%. Revenue normalized for material rights increased 43%. Turning to the geographic mix of revenue. Revenue from the Americas grew 33% to $299 million. Revenue from outside the Americas grew 52% to $129 million. Before turning to gross margins, expenses and profitability, I would like to note that I'll be discussing results on a non-GAAP basis going forward. Our non-GAAP gross margin was 81% in the second quarter compared to 81.6% in the year ago period. Our gross margin benefited from greater scale in our customer support organization, offset by lower material right related revenue and revenue mix. We continue to expect gross margins in our long-term target range of 77% to 82% as we discussed at our Analyst Day.

As a reminder, we look at subscription ARR contribution margin as a key measure of operating leverage. We believe the improvement in our subscription ARR contribution margin demonstrates our ability to drive operating leverage and profitability at scale. Subscription ARR contribution margin was 14% in the last 12 months ended July 31 compared to 9.4% in the year ago period an improvement of 460 basis points. The improvement was driven by higher sales, the benefits of scale and improving efficiencies and cost management across the business. Free cash flow was $65.7 million compared to $57.5 million in the second quarter of fiscal 2026. The increase was primarily driven by higher sales and improved operating leverage.

Turning to our balance sheet. We ended the second quarter in a strong cash position with $1.75 billion in cash, cash equivalents and short-term investments. And $1.13 billion in convertible debt. Let me now provide some context on our guidance. We are confident in our outlook, driven by the robust cyber resilience market, our differentiated technology platform and the scaling of our emerging products, such as Identity Resilience. This momentum, coupled with our consistent and effective execution positions us to achieve strong subscription ARR growth ahead. We plan to continue making operational investments across 2 key areas. First, we will continue to invest in R&D to accelerate innovation in the large but developing markets of data, security and AI.

Second, we will invest in our go-to-market specifically targeting regions and verticals that we believe offer the most attractive ROI. These go-to-market investments will also focus on scaling our newer innovations including our Identity Resilience platform and Rubrik Agent Cloud. Now turning to our guidance for the third quarter and full year fiscal 2027. In the third quarter, we expect revenue of $429 million to $431 million, up 23% or up 31% when normalized for material rights. We expect material rights related to our cloud transformation to contribute approximately $2 million to $3 million to revenue in the third quarter. We expect non-GAAP subscription ARR contribution margins of approximately 14%. We expect non-GAAP earnings per share of $0.07 to $0.09 based on approximately 230 million weighted average shares outstanding.

For the full year fiscal 2027, we expect subscription ARR in the range of $1.88 billion to $1.885 billion, reflecting a year-over-year growth rate of approximately 29%. We expect total revenue for the full year fiscal 2027 in the range of $1.685 billion to $1.693 billion. As a reminder, in fiscal 2027, the substantial reduction in material rights revenue will represent a meaningful headwind to our reported revenue growth. We expect material rights related to our cloud transformation to contribute approximately $18 million to revenue for the full year. Revenue growth normalized for material rights is expected to outpace our subscription ARR growth rate. In terms of profitability, we plan to continue to stay focused on capturing the market opportunity in cybersecurity and AI while balancing growth with improved efficiency.

Based on our current investment plans, we expect non-GAAP subscription ARR contribution margins of approximately 15.5% for the full year fiscal 2027. We expect non-GAAP earnings per share of $0.47 to $0.53 based on approximately 228 million weighted average shares outstanding for the full year. We expect free cash flow of $323 million to $333 million. As always, we have included additional modeling points in our investor presentation. In closing, we are very pleased with our strong second quarter results and remain confident in our ability to deliver durable and efficient growth as a market leader in cyber resilience. With that, we'd like to open up the call for questions.

Operator

[Operator Instructions] Your first question from the line of Saket Kalia with Barclays.

질의응답

Saket Kalia

Okay. Great. I'll keep it to one. And maybe the question is for you Kiran and a little bit of a housekeeping question. Can you just talk about how much ARR in the quarter, subscription ARR came from the STRATA Identity deal or just inorganic in general. I think there are some questions out there just around how big that was. So just for everybody's benefit, can you just walk through how much of this quarter's ARR came from inorganic?

Kiran Choudary

Sure, Saket. Thanks for the question. I'll just clarify here that most recent reported quarter, Q2, there was 0 ARR from Strata acquisition and also clarify that in the guidance we provided, there's assumption of 0 ARR as well. So both 0 in the quarter, 0 for the year.

Operator

Your next question from the line of Fatima Boolani with Citi.

Fatima Boolani

Kiran, I wanted to talk to you a little bit about the guidance. You've seen a pretty remarkable degree of growth on a net new ARR basis. year-to-date. And when I look at what is implied by your guidance, for the back half, we're seeing a pretty material step down essentially from something in the 20s on average, down to mid-single digits. That's a pretty precipitous deceleration. So barring some of the baseline conservatism that you always apply. I'm wondering what other factors that you are explicitly accounting for to have that be part of your thought process? And relatedly, what are some of the levers or I guess, positive externalities that transpire such that you can have a back half net new ARR growth performance that's comparable to, if not better than the first half?

Kiran Choudary

Sure, Fatima. So let me take the first part of the question. So obviously, very pleased with the first half performance, including Q2. As you know, we accelerated net new ARR growth. And when I look at the guidance, we took the guidance up by the full beat in Q2 as well as raise some more. So totally when you look at the last guide versus this guide, it's about $24 million to $25 million higher. In fact, the net new ARR growth rate implied by the new guidance for the year is 700 basis points over the previous guide. It went from 7% to 14%. Obviously, we run the business, as we have said many times, on an annual net new ARR basis, sales compensation as well. The plans have changed over the last year on an annual basis as well.

So it's really the annual number. We focus and run the business for. We have a multiproduct motion with multiple products doing really well. And it's obviously the half time in the year. We still have 2 quarters to execute, I feel pretty confident about the numbers we put forward and the pipeline we have to execute it.

Bipul Sinha

Just to add a little more color for them on that. If you look at where we started the fiscal year in terms of our net new ARR for the year, we have -- in 2 quarters, we have raised the net new ARR by $45 million. which is more than 10% from the beginning of the year number that we projected. And that is without any inorganic. I mean, as Kiran said, we added 0 ARR from Strata acquisition and the Strata acquisition is also not part of our projections. So 0 in the projection and 0 in the quarter. So we are accelerating our business. And if you look at this particular quarter, our net new ARR grew 35% year-over-year, which is a significant acceleration from our past quarter.

Kiran Choudary

I'll just add 1 more thing, Fatima. This is Kiran. On the -- and we have talked about in the past as well in terms of the cloud net new ARR, we obviously have had a very successful run with the migrations, it is wrapping up this year. So when you look at the cloud net new ARR growth, as of last quarter, we were reporting out the adjusted number without migrations, and we grew 20% year-over-year in terms of the cloud net new ARR growth. We obviously provided that in the press release and the investor presentation as well.

Operator

Your next question is from the line of John DiFucci with Guggenheim.

John DiFucci

Thanks for clarifying that. Kiran, that is, I think, like I said, you already had, but I think you said it verbally. Anyway, I look at these numbers and I see really good numbers here. And the acceleration is something that I don't think people see everywhere, they don't. But I have sort of a thematic question for Bipul. Bipul, you've been ahead of the curve. You, your team. When the world changed as it pertains to the needs of backup and recovery to not just be looking at time series data, but also the metadata, the application layer. And because of doing that, you were able to do other things that you might not have anticipated when you made that decision for different reasons. And it really seems like because of that, too, you're also well positioned when it comes to AI, and you've explained that in detail to me, and I appreciate that.

But as you point out, we're still really early with AI. Like some companies have deployed agents, but they haven't done it in mass. And they really haven't done a lot of trying to secure them. I guess where are you? I know you're well positioned because of where you sit and see all the data and not only see it, you manage it. But where are you as far as the products? And will your products be ready when the world is ready when all your customers need you.

Bipul Sinha

Thanks, John. If you look at our strategy, we have 3 pillars of products from data to identity to AI. And why are we doing AI because AI agents assume identity and work on sensitive data, and that's why you need to have a comprehensive agent security and governance platform as folks are adopting agents. As you know, businesses will have 2 kinds of agents. One is custom agent that is custom-built for their business workflows and those take time to build because you need to have harmonized data structures, harmonized ontology and context on the data before you can really design an agentic business processes customed to your business. But coding and search has become too widely adopted use case within enterprise when it comes to AI.

But when customers deploy these agents to do coding or search, they are worried about these agents taking destructive action or not following security protocols of the business. And that's why we focused on building agentic security and governance. But agentic security and governance, everybody is taking a point solution approach. We are taking a comprehensive approach from agent visibility, so telling what sanctioned or unsanctioned agents you have to agentic identity, which actually gives you the control and access plan for that agent so that at run time through MCP proxy, we are enforcing only the right set of data is being touched by the right user.

Then we have agent runtime security with our Symantec governance engine stage, where we are looking at the Agentic intent and the stopping actions that are not aligned to the business process and rules. And then finally, agentic rewinds that if agents take bad action, you can undo those actions. So we are taking a comprehensive approach to agentic security and helping our customers go on their agentic journey. They are mostly around coding and search so far. Just to give you a sense, one of our large U.S. health care technology firm bought Rubrik and the CIO was involved in that purchase to ensure that their agentic usage is compliant. And they were worried about -- since it's a health care company, they were worried about data leakage and compliant with the health care data and with our Rubrik agent cloud, they will be able to securely expand agentic uses across the organization because they now have both ability to secure the access in run time, understanding the intent of the agent as well as the ability to remind.

So these are the kinds of things our customers are coming to us, just like we have delivered data resilience and identity resilience, we are now delivering AI resilience.

John DiFucci

So it sounds like you're there. You're ready. It's just when they're ready, you're ready. Is that accurate?

Bipul Sinha

Exactly.

Operator

Your next question from the line of Gregg Moskowitz with Mizuho.

Gregg Moskowitz

I echo John's sentiment that it was important here and just to quantify and reiterate the net new cloud ARR growth of 20% year-over-year, very healthy. That being said, it was still fairly well below the total debt new subscription ARR growth. And I'm wondering hearing if you could walk through the dynamics behind this as well as what your high-level expectations are going forward for the mix of cloud versus other ARR growth?

Kiran Choudary

Sure, Greg. I can clarify that. So what -- I think we spoke about in the previous quarter as well. We have a cloud business as well as a non-cloud business. And the non-cloud business is largely directed towards folks who are in the regulated industry, government agencies as such on-prem, who do not want to use the cloud. And that business has started to grow. Obviously, we went through a period of migrations when there were -- there was a piece of the non-cloud business, which was moving to cloud, but that has largely been done now. So going forward, you'll see the non-cloud business grow as well. We saw that last quarter, we're going to see -- we saw it this quarter and going forward too. So the total net new growth for subscription ARR is going to be a combination of the cloud as well as non-cloud.

Bipul Sinha

Just to add a little bit of a color, Greg. Given the geopolitics and given all the things that we are seeing around the world in terms of security. Every country is now concerned about continuing their supply chain and economic infrastructure. And as you can imagine, digital infrastructure and AI infrastructure is an important economic infrastructure. And that's why folks are working on digital embassies and containing data containing infrastructure in their own sovereign realm. And this whole sovereign cloud and sovereign infrastructure is actually driving some trend to our non-cloud Rubrik sales. And that's what you see around regulated industries, sovereign sensitive industries, defense, government. And overall, geopolitics concerns is driving noncloud sovereign deployments.

Kiran Choudary

I'll also add, Greg, that there's ample demand in both these markets, both the cloud and the noncloud. So we run the business on subscription ARR. That's the primary metric we focus on, and the mix of cloud noncloud play out depending on the quarter. We have given some modeling points to guide for the second half in terms of cloud -- noncloud contribution, which should help you with the modeling.

Operator

Your next question from the line of Eric Heath with KeyBanc.

Eric Heath

Great. question for you, high level on the demand environment. We're hearing commentary and see in your results as well. But hearing commentary about post Mythos inflection. So can you just talk about the incremental demand you're seeing for cyber resilience or RAC in response to meet those? And maybe how that's starting to materialize in the quarter or the outlook.

Bipul Sinha

Thanks, Eric. So we have been saying for the last 6, 7 years, saying prevention and detection of cyberattack is not sufficient. Folks have to assume breach and prepare for cyber recovery and cyber resilience. And Mythos and Frontier AI models have been a huge inflection point for our industry. What Mythos has demonstrated is the vulnerability chaining will make low priority vulnerability into a P0 problem. And as a result, and these models are so smart, that there is no real time between intrusion and breach. So you cannot stop breaches. You cannot detect or prevent pretty much anything if it all if the vulnerability exists. So the real strategy is fast recovery of what we call machine speed recovery and patching without human intervention.

So the whole industry is now aligned to our original vision of assumed breach and deliver machine speed recovery. So we are seeing acceleration in terms of the customers coming to us, having concerns about Mythos, deploying cyber resilience capabilities that can deliver preemptive recovery engine, which delivers AI speed recovery. That's the conversation. And so that's the first part of the agentic cyber resilience, where AI is attacking you. At the same time, your agent that you're deploying in your enterprise can get compromised and that could lead to a significant insider attack. So folks are also worried about resilience for these AI agents. And that's why we have a complete agentic resilience platform with Rubrik Agent cloud that delivers both security and governance of AI agents.

Operator

Your next question from the line of Keith Bachman with BMO.

Keith Bachman

Yes. And Bipul, I wanted to ask and Kiran too on RAC and just trying to gauge expectations and I'll break it into a few different pieces. And so first part is on competition. When I hear the message on RAC, particularly around governance, it sounds a lot like what the identity providers are suggesting not on the access piece, but on the governance piece, but I just wanted to hear your perspective on where you think you're going to face competition. The second part is just on the 15 customers, are those paying customers? Could you just clarify? And then more broadly, the final piece of expectations is you've conditioned us to not think about RAC really contributing ARR this year, but should we be thinking about ARR, given all the activity surrounding agentic risk, can that contribute ARR in calendar year '27 or your next fiscal year? That's it for me.

Bipul Sinha

So let me start by giving you where we are. So yes, we have more than 15 paying customers for RAC. So -- and we are seeing a strong proof of concept to production deployment trend on rack. You talked about the competition and noise in this particular market. Yes, there is competition for point solutions. So observability companies are providing visibility into agents. Identity companies are providing access and governance into agents. Pretty much not many people are doing watching intent of AI agent with AI. That's unique. That we brought into the marketplace. And obviously, Agentic Rewind is our heritage. So if you look at Rubrik's strategy instead of having our customers buy 4 or 5 point solution and stitch them together to have complete visibility and control on AI agents, they could buy Rubrik platform, which has visibility, identity, runtime security as well as agent rewind all on a single platform.

So we are taking a very long-term platform approach because we believe that this particular market requires comprehensive platform because the risk with agents are very high. And we want our customers to deploy agents with confidence and get the benefit of the productivity that AI delivers.

Kiran Choudary

This is Kiran. I'll just add that we're very pleased with the progress so far, but the focus here is on finding the right product market fit and making our customers successful. So there's minimum assumption of RAC in this year's ARR, and we keep you updated as the year progresses.

Operator

Your next question from the line of Todd Coupland with CIBC.

Your next question comes from the line of Junaid Siddiqui with Truist.

Junaid Siddiqui

Great. Kiran, you mentioned not seeing a material impact to your business from rising hardware costs or supply constraints. But are you seeing a measurable increase in displacement opportunities where customers are reconsidering more hardware-dependent backup architectures. And could the current pricing environment create a more durable share gain opportunity over the next couple of years?

Bipul Sinha

So Junaid, just to give you the market and product sense, Rubrik does have a product that utilizes our customers' existing infrastructure to deliver cyber resilience. Having said that, we are a software company, and we are in the business of selling software and our customers have the opportunity to deploy cloud data protection across their many vendors that they might have in terms of their hardware supply chain. Plus, if you look at where our business is today, Rubrik is not a point solution on data center. That is a smaller part of our business. If you look at our overall business around cloud, M365, Identity and all -- and RAC all of the products that we are selling. So that's the reason that we have no material impact from hardware cost rising or supply chain issues. Kiran, do you want to give some.

Kiran Choudary

No, just to reiterate enterprise protection is a smaller part of the business. We had shared some data at our Analyst Day in June as well. So just in terms of the scale of that business. So we have a -- we're a multiproduct company with different avenues for growth and customers can protect data across different workloads in the cloud as well as on-premise.

Operator

Your next question from the line of Param Singh with Oppenheimer.

Paramveer Singh

I wanted to kind of dive a little bit more on to the Identity Resilience side. I want to understand how ubiquitous is the adoption of that across your installed base today? And do you think that's an incremental opportunity to penetrate other customers? How are you leading with it.

Bipul Sinha

Thank you, Param. So if you look at data security, the risk on the data security comes from user interaction on data, that is your identity. And that's why we built the complete identity resilience platform. It's still early days for us in identity and penetration in our customer base is still very early. Obviously, we started with identity recovery as the first product and then we built Identity Resilience that brings the risk aspect of the identity and in that risk as take misconfigured identity, privilege escalation, sensitive data exposure because of the privilege escalation, and this is where we bring the DSPM flavor into identity. And we have a significant opportunity with identity.

Just this quarter, we closed the largest international identity deal in Rubrik's history with an existing customer. The customer had the requirement of recovery in hours and their current solution was recovering in days like 7 days. And so this deal was a very high variety CIO, CISO level deal and Rubrik Identity Resilience provided that solution to the customer. So as you can see, identity data and the whole AI resilience, we are delivering the complete package to our customers to be ready for Mythos or whatever comes next.

Operator

Your next question from the line of Shrenik Kothari with Baird.

Zachary Schneider

This is Zack on for Shrenik. And so one distinctive part of the Rubrik's story really has been your ability to organically build successive businesses, cloud, SaaS, now identity while still selectively using acquisitions to accelerate certain capabilities. And so really as the opportunity broadens across identity, AI, et cetera, I would love to hear how you guys are thinking about the build versus buy prospect from here? And maybe are there any areas where the speed or data advantages increasingly makes M&A more attractive maybe than just the organic incubation model.

Kiran Choudary

Thank you. In terms of Rubrik's strategy, we always took a platform strategy because we believe that the complementary network effects of the Rubrik platform is very powerful to our customers because they are not just buying a solution from Rubrik, they are entering into an ecosystem of solutions where each additional product that they buy from Rubrik increases the value of all existing product that they already have with Rubrik. And this is the power of our platform. So we always take this approach that we want to look at teams, technologies, products, that we can bring in and integrate into our platform so that our customers continue to have a seamless experience.

Having said that, we are not dogmatic. We are always looking at new opportunities with the lens saying, can we accelerate our road map. Can we accelerate our customers' journey to AI, customers' journey to more of AI transformation and so we are always looking both organic and inorganic. But so far, we have found opportunities where we can accelerate our road map by finding teams technologies product to bring -- build into the Rubrik platform.

Operator

Your next question from the line of Gray Powell with U.S. Banc.

Gray Powell

Okay. Great. And congratulations on the strong results. So I just want to make sure that I understand one of the points that we often get from investors and if I'm looking at your guidance and the model points in the deck, it looks like noncloud ARR should be growing around 10% this year, give or take whereas in prior years, it was declining. And I know everybody likes to focus on cloud ARR, but like all else equal, isn't growth in non-cloud, a good thing? Like is there any difference in the gross margin profile or the expansion potential of these products? I guess I'm just asking because I'm a little bit confused why people seem to have overly focused on the cloud metric.

Kiran Choudary

This is Kiran. So that's a great question. And I think earlier on the call, I answered as well. For us, we have 2 businesses. We have a larger cloud business, which is represented by the cloud ARR and a smaller but now growing non-cloud business as well. We started our cloud transformation, where we started building cloud products and marketing them about a few years back after several years of deep R&D, which really allows our customers to manage data sources wherever they said, cloud, noncloud and SaaS applications or from the cloud.

But we also understand that there are some regulatory and requirements for which customers would want to sell host. And we respect that, and Bipul talked about earlier, there's an opportunity in sovereign clouds, in governments and in some regulated environments as well. So we will serve those markets fully as well. So you should expect that both these businesses are growth drivers. But we focus on a total subscription ARR. Really, the mix at this scale, we are 89% cloud. Maybe there's a little bit more in terms of contribution. But for us, both are important businesses, albeit the non-cloud business smaller. I would say from a margin perspective, the non-cloud business would have a higher mar because the customers are hosting, and we are not hosting it for them.

Operator

Your next question from the line of Rudy Kessinger with D.A. Davidson.

Rudy Kessinger

I want to double click on maybe just what you're seeing from a hardware standpoint. Obviously, you said there's no overall impact to the business, the quarter that's evident in the numbers. You also had mentioned you had sold some higher hardware in APAC, I believe, to some customers. So just what are your customers seeing from a lead time standpoint, relative to 90 days ago? And how are they navigating instances where they can't procure that hardware and going about on your software in those instances?

Kiran Choudary

Yes. This is Kiran. I can answer that. So as we mentioned in the prepared remarks, there was no material impact from hardware pricing or supply chains on our subscription ARR. And that was the case the last quarter as well as the quarter before. So we saw the same phenomena this time as well. On your question on lead times, actually, we are not in the hardware business per se. There is a small portion of hardware, which we sell, and that's largely in regions which are smaller like in some regions in Asia Pacific. And we did see lead times actually get better from the start of the year. But no material impact to subscription ARR.

Melissa Franchi

We'll take the last question.

Operator

Your last question comes from the line of Joe Vandrick with Scotiabank.

Unknown Analyst

Bipul, maybe for you. Can you help us understand what's driving the strength in your Identity Resilience business today? And is that demand primarily, is that incident driven? Is it proactive? And are these mostly greenfield deployments? Or are these competitive displacements?

Bipul Sinha

So as you know, hackers are not breaking in, they are logging in because identity has become the weakest link in cyber attacks. And once these attackers get in, lots of times, they actually destroy identity systems or do a ransom or encrypt the identity systems or have long-term persistence in the identity system and that can be host to attack other places. So identity systems have become also ground 0 for cyber. And so customers are looking for Identity Resilience to understand misconfigured identity, identity recovery to recover after the cyber attack. Also, if you have persistence in terms of the malicious identity you want to roll back and roll forward identity system and roll forward only legitimate identity changes so that you can bring back your identity system in a clean state. So this has become a significant problem.

Historically, only regulated industries, customers bought identity recovery system. And now with cyber attack and on the rise and everything else that is happening, particularly now with Mythos and other AI models, identity is recognized as a significant weakness. So we are seeing both brownfield as well as whitespace customers that have never bought Identity Resilience or recovery they are buying into it. We are very excited about this market. We identified this market early built on to our same platform that is giving data protection with identity and now we are connecting the dots across data, identity and AI. And so that's the power of the platform we are bringing to bear to solve this problem.

Operator

There are no further questions at this time. I will now turn the call back to Bipul Sinha for closing remarks.

Bipul Sinha

So thank you, everyone, for joining us today. I truly appreciate your time and questions. We are very excited about agentic cyber resilience and the opportunity ahead of Rubrik. As I said in the prepared remarks that these are early innings for Rubrik. The best of Rubrik is yet to come. Thank you so much. Talk to you soon.

Operator

This concludes today's call. Thank you for attending. You may now disconnect.