UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

FORM 10-Q

(Mark One)
x			QUARTERLY REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
For the quarterly period ended October 31, 2025
For the quarterly period ended April 30, 2026
or
o			TRANSITION REPORT PURSUANT TO SECTION 13 OR 15(d) OF THE SECURITIES EXCHANGE ACT OF 1934
For the transition period from_________to ________
Commission File Number: 001-42028

_________________________

RUBRIK, INC.

(Exact name of registrant as specified in its charter)

_________________________


Delaware (State or other jurisdiction of incorporation or organization)						46-4560494 (I.R.S. Employer Identification No.)


3495 Deer Creek Road, Palo Alto, California 94304
(Address of principal executive offices and zip code)
(844) 478-2745
(Registrant's telephone number, including area code)

_________________________

Securities registered pursuant to Section 12(b) of the Act:


Title of each class	Trading Symbol(s)	Name of each exchange on which registered
Class A Common Stock, $0.000025 par value	RBRK	New York Stock Exchange

Indicate by checkmark whether the registrant (1) has filed all reports required to be filed by Section 13 or 15 (d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the registrant was required to file such reports) and (2) has been subject to such filing requirements for the past 90 days. Yes x No o

Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T (§232.405 of this chapter) during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes x No o

Indicate by check mark whether the registrant is a large accelerated ﬁler, an accelerated ﬁler, a non-accelerated ﬁler, a smaller reporting company, or an emerging growth company. See the definitions of “large accelerated ﬁler,” “accelerated ﬁler,” “smaller reporting company,” and "“emerging growth company"” in Rule 12b-2 of the Exchange Act.

Large accelerated filer ox Accelerated filer o Non-accelerated filer xo Smaller reporting company o Emerging growth company xo

If an emerging growth company, indicate by check mark if the Registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes o No x

As of ~~November~~May 3031, ~~2025~~2026, Rubrik Inc. had ~~151~~160,~~894~~956,~~462~~763 shares of Class A common stock outstanding, and 4844,~~247~~871,~~083~~803 shares of Class B common stock outstanding.

Table of Contents

Rubrik, Inc.

FORM 10-Q

For the Fiscal Quarter Ended ~~October~~April 3130, ~~2025~~2026

TABLE OF CONTENTS

PART I. FINANCIAL INFORMATION
Item 1.	Financial Statements (unaudited)	5
	Condensed Consolidated Balance Sheets	5
	Condensed Consolidated Statements of Operations	6
	Condensed Consolidated Statements of Comprehensive Loss	7
	Condensed Consolidated Statements of Redeemable Convertible Preferred Stock and Stockholders’ Deficit	8
	Condensed Consolidated Statements of Stockholders’ Deficit	8
	Condensed Consolidated Statements of Cash Flows	119
	Notes to Condensed Consolidated Financial Statements	1210
Item 2.	Management's Discussion and Analysis of Financial Condition and Results of Operations	3122
Item 3.	Quantitative and Qualitative Disclosures About Market Risk	4836
Item 4.	Controls and Procedures	4836
PART II. OTHER INFORMATION
Item 1.	Legal Proceedings	5038
Item 1A.	Risk Factors	5038
Item 2.	Unregistered Sales of Equity Securities and Use of Proceeds	9077
Item 3.	Defaults Upon Senior Securities	9077
Item 4.	Mine Safety Disclosures	9077
Item 5.	Other Information	9077
Item 6.	Exhibits	9278
	Signatures	9379

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 2

Table of Contents

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Quarterly Report on Form 10-Q contains forward-looking statements about us and our industry that involve substantial risks and uncertainties. All statements other than statements of historical facts contained in this Quarterly Report on Form 10-Q, including statements regarding our future financial condition or results of operations, business strategy and plans, and objectives of management for future operations are forward-looking statements. In some cases, you can identify forward-looking statements because they contain words such as “anticipate,” “believe,” “continue,” “could,” “estimate,” “expect,” “intend,” “may,” “plan,” “potential,” “predict,” “project,” “should,” “target,” “toward,” “will,” “would,” or the negative of these words or other similar terms or expressions. These forward-looking statements include, but are not limited to, statements concerning the following:

•our expectations regarding our revenue, cost of revenue, gross profit or gross margin, operating expenses, and other results of operations, including our key metrics;

•the growth rate of the market in which we compete;

•our business plan and our ability to effectively manage our growth and associated investments;

•anticipated trends, growth rates, and challenges in our business and in the markets in which we operate;

•our ability to achieve or sustain our profitability;

•future investments in our business, our anticipated capital expenditures, and our estimates regarding our capital requirements;

•the costs and success of our marketing efforts and our ability to promote our brand;

•our ability to increase sales of our products;

•our ability to acquire new customers and successfully retain and expand platform usage with existing customers;

•our ability and expectations to continue to innovate and enhance our platform;

•our ability to operate our business under evolving macroeconomic conditions, such as high inflation, bank failures and related uncertainties, or recessionary or uncertain environments, and supply chain disruptions, including global semiconductor or hardware component shortages;

•our ability to compete effectively with existing competitors and new market entrants;

•our ability to introduce new products on top of our platform; and

•our expectations regarding our convertible senior notes due June 2030, including the expected use of proceeds we received and our ability to meet the requirements of the notes.

We caution you that the foregoing list may not contain all of the forward-looking statements made in this Quarterly Report on Form 10-Q.

You should not rely on forward-looking statements as predictions of future events. We have based the forward-looking statements contained in this Quarterly Report on Form 10-Q primarily on our current expectations and projections about future events and trends that we believe may affect our business, financial condition, and results of operations. The outcome of the events described in these forward-looking statements is subject to risks, uncertainties, and other factors described in the section titled “Risk Factors” and elsewhere in this Quarterly Report on Form 10-Q. Moreover, we operate in a very competitive and rapidly changing environment. New risks and uncertainties emerge from time to time, and it is not possible for us to predict all risks and uncertainties that could have an impact on the forward-looking statements contained in this Quarterly Report on Form 10-Q. The results, events, and circumstances reflected in the forward-looking statements may not be achieved or occur, and actual results, events, or circumstances could differ materially from those described in the forward-looking statements.

In addition, statements that “we believe” and similar statements reflect our beliefs and opinions on the relevant subject. These statements are based on information available to us as of the date of this Quarterly Report on Form 10-Q. While we believe such information provides a reasonable basis for these statements, such information may be limited or incomplete. Our statements should not be read to indicate that we have conducted an exhaustive inquiry into, or review of, all relevant information. These statements are inherently uncertain, and investors are cautioned not to unduly rely on these statements.

The forward-looking statements made in this Quarterly Report on Form 10-Q relate only to events as of the date on which the statements are made. We undertake no obligation to update any forward-looking statements made in this Quarterly Report on Form 10-Q to reflect events or circumstances after the date of this Quarterly Report on Form 10-Q or to reflect new information, actual results, revised expectations, or the occurrence of unanticipated events, except as required by law. We may not actually achieve the plans, intentions, or expectations disclosed in our forward-looking statements, and you should not place undue reliance on our forward-looking statements. Our forward-looking statements do not reflect the potential impact of any future acquisitions, mergers, dispositions, joint ventures, or investments.

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 3

Table of Contents

Risk Factors Summary

Below is a summary of the principal factors that make an investment in our Class A common stock speculative or risky:

•Our recent rapid growth may not be indicative of our future growth. Our rapid growth also makes it difficult to evaluate our future prospects.

•If the market for data security and AI solutions does not grow, our ability to grow our business and our results of operations may be adversely affected.

•We have a limited operating history, particularly with respect to our ~~offering~~offerings of Rubrik Security Cloud and Rubrik Agent Cloud, which makes it difficult to forecast our future results of operations.

•If we are unable to attract new customers, our future results of operations could be harmed.

•We have a history of operating losses and may not achieve or sustain profitability in the future.

•If our customers do not renew their subscriptions for our platform and ~~data security~~ products or expand their subscriptions to increase the amount of data secured, secure new applications, or include new features or capabilities, our results of operations could be harmed.

•If our ~~data security~~ solutions fail or do not perform as intended or are perceived to have defects, errors, or vulnerabilities, our brand and reputation will be harmed, which would adversely affect our business and results of operations.

•Our information technology systems or data, or those of third parties with whom we work, have in the past been, and may in the future be, compromised, which may cause us to experience significant adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences. As a data security company, we have been and may in the future be specifically targeted by various threat actors who try to compromise our information technology systems or data.

•~~Our~~The ~~use~~limited number of ~~generative~~contract manufacturers and ~~other~~original ~~artificial~~equipment ~~intelligence~~manufacturers ~~tools~~that ~~may~~produce ~~pose~~commodity ~~risks~~servers tothat are compatible with our ~~business~~solutions are susceptible to supply chain disruptions and ~~operations~~have recently experienced shortages of key components for their servers, ~~including~~which may adversely affect our ~~proprietary~~ability ~~software~~to accurately forecast demand for these commodity servers or successfully manage the relationship with such manufacturers, and ~~systems~~could negatively impact demand for our offerings, and ~~may~~adversely ~~subject~~affect usour tobusiness ~~legal~~and ~~liability~~financial results.

•WeOur ~~expect~~use ~~our~~of ~~revenue~~generative, ~~mix~~agentic and ~~certain~~other ~~business~~artificial ~~factors~~intelligence totools ~~impact~~may ~~the~~pose ~~amount~~risks ofto ~~revenue~~business ~~recognized~~and ~~period-to-period~~operations, ~~which~~including ~~could~~our ~~make~~proprietary ~~period-to-period~~software ~~revenue~~and ~~comparisons~~systems, ~~not meaningful~~ and ~~make~~may ~~revenue~~subject ~~difficult~~us to ~~predict~~legal liability.

•We rely upon third-party cloud providers to host our ~~data security~~ solutions, and any disruption of, or interference with, our use of third-party cloud products would adversely affect our business, financial condition, and results of operations.

•We may not be able to successfully manage our growth, and if we are not able to grow efficiently, our business, financial condition, and results of operations could be harmed.

•The markets in which we participate are competitive, and if we do not compete effectively, our business, financial condition, and results of operations could be harmed.

•Our estimates of market opportunity, forecasts of market growth, and potential return on investment may prove to be inaccurate, and even if the market in which we compete achieves the forecasted growth, our business could fail to grow at similar rates, if at all.

•The dual class structure of our common stock has the effect of concentrating voting control with the holders of our Class B common stock, including our executive officers, employees, and directors and their affiliates, and limiting your ability to influence corporate matters, which could adversely affect the trading price of our Class A common stock.

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 4

Table of Contents

PART I. FINANCIAL INFORMATION

Item 1. Financial Statements (unaudited)

Rubrik, Inc.

CONDENSED CONSOLIDATED BALANCE SHEETS

(in thousands, except share and par value amounts)

(unaudited)

October 31,

January 31,

April 30,

January 31,

2025

2026

Assets

Current assets

Cash and cash equivalents

~~307~~429,~~100~~397

~~186~~380,~~331~~196

Short-term investments

1,~~295~~319,~~907~~717

~~518~~1,~~813~~295,579

Accounts receivable, net of allowances of $569 and $499

219,687

177,627

Accounts receivable, net of allowances of $546 and $299

199,344

256,773

Deferred commissions

~~100~~109,~~820~~910

91110,~~919~~651

Prepaid expenses and other current assets

~~143~~165,~~183~~368

~~102~~180,~~951~~365

Total current assets

2,~~066~~223,~~697~~736

12,~~077~~223,~~641~~564

Property and equipment, net

6686,~~989~~504

5383,~~194~~830

Deferred commissions, noncurrent

~~133~~155,~~624~~621

~~132~~157,~~465~~592

Goodwill

199,606

~~100~~199,~~343~~606

Other assets, noncurrent

81102,~~739~~780

59101,~~331~~944

Total assets

2,~~548~~768,~~655~~247

12,~~422~~766,~~974~~536

Liabilities and stockholders’ deficit

Current liabilities

Accounts payable

1114,~~857~~161

1015,~~439~~329

Accrued expenses and other current liabilities

~~182~~143,~~820~~910

~~162~~229,~~602~~976

Deferred revenue

~~968~~1,~~167~~121,975

~~777~~1,~~135~~068,754

Total current liabilities

1,~~162~~280,~~844~~046

~~950~~1,~~176~~314,059

Deferred revenue, noncurrent

~~718~~766,~~380~~401

~~642~~776,~~370~~547

Other liabilities, noncurrent

6271,~~213~~334

6164,~~821~~771

Convertible senior notes, net

1,~~129~~131,~~627~~791

—1,130,721

Debt, noncurrent

—

322,341

Total liabilities

3,249,572

3,286,098

Total liabilities

3,073,064

1,976,708

Commitments and contingencies (Note 8)

Commitments and contingencies (Note 9)

Stockholders’ deficit

Preferred stock, $0.000025 par value – 20,000,000 shares authorized as of October 31, 2025 and January 31, 2025; zero shares issued and outstanding as of October 31, 2025 and January 31, 2025

—

Preferred stock, $0.000025 par value – 20,000,000 shares authorized as of April 30, 2026 and January 31, 2026; zero shares issued and outstanding as of April 30, 2026 and January 31, 2026

—

Class A common stock, $0.000025 par value – 1,070,000,000 shares authorized as of October 31, 2025 and January 31, 2025; 151,877,278 and 101,981,023 shares issued and outstanding as of October 31, 2025 and January 31, 2025, respectively

Class A common stock, $0.000025 par value – 1,070,000,000 shares authorized as of April 30, 2026 and January 31, 2026; 160,945,763 and 157,370,648 shares issued and outstanding as of April 30, 2026 and January 31, 2026, respectively

Class B common stock, $0.000025 par value – 210,000,000 shares authorized as of October 31, 2025 and January 31, 2025; 48,256,092 and 87,785,767 shares issued and outstanding as of October 31, 2025 and January 31, 2025, respectively

Class B common stock, $0.000025 par value – 210,000,000 shares authorized as of April 30, 2026 and January 31, 2026; 44,871,803 and 44,871,492 shares issued and outstanding as of April 30, 2026 and January 31, 2026, respectively

Additional paid-in capital

2,~~574~~755,~~825~~906

2,~~291~~662,~~829~~861

Accumulated other comprehensive loss

(44)

(8,235)

Accumulated other comprehensive (loss) income

(9,222)

3,733

Accumulated deficit

(3,~~099~~228,~~195~~014)

(23,~~837~~186,~~333~~161)

Total stockholders’ deficit

(~~524~~481,~~409~~325)

(~~553~~519,~~734~~562)

Total liabilities and stockholders’ deficit

2,~~548~~768,~~655~~247

12,~~422~~766,~~974~~536

The accompanying notes are an integral part of these unaudited condensed consolidated financial statements.

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 5

Table of Contents

Rubrik, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF OPERATIONS

(in thousands, except per share amounts)

(unaudited)

	Three Months Ended October 31,				Nine Months Ended October 31,
			Three Months Ended April 30,
	2025		2024		2025		2024
					2026		2025
Revenue
Subscription	$	~~336,390~~	$	~~221,511~~	$	~~899~~374,~~008~~153	$	~~585~~265,~~021~~661
Maintenance	1,508		4,342		5,798		15,027
Other					12,915		12,820
Other	12,268		10,325		33,701		28,396
Total revenue					387,068		278,481
Total revenue	350,166		236,178		938,507		628,444
Cost of revenue
Subscription	~~59,842~~		~~46,486~~		~~167~~66,~~778~~723		~~166~~51,~~006~~912
Maintenance	187		824		983		5,473
Other					8,562		8,571
Other	8,108		8,836		23,418		35,814
Total cost of revenue					75,285		60,483
Total cost of revenue	68,137		56,146		192,179		207,293
Gross profit					311,783		217,998
Gross profit	282,029		180,032		746,328		421,151
Operating expenses
Research and development	~~97,581~~		~~80,050~~		~~271~~114,~~503~~341		~~451~~81,~~657~~815
Sales and marketing	~~193,151~~		~~158,907~~		~~545~~193,~~129~~098		~~706~~169,~~163~~993
General and administrative	~~66,780~~		~~65,862~~		~~192~~56,~~733~~978		~~281~~59,~~248~~281
Total operating expenses	~~357,512~~		~~304,819~~		1364,~~009,365~~417		1311,~~439,068~~089
Loss from operations	~~(75,483)~~		~~(124,787)~~		(~~263~~52,~~037~~634)		(193,~~017,917~~091)
Interest income	~~16,591~~		~~7,468~~		3615,~~480~~898		177,~~688~~696
Interest expense	~~(1,080)~~		~~(10,310)~~		(161,~~134~~070)		(319,~~179~~813)
Loss on debt extinguishment	—		—		(6,653)		—
Other income (expense), net					590		(5,622)
Other income (expense), net	(965)		(1,333)		(6,515)		(3,406)
Loss before income taxes					(37,216)		(100,830)
Loss before income taxes	(60,937)		(128,962)		(255,859)		(1,034,814)
Income tax expense					4,637		1,274
Income tax expense	2,892		1,948		6,003		5,117
Net loss					$	(41,853)	$	(102,104)
Net loss	$	(63,829)	$	(130,910)	$	(261,862)	$	(1,039,931)
Net loss per share, basic and diluted					$	(0.21)	$	(0.53)
Net loss per share, basic and diluted	$	(0.32)	$	(0.71)	$	(1.34)	$	(7.27)
Weighted-average shares used in computing net loss per share, basic and diluted					203,668		191,625
Weighted-average shares used in computing net loss per share, basic and diluted	198,379		183,590		195,001		142,985

The accompanying notes are an integral part of these unaudited condensed consolidated financial statements.

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 6

Table of Contents

Rubrik, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF COMPREHENSIVE LOSS

(in thousands)

(unaudited)

	Three Months Ended October 31,				Nine Months Ended October 31,
			Three Months Ended April 30,
	2025		2024		2025		2024
					2026		2025
Net loss	$	~~(63,829)~~	$	~~(130,910)~~	$	(~~261~~41,~~862~~853)	$	(1102,~~039,931~~104)
Foreign currency translation adjustment, net of tax	~~(393)~~		~~501~~		6(9,~~551~~019)		~~898~~8,751
Unrealized gain (loss) on available-for-sale securities, net of tax	2,929		321		1,640		525
Unrealized (loss) gain on available-for-sale securities, net of tax					(3,936)		41
Total other comprehensive income (loss), net of tax	2,536		822		8,191		1,423
Total other comprehensive (loss) income, net of tax					(12,955)		8,792
Comprehensive income (loss)	$	(61,293)	$	(130,088)	$	(253,671)	$	(1,038,508)
Comprehensive loss					$	(54,808)	$	(93,312)

The accompanying notes are an integral part of these unaudited condensed consolidated financial statements.

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 7

Table of Contents

Rubrik, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF ~~REDEEMABLE CONVERTIBLE PREFERRED STOCK AND~~ STOCKHOLDERS' DEFICIT

(in thousands, except share amounts)

(unaudited)

	Three Months Ended October 31, 2025
	Three Months Ended April 30, 2026
	Common stock			Additional paid-in capital		Accumulated other comprehensive income (loss)		Accumulated deficit		Total stockholders' deficit
	Shares	Amount
Balances as of July 31, 2025	197,389,456	$	5	$	2,473,597	$	(2,580)	$	(3,035,366)	$	(564,344)
Balances as of January 31, 2026	202,242,140	$	5	$	2,662,861	$	3,733	$	(3,186,161)	$	(519,562)
Issuance of common stock upon exercise of stock options	72152,~~501~~660	—		~~486~~643		—		—		~~486~~643
Issuance of common stock upon settlement of restricted stock units	2,~~158~~881,~~880~~121	—		—		—		—		—
Issuance of common stock under employee stock purchase plan	~~512~~541,~~854~~645	—		1516,~~494~~559		—		—		1516,~~494~~559
Forfeiture of common stock related to business combination	(321)	—		—		—		—		—
Stock-based compensation	—	—		75,843		—		—		75,843
Stock-based compensation	—	—		85,248		—		—		85,248
Other comprehensive loss	—	—		—		(12,955)		—		(12,955)
Other comprehensive income (loss)	—	—		—		2,536		—		2,536
Net loss	—	—		—		—		(41,853)		(41,853)
Net loss	—	—		—		—		(63,829)		(63,829)
Balances as of April 30, 2026	205,817,566	$	5	$	2,755,906	$	(9,222)	$	(3,228,014)	$	(481,325)
Balances as of October 31, 2025	200,133,370	$	5	$	2,574,825	$	(44)	$	(3,099,195)	$	(524,409)

		Three Months Ended October 31, 2024
		Three Months Ended April 30, 2025
	Common stock		Additional paid-in capital			Accumulated other comprehensive ~~income~~ (loss) income		Accumulated deficit		Total stockholders' deficit
		Shares			Amount
Balances as of July 31, 2024		181,422,818	$	4		$	2,093,874	$	(1,638)	$	(2,591,534)	$	(499,294)
Balances as of January 31, 2025		189,766,790	$	5		$	2,291,829	$	(8,235)	$	(2,837,333)	$	(553,734)
Issuance of common stock upon exercise of stock options		~~487~~197,~~997~~534	—			21,~~877~~875		—		—		21,~~877~~875
Issuance of common stock upon settlement of restricted stock units		2,~~877~~923,~~093~~098	—			—		—		—		—
Issuance of common stock under employee stock purchase plan		~~406~~494,~~769~~926	—			1113,~~064~~492		—		—		1113,~~064~~492
Stock-based compensation		—	—			9475,~~354~~149		—		—		9475,~~354~~149
Other comprehensive income (loss)		—	—			—		822		—		822
Other comprehensive income		—	—			—		8,792		—		8,792
Net loss		—	—			—		—		(~~130~~102,~~910~~104)		(~~130~~102,~~910~~104)
Balances as of October 31, 2024		185,194,677	$	4		$	2,202,169	$	(816)	$	(2,722,444)	$	(521,087)
Balances as of April 30, 2025		193,382,348	$	5		$	2,382,345	$	557	$	(2,939,437)	$	(556,530)

The accompanying notes are an integral part of these unaudited condensed consolidated financial statements.

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 8

Table of Contents

Rubrik, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF REDEEMABLE CONVERTIBLE PREFERRED STOCK AND STOCKHOLDERS' DEFICIT

(in thousands, except share amounts)

(unaudited)

	Nine Months Ended October 31, 2025
	Common stock			Additional paid-in capital		Accumulated other comprehensive income (loss)		Accumulated deficit		Total stockholders' deficit
	Shares	Amount
Balances as of January 31, 2025	189,766,790	$	5	$	2,291,829	$	(8,235)	$	(2,837,333)	$	(553,734)
Issuance of common stock upon exercise of stock options	510,383	—		3,594		—		—		3,594
Issuance of common stock upon settlement of restricted stock units	7,386,523	—		—		—		—		—
Issuance of common stock under employee stock purchase plan	1,007,780	—		28,986		—		—		28,986
Issuance of common stock for business combination, net of settlement for tax withholding and forfeiture	1,461,894	—		88,233		—		—		88,233
Purchase of capped calls related to convertible senior notes	—	—		(88,550)		—		—		(88,550)
Stock-based compensation	—	—		250,733		—		—		250,733
Other comprehensive income (loss)	—	—		—		8,191		—		8,191
Net loss	—	—		—		—		(261,862)		(261,862)
Balances as of October 31, 2025	200,133,370	$	5	$	2,574,825	$	(44)	$	(3,099,195)	$	(524,409)

The accompanying notes are an integral part of these unaudited condensed consolidated financial statements.

Rubrik, Inc. Q3 2026 Form 10-Q 9

Table of Contents

	Nine Months Ended October 31, 2024
	Redeemableconvertible preferredstock			Common stock			Additional paid-in capital		Accumulated other comprehensive income (loss)		Accumulated deficit		Total stockholders' deficit
	Shares	Amount		Shares	Amount
Balances as of January 31, 2024	74,182,559	$	714,713	61,262,729	$	1	$	265,494	$	(2,239)	$	(1,682,513)	$	(1,419,257)
Conversion of redeemable convertible preferred stock and founder stock to common stock upon initial public offering	(74,182,559)	(714,713)		74,182,559	2		714,711		—		—		714,713
Issuance of common stock upon initial public offering and underwriters' exercise of over-allotment option, net of underwriting discounts and commissions, and offering costs	—	—		26,972,252	1		805,134		—		—		805,135
Issuance of common stock upon exercise of stock options	—	—		1,168,397	—		6,595		—		—		6,595
Issuance of common stock upon settlement of restricted stock units	—	—		21,201,971	—		(432,512)		—		—		(432,512)
Issuance of common stock under employee stock purchase plan	—	—		406,769	—		11,064		—		—		11,064
Stock-based compensation	—	—		—	—		831,683		—		—		831,683
Other comprehensive income (loss)	—	—		—	—		—		1,423		—		1,423
Net loss	—	—		—	—		—		—		(1,039,931)		(1,039,931)
Balances as of October 31, 2024	—	$	—	185,194,677	$	4	$	2,202,169	$	(816)	$	(2,722,444)	$	(521,087)

The accompanying notes are an integral part of these unaudited condensed consolidated financial statements.

Rubrik, Inc. Q3 2026 Form 10-Q 10

Table of Contents

Rubrik, Inc.

CONDENSED CONSOLIDATED STATEMENTS OF CASH FLOWS

(in thousands)

(unaudited)

	Nine Months Ended October 31,
	Three Months Ended April 30,
	2025		2024
	2026		2025
Cash flows from operating activities:
Net loss	$	(~~261~~41,~~862~~853)	$	(1102,~~039,931~~104)
Adjustments to reconcile net loss to net cash provided by (used in) operating activities:
Adjustments to reconcile net loss to net cash provided by operating activities:
Depreciation and amortization	2612,~~423~~081		218,~~542~~075
Stock-based compensation	~~244~~73,~~464~~368		~~827~~73,~~875~~540
Amortization of deferred commissions	7929,~~344~~307		6624,~~372~~785
Non-cash interest	—		29,127
Deferred income taxes	489		604
Loss on debt extinguishment	6,653		—
Other	1,850		(375)
Deferred income taxes	2,591		1,527
Other	(1,462)		(4,670)
Changes in operating assets and liabilities:
Accounts receivable	~~(42~~57,~~700)~~429		~~(14~~12,~~312)~~031
Deferred commissions	(8926,~~404~~595)		(9021,~~428~~449)
Prepaid expenses and other assets	~~(59~~13,~~748)~~783		(147,~~291~~824)
Accounts payable	~~1,387~~(861)		~~3,888~~(489)
Accrued expenses and other liabilities	17(80,~~135~~384)		~~950~~(36,813)
Deferred revenue	~~267~~43,~~042~~075		~~176~~89,~~982~~674
Net cash provided by (used in) operating activities	189,863		(35,369)
Net cash provided by operating activities	81,689		39,655
Cash flows from investing activities:
Purchases of property and equipment	(114,~~087~~277)		(112,~~296~~850)
Capitalized internal-use software	(113,~~004~~799)		(63,~~902~~465)
Purchases of investments	(1291,~~289,391~~957)		(~~641~~120,~~292~~162)
Sale of investments	—		27,978
Maturities of investments	263,850		162,617
Maturities of investments	520,913		243,912
Payments for business combinations, net of cash acquired	—		(1,975)
Payments for business combinations, net of cash acquired	(20,903)		—
Net cash (used in) provided by investing activities	(36,183)		34,165
Net cash used in investing activities	(811,472)		(387,600)
Cash flows from financing activities:
Proceeds from initial public offering and underwriters' exercise of over-allotment option, net of underwriting discounts and commissions	—		815,209
Proceeds from exercise of stock options	656		1,849
Taxes paid related to net share settlement of equity awards	(6,339)		(432,512)
Proceeds from issuance of common stock under employee stock purchase plan	16,559		13,492
Proceeds from exercise of stock options	3,589		6,592
Net cash provided by financing activities	17,215		15,341
Proceeds from issuance of common stock under employee stock purchase plan	28,986		11,064
Effect of exchange rate on cash, cash equivalents, and restricted cash	(9,483)		8,751
Payments for deferred offering costs, net	—		(3,545)
Net increase in cash, cash equivalents, and restricted cash	53,238		97,912
Proceeds from issuance of convertible senior notes, net of discount	1,129,875		—
Cash, cash equivalents, and restricted cash, beginning of period	392,740		193,594
Repayment of debt and related costs	(329,646)		—
Cash, cash equivalents, and restricted cash, end of period	$	445,978	$	291,506
Payments for debt discount costs	—		(475)
Payments for debt issuance costs	(1,903)		(233)
Purchase of capped calls related to convertible senior notes	(88,550)		—
Net cash provided by financing activities	736,012		396,100
Effect of exchange rate on cash, cash equivalents, and restricted cash	6,550		898
Net increase (decrease) in cash, cash equivalents, and restricted cash	120,953		(25,971)
Cash, cash equivalents, and restricted cash, beginning of period	193,594		137,059
Cash, cash equivalents, and restricted cash, end of period	$	314,547	$	111,088
Supplemental cash flow information:
Cash paid for income taxes, net of refunds	$	79,~~685~~922	$	81,~~769~~531
Cash paid for interest	~~11,807~~—		59,~~247~~299
Non-cash investing and financing activities:
Transfers of inventory to property and equipment	$	—	$	102
Property and equipment received, included in payables and accrued but not paid	$	2,552	$	1,788
Property and equipment received, included in payables and accrued but not paid	$	1,004	$	537
Stock-based compensation capitalized in internal-use software	$	2,439	$	1,567
Stock-based compensation capitalized in internal-use software	$	6,165	$	3,602
Fair value of common stock issued as consideration for business combination	$	93,849	$	—
Unpaid taxes related to business combination included in accrued expenses and other current liabilities	$	356	$	—
Acquisition holdback accrued not paid in accrued expenses and other current liabilities	$	760	$	—
Leasehold improvements funded directly by lessor included in property and equipment, net	$	885	$	—

The accompanying notes are an integral part of these unaudited condensed consolidated financial statements.

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 119

Table of Contents

Rubrik, Inc.

NOTES TO CONDENSED CONSOLIDATED FINANCIAL STATEMENTS

(unaudited)

Note 1 – Description of Business

Rubrik, Inc. (“Rubrik” or the “Company”) is a ~~Security~~security and artificial intelligence ("“AI"”) operations company, ~~that~~with ~~operates~~a atmission ~~the~~to ~~intersection~~secure ofand ~~data~~accelerate ~~protection,~~the ~~cyber~~world’s ~~resilience and enterprise~~ AI ~~acceleration~~transformation. Rubrik's ~~primary~~built ~~offering is~~ the Rubrik Security Cloud ~~platform,~~(“RSC”) ~~which~~suite iswith ~~designed~~Zero Trust design principles to ~~deliver~~secure ~~robust~~data ~~cyber~~across ~~resilience~~enterprise, ~~and~~cloud, ~~recovery~~SaaS, ~~including~~unstructured data, and identity ~~resilience~~providers. toRSC ~~ensure~~delivers ~~continuous~~a ~~business~~cloud ~~operation~~native SaaS platform that detects, ~~all~~analyzes, onand ~~top~~remediates ofdata ~~secure~~security ~~metadata~~risks and ~~data~~unauthorized ~~lake~~user activities. Rubrik launched Rubrik Agent Cloud in February 2026 to provide a comprehensive AI operations suite that can dynamically monitor, control, and remediate agentic actions. The Company was incorporated in December 2013 as ScaleData, Inc., a Delaware corporation, and changed its name to Rubrik, Inc. in October 2014. The Company is headquartered in Palo Alto, California.

Note 2 – Basis of Presentation and Summary of Significant Accounting Policies

Fiscal Year

The Company'’s fiscal year ends on January 31. For example, references to fiscal ~~2026~~2027 and ~~2025~~2026 refer to the fiscal year ending January 31, ~~2026~~2027 and ~~2025~~2026, respectively.

Basis of Presentation and Principles of Consolidation

The accompanying unaudited condensed consolidated financial statements have been prepared in conformity with accounting principles generally accepted in the United States (“U.S. GAAP”) and applicable rules and regulations of the U.S. Securities and Exchange Commission (the "“SEC"”) regarding interim financial reporting. Accordingly, they do not include all disclosures normally required in annual consolidated financial statements prepared in accordance with U.S. GAAP. Therefore, these unaudited condensed consolidated financial statements should be read in conjunction with the audited consolidated financial statements and notes included in the Company’s Annual Report on Form 10-K for the fiscal year ended January 31, ~~2025~~2026, as filed with the SEC on March 2019, ~~2025~~2026 (the “Annual Report”).

The unaudited condensed consolidated financial statements and notes include the Company and its wholly-owned subsidiaries and reflect all adjustments that, in the opinion of management, are necessary for a fair presentation of the periods presented. All intercompany accounts and transactions have been eliminated in consolidation.

Certain prior period amounts reported in the unaudited condensed consolidated financial statements and notes have been reclassified to conform to the current year presentation. For the three months ended April 30, 2026 and 2025, the Company combined maintenance revenue and other revenue into “Other” on the unaudited condensed consolidated statements of operations. The presentation of cost of revenue has been conformed to reflect the changes related to the presentation of revenues. Such reclassifications related to the presentation of revenue and cost of revenue did not impact total revenue, loss from operations or net loss.

Use of Estimates

The preparation of ~~the~~ unaudited condensed consolidated financial statements in conformity with U.S. GAAP requires management to make estimates and assumptions that affect the amounts reported in the unaudited condensed consolidated financial statements and accompanying notes. Such management estimates include, but are not limited to, the estimation of standalone selling prices for performance obligations, the ~~estimation~~estimates offor material rights, the application of a portfolio approach for capitalization of deferred commissions, the determination of the period of benefit for deferred commissions, the determination of fair value of the Company’s common stock prior to ~~its~~the ~~initial~~completion ~~public~~of ~~offering~~the ("IPO~~") in April 2024~~, the valuation of stock-based awards, the valuation and assessment of recoverability of intangible assets and their estimated useful lives, the assessment of goodwill impairment, the incremental borrowing rate used to value operating lease liabilities, the valuation of deferred income tax assets and uncertain tax positions, and contingencies. Management evaluates these estimates and assumptions on an ongoing basis using historical experience and other factors and makes adjustments when facts and circumstances dictate. Actual results could differ materially from these estimates.

Significant Accounting Policies

There have been no significant changes to the Company’s significant accounting policies disclosed in “Note 2 – Basis of Presentation and Summary of Significant Accounting Policies” of the Company’s Annual Report, except as noted below.

Revenue Recognition

The Company generates revenue primarily from the sale of subscriptions and typically invoices customers at the inception of the contract. The Company’s contracts with customers have a typical stated duration ranging from one to five years, with the majority of contracts having a stated duration of three years. The Company’s contracts with customers are generally non-cancelable and non-refundable. The Company primarily sells products and services to end users through distributors and resellers (“Channel Partners”). Channel Partners are the Company’s customers. The Company offers rebates to its Channel Partners calculated as a fixed percentage ~~of the total selling price of a revenue contract. The Company accounts for rebates as consideration payable to a customer and records the amounts as a reduction to revenue.~~

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 1210

Table of Contents

of the total selling price of a revenue contract. The Company accounts for rebates as consideration payable to a customer and records the amounts as a reduction to revenue.

The Company determines revenue recognition through the following steps:

•Identification of the contract, or contracts, with a customer;

•Identification of the performance obligations in the contract;

•Determination of the transaction price;

•Allocation of the transaction price to the performance obligations in the contract; and

•Recognition of revenue when, or as, the Company satisfies a performance obligation.

Payment terms of the Company’s contracts range from 30 days to 60 days after fulfillment or service commencement date, except for certain contracts, which are billed in installments over the contract term.

The Company determines its transaction price based on the expected amount it is entitled to receive in exchange for transferring promised products and services to the customer.

The Company’s contracts with customers can include multiple products and services. The Company determines performance obligations in a customer contract by assessing whether products and services are capable of being distinct and distinct in the context of the contract, including customer options that are determined to be material rights. The transaction price is allocated to the separate performance obligations based on the relative standalone selling price basis. The standalone selling price is determined based on the price at which the performance obligation either is sold separately or, if not observable through past transactions, is estimated taking into account available information such as market conditions and internally approved pricing guidelines related to the performance obligations. For performance obligations that are not sold separately, standalone selling price is determined based on observable inputs, overall pricing trends, market conditions and other factors, such as the price charged by the Company’s competitors for similar products and services with any necessary or appropriate adjustments.

Subscription revenue

Subscription revenue consists of software-as-a-service (“SaaS”) subscriptions and subscription term-based licenses with related support services.

SaaS subscriptions include standalone sales of SaaS subscription ~~products~~offerings as well as sales of ~~Rubrik Security Cloud (“~~RSC”). RSC is a fully-hosted subscription in the case of protection of cloud, SaaS, and unstructured data, ~~and identity providers~~applications. When RSC is securing enterprise applications, it is a hybrid cloud subscription which includes software hosted from the cloud (as a service) and on-premise software licenses. RSC is accounted for as a single performance obligation because the software hosted from the cloud (as a service) and the on-premise software licenses are not separately identifiable and serve together to fulfill the Company’s promise to RSC customers, which is to provide a single, unified data security solution. The Company’s subscription capabilities are primarily sold as editions which bundle multiple products and include the Foundation Edition, Business Edition, ~~Enterprise Edition,~~ and Enterprise ~~Proactive~~ Edition. Subscription revenue related to SaaS is recognized ratably over the subscription period.

Subscription term-based licenses provide customers with a right to use the software for a fixed term commencing upon delivery of the license to the customers. Support services are bundled with each subscription term-based license for the term of the subscription. Subscription revenue related to subscription term-based licenses includes upfront revenue recognized at the later of the start date of the subscription term-based license and the date when the subscription term-based license is delivered. The remainder of the revenue is recognized ratably over the subscription period for support services, commencing on the date the service is made available to customers. The Company does not recognize software revenue related to the renewal of subscription term-based licenses earlier than the beginning of the related renewal period. The Company also sells Rubrik-branded commodity servers ("“Rubrik-branded Appliances"”) support which is recognized ratably over the support period.

Maintenance revenue

Other revenue

Other revenue ~~represents~~includes fees earned from sales of professional services, software updates on a when-and-if-available basis, telephone and integrated web-based support, Rubrik-branded Appliance maintenance relating to our perpetual licenses, and Rubrik-branded Appliances. Revenue related to professional services is typically recognized as the ~~sale~~services are performed. Revenue for Rubrik-branded Appliances is recognized when shipped to the customer, as the Company's shipping term is free on board shipping point, meaning control of the Rubrik-branded Appliance transfers to the customer upon shipment. When we sell our software license with our Rubrik-branded Appliances, revenue for both the Rubrik-branded Appliances and ~~professional~~software ~~services~~licenses are recognized at the same time.

~~The Company has determined the~~ Rubrik~~-branded~~, ~~Appliances~~Inc. ~~and~~Q1 ~~software~~2027 ~~licenses~~Form ~~are separate performance obligations because the Rubrik~~10-~~branded~~Q Appliances and software licenses are not highly interdependent or interrelated and the customer can benefit from the Rubrik-branded Appliances and software licenses separately. The Company does not customize its software licenses and installation services are not required for the software to function.11

Rubrik, Inc. Q3 2026 Form 10-Q 13

Table of Contents

~~Rubrik-branded~~Amounts ~~Appliance~~billed ~~revenue is recognized when shipped~~ to ~~the~~customers ~~customer.~~for ~~The Company’s~~ shipping ~~term~~and ishandling ~~free~~costs onare ~~board~~classified ~~shipping~~as ~~point~~other revenue, ~~which~~and ~~means~~ the ~~control of the Rubrik-branded Appliance is transferred to customers upon shipment. When the~~ Company’s ~~sells~~shipping ~~software licenses with Rubrik-branded Appliances, revenue related to both the Rubrik-branded Appliances~~ and ~~software~~handling ~~licenses~~costs are ~~recognized~~classified atas ~~the~~cost ~~same~~of ~~time~~revenue.

Revenue related to professional services is typically recognized as the services are performed.

Amounts billed to customers for shipping and handling costs are classified as other revenue, and the Company’s shipping and handling costs are classified as other cost of revenue.

Judgments

The Company identifies performance obligations in a customer contract by assessing whether products and services are capable of being distinct and distinct in the context of the contract. The determination of the performance obligations for RSC when offered as a hybrid cloud subscription requires significant judgment due to the ongoing interaction between the software hosted from the cloud (as a service) and the on-premise software licenses. The Company has concluded that the software hosted from the cloud (as a service) and software licenses are not distinct from each other in the context of the contract such that revenue from the combined offering should be recognized ratably over the subscription period for which the software hosted from the cloud (as a service) is provided. In reaching this conclusion, the Company considered the nature of its promise to customers with a RSC hybrid cloud subscription, which is to provide a single, unified data security solution that operates seamlessly across multiple data sources and teams, and to give customers the ability to manage all their data sources consistently and/or in a manner they dictate. The Company only fulfills this multi-faceted promise by providing access to an integrated solution comprised of both cloud-based and on-premise software. The cloud-based software and on-premise software work together to provide features and functionalities necessary to fulfill that promise, which neither the software hosted from the cloud (as a service) nor the software licenses could provide on their own or together with third-party resources.

The Company had offered ~~subscription~~Subscription ~~credits~~Credits for RSC to qualified customers ~~with Refresh Rights (as defined below)~~ in exchange for relinquishing their existing rights to next-generation Rubrik-branded Appliances at no cost (“Refresh Rights”). These are customer options that are accounted for as material rights.

The Company’s contracts with customers may include customer options that are material rights. The determination of the likelihood of customers exercising their options requires significant judgment. Management estimates the likelihood of customers exercising their options by taking into account available information such as the number and timing of options exercised or forfeited, and considers other factors such as customer churn that may impact the options that have yet to be exercised or forfeited. Depending on the type of customer option exercised, the amount of consideration allocated to the material rights will be recognized into revenue at a point in time or over time beginning on the date the customer accepts the option. Deferred revenue associated with customer options that are subsequently forfeited will be released into revenue at the time the options are forfeited.

Timing of revenue recognition (in thousands):

Three Months Ended October 31,

Nine Months Ended October 31,

Three Months Ended April 30,

2025

2024

2025

2024

2026

2025

Subscription revenue

Products and services transferred over time

~~300,520~~

~~200,102~~

~~817~~355,~~940~~639

~~534~~243,~~283~~991

Products and services transferred at a point in time

~~35,870~~

~~21,409~~

8118,~~068~~514

5021,~~738~~670

Maintenance revenue

Products and services transferred over time

1,508

4,342

5,798

15,027

Other revenue

Products and services transferred over time

~~9,834~~

~~7,530~~

2711,~~807~~160

2211,~~025~~074

Products and services transferred at a point in time

~~2,434~~

~~2,795~~

51,~~894~~755

61,~~371~~746

Total revenue

~~350,166~~

~~236,178~~

~~938~~387,~~507~~068

~~628~~278,~~444~~481

Rubrik, Inc. Q3 2026 Form 10-Q 14

Table of Contents

Contract assets

The Company invoices its customers in accordance with contractual billing terms established in each contract. As the Company performs under customer contracts, its right to consideration that is unconditional is classified as accounts receivable. If the Company’s right to consideration for such performance is contingent upon a future event or satisfaction of additional performance obligations, the amount of revenue the Company has recognized in excess of the amount it has billed to the customer is classified as a contract asset. Contract assets are included in prepaid expenses and other current assets and other assets, noncurrent in the unaudited condensed consolidated balance sheets. There were $1014.30 million and $812.56 million of contract assets as of ~~October~~April 3130, ~~2025~~2026 and January 31, ~~2025~~2026, respectively. The current and noncurrent contract assets balances as of ~~October~~April 3130, ~~2025~~2026 were $4.46 million and $5.9.4 million, respectively, and as of January 31, ~~2025~~2026 were $43.58 million and $48.08 million, respectively.

Deferred revenue

Deferred revenue, which are contract liabilities, are amounts received or due from customers in advance of the Company’s performance. The current portion of deferred revenue represents the amount that is expected to be recognized as revenue within one year of the unaudited condensed consolidated balance sheet date. The Company invoices customers upfront for the majority of contracts, and the increase in the Company’s deferred revenue corresponds to an increase in revenue contracts that include SaaS and support in which the Company satisfies its performance obligations typically over the contractual service period. During the three and nine months ended October 31, 2025, the Company recognized revenue of approximately $299.3 million and $661.0 million, respectively, pertaining to amounts deferred as of July 31, 2025 and January 31, 2025, respectively. During the three and nine months ended October 31, 2024, the Company recognized revenue of approximately $192.4 million and $419.2 million, respectively, pertaining to amounts deferred as of July 31, 2024 and January 31, 2024, respectively.

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

months ended April 30, 2026 and 2025, the Company recognized revenue of approximately $336.4 million and $240.3 million, respectively, pertaining to amounts deferred at the beginning of each respective period.

Transaction price allocated to the remaining performance obligations

Transaction price allocated to the remaining performance obligations represents contracted revenue that has not yet been recognized, which includes deferred revenue for contracts that have been invoiced and will be recognized as revenue in future periods.

As of ~~October~~April 3130, ~~2025~~2026, total remaining non-cancellable performance obligations under the Company’s contracts with customers was approximately $2.1344 billion. The Company expects to recognize approximately 53% of this amount as revenue over the next 12 months, with the remaining balance to be recognized as revenue thereafter.

Concentration of Risk

Credit risk

The Company’s financial instruments that are exposed to concentrations of credit risk consist primarily of cash and cash equivalents, restricted cash, short-term investments, and accounts receivable. Cash and cash equivalents and short-term investments are primarily held in three financial institutions and, at times, may exceed federally insured limits. The Company grants credit to customers in a wide variety of industries worldwide and generally does not require collateral. The Company has not experienced any material credit losses as of ~~October~~April 3130, ~~2025~~2026.

Concentration of revenue and accounts receivable

The following customers individually accounted for 10% or more of total revenue or 10% or more of accounts receivable, net:

	~~Revenue~~		Revenue		Accounts Receivable, Net
	Three Months Ended October 31,		Nine Months Ended October 31,		October 31,	January 31,
		Three Months Ended April 30,		April 30,	January 31,
	2025	2024	2025	2024	2025	2025
			2026	2025	2026	2026
Partner A	~~27%~~	~~28%~~	2827%	29%	2824%	3332%
Partner B	~~31%~~	~~33%~~	3229%	3432%	2326%	2021%
Partner C	*	~~10%~~	*	~~10%~~*	1011%	~~14%~~*
Partner D			*	*	*	11%
Partner E			*	*	12%	*
* Less than 10%

Vendor risk

The Company uses third-party vendors for delivering its SaaS. While these services are highly available and designed to be resilient to failure of infrastructure, the Company’s services could be significantly impacted if the third-party vendors’ services experience certain types of interruptions.

~~Rubrik,~~Recent ~~Inc.~~Accounting ~~Q3 2026 Form 10-Q 15~~Pronouncements

~~Table~~Recently ofAdopted ~~Contents~~Accounting Pronouncements

~~The~~In ~~Company~~July ~~relies~~2025, onthe FASB issued ASU 2025-05, Financial Instruments — Credit Losses, which provides a ~~limited~~practical ~~number~~expedient offor ~~suppliers~~estimating expected credit losses for ~~its~~current ~~contract~~accounts ~~manufacturing~~receivable and ~~certain~~current ~~raw~~contract ~~material~~assets ~~components.~~that Inarise ~~instances~~from ~~where~~transactions ~~suppliers~~accounted ~~fail~~for tounder ~~perform~~Topic ~~their obligations~~606, ~~the~~Revenue from Contracts with Customers. The Company ~~may~~adopted beASU ~~unable~~2025-05 toeffective ~~find~~February ~~alternative~~1, ~~suppliers~~2026 oron ~~satisfactorily~~a ~~deliver~~prospective ~~its~~basis ~~products~~and toelected ~~its~~the ~~customers~~practical expedient. The adoption did not have a material impact on ~~time.~~the Company’s unaudited condensed consolidated financial statements and related disclosures.

Convertible Senior Notes

In June 2025, the Company issued $1.15 billion aggregate principal amount of 0.00% convertible senior notes due June 2030 (the “Convertible Notes”), which are recorded at their carrying value on the unaudited condensed consolidated balance sheets. The Convertible Notes will be classified as long-term liabilities until they are scheduled to mature within one year of the balance sheet date or become repayable within one year of the balance sheet date. Debt discount and issuance costs in connection with the issuance of the Convertible Notes are recorded as a reduction to the Convertibles Notes and are amortized as interest expense using the effective interest rate method over the contractual term of the Convertible Notes. The amortized debt discount and issuance costs are included within interest expense on the unaudited condensed consolidated statements of operations. The Company evaluates conversion features to determine if they are required to be accounted for separately as embedded derivatives.

Recently Announced Accounting Pronouncements Not Yet Adopted

In December 2023, the FASB issued ASU 2023-09, Improvements to Income Tax Disclosures, which requires entities to provide consistent categories and greater disaggregation of information in the rate reconciliation as well as income tax paid disaggregated by jurisdiction to improve the transparency of income tax disclosures. ASU 2023-09 is effective for annual periods beginning after December 15, 2024, with early adoption permitted. The Company is assessing the impact of adopting this standard.

In November 2024, the FASB issued ASU 2024-03, Income Statement - Reporting Comprehensive Income - Expense Disaggregation Disclosures, which requires entities to provide disclosures about specific types of expenses included in the expense captions presented on the face of the income statement as well as disclosures about selling expenses. ASU 2024-03 is effective for annual periods beginning after December 15, 2026, and interim periods beginning after December 15, 2027, on either a prospective or retrospective basis, with early adoption permitted. The Company is assessing the timing and impact of adopting this standard.

In ~~July~~September 2025, the FASB issued ASU 2025-0506, ~~Financial~~Intangibles ~~Instruments~~- —Goodwill ~~Credit~~and ~~Losses,~~Other ~~which~~- ~~provides~~Internal-Use aSoftware: ~~practical~~Targeted ~~expedient~~Improvements ~~for~~to ~~estimating~~the ~~expected~~Accounting ~~credit~~for ~~losses~~Internal-Use ~~for~~Software, ~~current~~which ~~accounts~~modernizes ~~receivable~~the ~~and~~accounting ~~current~~for ~~contract~~internal-use ~~assets~~software ~~that~~costs ~~arise~~by ~~from~~increasing ~~transactions~~the ~~accounted~~operability ~~for~~of ~~under~~the ~~Topic~~recognition ~~606,~~guidance ~~Revenue~~considering ~~from~~different ~~Contracts~~methods ~~with~~of ~~Customers~~software development. ASU 2025-0506 is effective for annual periods beginning after December 15, 2025 and interim periods within those annual reporting periods and should be applied prospectively, with early adoption permitted. The Company is assessing the impact of adopting this standard.

~~In September 2025~~Rubrik, the FASB issued ASU 2025-06, Intangibles - Goodwill and Other - Internal-Use Software: Targeted Improvements to the Accounting for Internal-Use Software, which modernizes the accounting for internal-use software costs by increasing the operability of the recognition guidance considering different methods of software developmentInc. ~~ASU~~Q1 ~~2025-06 is effective for annual periods beginning after December 15,~~ 2027 ~~and~~Form ~~interim~~10-Q periods within those annual reporting periods and can be applied prospectively, retrospectively, or with a modified transition approach, with early adoption permitted. The Company is assessing the impact of adopting this standard.13

Table of Contents

periods beginning after December 15, 2027 and interim periods within those annual reporting periods and can be applied prospectively, retrospectively, or with a modified transition approach, with early adoption permitted. The Company is assessing the impact of adopting this standard.

Note 3 – Revenue by Geography

The geographic regions are the Americas, EMEA (Europe, the Middle East, and Africa) and APAC (Asia Pacific). The following table sets forth revenue by geographic area based on ship to address (in thousands):

	Three Months Ended October 31,				Nine Months Ended October 31,
			Three Months Ended April 30,
	2025		2024		2025		2024
					2026		2025
Americas	$	~~255,658~~	$	~~169,350~~	$	~~683~~278,~~713~~913	$	~~450~~202,~~785~~765
EMEA	~~80,686~~		~~56,620~~		~~218,483~~$	92,188	~~152~~64,~~710~~760
APAC	~~13,822~~		~~10,208~~		~~36,311~~$	15,967	2410,~~949~~956
Total revenue	$	~~350,166~~	$	~~236,178~~	$	~~938~~387,~~507~~068	$	~~628~~278,~~444~~481

For the three months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024~~2025, United States accounted for $~~245~~268.92 million and $~~163~~195.63 million, respectively, or ~~70% and~~ 69%, ~~respectively, of consolidated total revenue. For the nine months ended October 31, 2025~~ and ~~2024, United States accounted for $657.8 million and $434.1 million, respectively, or~~ 70% ~~and 69%~~, respectively, of consolidated total revenue.

~~Rubrik,~~Note ~~Inc.~~4 Q3– ~~2026~~Intangible ~~Form 10-Q 16~~Assets

Table of Contents

Note 4 – Business Combinations

In July 2025, the Company acquired all outstanding stock of Predibase, Inc. (“Predibase”), a developer platform specializing in the operationalization of open-source AI models. The acquisition of Predibase is expected to allow the Company to accelerate agentic AI adoption from pilot to production at scale.

The Company accounted for this transaction as a business combination. The acquisition date fair value of the purchase consideration was $109.1 million, consisting of $14.5 million in cash consideration and $94.6 million issued in shares of the Company's Class A common stock valued at $88.11 per share based on the closing stock price of the Company's Class A common stock on July 18, 2025. The Company also issued 0.5 million shares of restricted stock to certain Predibase employees, including the two founders, with an aggregate fair value of $40.4 million determined based on the closing stock price of the Company's Class A common stock on July 18, 2025. These amounts are subject to vesting and continued employment. The fair value of the restricted stock will be recognized as stock-based compensation expense over the requisite service period of three years.

The Company recorded $11.0 million as an acquired developed technology intangible asset with an estimated useful life of 2 years and $92.9 million of goodwill which is primarily attributed to assembled workforce and expected synergies arising from enhanced efficiency in the integration of Predibase’s technology with the Company’s technology. The goodwill is not deductible for tax purposes. The remaining assets acquired and liabilities assumed on the acquisition date were not material.

During the three months ended April 30, 2025, the Company completed an immaterial acquisition for aggregate purchase consideration of $2.0 million and accounted for it as a business combination from the date of acquisition. $0.7 million of the purchase consideration was allocated to intangible assets and the remaining $1.3 million to goodwill.

During the three months ended October 31, 2025, the Company completed two immaterial acquisitions for aggregate purchase consideration of $11.0 million and accounted for them as business combinations from the respective dates of acquisition. $5.9 million of the purchase consideration was allocated to intangible assets and the remaining $5.1 million to goodwill.

Pro forma results of operations for the business combinations have not been presented, as they were not material to the Company's unaudited condensed consolidated statements of operations. Acquisition-related costs for the business combinations were expensed as incurred within general and administrative expense in the unaudited condensed consolidated statements of operations and were not material.

Acquired intangible assets are as follows (in thousands):

	October 31, 2025
	April 30, 2026
	Gross		Accumulated Amortization		Net
Acquired technology	$	28,641	$	(915,~~930~~640)	$	1813,~~711~~001
Total	$	28,641	$	(915,~~930~~640)	$	1813,~~711~~001

January 31, 2025

January 31, 2026

Gross

Accumulated Amortization

Net

Acquired technology

1128,~~000~~641

(512,~~349~~838)

515,~~651~~803

Total

1128,~~000~~641

(512,~~349~~838)

515,~~651~~803

The Company recognized $2.48 million and $01.90 million amortization expense in acquired intangible assets for the three months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024, respectively, and $4.6 million and $2.7 million for the nine months ended October 31,~~ 2025 ~~and 2024~~, respectively.

~~Rubrik,~~The ~~Inc.~~following Q3table ~~2026~~summarizes ~~Form~~the ~~10-Q~~estimated 17future amortization expense of the acquired intangible assets as of April 30, 2026 (in thousands):

Table of Contents


Fiscal year	Amount
Remainder of 2027	$	7,014
2028	4,513
2029	1,474

Total	$	13,001

The following table summarizes the estimated future amortization expense of the acquired intangible assets as of October 31, 2025 (in thousands):

Fiscal year	Amount
Remainder of 2026	$	2,907
2027	9,816
2028	4,513
2029	1,475
Total	$	18,711

Note 5 – Fair Value of Financial Instruments

The Company classifies its financial instruments within the fair value hierarchy based on the lowest level of input that is significant to the fair value measurement. Three levels of input may be used to measure fair value:

•Level 1 – Observable inputs are unadjusted quoted prices in active markets for identical assets or liabilities.

•Level 2 – Observable inputs are quoted for similar assets and liabilities in active markets or inputs other than quoted prices which are observable for the assets or liabilities, either directly or indirectly through market corroboration, for substantially the full term of the financial instruments.

~~•Level~~Rubrik, ~~3 – Unobservable inputs that are supported by little or no market activity and are significant to the fair value of the assets or liabilities~~Inc. ~~These~~Q1 ~~inputs~~2027 ~~will~~Form be10-Q ~~based on the Company’s own assumptions and will require significant management judgment or estimation.~~14

The Company did not have any level 3 investments as of October 31, 2025 and January 31, 2025. The following table summarizes the Company’s cash and available-for-sale marketable securities’ amortized cost, gross unrealized gains, gross unrealized losses, and estimated fair value by significant investment category reported as cash and cash equivalents or short-term investments (in thousands):

									Reported as
October 31, 2025	Amortized Cost		Gross Unrealized Gains		Gross Unrealized Losses		Estimated Fair Value		Cash and Cash Equivalents		Short-Term Investments
Cash:	$	70,104	$	—	$	—	$	70,104	$	70,104	$	—
Level 1:
Money market funds	233,037		—		—		233,037		233,037		—
U.S. Treasuries	532,503		609		(161)		532,951		—		532,951
Subtotal	765,540		609		(161)		765,988		233,037		532,951
Level 2:
Certificate of deposit	8,857		11		—		8,868		—		8,868
Commercial paper	35,574		28		—		35,602		3,959		31,643
Corporate bonds	710,355		1,564		(40)		711,879		—		711,879
U.S. government agencies	10,558		8		—		10,566		—		10,566
Subtotal	765,344		1,611		(40)		766,915		3,959		762,956
Total	$	1,600,988	$	2,220	$	(201)	$	1,603,007	$	307,100	$	1,295,907

Rubrik, Inc. Q3 2026 Form 10-Q 18

Table of Contents

									Reported as
January 31, 2025	Amortized Cost		Gross Unrealized Gains		Gross Unrealized Losses		Estimated Fair Value		Cash and Cash Equivalents		Short-Term Investments
Cash:	$	75,541	$	—	$	—	$	75,541	$	75,541	$	—
Level 1:
Money market funds	96,423		—		—		96,423		96,423		—
U.S. Treasuries	259,327		345		(76)		259,596		—		259,596
Subtotal	355,750		345		(76)		356,019		96,423		259,596
Level 2:
Commercial paper	88,732		8		(3)		88,737		14,367		74,370
Corporate bonds	184,742		195		(90)		184,847		—		184,847
Subtotal	273,474		203		(93)		273,584		14,367		259,217
Total	$	704,765	$	548	$	(169)	$	705,144	$	186,331	$	518,813

•Level 3 – Unobservable inputs that are supported by little or no market activity and are significant to the fair value of the assets or liabilities. These inputs will be based on the Company’s own assumptions and will require significant management judgment or estimation.

The Company did not have any level 3 investments as of April 30, 2026 and January 31, 2026. The following table summarizes the Company’s cash and available-for-sale marketable securities’ amortized cost, gross unrealized gains, gross unrealized losses, and estimated fair value by significant investment category reported as cash and cash equivalents or short-term investments (in thousands):


									Reported as
April 30, 2026	Amortized Cost		Gross Unrealized Gains		Gross Unrealized Losses		Estimated Fair Value		Cash and Cash Equivalents		Short-Term Investments
Cash:	$	67,343	$	—	$	—	$	67,343	$	67,343	$	—
Level 1:
Money market funds	359,989		—		—		359,989		359,989		—
U.S. Treasuries	549,393		139		(1,457)		548,075		2,065		546,010
Subtotal	909,382		139		(1,457)		908,064		362,054		546,010
Level 2:
Certificate of deposit	8,216		5		(2)		8,219		—		8,219
Commercial paper	32,627		3		(15)		32,615		—		32,615
Corporate bonds	722,364		516		(613)		722,267		—		722,267
U.S. government agencies	10,597		9		—		10,606		—		10,606
Subtotal	773,804		533		(630)		773,707		—		773,707
Total	$	1,750,529	$	672	$	(2,087)	$	1,749,114	$	429,397	$	1,319,717


									Reported as
January 31, 2026	Amortized Cost		Gross Unrealized Gains		Gross Unrealized Losses		Estimated Fair Value		Cash and Cash Equivalents		Short-Term Investments
Cash:	$	66,674	$	—	$	—	$	66,674	$	66,674	$	—
Level 1:
Money market funds	294,365		—		—		294,365		294,365		—
U.S. Treasuries	539,437		627		(101)		539,963		6,054		533,909
Subtotal	833,802		627		(101)		834,328		300,419		533,909
Level 2:
Certificate of Deposit	19,949		8		—		19,957		9,816		10,141
Commercial paper	39,994		16		—		40,010		3,287		36,723
Corporate bonds	702,250		1,958		(4)		704,204		—		704,204
U.S. government agencies	10,585		17		—		10,602		—		10,602
Subtotal	772,778		1,999		(4)		774,773		13,103		761,670
Total	$	1,673,254	$	2,626	$	(105)	$	1,675,775	$	380,196	$	1,295,579

The following table summarizes the estimated fair value of the Company’s investments by their remaining contractual maturity dates (in thousands):

	October 31, 2025
	April 30, 2026
Due within one year	$	~~754~~708,~~148~~224
Due between one to two years	~~541~~611,~~759~~493
Total	$	1,~~295~~319,~~907~~717

For available-for-sale debt securities that have unrealized losses, the Company evaluates whether (i) the Company has the intention to sell any of these investments, (ii) it is not more likely than not that the Company will be required to sell any of these available-for-sale debt securities before recovery of the entire amortized cost basis, and (iii) the decline in the fair value of the investment is due to credit or non-credit related factors. Based on this evaluation, the Company determined that for its short-term investments there were no material credit or non-credit related impairments as of ~~October~~April 3130, ~~2025~~2026 and January 31, ~~2025~~2026.

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

Convertible Notes

As of ~~October~~April 3130, ~~2025~~2026, the total estimated fair value of the Convertible Notes (as defined below) was $1.1003 billion. The fair value was determined based on the quoted price of the Convertible Notes in an inactive market on the last trading day of the reporting period and is classified within Level 2 of the fair value hierarchy. See Note 87, Debt.

Note 6 – Balance Sheet Components

Prepaid Expenses and Other Current Assets

Prepaid expenses and other current assets consisted of the following (in thousands):

October 31,

January 31,

April 30,

January 31,

2025

2026

Prepaid expenses

~~124~~139,~~901~~142

77155,~~857~~901

Inventory, net

57,~~305~~043

45,~~183~~676

Contract assets, current

4,~~376~~645

43,~~537~~845

Other current assets

814,~~601~~538

1614,~~374~~943

Total prepaid expenses and other current assets

~~143~~165,~~183~~368

~~102~~180,~~951~~365

Rubrik, Inc. Q3 2026 Form 10-Q 19

Table of Contents

Property and Equipment, Net

Property and equipment, net consisted of the following (in thousands):

October 31,

January 31,

April 30,

January 31,

2025

2026

Equipment

7999,~~363~~097

7587,~~589~~483

Capitalized internal-use software

5359,~~301~~503

3653,~~132~~265

Leasehold improvements

2221,~~800~~930

1228,~~739~~335

Furniture and fixtures

57,~~012~~018

47,~~687~~030

Total property and equipment, gross

~~160~~187,~~476~~548

~~129~~176,~~147~~113

Less: accumulated depreciation and amortization

(93101,~~487~~044)

(7592,~~953~~283)

Total property and equipment, net

6686,~~989~~504

5383,~~194~~830

Depreciation expense related to the Company’s property and equipment, which did not include amortization expense related to capitalized internal-use software, was $45.31 million ~~for each of the three months ended October 31, 2025~~ and ~~2024, and~~ $134.14 million for ~~each of~~ the ~~nine~~three months ended ~~October 31~~April 30, ~~2025~~2026 and ~~2024.~~2025, respectively.

Amortization expense relating to capitalized internal-use software was $34.2 million and $2.27 million for the three months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024, respectively, and $8.7 million and $5.7 million for the nine months ended October 31,~~ 2025 ~~and 2024~~, respectively.

Accrued Expenses and Other Current Liabilities

Accrued expenses and other current liabilities consisted of the following (in thousands):

October 31,

January 31,

April 30,

January 31,

2025

2026

Accrued expenses

5249,~~430~~270

3060,~~983~~257

Accrued bonuses

4117,~~943~~957

4956,~~104~~630

Accrued sales commissions

2716,~~434~~153

2736,~~627~~958

Accrued payroll-related expenses, taxes, and benefits

4540,~~393~~816

3858,~~533~~170

Operating lease liabilities

1114,~~641~~612

1012,~~087~~709

Other

35,~~979~~102

65,~~268~~252

Total accrued expenses and other current liabilities

~~182~~143,~~820~~910

~~162~~229,~~602~~976

~~Rubrik,~~Note ~~Inc.~~7 Q3– ~~2026 Form 10-Q 20~~Debt

Table of Contents

Note 7 – Leases

The Company has operating leases for its offices and data centers. Balance sheet information related to operating leases was as follows (in thousands):

	October 31,		January 31,
Reported as:	2025		2025
Other assets, noncurrent (operating lease ROU assets)	$	33,112	$	25,906
Accrued expenses and other current liabilities (operating lease liabilities, current)	11,641		10,087
Other liabilities, noncurrent (operating lease liabilities, noncurrent)	25,204		18,382
Total operating lease liabilities	$	36,845	$	28,469

The Company had operating lease costs of $3.7 million and $3.0 million for the three months ended October 31, 2025 and 2024, respectively, and $11.0 million and $8.9 million for the nine months ended October 31, 2025 and 2024, respectively.

Supplemental cash flow information and non-cash activity related to the Company’s operating leases were as follows (in thousands):

	Nine Months Ended October 31,
	2025		2024
Cash paid for amounts included in measurement of operating lease liabilities	$	9,900	$	9,217
ROU assets obtained in exchange of lease liabilities for new operating leases	$	17,356	$	2,335

Supplemental information related to the remaining lease term and discount rate were as follows:

	October 31,	January 31,
	2025	2025
Weighted-average remaining lease term	3.3 years	3.0 years
Weighted-average discount rate	6.0%	5.5%

The following table summarizes the maturity of the Company’s operating lease liabilities as of October 31, 2025 (in thousands):

Fiscal year	Operating Leases
Remainder of 2026	$	3,886
2027	13,412
2028	12,245
2029	5,412
2030	4,286
Thereafter	2,485
Total operating lease payments	41,726
Less: imputed interest	(4,881)
Total operating lease liabilities	$	36,845

Note 8 – Debt

Term Loan

In June 2022, the Company entered into a credit agreement with a consortium of lenders for a total $195.0 million revolving credit facility (the “Prior Credit Facility”) consisting of a $175.0 million term loan (the “Prior Closing Date Term Loan”) and $20.0 million in committed delayed-draw term loans (the “Prior Delayed Draw Term Loans”) with a maturity date of June 10, 2027. The proceeds of the Prior Delayed Draw Term Loans were to be used to pay accrued interest relating to the Prior Credit Facility. The Company also had the option to request incremental Delayed Draw Term Loan commitments (the “Prior Supplemental Delayed Draw Term Loans” and, together with the Prior Delayed Draw Term Loans and the Prior Closing Date Term Loan, collectively, the “Prior Loans”). The terms of the Prior Supplemental Delayed Draw Term Loans were identical to the Prior Delayed Draw Term Loans. The Company borrowed the full $175.0 million Prior Closing Date Term Loan with a closing date of June 10, 2022 and incurred $4.3 million debt discount and issuance costs.

Rubrik, Inc. Q3 2026 Form 10-Q 21

Table of Contents

Under the Prior Credit Facility, interest accrued on the Prior Loans, at the Company’s election made at the time of borrowing, at either the Alternate Base Rate (“ABR”) or Secured Overnight Financing Rate (“SOFR”). The Company also had the option to convert all or a portion of the outstanding principal amount to/from a SOFR-based loan to/from an ABR-based loan after the initial election. ABR loans had an annual interest rate equal to ABR plus 5.5%. ABR is a fluctuating interest rate per annum equal to the highest of: (i) prime rate, (ii) federal funds rate plus 0.5%, or (iii) Term SOFR for one month plus 1.0%. SOFR loans had an annual interest rate equal to Term SOFR plus 6.5%. Term SOFR is a rate per annum equal to the greater of: (i) the floor of 1.0% or (ii) the sum of Term SOFR Reference Rate plus Term SOFR Adjustment applicable to the comparable Interest Period (as defined in the June 2022 credit agreement). The Company had the option to elect an Interest Period of one, three, or six months on the SOFR loans as long as the election did not extend beyond the maturity date of June 10, 2027. The annual interest rate was subject to a 0.5% increase and separately, a 0.5% decrease depending on certain actions by the Company.

Interest on ABR loans was payable quarterly in arrears. Interest on SOFR loans was payable on the last day of each Interest Period, but if the interest period was more than three months, interest was payable on the last day of each three-month interval after the first day of such Interest Period.

In August 2023, the Company executed an amended and restated credit agreement with a consortium of lenders for a total $330.0 million revolving credit facility (the “Amended Credit Facility”) consisting of a $289.5 million term loan (the “Amended Term Loan”) and $40.5 million in committed delayed draw term loan (the “Amended Delayed Draw Term Loan”) with a maturity date of August 17, 2028. The Amended Credit Facility replaced the Prior Credit Facility. Immediately prior to the closing date of the Amended Credit Facility, the Company had an outstanding balance under the Prior Credit Facility of $193.6 million which consisted of $189.5 million of the Prior Loans and $4.1 million of unpaid interest under the Prior Credit Facility. The Company borrowed the full $289.5 million Amended Term Loan and used a portion to replace and refinance the full $189.5 million of the Prior Loans. The Company borrowed $4.1 million under the Amended Delayed Draw Term Loan to fund the unpaid interest under the Prior Credit Facility. The Company incurred $3.5 million debt discount costs in relation to the Amended Credit Facility.

The interest terms under the Amended Credit Facility are identical to the interest terms under the Prior Credit Facility except the ABR loan has an annual interest rate equal to ABR plus 6.0%, the SOFR loan has an annual interest rate equal to Term SOFR plus 7.0%, and the maturity date is August 17, 2028.

Under the Amended Credit Facility, the prepayment starts at 1.5% and reduces to zero beginning on the third anniversary from the closing date. Any amounts drawn and repaid or prepaid under the Amended Credit Facility may not be reborrowed.

The Company will have the option to fund up to 100.0% of cash interest with the proceeds of the Amended Delayed Draw Term Loan, subject to a 0.5% increase in the annual interest rate effective from the date of funding for 90 days, or 180 days if the Interest Period for such Amended Delayed Draw Term Loan is six months from the date of funding.

Under the Amended Credit Facility, the annual interest rate on all outstanding principal amounts will be reduced by 0.5% if the Company’s Annualized Subscription Recurring Revenue (as defined in the amended credit agreement, “ASRR”) is at least $500.0 million and the Company delivers a compliance certificate in accordance with the amended credit agreement.

The amended credit agreement contains certain covenants that require the Company, among other things, to maintain a specified minimum liquidity amount and minimum ASRR amount. Failure to comply with these covenants, along with other non-financial covenants, could result in an event of default, which may lead to acceleration of the amounts owed and/or the enforcement of other remedies by the lenders.

The Company had $6.9 million of debt discount and issuance costs on the $293.6 million Amended Term Loan and Amended Delayed Draw Term Loan as of August 17, 2023. The debt discount and issuance costs were recorded as a direct deduction from the long-term debt liability and are amortized into interest expense over the contractual term of the Amended Credit Facility.

Under the Amended Delayed Draw Term Loan, the Company borrowed zero and $29.1 million during the nine months ended October 31, 2025 and 2024, respectively.

In June 2025, the Company repaid in full the outstanding balance of $327.9 million under the Amended Credit Facility, which consisted of $289.5 million under the Amended Term Loan and $38.4 million under the Amended Delayed Draw Term Loan, and terminated the Amended Credit Agreement. In conjunction with the repayment, the Company incurred a loss on early extinguishment of debt of $6.7 million related to the write-off of unamortized debt discount and issuance costs and prepayment premium, which was recorded as a loss on debt extinguishment in the unaudited condensed consolidated statements of operations for the nine months ended October 31, 2025.

Rubrik, Inc. Q3 2026 Form 10-Q 22

Table of Contents

Convertible Notes

In June 2025, the Company ~~completed~~issued ~~a private offering to qualified institutional buyers of~~ $1.15 billion aggregate principal amount of 0.00% convertible senior notes due 2030, ~~including~~ (the ~~exercise in full of the initial purchasers’ option to purchase up to an additional $150.0 million principal amount of the~~ “Convertible Notes.” ~~The~~or Company’s net proceeds from the Convertible Notes were approximately $1.13 billion, after deducting the initial purchasers’ discounts and debt issuance costs. The Convertible Notes were issued pursuant to an indenture, dated June 13, 2025 (the “~~Indenture~~Notes”)~~, between the Company and U~~.S. ~~Bank~~Refer ~~Trust~~to ~~Company,~~Note ~~National Association~~8, asDebt ~~trustee. The Convertible Notes are general unsecured obligations~~ of ~~the~~our ~~Company~~Annual ~~and~~Report ~~will mature~~ on ~~June 15,~~Form ~~2030,~~10-K ~~unless~~for ~~earlier converted, redeemed or repurchased. The Convertible Notes do not bear regular interest, and~~ the ~~principal~~fiscal ~~amount~~year ofended ~~the~~January ~~Convertible Notes will not accrete. Special interest~~31, ~~if any~~2026, isfor ~~payable~~additional ~~semiannually~~information ~~in arrears~~ on ~~June 15 and December 15 of each year, beginning on December 15, 2025 (if and to~~ the ~~extent that special interest is then payable on the~~ Convertible Notes).

~~The Convertible Notes are convertible at the option of the holders at any time prior to the close of business on the business day immediately preceding March 15~~Rubrik, ~~2030, only upon satisfaction of certain conditions as described in the Indenture~~Inc. OnQ1 or2027 ~~after~~Form March 15, 2030, the Convertible Notes are convertible at any time at the election of holders until the close of business on the second scheduled trading day immediately preceding the maturity date. The conversion rate for the Convertible Notes will initially be 8.0155 shares of Class A common stock per $1,000 principal amount of the Convertible Notes, which is equivalent to an initial conversion price of approximately $124.76 per share of the Company’s Class A common stock. The conversion rate for the Convertible Notes is subject to adjustment under certain circumstances, such as upon the occurrence of a make10-~~whole~~Q fundamental change as defined in the Indenture, where the maximum conversion rate will not exceed 11.4220 shares of Class A common stock per $1,000 principal amount of the Convertible Notes, subject to adjustment in the same manner as the conversion rate. Upon conversion, the Company will pay or deliver, as the case may be, cash, shares of Class A common stock or a combination of cash and shares of Class A common stock, at the Company’s election, in the manner and subject to the terms and conditions provided in the Indenture. 16

The Company may redeem for cash all or any portion of the Convertible Notes (subject to the partial redemption limitation set forth in the Indenture), at its option, on or after June 20, 2028, if the last reported sale price of the Class A common stock has been at least 130% of the conversion price for the Convertible Notes then in effect for at least 20 trading days (whether or not consecutive) during any 30 consecutive trading day period (including the last trading day of such period) ending on, and including, the trading day immediately preceding the date on which the Company provides notice of redemption at a redemption price equal to 100% of the principal amount of the Convertible Notes to be redeemed, plus accrued and unpaid special interest, if any, to, but excluding, the redemption date.

If the Company undergoes a fundamental change (as defined in the Indenture), then, subject to certain conditions and except as set forth in the Indenture, holders may require the Company to repurchase for cash all or any portion of their Convertible Notes at a fundamental change repurchase price equal to 100% of the principal amount of the Convertible Notes to be repurchased, plus accrued and unpaid special interest, if any, to, but excluding, the fundamental change repurchase date.

The net carrying amount of the Convertible Notes was as follows (in thousands):

	October 31, 2025
Principal	$	1,150,000
Unamortized debt discount and issuance costs	(20,373)
Net carrying amount	$	1,129,627

For the three and nine months ended October 31, 2025, amortization of debt discount and issuance costs was $1.1 million and $1.7 million, respectively. The debt discount and issuance costs are being amortized into interest expense on the unaudited condensed consolidated statements of operations over the term of the Convertible Notes at an effective interest rate of 0.19%.

Rubrik, Inc. Q3 2026 Form 10-Q 23

Table of Contents

As of April 30, 2026, the conditions allowing holders of the Convertible Notes to convert have not been met.

The net carrying amount of the Convertible Notes was as follows (in thousands):


	April 30, 2026
Principal	$	1,150,000
Unamortized debt discount and issuance costs	(18,209)
Net carrying amount	$	1,131,791

For the three months ended April 30, 2026, amortization of debt discount and issuance costs was $1.1 million. The debt discount and issuance costs are being amortized into interest expense on the unaudited condensed consolidated statements of operations over the term of the Convertible Notes at an effective interest rate of 0.19%.

Capped Calls

In connection with the pricing of the Convertible Notes and the exercise in full by the initial purchasers of their option to purchase additional Convertible Notes, the Company entered into capped call transactions (the "“Capped Calls"”) with certain affiliates of certain initial purchasers of the Convertible Notes and other financial institutions. ~~The~~Refer ~~Capped Calls each have an initial strike price of approximately $124.76 per share, subject~~ to ~~certain~~Note ~~adjustments~~8, ~~which~~Debt ~~corresponds to the initial conversion price~~ of ~~the~~our ~~Convertible~~Annual ~~Notes.~~Report ~~The~~on ~~Capped~~Form ~~Calls associated with the Convertible Notes cover, subject to anti~~10-~~dilution~~K ~~adjustments,~~for ~~approximately 9.2 million shares of~~ the ~~Company’s~~fiscal ~~Class~~year Aended ~~common~~January stock. The Capped Calls are generally expected to reduce the potential dilution to the Company’s Class A common stock upon any conversion of the Convertible Notes and/or offset any cash payments the Company is required to make in excess of the principal amount of converted Convertible Notes31, ~~as the case may be~~2026, ~~with~~for ~~such~~additional ~~reduction~~information ~~and/or offset subject to a cap based~~ on the ~~cap price initially equal to $175.10 per share, subject to certain adjustments. For accounting purposes, the~~ Capped Calls ~~are separate transactions and not part of the terms of the Convertible Notes, and are recorded in stockholders’ equity and are not accounted for as derivatives~~. The cost of $88.6 million incurred to purchase the Capped Calls was recorded as a reduction to additional paid-in capital and will not be remeasured as long as they continue to meet the condition for equity classification.

~~The~~Note ~~Convertible~~8 ~~Notes~~– Commitments and the Capped Calls have been integrated for tax purposes. The impact of this tax treatment results in the Capped Calls being deductible with the cost of the Capped Calls qualifying as original issue discount for tax purposes over the term of the Convertible Notes.Contingencies

Note 9 – Commitments and Contingencies

Purchase Commitments

InAs ~~June~~of ~~2025~~April 30, ~~the~~2026, ~~Company~~there ~~amended~~were anno ~~existing~~significant ~~hosting~~changes ~~service~~outside ~~contract with a third party. The amendment extended~~ the ~~original~~ordinary ~~contract~~course ~~term~~of bybusiness ~~approximately two years~~ to ~~April 2029, and increased~~ the ~~minimum~~Company's ~~spending~~commitments ~~amount~~and bypurchase ~~$375.0~~obligations ~~million~~since ~~from the original spending commitment of $220.0 million. As of October~~January 31, ~~2025, the Company had $336~~2026.~~3 million remaining on this commitment.~~

In addition to the commitments described above, as of October 31, 2025, the Company had other remaining purchase commitments of approximately $188.1 million primarily for hosting costs and software and subscription services.

Litigation

From time to time, the Company receives inquiries and/or claims or is involved in legal disputes and/or matters. In the opinion of management, any liabilities resulting from these claims will not have a material adverse effect on the Company’s results of operations, financial position, and cash flows.

Warranties and Indemnifications

The Company provides to qualifying customers a services warranty program for recovery of certain expenses related to data recovery and restoration in the event that data backed up using the Company’s solutions cannot be recovered following a ransomware attack. To date, costs relating to the warranty program have not been material.

The Company typically provides indemnification to customers for certain losses suffered or expenses incurred as a result of third-party claims arising from the Company’s infringement of a third-party’s intellectual property. Certain of these indemnification provisions survive termination or the expiration of the applicable agreement. The Company has not incurred a material liability relating to these indemnification provisions, and therefore, has not recorded a liability during any period for these indemnification provisions.

~~Note~~Rubrik, 10Inc. –Q1 ~~Stockholders’~~2027 ~~Deficit~~Form 10-Q 17

Preferred Stock

In connection with the IPO, the Company’s amended and restated certificate of incorporation became effective, which authorized the issuance of 20,000,000 shares of undesignated preferred stock with a par value of $0.000025 per share with rights and preferences, including voting rights, designated from time to time by the board of directors.

Rubrik, Inc. Q3 2026 Form 10-Q 24

Table of Contents

~~Common~~Note ~~Stock~~9 – Stockholders’ Deficit

The Company has two classes of common stock – Class A common stock and Class B common stock. In connection with the IPO, the Company’s amended and restated certificate of incorporation authorized the issuance of 1,070,000,000 shares of Class A common stock and 210,000,000 shares of Class B common stock. The shares of Class A common stock and Class B common stock are identical, except with respect to voting, conversion, and transfer rights. Each share of Class A common stock is entitled to one vote. Each share of Class B common stock is entitled to 20 votes. Class A and Class B common stock have a par value of $0.000025 per share, and are referred to collectively as common stock throughout the notes to the unaudited condensed consolidated financial statements, unless otherwise noted. Holders of common stock are entitled to receive any dividends as may be declared from time to time by the board of directors.

Each share of Class B common stock is convertible at any time at the option of the holder into one share of Class A common stock. Any holder’s shares of Class B common stock will convert automatically to Class A common stock, on a one-to-one basis, upon the earliest to occur following the Company's IPO: (i) sale or transfer of such share of Class B common stock, except for permitted transfers as described in the amended and restated certificate of incorporation; (ii) the death or incapacity of the Class B common stockholder (or 180 days following the date of the death or incapacity if the stockholder is one of the Company’s founders); and (iii) on the final conversion date, defined as the earliest of (a) the date fixed by the Company's board of directors that is no less than 61 days and no more than 180 days following the date on which the outstanding shares of Class B common stock represent less than 5% of the then outstanding shares of Class A and Class B common stock; (b) the last trading day of the fiscal year following the tenth anniversary of the effectiveness of the registration statement in connection with the Company’s IPO; (c) the date fixed by the Company’s board of directors that is no less than 61 days and no more than 180 days following the date that Bipul Sinha is no longer providing services to the Company as an officer, employee, or director; (d) the date fixed by the board of directors that is no less than 61 days and no more than 180 days following the death or incapacity of Mr. Sinha; or (e) the date specified by a vote of the holders of a majority of the outstanding shares of Class B common stock.

Equity Incentive Plan

In January 2014, the Company adopted the 2014 Stock Option and Grant Plan, as amended (the “2014 Plan”). The 2014 Plan permits the grant of incentive stock options, non-qualified stock options, restricted stock awards, unrestricted stock awards, or restricted stock units (RSUs) awards based on, or related to, shares of the Company’s common stock. The 2014 Plan was terminated in April 2024 in connection with the IPO, but continues to govern the terms of outstanding awards that were granted prior to the termination of the 2014 Plan. No further equity awards will be granted under the 2014 Plan. With the establishment of the 2024 Equity Incentive Plan (the “2024 Plan”), upon the expiration, forfeiture, cancellation, or reacquisition of any shares of Class B common stock underlying outstanding equity awards granted under the 2014 Plan, an equal number of shares of Class A common stock will become available for grant under the 2024 Plan.

In March 2024, the Company's board of directors adopted, and in April 2024, the Company's stockholders approved, the 2024 Plan, which became effective in connection with the Company’s IPO. The 2024 Plan provides for the grant of incentive stock options, nonqualified stock options, stock appreciation rights, restricted stock awards, RSU awards, performance-based awards, and other forms of awards to employees, non-employee directors and consultants, and employees and consultants of the Company's affiliates. A total of 46,073,027 shares of the Company’s Class A common stock have been reserved for future issuance under the 2024 Plan in addition to (i) shares underlying outstanding equity awards granted under the 2014 Plan that expire, or are forfeited, cancelled, or reacquired, as described above, and (ii) any automatic increases in the number of shares of Class A common stock reserved for future issuance under this plan.

In March 2024, the board of directors adopted, and in April 2024, the stockholders approved, the 2024 Employee Stock Purchase Plan (the “2024 ESPP” or the "ESPP"), which became effective in connection with the Company’s IPO. The 2024 ESPP authorizes the issuance of shares of Class A common stock pursuant to purchase rights granted to employees. A total of 4,607,303 shares of the Company’s Class A common stock have been reserved for future issuance under the 2024 ESPP. The number of shares of Class A common stock reserved for issuance under the 2024 ESPP will automatically increase on February 1st of each fiscal year, beginning on February 1, 2025 and ending on and including February 1, 2034, by the lesser of (1) one percent (1%) of the aggregate number of shares of common stock of all classes issued and outstanding on January 31 of the preceding fiscal year, (2) 9,214,605 shares, or (3) a lesser number of shares determined by the Company's board of directors.

Rubrik, Inc. Q3 2026 Form 10-Q 25

Table of Contents

The Company has reserved shares of its common stock for future issuance as follows (in thousands):

October 31,

January 31,

April 30,

January 31,

2025

2026

2014 Stock Option and Grant Plan:

Outstanding stock options

98,~~056~~818

98,~~570~~970

Outstanding restricted stock units

106,~~795~~200

189,~~039~~227

2024 Equity Incentive Plan:

Outstanding restricted stock units

1016,~~963~~898

412,~~217~~294

Shares available for future issuance under the 2024 Plan

6064,~~195~~061

5758,~~591~~406

2024 Employee Stock Purchase Plan

56,~~090~~571

45,~~201~~090

Total shares of common stock reserved

96102,~~099~~548

93,~~618~~987

Stock Options

Options issued under the Company’s 2014 Plan and 2024 Plan generally are exercisable for periods not to exceed ten years and generally vest over four years with 25% vesting after one year and the remainder vesting monthly thereafter in equal installments.

A summary of the stock option activity and related information is as follows:

	Number ofOptions	Weighted-AverageExercise Price		Weighted-AverageRemainingContractualTerm (in years)	AggregateIntrinsicValue (inthousands)
Outstanding as of January 31, 2025	9,570,134	$	27.80	8.2	$	435,133
Outstanding as of January 31, 2026	8,970,353	$	29.20	7.6	$	239,954
Granted	—	—		—	—
Exercised	(~~510~~152,~~383~~660)	74.0421		—	357,~~174~~200
Cancelled	~~(3,647)~~—	~~11.73~~—		—	—
Outstanding as of October 31, 2025	9,056,104	$	28.98	7.8	$	419,219
Outstanding as of April 30, 2026	8,817,693	$	29.63	7.4	$	207,630
Vested and exercisable as of October 31, 2025	3,551,196	$	24.31	6.7	$	180,966
Vested and exercisable as of April 30, 2026	3,649,981	$	26.28	6.7	$	98,168

There were no options granted during the three months ended April 30, 2026 and 2025.

The intrinsic value of the options exercised represents the difference between the estimated fair market value of the Company’s common stock on the date of exercise and the exercise price of each option.

~~There~~As ~~were~~of ~~no options with only a service-based vesting condition granted during the nine months ended October~~April 3130, ~~2025 and 2024. In June 2022~~2026, ~~the~~there ~~Company’s~~was ~~board~~approximately of$36.3 ~~directors~~million ~~approved the grant~~ of aunrecognized stock-based ~~option~~compensation ~~under~~expense ~~the~~related ~~2014 Plan~~ to ~~the Company's CEO, Mr. Sinha, to purchase up to 8,000,000 of Class B common~~ stock, ~~contingent and effective upon a listing event~~options, which ~~includes~~is ~~the~~expected ~~Company's~~to ~~IPO~~be ~~(the~~recognized ~~“CEO~~over ~~Performance Award” or "the Award"). The CEO Performance Award was granted upon the Company's IPO in April 2024 and vests upon the satisfaction of~~ a ~~service~~weighted-average ~~condition~~period ~~and achievement~~ of ~~certain~~1.7 ~~stock price targets~~years.

As of October 31, 2025, there was approximately $50.0 million of unrecognized stock-based compensation expense related to stock options, which is expected to be recognized over a weighted-average period of 2.1 years.

Restricted Stock Units

The Company grants service-based condition RSUs, service- and performance-based conditions RSUs, and service-, market-, and performance-based conditions RSUs. RSUs issued under the 2014 Plan and 2024 Plan typically have an expiry period of seven years from the grant date.

Rubrik, Inc. Q3 2026 Form 10-Q 26

Table of Contents

A summary of the RSU activity and related information is as follows:

	Number ofRSUs	Weighted-AverageGrant Date Fair Value
Unvested as of January 31, 2025	22,215,749	$	31.30
Unvested as of January 31, 2026	21,480,571	$	48.73
Granted	86,~~818~~648,~~284~~891	6649.8304
Vested	(72,~~386~~840,~~523~~496)	2935.5217
Forfeited	(12,~~929~~191,~~949~~311)	3643.7237
Unvested as of October 31, 2025	21,717,561	45.85
Outstanding as of April 30, 2026	23,097,655	$	51.00
Vested and not yet released	40,625	11.35
Outstanding as of October 31, 2025	21,758,186	$	45.79

~~For the nine months ended October 31~~Rubrik, ~~2025 and 2024, the total grant date fair value of vested RSUs was $218~~Inc.1 ~~million~~Q1 ~~and~~2027 ~~$508.7~~Form ~~million,~~10-Q ~~respectively.~~18

AsTable of October 31, 2025, there was approximately $757.2 million of unrecognized stock-based compensation expense relating to RSUs, which is expected to be recognized over a weighted-average period of 1.7 years. Contents

~~Restricted~~For ~~stock~~the three months ended April 30, 2026 and 2025, the total grant date fair value of vested RSUs was $99.9 million and $74.8 million, respectively.

As of April 30, 2026, there was approximately $975.5 million of unrecognized stock-based compensation expense relating to RSUs, which is expected to be recognized over a weighted-average period of 1.6 years.

Restricted Stock

The Company issued 0.5 million shares of restricted stock in connection with the Predibase acquisition to certain Predibase employees with an aggregate fair value of $40.4 million determined based on the closing price of $88.11 per share of the Company's Class A common stock on July 18, 2025. These amounts are subject to vesting and continued employment, and will be recognized as stock-based compensation expense over the requisite service period of three years.

As of ~~October~~April 3130, ~~2025~~2026, there was approximately $3629.46 million of unrecognized stock-based compensation expense relating to the restricted stock.

2024 Employee Stock Purchase Plan

In April 2024, the Company's 2024 ESPP became effective. The 2024 ESPP allows eligible employees to purchase shares of Class A common stock at a discount through payroll deductions of up to 15% of their eligible compensation, subject to any plan limitations. Except for the initial offering period, the 2024 ESPP provides for 24-month offering periods beginning March 21 and September 21 of each year, and each offering period will consist of four six-month purchase periods. The initial offering period began on April 24, 2024, and will end on March 20, 2026.

On each purchase date, eligible employees will purchase Class A common stock at a price per share equal to 85% of the lesser of (1) the fair market value of the Class A common stock on the offering date, or (2) the fair market value of the Class A common stock on the purchase date. For the first offering period, which began on April 24, 2024, the fair market value of the Class A common stock on the offering date was $32.00, the price at which the Company's common stock was first sold to the public in the IPO, as specified in the final prospectus filed with the SEC on April 26, 2024, pursuant to Rule 424(b).

The Company estimated the fair value of ESPP purchase rights using a Black-Scholes option-pricing model with the following assumptions:

	Three Months Ended October 31,		Nine Months Ended October 31,
		Three Months Ended April 30,
	2025	2024	2025	2024
			2026	2025
Expected term (in years)	~~0.5 - 2.0~~	~~0.5 - 2.0~~	0.5 - 2.0	0.45 - 2.0
Expected volatility	~~61.5% - 65.7%~~	~~56.5% - 69.1%~~	59.04% - 6561.72%	5659.50% - 7164.7%
Risk-free interest rate	~~3.6% - 3.8%~~	~~3.6% - 4.4%~~	3.68% - 4.3.8%	3.69% - 5.4.3%
Dividend yield	—	—	—	—

~~Rubrik~~As of April 30, ~~Inc~~2026, there was approximately $33.4 Q3million ~~2026~~of ~~Form~~unrecognized 10stock-Qbased 27compensation expense related to the ESPP, which is expected to be recognized over a weighted-average period of 1.3 years.

Table of Contents

As of October 31, 2025, there was approximately $8.8 million of unrecognized stock-based compensation expense related to the ESPP, which is expected to be recognized over a weighted-average period of 1.0 years.

Stock-Based Compensation Expense

Total stock-based compensation expense included in the Company’s unaudited condensed consolidated statements of operations was as follows (in thousands):

	Three Months Ended October 31,				Nine Months Ended October 31,
			Three Months Ended April 30,
	2025		2024		2025		2024
					2026		2025
Cost of revenue
Subscription	$	~~4,164~~	$	~~4,684~~	$	124,~~275~~631	$	453,~~358~~968
Maintenance	35		196		193		2,939
Other					634		857
Other	614		1,075		2,021		13,603
Research and development					33,026		19,812
Research and development	29,135		23,088		73,681		275,562
Sales and marketing					16,331		24,144
Sales and marketing	29,818		27,468		83,600		301,611
General and administrative					18,746		24,759
General and administrative	18,701		36,016		72,694		188,802
Total stock-based compensation expense					$	73,368	$	73,540
Total stock-based compensation expense	$	82,467	$	92,527	$	244,464	$	827,875

Note 1110 – Net Loss Per Share

For periods in which there were Class A and Class B shares outstanding, the rights, including the liquidation and dividend rights, of the holders of Class A and Class B common stock are identical, except with respect to voting, conversion, and transfer rights. As the liquidation and dividend rights are identical, the undistributed earnings are allocated on a proportionate basis to each class of common stock and the resulting basic and diluted net loss per share attributable to common stockholders are, therefore, the same for both Class A and Class B common stock on both individual and combined basis.

~~The following table presents the calculation of basic and diluted net loss per share (in thousands~~Rubrik, ~~except~~Inc. ~~per~~Q1 ~~share~~2027 ~~amounts):~~Form 10-Q 19

	Three Months Ended October 31,
	2025				2024
	Class A		Class B		Class A		Class B
Numerator:
Net loss	$	(47,165)	$	(16,664)	$	(53,934)	$	(76,976)
Denominator:
Weighted-average common stock shares used in computing net loss per share, basic and diluted	146,589		51,790		75,638		107,952
Net loss per common stock share, basic and diluted	$	(0.32)	$	(0.32)	$	(0.71)	$	(0.71)

	Nine Months Ended October 31,
	2025				2024
	Class A		Class B		Class A		Class B
Numerator:
Net loss	$	(174,795)	$	(87,067)	$	(327,198)	$	(712,733)
Denominator:
Weighted-average common stock shares used in computing net loss per share, basic and diluted	130,165		64,836		44,988		97,997
Net loss per common stock share, basic and diluted	$	(1.34)	$	(1.34)	$	(7.27)	$	(7.27)

Rubrik, Inc. Q3 2026 Form 10-Q 28

Table of Contents

The following table presents the calculation of basic and diluted net loss per share (in thousands, except per share amounts):


	Three Months Ended April 30,
	2026				2025
	Class A		Class B		Class A		Class B
Numerator:
Net loss	$	(32,603)	$	(9,250)	$	(59,676)	$	(42,428)
Denominator:
Weighted-average common stock shares used in computing net loss per share, basic and diluted	158,655		45,013		111,998		79,627
Net loss per common stock share, basic and diluted	$	(0.21)	$	(0.21)	$	(0.53)	$	(0.53)

The following outstanding potentially dilutive securities were excluded from the computation of diluted net loss per share for the periods presented because the impact of including them would have been antidilutive (in thousands):

	Three and Nine Months Ended October 31,
	Three Months Ended April 30,
	2025	2024
	2026	2025
Issued and outstanding stock options	98,~~056~~818	9,~~985~~373
Unvested RSUs issued and outstanding	2123,~~718~~098	2324,~~285~~105
Convertible notes	9,218	—
Restricted stock issued for business combination	~~402~~396	—
Total	4041,~~394~~530	33,~~270~~478

The Company entered into the Capped Calls in connection with the issuance of the Convertible Notes. The effect of the Capped Calls was excluded from the calculation of diluted net loss per share attributable to the Company’s Class A common stockholders as the effect of the Capped Calls would have been anti-dilutive. The Capped Calls are generally expected to reduce the potential dilution to the Company’s Class A common stock upon any conversion of the relevant series of the Convertible Notes. See Note 87, Debt.

Note 1211 – Income Taxes

The Company recorded an income tax expense of $24.96 million and $1.93 million for the three months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024, respectively, and $6.0 million and $5.1 million for the nine months ended October 31,~~ 2025 ~~and 2024~~, respectively.

For the three months ended ~~October~~April 3130, 2026 and 2025, the income tax provision consisted of taxes on the income of the Company's foreign subsidiaries, foreign withholding taxes, and U.S. state taxes, partially offset by excess benefits from stock-based compensation deductions in the UK. ~~For the three months ended October 31, 2024, the income tax provision consisted of taxes on the income of the Company's foreign subsidiaries, foreign withholding taxes, and U.S. state taxes.~~

~~For~~As ~~the~~of ~~nine months ended October~~April 3130, ~~2025~~2026, the ~~income~~Company ~~tax~~maintained ~~provision~~a ~~consisted~~full ofvaluation ~~taxes~~allowance on ~~the~~its ~~income of the Company's foreign subsidiaries, foreign withholding taxes, and~~ U.S. ~~state~~federal taxes, partially offset by excess benefits from stock-based compensation deductions in the UK. For the nine months ended October 31, 2024, the income tax provision consisted of taxes on the income of the Company’s foreign subsidiaries, foreign withholding taxes, and ~~U.S.~~ state ~~taxes,~~net ~~partially~~deferred ~~offset by a U.S. federal & state~~ tax ~~benefit~~assets as ait ~~result~~was ofmore ~~several~~likely ofthan ~~the~~not ~~Company's~~that ~~foreign~~those ~~subsidiaries~~deferred ~~making~~tax anassets ~~election~~will tonot be ~~treated as U~~realized.~~S. branches for federal income tax purposes effective in fiscal year ended January 31, 2024.~~

AsNote of12 ~~October 31,~~– ~~2025,~~Segment ~~the~~Reporting ~~Company maintained a full valuation allowance on its U.S. federal and state net deferred tax assets as it was more likely than not that those deferred tax assets will not be realized.~~

OnThe ~~July~~Company 4,has ~~2025,~~one ~~the~~reportable Usegment which is software and services.S. ~~enacted~~The ~~tax~~software ~~reform~~and ~~legislation~~services ~~through~~segment ~~the~~provides ~~One~~unified ~~Big~~data ~~Beautiful~~security ~~Bill~~solutions ~~Act~~to ~~("OBBBA")~~customers primarily under SaaS arrangements. ~~Included~~The inCompany ~~this~~manages ~~legislation~~the ~~are~~business ~~provisions~~activities ~~that~~on ~~allow~~a ~~for~~consolidated basis. The technology used in the ~~immediate~~customer ~~expensing~~arrangements ofis ~~domestic~~primarily ~~research~~based ~~and~~on ~~development~~a ~~expenses~~single assoftware ~~well~~platform asthat ~~other~~is ~~changes~~deployed to ~~the~~and ~~U.S.~~implemented ~~taxation~~by ofcustomers ~~profits~~in ~~derived~~a ~~from~~similar ~~foreign operations~~manner. The ~~provisions~~types inof ~~the~~software ~~legislation~~and ~~are~~services ~~generally~~from ~~effective~~which ~~beginning~~the inCompany ~~fiscal~~generates ~~2026.~~revenue ~~The~~are ~~Company~~described ~~does~~under ~~not~~the ~~expect~~“Revenue ~~OBBBA~~Recognition” topolicy ~~have~~within athe ~~material~~“Note ~~impact~~2, onBasis ~~its~~of ~~unaudited~~Presentation ~~consolidated~~and ~~financial~~Summary ~~statements~~of inSignificant ~~fiscal~~Accounting ~~2026~~Policies.”

~~Note~~The 13Company’s –chief ~~Segment~~operating ~~Reporting~~decision maker is its chief executive officer. The chief operating decision maker assesses performance for the software and services segment and decides how to allocate resources based on net loss that is also reported on the consolidated statements of operations as consolidated net loss. The chief operating decision maker does not use any segment assets measure to assess performance and decide how to allocate resources.

The Company has one reportable segment which is software and services. The software and services segment provides unified data security solutions to customers primarily under SaaS arrangements. The Company manages the business activities on a consolidated basis. The technology used in the customer arrangements is primarily based on a single software platform that is deployed to and implemented by customers in a similar manner. The types of software and services from which the Company generates revenue are described under the “Revenue Recognition” policy within the “Note 2, Basis of Presentation and Summary of Significant Accounting Policies”.

The Company’s chief operating decision maker is its chief executive officer. The chief operating decision maker assesses performance for the software and services segment and decides how to allocate resources based on net loss that is also reported on the unaudited condensed consolidated statements of operations as consolidated net loss. The chief operating decision maker does not use any segment assets measure to assess performance and decide how to allocate resources.

Rubrik, Inc. Q3 2026 Form 10-Q 29

Table of Contents

The chief operating decision maker uses net loss and the functional areas as a percentage of revenue to evaluate and decide where to invest within the software and services segment. Net loss is used to monitor budget versus actual results. The chief operating decision maker also uses net loss in competitive analysis by benchmarking to the Company’s competitors. The competitive analysis along with the monitoring of budgeted versus actual results are used in assessing the performance of the segment.

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

The Company does not have intra-entity sales or transfers.

The following table presents the segment information (in thousands):

Three Months Ended October 31,

Nine Months Ended October 31,

Three Months Ended April 30,

2025

2024

2025

2024

2026

2025

Total revenue

~~350,166~~

~~236,178~~

~~938~~387,~~507~~068

~~628~~278,~~444~~481

Less:

Adjusted subscription cost of revenue (1)

~~52,583~~

~~40,760~~

~~149~~58,~~467~~194

~~117~~46,~~750~~635

Remaining cost of revenue

~~4,854~~

~~6,114~~

144,~~164~~440

185,~~430~~124

Remaining research and development expenses

~~66,448~~

~~54,886~~

~~191~~78,~~649~~875

~~169~~59,~~789~~883

Remaining sales and marketing expenses

~~161,829~~

~~129,958~~

~~457~~175,~~111~~278

~~400~~144,~~048~~404

Remaining general and administrative expenses

~~46,800~~

~~28,616~~

~~116~~36,~~120~~734

8833,~~856~~208

Stock-based compensation expense (2)

~~82,467~~

~~92,527~~

~~244~~73,~~464~~368

~~827~~73,~~875~~540

Depreciation and amortization

~~8,270~~

~~7,181~~

2310,~~988~~011

207,~~864~~818

Amortization of acquired intangibles

~~2,398~~

~~923~~

42,~~581~~802

~~2,749~~960

Interest expense

~~1,080~~

~~10,310~~

161,~~134~~070

319,~~179~~813

Income tax expense (benefit)

2,892

1,948

6,003

5,117

Income tax expense

4,637

1,274

Other items (3)

~~965~~

~~1,333~~

~~13,168~~(590)

35,~~406~~622

Plus:

Interest income

~~16,591~~

~~7,468~~

3615,~~480~~898

177,~~688~~696

Segment net loss

~~(63,829)~~

~~(130,910)~~

(~~261~~41,~~862~~853)

(1102,~~039,931~~104)

Consolidated net loss

~~(63,829)~~

~~(130,910)~~

(~~261~~41,~~862~~853)

(1102,~~039,931~~104)

(1) Adjusted subscription cost of revenue is subscription cost of revenue adjusted for stock-based compensation expense, amortization of acquired intangibles, and stock-based compensation from amortization of capitalized internal-use software as follows (in thousands):

	Three Months Ended October 31,				Nine Months Ended October 31,
			Three Months Ended April 30,
	2025		2024		2025		2024
					2026		2025
Subscription cost of revenue	$	~~59,842~~	$	~~46,486~~	$	~~167~~66,~~778~~723	$	~~166~~51,~~006~~912
Less:
Stock-based compensation expense	~~4,164~~		~~4,684~~		124,~~275~~631		453,~~358~~968
Stock-based compensation from amortization of capitalized internal-use software	697		119		1,455		149
Amortization of acquired intangibles					2,802		960
Amortization of acquired intangibles	2,398		923		4,581		2,749
Stock-based compensation from amortization of capitalized internal-use software					1,096		349
Adjusted subscription cost of revenue	$	~~52,583~~	$	~~40,760~~	$	~~149~~58,~~467~~194	$	~~117~~46,~~750~~635

(2) See Note 109 for stock-based compensation expense by captions.

(3) Other items include foreign currency exchange gains (losses).

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 3021

Table of Contents

Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our unaudited condensed consolidated financial statements and related notes appearing elsewhere in this Quarterly Report on Form 10-Q and our audited consolidated financial statements and the related notes and the discussion under the heading "“Management'’s Discussion and Analysis of Financial Condition and Results of Operations"” included in the Company’s Annual Report on Form 10-K for the fiscal year ended January 31, ~~2025~~2026, as filed with the SEC on March 2019, ~~2025~~2026 (the “Annual Report”). Some of the information contained in this discussion and analysis, ~~including information with respect to our planned investments in our research and development, sales and marketing, and general and administrative functions,~~ includes forward-looking statements that involve risks and uncertainties as described under the heading “Special Note About Forward-Looking Statements” in this Quarterly Report on Form 10-Q. You should review the disclosure under the heading “Risk Factors” in this Quarterly Report on Form 10-Q for a discussion of important factors that could cause our actual results to differ materially from those anticipated in these forward-looking statements.

Unless the context otherwise requires, all references in this Quarterly Report on Form 10-Q to “we,” “us,” “our,” “our company,” and “Rubrik” refer to Rubrik, Inc. and its consolidated subsidiaries. Unless otherwise indicated, references to our “common stock” include our Class A common stock and Class B common stock.

Overview

We are on a mission to secure and accelerate the world’s ~~data.~~AI transformation.

Cyberattacks are inevitable. Prevention and detection are not enough. Realizing that cyberattacks ultimately target data, we created Zero Trust Data Security to deliver cyber resilience so that organizations can secure their data across the cloud and recover from cyberattacks. As enterprises embrace the forthcoming AI transformation, they are grappling with a threat landscape that is now amplified at an AI-scale. We believe that cyber resilience will result in AI resilience and that the future of cybersecurity is data security—if your data is secure, your business is resilient.

We built the Rubrik Security Cloud ("“RSC"”) suite with Zero Trust design principles to secure data across enterprise, cloud, SaaS, unstructured data, and identity providers. RSC delivers a cloud native SaaS platform that detects, analyzes, and remediates data security risks and unauthorized user activities. Our platform is architected to help organizations achieve cyber resilience, which encompasses cyber posture and cyber recovery. We enable organizations to confidently accelerate digital transformation and leverage the cloud to realize business agility.

We launched our first enterprise software product, Converged Data Management, in fiscal 2016, which combined data and metadata together into a single layer of software to offer Zero Trust data protection, and sold it as a perpetual license along with associated maintenance contracts. In fiscal 2019, we extended data protection to cloud native applications and rebranded Converged Data Management to Cloud Data Management ("“CDM"”). Data protection for cloud native applications are sold as a SaaS subscription ~~product~~offering. In addition, we began ~~offering~~launching new SaaS subscription ~~products~~offerings, Anomaly Detection and Sensitive Data Monitoring. In fiscal 2020, we continued our business evolution to a subscription pricing model by offering ~~our~~ CDM ~~platform~~ as a subscription term-based license with associated support. Included in this subscription term-based license was the right to next generation Rubrik-branded commodity servers ("“Rubrik-branded Appliances"”) at no cost for qualified customers ("“Refresh Rights"”). As of February 1, 2022, we stopped offering CDM as a perpetual license.

In fiscal 2023, to meet customer demands for data security and a single, unified cloud-based control plane, we launched RSC, a suite built on top of our comprehensive Zero Trust Data Security platform. RSC culminates our early vision of providing one point of control to secure data across enterprise, cloud, SaaS, unstructured data, and identity providers. RSC is primarily adopted by our customers as a cloud-native, fully managed SaaS solution. It is also available as an enterprise-ready, self-managed version ("“RSC-Private"”), for a few select customers that are subject to stringent data control policies. For U.S. public sector organizations, we also offer a specialized cloud-native fully managed SaaS solution called RSC-Government.

We began transitioning customers from our legacy CDM capabilities to RSC, which is offered on a subscription basis, in fiscal 2023. As part of this business transition, we began transitioning the sale of Rubrik-branded Appliances from us to our contract manufacturers and stopped offering the Refresh Rights as part of our subscription offerings. In lieu of offering Refresh Rights, we ~~offer~~offered Subscription Credits to qualifying customers (which are customer options that are accounted for as material rights). We recognize ratable revenue upon utilization or upfront revenue upon expiration of Subscription Credits, and utilization of Subscription Credits also offsets Subscription ARR for the applicable period. AsSince of the end of fiscal 2024, RSC has represented a majority of our total revenue.

We recognize revenue from the sales of our RSC ~~platform~~suite (excluding RSC-Private) ratably over the term of the subscription. We recognize a portion of revenue from sales of RSC-Private upon delivery and the remainder ratably over the term of the subscription. The majority of sales of our subscriptions are for three-year terms with upfront payment, and renewals are typically for one-year terms.

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 3122

Table of Contents

WeNew ~~expect new~~ and existing customers ~~to continue to adopt RSC. Our new customers~~ have ~~generally~~largely ~~been~~adopted ~~rapidly adopting the~~ RSC ~~platform~~. We ~~are~~have ~~actively~~largely ~~migrating~~migrated our existing customers from our legacy CDM capabilities to RSC. AsDuring ~~part of~~ this migration, ~~we expect~~ certain existing customers toconsumed ~~consume~~ our platform and products through a mix of RSC and a transitional CDM license ("“RCDM-T"”), during which time we ~~expect~~recognized ~~to continue recognizing~~ a portion of the associated revenue from these customers upfront at the time we ~~transfer~~transferred control of the license to the customer., Weand ~~cannot~~we ~~predict~~have ~~how~~largely ~~long~~completed ~~these customers will use~~ this ~~mix~~transition ~~before~~in ~~they~~fiscal ~~complete their transition~~2026. In addition, we expect our subscription revenue ~~will~~to ~~fluctuate~~continue ~~when~~to ~~qualified~~benefit from customers ~~choose~~exercising ~~to exercise~~ or ~~forfeit~~forfeiting their Subscription Credits ~~(which~~through ~~are~~fiscal ~~customer~~2027, ~~options~~although ~~that~~we ~~are~~expect ~~accounted~~the ~~for~~benefits asto ~~material~~significantly ~~rights)~~decline ~~upon their associated expiration date~~sequentially.

~~Key~~In ~~Factors~~fiscal ~~Affecting~~2026, ~~Our~~we ~~Performance~~launched RAC, our AI agent operations suite, to accelerate enterprise AI transformation without introducing added risk. RAC is designed to monitor and audit agentic actions, enforce real-time guardrails for agentic changes, fine-tune agents for accuracy and, finally, undo agent mistakes. Built on our unique architecture that understands data, identity and application contexts, RAC is designed to give customers security, accuracy, and efficiency as they transform their organizations into AI enterprises. As RAC only became commercially available in February of 2026, we expect the RSC suite to continue to be the majority of our revenue in fiscal 2027 and the main driver for ARR growth.

In the first quarter of fiscal 2027, we started offering the Resilience Guardian as a term-based subscription license program, which provides customers with dedicated resilience managers to design and implement a cyber resilience strategy that maps to business outcomes. This includes proactive security and health checks, detection and resolution of emerging issues, upgrade planning and assistance, and adoption excellence and value realization.

Factors Affecting Our Performance

Evolution of the Market and Adoption of Our Solutions

Our future success depends in part on the market adoption of our approach to Zero Trust Data Security. Many organizations have focused on preventing cyberattacks instead of protecting their data and having a plan to recover it in case of a cyberattack. We believe that the existing security ecosystem lacks a data security platform that will secure a customer’s data, wherever it lives, across enterprise, cloud, SaaS, unstructured data, and identity providers. RSC is our Zero Trust Data Security platform that addresses the growing demand from organizations of virtually any size, across a wide range of industries, to address data security and cyberattack risks. As the data security market continues to evolve, we expect to continuously innovate our platform and product functionality to keep us in a strong position to capture the large opportunity ahead.

New Customer Acquisition

Our business model relies on rapidly and efficiently engaging with new customers. Our ability to attract new customers will depend on a number of factors, including our ability to innovate upon our product breadth and capabilities, our success in recruiting and scaling our sales and marketing organization, our ability to accelerate ramp time of our sales force, our ability to develop and maintain strong partnerships, the impact of marketing efforts to enhance our brand, and competitive dynamics in our target markets.

Retaining and Expanding Within Our Existing Customer Base

Our ability to retain customers and expand within existing customers is integral to our growth and future success. Our growing base of customers represents a significant opportunity for further expansion across our platform. Our customers typically start with securing data in one or more applications on our platform, and then expand by securing additional applications and increasing the amount of data secured. They further extend their use of our platform through adoption of additional security products. Several of our largest customers have deployed our platform to secure large amounts of their data across enterprise, cloud, SaaS, unstructured data, and identity providers. Our ability to expand and extend within our customer base depends on, and has been impacted by, a number of factors, including platform performance, our customers’ satisfaction with our platform, competitive offerings, pricing, overall changes in our customers’ spending levels, and the effectiveness of our efforts to help our customers realize the benefits of our platform.

Macroeconomic and Supply Chain Conditions

Our overall performance depends in part on worldwide economic and geopolitical conditions and their impact on customer behavior. Macroeconomic conditions, including inflation, fluctuations in interest rates, foreign currency fluctuations, tariffs or other trade restrictions, geopolitical issues, changes in government policy or spending, and other changes in economic conditions, may adversely affect the buying patterns of our customers and prospective customers. For example, in light of current macroeconomic conditions, such as higher cost-consciousness around information technology budgets, as well as constraints affecting the availability or pricing of compatible commodity servers needed to deploy our solutions, we have observed a lengthening of our sales cycles. Additionally, key components of the commodity servers that are compatible with our solutions have been, and continue to be, affected by global chip shortages and allocation constraints, in part due to elevated industry demand, which in certain cases have resulted in extended lead times and increased server prices. Such delays, constraints and increased costs may affect our customers’ purchasing decisions and

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

deployment timelines, in some cases delaying customer purchases and in other cases resulting in customers pulling software purchases forward to lock in hardware prices. In response, we may in the future provide certain commercial accommodations, which could reduce our margins or adversely affect our revenue and operating results if such practices become widespread or prolonged. Due to our subscription-focused business model, any impact of the current macroeconomic environment and supply chain constraints on our business may not be fully reflected in our results of operations until future periods. As we continue to monitor the direct and indirect impacts of the current environment, the broader implications of macroeconomic conditions and supply chain constraints on our business, results of operations and financial condition, particularly in the long term, remain uncertain.

Key Business Metrics

We monitor the following key business metrics to help us evaluate our business.

Subscription ARR

Subscription ARR is calculated as the annualized value of our active subscriptions as of the measurement date, based on our customers’ total contract value, and assuming any contract that expires during the next 12 months is renewed on existing terms. Subscriptions include offerings for our RSC ~~platform~~suite and related data security SaaS solutions, term-based licenses for our RSC-Private ~~platform~~suite and related products, prior sales of CDM sold as a subscription term-based license with associated support and related SaaS products, and standalone sales of our SaaS subscription ~~products~~offerings like Anomaly Detection, ~~and~~ Sensitive Data Monitoring and Resilience Guardian. We believe Subscription ARR illustrates our success in acquiring new subscription customers and maintaining and expanding our relationships with existing subscription customers.

The following table sets forth our Subscription ARR as of the dates presented:

	October 31,
	April 30,
	2025			2024
	2026			2025
	(in thousands, except percentages)
Subscription ARR	$	1,~~346~~565,~~836~~141		$	1,~~002~~181,~~252~~269
% growth	3432		%	38		%

~~Rubrik~~Subscription ARR does not include any maintenance revenue associated with perpetual licenses, ~~Inc~~which we generally no longer offer. Q3Of the 32% and 38% growth, approximately 0.4 percentage points and 2 percentage points of growth for the three months ended April 30, 2026 ~~Form~~and ~~10-Q~~2025, 32respectively, were a result of transitioning our existing maintenance customers to our subscription editions. Contributions to growth from these transitions were largely completed in fiscal 2026.

Table of Contents

Subscription ARR does not include any maintenance revenue associated with perpetual licenses, which we generally no longer offer. Of the 34% and 38% growth, approximately 1.2 percentage points and 2.0 percentage points of growth for the twelve months endedOctober 31, 2025 and 2024, respectively, were a result of transitioning our existing maintenance customers to our subscription editions. We expect the contributions to growth from these transitions to continue to subside in fiscal 2026.

Cloud Annual Recurring Revenue, or Cloud ARR

Cloud ARR is calculated as the annualized value of our active cloud-based subscriptions as of the measurement date, based on our customers’ total contract value, and assuming any contract that expires during the next 12 months is renewed on existing terms. Our cloud-based subscriptions include RSC and RSC-Government (excluding RSC-Private). Cloud ARR also includes SaaS subscription ~~products~~offerings like Anomaly Detection and Sensitive Data Monitoring, which are sold standalone or with prior sales of term-based license offerings of CDM. We believe that Cloud ARR provides important information on new and existing customers purchasing new RSC subscription offerings and existing subscription term-based license customers renewing with RSC subscription offerings.

The following table sets forth our Cloud ARR as of the dates presented:

	October 31,
	April 30,
	2025			2024
	2026			2025
	(in thousands, except percentages)
Cloud ARR	$	1,~~174~~393,~~693~~920		$	~~768~~971,~~838~~546
% growth	5343		%	6960		%

Average Subscription Dollar-Based Net Retention Rate

Our average subscription dollar-based net retention rate compares our Subscription ARR from the same set of subscription customers across comparable periods. We calculate our average subscription dollar-based net retention rate by first identifying subscription customers (the "“Prior Period Subscription Customers"”) that were subscription customers at the end of a particular quarter (the "“Prior Period"”) and calculate the Subscription ARR from the Prior Period Subscription Customers. We then calculate the Subscription ARR from these Prior Period Subscription Customers at the end of the same quarter of the subsequent year (the "“Current Period"”). This calculation captures upsells, contraction, and attrition since the Prior Period. We then divide total Current Period Subscription ARR by the total Prior Period Subscription ARR for Prior Period Subscription Customers. Our average subscription dollar-based net retention rate in a particular quarter is obtained by averaging the result from that particular quarter with the corresponding results from each of the prior three quarters. We believe that our average subscription dollar-based net retention rate provides useful information about the evolution of our existing customers as they expand through the increase of data from applications we already secure, new applications for us to secure, additional data security products, and conversion of our recurring revenue related to maintenance contracts into subscription revenue.

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

calculation captures upsells, contraction, and attrition since the Prior Period. We then divide total Current Period Subscription ARR by the total Prior Period Subscription ARR for Prior Period Subscription Customers. Our average subscription dollar-based net retention rate in a particular quarter is obtained by averaging the result from that particular quarter with the corresponding results from each of the prior three quarters. We believe that our average subscription dollar-based net retention rate provides useful information about the evolution of our existing customers as they expand through the increase of data from applications we already secure, new applications for us to secure, additional data security products, and conversion of our recurring revenue related to maintenance contracts into subscription revenue.

Our historical average subscription dollar-based net retention rate does not include any maintenance revenue associated with perpetual licenses, which we no longer offer. Like Subscription ARR, our historical average subscription dollar-based net retention rate benefits from the transition of our existing maintenance customers to our subscription editions.

The following table sets forth our average subscription dollar-based net retention rate as of the dates presented:

	October 31,
	April 30,
	2025	2024
	2026	2025
Average subscription dollar-based net retention rate	~~over~~approximately 120%	over 120%

Customers with $100,000 or More in Subscription ARR

We believe that customers with $100,000 or more in Subscription ARR is a helpful metric in measuring our ability to scale with our customers and the success of our ability to acquire large customers. Additionally, we believe that our ability to increase the number of customers with $100,000 or more in Subscription ARR is a useful indicator of our market penetration and demand for our platform.

The following table sets forth the number of customers with $100,000 or more in Subscription ARR as of the dates presented:

	October 31,
	April 30,
	2025		2024
	2026		2025
Customers with $100,000 or more in Subscription ARR	2,~~638~~946		2,~~085~~381
% growth	2724	%	3228	%

Rubrik, Inc. Q3 2026 Form 10-Q 33

Table of Contents

Non-GAAP Financial Measures

We believe that non-GAAP financial measures, when taken collectively, may be helpful to investors because they provide consistency and comparability with past financial performance. However, non-GAAP financial measures are presented for supplemental informational purposes only, have limitations as an analytical tool, and should not be considered in isolation or as a substitute for financial information presented in accordance with GAAP. Other companies, including companies in our industry, may calculate similarly titled non-GAAP financial measures differently or may use other measures to evaluate their performance, all of which could reduce the usefulness of our non-GAAP financial measures as tools for comparison. A reconciliation is provided below for each non-GAAP financial measure to the most directly comparable financial measure stated in accordance with GAAP. Investors are encouraged to review the related GAAP financial measures and the reconciliation of these non-GAAP financial measures to their most directly comparable GAAP financial measures, and not to rely on any single financial measure to evaluate our business.

Free Cash Flow

Free cash flow is a non-GAAP financial measure that we calculate as net cash provided by (used in) operating activities less cash used for purchases of property and equipment and capitalized internal-use software. We believe that free cash flow is a helpful indicator of liquidity that provides information to management and investors about the amount of cash generated or used by our operations that, after the investments in property and equipment and capitalized internal-use software, can be used for strategic initiatives, including investing in our business and strengthening our financial position. The limitation of free cash flow is that it does not reflect our future contractual commitments and may fluctuate due to the timing of cash payments received from our customers and payments relative to expenses, ~~including discretionary cash payments of our debt interest expense pursuant to the terms of our Amended Credit Facility,~~ prepayments of other spend, including hosting prepayments, and charitable donations. Additionally, free cash flow is not a substitute for cash provided by (used in) operating activities, and the utility of free cash flow as a measure of our liquidity is further limited as it does not represent the total increase or decrease in our cash balance for a given period.

Free cash flow was $~~167~~73.86 million and $~~(53~~33.6)3 million for the ~~nine~~three months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024~~2025, respectively. ~~Free~~The cash flow for the nine months ended October 31, 2024 includes a cash outlay of $22.8 million for employer payroll taxes due to the vesting of certain equity awards in conjunction with the initial public offering. Adjusting for this, the improvement in free cash flow was primarily due to higher sales, including timing of renewals, improved operating leverage and optimizing our capital structure. This trend when combined with changes in new business growth, may result in free cash flow volatility across periods.

~~In the longer term~~Rubrik, weInc. ~~view~~Q1 ~~continued~~2027 ~~Subscription~~Form ~~ARR growth, operating leverage, and the mix of annual versus upfront payment terms on our multi~~10-~~year~~Q contracts as primary drivers of free cash flow. See the risk factor titled “We expect fluctuations in our financial results, making it difficult to project future results, and if we fail to meet the expectations of securities analysts or investors with respect to our results of operations, our stock price and the value of your investment could decline” in the section titled “Risk Factors.”25

The following table presents a reconciliation of free cash flow to net cash provided by (used in) operating activities for the periods presented:

	Nine Months Ended October 31,
	2025		2024
	(in thousands)
Net cash provided by (used in) operating activities	$	189,863	$	(35,369)
Less: Purchases of property and equipment	(11,087)		(11,296)
Less: Capitalized internal-use software	(11,004)		(6,902)
Free cash flow	$	167,772	$	(53,567)
Net cash used in investing activities	$	(811,472)	$	(387,600)
Net cash provided by financing activities	$	736,012	$	396,100

Rubrik, Inc. Q3 2026 Form 10-Q 34

Table of Contents

In the longer term, we view continued Subscription ARR growth, operating leverage, and the mix of annual versus upfront payment terms on our multi-year contracts as primary drivers of free cash flow. See the risk factor titled “We expect fluctuations in our financial results, making it difficult to project future results, and if we fail to meet the expectations of securities analysts or investors with respect to our results of operations, our stock price and the value of your investment could decline” in the section titled “Risk Factors.”

The following table presents a reconciliation of free cash flow to net cash provided by operating activities for the periods presented:


	Three Months Ended April 30,
	2026		2025

	(in thousands)
Net cash provided by operating activities	$	81,689	$	39,655
Less: Purchases of property and equipment	(4,277)		(2,850)
Less: Capitalized internal-use software	(3,799)		(3,465)
Free cash flow	$	73,613	$	33,340
Net cash (used in) provided by investing activities	$	(36,183)	$	34,165
Net cash provided by financing activities	$	17,215	$	15,341

Subscription ARR Contribution Margin

We define Subscription ARR Contribution Margin as the Subscription ARR Contribution (as defined below) divided by Subscription ARR at the end of the period. We define Subscription ARR Contribution as Subscription ARR at the end of the period less: (i) our non-GAAP subscription cost of revenue and (ii) our non-GAAP operating expenses for the prior 12-month period ending on that date. In fiscal 2023, we began transitioning customers from our legacy CDM capabilities to our subscription-based RSC offerings. As a result of differing revenue recognition treatment between CDM and RSC, including the RCDM-T licenses offered to existing customers, and as qualified customers choose to exercise or forfeit their Subscription Credits, these business transitions cause fluctuations to our total revenue growth and limit the comparability of our revenue with past performance. As a result, we measure the performance of our business on the basis of Subscription ARR. We believe that Subscription ARR Contribution Margin is a helpful indicator of operating leverage during this business transition. One limitation of Subscription ARR Contribution Margin is that the factors that impact Subscription ARR will vary from those that impact subscription revenue and, as such, may not provide an accurate indication of our actual or future GAAP results. Additionally, the historical expenses in this calculation may not accurately reflect the costs associated with future commitments.

Subscription ARR Contribution Margin was 1013% and ~~(3)~~8% for the 12 months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024~~2025, respectively. ~~For~~The the 12 months ended October 31, 2024, the non-GAAP expenses included the recognition of $22.8 million for employer payroll taxes due to the vesting of certain equity awards in conjunction with the initial public offering. Adjusting for this, the increase in Subscription ARR Contribution Margin was primarily driven by the strong year-over-year ~~growth in~~ Subscription ARR, ~~compared~~growth tooutpacing the year-over-year growth in non-GAAP subscription costs of sales and non-GAAP operating expenses. We believe that this increase in Subscription ARR Contribution Margin reflects increased operating leverage in our business.

~~The~~Rubrik, ~~following~~Inc. ~~table~~Q1 ~~presents~~2027 ~~the~~Form ~~calculation of Subscription ARR Contribution Margin for the periods presented as well as a reconciliation of (i) non~~10-~~GAAP~~Q ~~subscription cost of revenue to subscription cost of revenue and (ii) non-GAAP operating expenses to operating expenses:~~26

	Twelve Months Ended October 31,
	2025			2024
	(in thousands, except percentages)
Subscription cost of revenue	$	216,808		$	196,395
Stock-based compensation expense	(16,431)			(45,360)
Stock-based compensation from amortization of capitalized internal-use software	(1,579)			(163)
Amortization of acquired intangibles	(5,505)			(3,672)
Non-GAAP subscription cost of revenue	$	193,293		$	147,200
Operating expenses	$	1,325,125		$	1,657,219
Stock-based compensation expense	(310,872)			(769,401)
Non-GAAP operating expenses	$	1,014,253		$	887,818
Subscription ARR	$	1,346,836		$	1,002,252
Non-GAAP subscription cost of revenue	(193,293)			(147,200)
Non-GAAP operating expenses	(1,014,253)			(887,818)
Subscription ARR Contribution	$	139,290		$	(32,766)
Subscription ARR Contribution Margin	10		%	(3)		%

Rubrik, Inc. Q3 2026 Form 10-Q 35

Table of Contents

The following table presents the calculation of Subscription ARR Contribution Margin for the periods presented as well as a reconciliation of (i) non-GAAP subscription cost of revenue to subscription cost of revenue and (ii) non-GAAP operating expenses to operating expenses:


	Twelve Months Ended April 30,
	2026			2025

	(in thousands, except percentages)
Subscription cost of revenue	$	244,552		$	193,223
Stock-based compensation expense	(17,037)			(18,289)
Stock-based compensation included in amortization of capitalized internal-use software	(2,903)			(607)
Amortization of acquired intangibles	(9,330)			(3,730)
Non-GAAP subscription cost of revenue	$	215,282		$	170,597

Operating expenses	$	1,453,058		$	1,249,744
Stock-based compensation expense	(309,832)			(334,156)
Non-GAAP operating expenses	$	1,143,226		$	915,588

Subscription ARR	$	1,565,141		$	1,181,269
Non-GAAP subscription cost of revenue	(215,282)			(170,597)
Non-GAAP operating expenses	(1,143,226)			(915,588)
Subscription ARR Contribution	$	206,633		$	95,084
Subscription ARR Contribution Margin	13.2		%	8.0		%

Components of Results of Operations

Revenue

We generate revenue primarily from sales of subscriptions and typically invoice our customers at the inception of the contract.

~~Our~~While ~~revenue~~we ~~will~~have ~~fluctuate~~largely ~~based~~completed onboth the ~~timing~~sales ~~for~~of Rubrik-branded Appliances transitioning from us to our ~~existing~~contract ~~customers~~manufacturers toin ~~RSC,~~fiscal ~~including~~2025 and the ~~RCDM-T~~transition ~~licenses~~for ~~offered~~new toand existing customers, to sales of RSC~~-Private~~ in fiscal 2026, ~~and~~we ~~when~~expect ~~qualified~~our ~~customers~~subscription ~~choose~~revenue to ~~exercise~~continue to benefit from customers exercising or ~~forfeit~~forfeiting their Subscription Credits, ~~the~~(which are customer options that are accounted for as material rights.) ~~These~~through ~~expected~~fiscal ~~trends~~2027, ~~when~~although ~~combined~~we ~~with~~expect the ~~transition~~benefits ofto ~~the~~significantly ~~sale~~decline ofsequentially. ~~Rubrik-branded~~These ~~Appliances~~business ~~from~~transitions uscause fluctuations to our ~~contract~~total ~~manufacturers,~~revenue ~~will~~growth ~~limit~~ and ~~cause~~limit ~~fluctuations~~the tocomparability of our revenue ~~growth~~with ~~through~~past ~~fiscal 2027~~performance. We primarily measure our business on the basis of Subscription ARR, as we believe it best reflects our actual growth and our growth prospects.

Subscription Revenue

Our subscription revenue consists of SaaS subscriptions and subscription term-based licenses with related support services.

SaaS includes SaaS subscription ~~products~~offerings like Anomaly Detection and Sensitive Data Monitoring sold standalone or with prior sales of term-based license offerings of CDM prior to the launch of the RSC ~~platform~~suite as well as sales of RSC. RSC is offered as a fully-hosted subscription or a hybrid cloud subscription. RSC is a fully-hosted subscription in the case of protection of cloud, SaaS, unstructured data, and identity providers. When RSC is securing enterprise applications, it is a hybrid cloud subscription which includes software hosted from the cloud (as a service) and an on-premise license for securing enterprise applications. The hybrid cloud subscription is accounted for as a single performance obligation because the software hosted from the cloud (as a service) and the on-premise software licenses are not separately identifiable and serve together to fulfill our promise to the customer, which is to provide a single, unified data security solution. Our RSC subscription capabilities are primarily sold as editions which bundle multiple products and include the Foundation Edition, Business Edition, ~~Enterprise Edition,~~ and Enterprise ~~Proactive~~ Edition. Subscription revenue related to SaaS is recognized ratably over the subscription period.

Subscription term-based licenses provide our customer with a right to use the software for a fixed term commencing upon delivery of the license to our customer. Support services are bundled with each subscription term-based license for the term of the subscription. Subscription revenue related to subscription term-based licenses includes upfront revenue recognized at the later of the start date of the subscription term-based license and the date when the subscription term-based license is delivered. The remainder of the revenue is recognized ratably over the subscription period for support services, commencing with the date the service is made available to customers.

~~As customers continue to adopt or transition to RSC~~Rubrik, ~~we expect the ratable portion of our subscription revenue to increase~~Inc. WeQ1 ~~expect~~2027 ~~certain~~Form ~~customers to consume our platform and products through a mix of RSC and RCDM~~10-TQ as they complete the migration, which will result in a recognition of a portion of the associated revenue for these customers upfront. Furthermore, our subscription revenue will also fluctuate when qualified customers choose to exercise or forfeit their customer options that are accounted for as material rights. We expect to continue seeing these benefits in revenue growth due to the non-recurring revenue related to material rights, and we believe these benefits will decline for the remainder of fiscal 2026. Moreover, we expect these benefits will further decline in fiscal 2027. The combination of both of these factors will limit and cause fluctuations in our subscription revenue growth through fiscal 2027, depending in part on the timing of our existing customers’ transition to RSC and exercises or forfeitures of Subscription Credits.27

Maintenance Revenue

Maintenance revenue represents fees earned from software updates on a when-and-if-available basis, telephone support, integrated web-based support, and Rubrik-branded Appliance maintenance relating to our perpetual licenses. Maintenance revenue is recognized ratably over the term of the service period. We expect our maintenance revenue to decrease as we drive adoption of RSC for existing maintenance customers and the transition to be largely completed by the end of fiscal 2026.

Other Revenue

Other revenue represents fees earned from sales of Rubrik-branded Appliances and professional services. Revenue for Rubrik-branded Appliances is recognized when shipped to the customer. When we sell our software license with our Rubrik-branded Appliances, revenue for both the Rubrik-branded Appliances and software licenses are recognized at the same time. Revenue related to professional services is typically recognized as the services are performed. In the third quarter of fiscal 2023, we began transitioning the sale of Rubrik-branded Appliances from us to our contract manufacturers and this was largely completed in fiscal 2025. We expect other revenue to be largely driven by sales of professional services in the future and as a percentage of total revenue to decrease over time.

Rubrik, Inc. Q3 2026 Form 10-Q 36

Table of Contents

Subscription revenue related to subscription term-based licenses includes upfront revenue recognized at the later of the start date of the subscription term-based license and the date when the subscription term-based license is delivered. The remainder of the revenue is recognized ratably over the subscription period for support services, commencing with the date the service is made available to customers.

Our subscription revenue will fluctuate when qualified customers choose to exercise or forfeit their customer options that are accounted for as material rights. We have experienced revenue growth benefits from the non-recurring revenue associated with material rights; however, we expect these benefits to decline over the course of fiscal 2027. The combination of both of these factors may continue to limit and cause fluctuations in our subscription revenue growth during fiscal 2027, depending in part on the timing of our existing customers’ transition to RSC and exercises or forfeitures of Subscription Credits (which are customer options that are accounted for as material rights).

Other Revenue

Other revenue includes fees earned from sales of professional services, software updates on a when-and-if-available basis, telephone and integrated web-based support, Rubrik-branded Appliance maintenance relating to our perpetual licenses, and Rubrik-branded Appliances. Revenue for Rubrik-branded Appliances is recognized when shipped to the customer. When we sell our software license with our Rubrik-branded Appliances, revenue for both the Rubrik-branded Appliances and software licenses are recognized at the same time. Revenue related to professional services is typically recognized as the services are performed. We expect other revenue to be largely driven by sales of professional services in the future and as a percentage of total revenue to decrease over time.

Cost of Revenue

Cost of revenue primarily includes employee compensation and related expenses associated with customer support, certain hosting costs, amortization of capitalized internal-use software, amortization of finite-lived intangible assets and cost of Rubrik-branded Appliances.

Cost of Subscription Revenue

Cost of subscription revenue primarily includes employee compensation and related expenses associated with customer support for our subscription offerings, certain hosting costs, amortization of capitalized internal-use software, and amortization of finite-lived intangible assets. We expect our cost of subscription revenue to increase as our subscription revenue increases.

Cost of Maintenance Revenue

Cost of maintenance revenue primarily includes employee compensation and related expenses associated with customer support from our perpetual licenses. Over the long-term, we expect our cost of maintenance revenue to decrease as our maintenance revenue decreases.

Cost of Other Revenue

Cost of other revenue ~~primarily~~ includes the cost of ~~Rubrik-branded~~professional ~~Appliances~~services, employee compensation and ~~professional~~related ~~services~~expenses associated with customer support from our perpetual licenses, and the cost of Rubrik-branded Appliances. We expect cost of other revenue as a percentage of total cost of revenue to decrease ~~due~~as to the transition of sales of Rubrik-branded Appliances ~~transitioning~~ from us to our contract manufacturers ~~which~~ was largely completed in fiscal 2025. Over the long-term, we expect the cost of other revenue to be largely driven by sales of professional services.

Gross Profit and Margin

Gross profit is revenue less cost of revenue.

Gross margin is gross profit expressed as a percentage of revenue. Our gross margin has been, and will continue to be, affected by a number of factors, including the mix of subscription term-based licenses, SaaS subscriptions, and other products, when qualified customers choose to exercise or forfeit their customer options that are accounted for as material rights, the timing and extent of our investments in our global customer support organization, certain hosting costs, the amortization of capitalized internal-use software, and stock-based compensation expense. Over time, we expect our gross margin to fluctuate due to the factors described above.

Subscription Gross Margin

~~With~~We ~~increased adoption of RSC, we~~ expect ~~SaaS revenue to increase as a percentage of total revenue, which we expect will result in an increase in associated hosting costs. As customers adopt RSC, we expect~~ our subscription gross margin to fluctuate through fiscal 2027. This is due to the revenue being recognized ratably over the subscription term rather than a portion being recognized upfront from subscription term-based licenses and associated increases in hosting costs for our SaaS solutions. We expect our subscription gross margin to fluctuate as customers adopt data security SaaS solutions on the RSC ~~platform~~suite.

Maintenance Gross Margin

We expect maintenance revenue to decrease as a percentage of total revenue, which we expect will result in a decrease in maintenance costs. We expect our maintenance margin to fluctuate until the end of fiscal 2026 as maintenance revenue and related costs decline as customers adopt RSC.

Other Gross Margin

We expect ~~sales~~other ofgross ~~Rubrik-branded~~margin ~~Appliances~~ to decrease as wea ~~transition~~percentage ~~the~~of ~~sale~~total ~~from us to contract manufacturers~~revenue, which we expect will result in a decrease in ~~associated~~cost ~~Rubrik-branded~~of ~~Appliance~~other ~~costs~~revenue. ~~The~~We ~~transition~~expect ofsales ~~the sale~~ of Rubrik-branded Appliances to ~~our~~decrease ~~contract~~as ~~manufacturers~~the ~~was~~transition ~~largely~~of ~~completed~~sales inof ~~fiscal 2025. Over the long~~Rubrik-~~term,~~branded weAppliances ~~expect~~from ~~other~~us ~~gross margin~~ to ~~be largely driven by sales of professional services.~~

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

our contract manufacturers was largely completed in fiscal 2025. Over the long-term, we expect other gross margin to be largely driven by sales of professional services.

Operating Expenses

Our operating expenses consist of research and development, sales and marketing, and general and administrative expenses. Personnel costs are the most significant component of operating expenses. We also incur other non-personnel costs such as colocation and certain hosting costs, office space costs, fees for third-party professional services, and costs associated with software and subscription services. We expect our operating expenses will continue to increase as our business grows. We also expect our operating expenses, exclusive of stock-based compensation, as a percentage of revenue to generally decrease over the long term.

Rubrik, Inc. Q3 2026 Form 10-Q 37

Table of Contents

Research and Development

Research and development expenses consist primarily of employee compensation and related expenses, net of capitalized amounts, and colocation and certain hosting costs. To capture share in the ever-growing data security market, we expect to continuously innovate our platform and product functionality and will continue to invest in research and development. We expect our research and development expenses will continue to increase as our business grows. We also expect our research and development expenses, exclusive of stock-based compensation, as a percentage of revenue to generally decrease over the long term.

Sales and Marketing

Sales and marketing expenses consist primarily of employee compensation and related expenses including sales commissions, marketing programs, and travel-related costs. To capture share in the ever-growing data security market, we expect to continuously expand our sales force, increase our marketing efforts, and expand into new markets. We expect our sales and marketing expenses will continue to increase as our business grows. We also expect our sales and marketing expenses, exclusive of stock-based compensation, as a percentage of revenue to generally decrease over the long term.

General and Administrative

General and administrative expenses consist primarily of employee compensation and related expenses for administrative functions, including finance, legal, human resources, information technology, and fees for third-party professional services. We expect our general and administrative expenses will continue to increase as our business grows. We also expect our general and administrative expenses, exclusive of stock-based compensation, as a percentage of revenue to generally decrease over the long term.

Other Non-Operating Income (Expense)

Other non-operating income (expense) consists primarily of interest income, interest expense, loss on debt extinguishment, and foreign exchange gains and losses.

Income Tax Expense ~~(Benefit)~~

Income tax expense consists primarily of income taxes in certain foreign jurisdictions in which we conduct business, as well as ~~federal and~~ state income taxes in the United States. We have recorded U.S. federal and state net deferred tax assets for which we provide a full valuation allowance, which includes net operating loss carryforwards and tax credits. We expect to maintain this full valuation allowance for the foreseeable future as it is more likely than not that some or all of those deferred tax assets may not be realized based on our history of losses.

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 3829

Table of Contents

Results of Operations

The following tables summarize our unaudited condensed consolidated statements of operations data for the periods presented. The period-to-period comparison of results is not necessarily indicative of results for future periods.

	Three Months Ended October 31,				Nine Months Ended October 31,
			Three Months Ended April 30,
	2025		2024		2025		2024
					2026		2025
	~~(in thousands)~~				(in thousands)
Revenue
Subscription	$	~~336,390~~	$	~~221,511~~	$	~~899~~374,~~008~~153	$	~~585~~265,~~021~~661
Maintenance	1,508		4,342		5,798		15,027
Other					12,915		12,820
Other	12,268		10,325		33,701		28,396
Total revenue					387,068		278,481
Total revenue	350,166		236,178		938,507		628,444
Cost of revenue
Subscription(1)	~~59,842~~		~~46,486~~		~~167~~66,~~778~~723		~~166~~51,~~006~~912
Maintenance(1)	187		824		983		5,473
Other(1)					8,562		8,571
Other(1)	8,108		8,836		23,418		35,814
Total cost of revenue					75,285		60,483
Total cost of revenue	68,137		56,146		192,179		207,293
Gross profit					311,783		217,998
Gross profit	282,029		180,032		746,328		421,151
Operating expenses
Research and development(1)	~~97,581~~		~~80,050~~		~~271~~114,~~503~~341		~~451~~81,~~657~~815
Sales and marketing(1)	~~193,151~~		~~158,907~~		~~545~~193,~~129~~098		~~706~~169,~~163~~993
General and administrative(1)	~~66,780~~		~~65,862~~		~~192~~56,~~733~~978		~~281~~59,~~248~~281
Total operating expenses	~~357,512~~		~~304,819~~		1364,~~009,365~~417		1311,~~439,068~~089
Loss from operations	~~(75,483)~~		~~(124,787)~~		(~~263~~52,~~037~~634)		(193,~~017,917~~091)
Interest income	~~16,591~~		~~7,468~~		3615,~~480~~898		177,~~688~~696
Interest expense	~~(1,080)~~		~~(10,310)~~		(161,~~134~~070)		(319,~~179~~813)
Loss on debt extinguishment	—		—		(6,653)		—
Other income (expense), net					590		(5,622)
Other income (expense), net	(965)		(1,333)		(6,515)		(3,406)
Loss before income taxes					(37,216)		(100,830)
Loss before income taxes	(60,937)		(128,962)		(255,859)		(1,034,814)
Income tax expense					4,637		1,274
Income tax expense	2,892		1,948		6,003		5,117
Net loss					$	(41,853)	$	(102,104)
Net loss	$	(63,829)	$	(130,910)	$	(261,862)	$	(1,039,931)
Net loss per share, basic and diluted					$	(0.21)	$	(0.53)
Net loss per share, basic and diluted	$	(0.32)	$	(0.71)	$	(1.34)	$	(7.27)
Weighted-average shares used in computing net loss per share, basic and diluted					203,668		191,625
Weighted-average shares used in computing net loss per share, basic and diluted	198,379		183,590		195,001		142,985

(1) Includes stock-based compensation expense as follows:

	Three Months Ended October 31,				Nine Months Ended October 31,
			Three Months Ended April 30,
	2025		2024		2025		2024
					2026		2025
	~~(in thousands)~~				(in thousands)
Cost of revenue
Subscription	$	~~4,164~~	$	~~4,684~~	$	124,~~275~~631	$	453,~~358~~968
Maintenance	35		196		193		2,939
Other					634		857
Other	614		1,075		2,021		13,603
Research and development					33,026		19,812
Research and development	29,135		23,088		73,681		275,562
Sales and marketing					16,331		24,144
Sales and marketing	29,818		27,468		83,600		301,611
General and administrative					18,746		24,759
General and administrative	18,701		36,016		72,694		188,802
Total stock-based compensation expense					$	73,368	$	73,540
Total stock-based compensation expense	$	82,467	$	92,527	$	244,464	$	827,875

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 3930

Table of Contents

The following table sets forth our unaudited condensed consolidated statements of operations data expressed as a percentage of revenue for the periods indicated:

	Three Months Ended October 31,				Nine Months Ended October 31,
			Three Months Ended April 30,
	2025		2024		2025		2024
					2026		2025
Revenue
Subscription	96	%	94	%	9697	%	9395	%
Maintenance	—		2		1		2
Other					3		5
Other	4		4		3		5
Total revenue					100		100
Total revenue	100		100		100		100
Cost of revenue
Subscription	17		20		1817		2619
Maintenance	—		1		—		1
Other					2		3
Other	2		3		2		6
Total cost of revenue					19		22
Total cost of revenue	19		24		20		33
Gross profit					81		78
Gross profit	81		76		80		67
Operating expenses
Research and development	28		34		2930		7229
Sales and marketing	56		67		5850		~~112~~61
General and administrative	19		28		2115		4521
Total operating expenses	~~103~~		~~129~~		~~108~~95		~~229~~111
Loss from operations	~~(22)~~		~~(53)~~		(2814)		(~~162~~33)
Interest income	5		3		4		3
Interest expense	—		~~(4)~~		~~(2)~~—		(54)
Loss on debt extinguishment	—		—		(1)		—
Other income (expense), net					—		(2)
Other income (expense), net	—		(1)		(1)		(1)
Loss before income taxes					(10)		(36)
Loss before income taxes	(17)		(55)		(28)		(165)
Income tax expense					1		1
Income tax expense	1		—		—		—
Net loss					(11)	%	(37)	%
Net loss	(18)	%	(55)	%	(28)	%	(165)	%

Comparison of the Three ~~and Nine~~ Months Ended ~~October~~April 3130, ~~2025~~2026 and ~~2024~~2025

Revenue

	Three Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		$ Change		% Change
	2026		2025		$ Change		% Change
	(dollars in thousands)
Revenue
Subscription	$	~~336~~374,~~390~~153	$	~~221~~265,~~511~~661	$	~~114~~108,~~879~~492	5241	%
Maintenance	1,508		4,342		(2,834)		(65)	%
Other	12,915		12,820		95		1	%
Other	12,268		10,325		1,943		19	%
Total revenue	$	387,068	$	278,481	$	108,587	39	%
Total revenue	$	350,166	$	236,178	$	113,988	48	%

	Nine Months Ended October 31,
	2025		2024		$ Change		% Change
	(dollars in thousands)
Revenue
Subscription	$	899,008	$	585,021	$	313,987	54	%
Maintenance	5,798		15,027		(9,229)		(61)	%
Other	33,701		28,396		5,305		19	%
Total revenue	$	938,507	$	628,444	$	310,063	49	%

Growth in subscription revenue for the three months ended April 30, 2026 was driven by growth in Subscription ARR and some benefits as customers exercised or forfeited their Subscription Credits. For the three months ended April 30, 2026, non-recurring revenue related to material rights associated with Subscription Credits accounted for approximately $8.5 million of subscription revenue. We expect our subscription revenue to continue to benefit from customers exercising or forfeiting their Subscription Credits through fiscal 2027, although we expect the benefits to significantly decline sequentially.

~~Rubrik~~Our Subscription ARR grew from $1.18 billion as of April 30, ~~Inc~~2025 to $1.57 Q3billion as of April 30, 2026, ~~Form~~representing 10a 32% increase. Of the increase in Subscription ARR, approximately 0.4 percentage points are a result of transitioning our existing maintenance customers to our subscription editions. A further indication of our ability to expand revenue from existing customers is through our average subscription dollar-Qbased 40net retention rate which was approximately 120% as of April 30, 2026. We had 2,946 customers with $100,000 or more in Subscription ARR as of April 30, 2026, increasing from 2,381 as of April 30, 2025.

Other revenue, which consists primarily of sales of perpetual licenses of our legacy CDM product, Rubrik-branded Appliances and professional services, was relatively flat for the three months ended April 30, 2026. Other revenue represented 3% and 5% of total revenue for the three months ended April 30, 2026 and 2025, respectively. The transition of existing maintenance customers adopting RSC subscription offerings was largely completed in fiscal 2026. We expect our other revenue as a percentage of total revenue to continue to decrease.

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

Growth in subscription revenue for the three and nine months ended October 31, 2025 was driven by growth in Subscription ARR and some benefits as customers exercised or forfeited their Subscription Credits. For the three months ended October 31, 2025, non-recurring revenue related to material rights accounted for approximately $24.6 million in non-recurring revenue. We expect our subscription revenue to continue to benefit from customers exercising or forfeiting their Subscription Credits for the remainder of fiscal 2026, although we expect a sequential decrease in the amount of revenue attributable to material rights. We believe these benefits will decline for the remainder of fiscal 2026. Moreover, we expect these benefits will further decline in fiscal 2027.

Our Subscription ARR grew from $1.00 billion as of October 31, 2024 to $1.35 billion as of October 31, 2025, representing a 34% increase. Of the increase in Subscription ARR, approximately 1.2 percentage points are a result of transitioning our existing maintenance customers to our subscription editions. A further indication of our ability to expand revenue from existing customers is through our average subscription dollar-based net retention rate which was over 120% as of October 31, 2025. We had 2,638 customers with $100,000 or more in Subscription ARR as of October 31, 2025, increasing from 2,085 as of October 31, 2024.

Maintenance revenue associated with sales of perpetual licenses of our legacy CDM product decreased for the three and nine months ended October 31, 2025. Maintenance revenue represented less than 1% and 2% of total revenue for the three months ended October 31, 2025 and 2024, respectively, and 1% and 2% of total revenue for nine months ended October 31, 2025 and 2024, respectively. We expect the transition of existing maintenance customers adopting RSC subscription offerings to be largely completed by the end of fiscal 2026.

Other revenue increased for the three and nine months ended October 31, 2025 due to an increase in professional services. We expect our other revenue as a percentage of total revenue to continue to decrease.

Cost of Revenue

	Three Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		$ Change		% Change
	2026		2025		$ Change		% Change
	(dollars in thousands)
Cost of revenue
Subscription	$	5966,~~842~~723	$	4651,~~486~~912	$	1314,~~356~~811	29	%
Maintenance	187		824		(637)		(77)	%
Other	8,562		8,571		(9)		—	%
Other	8,108		8,836		(728)		(8)	%
Total cost of revenue	$	75,285	$	60,483	$	14,802	24	%
Total cost of revenue	$	68,137	$	56,146	$	11,991	21	%

	Nine Months Ended October 31,
	2025		2024		$ Change		% Change
	(dollars in thousands)
Cost of revenue
Subscription	$	167,778	$	166,006	$	1,772	1	%
Maintenance	983		5,473		(4,490)		(82)	%
Other	23,418		35,814		(12,396)		(35)	%
Total cost of revenue	$	192,179	$	207,293	$	(15,114)	(7)	%

Cost of subscription revenue increased for the three months ended April 30, 2026 primarily driven by an increase of $8.5 million in hosting costs due to the launch and adoption of more SaaS offerings by our customers, an increase of $2.7 million from growth in our customer support organization, an increase of $1.8 million of amortization of acquired technology and an increase of $1.5 million of amortization of capitalized internal-use software.

Cost of subscription revenue increased for the three months ended October 31, 2025 primarily driven by an increase of $8.2 million in hosting cost and an increase of $2.3 million from growth in our customer support organization. Cost of subscription revenue increased for the nine months ended October 31, 2025 primarily driven by an increase of $21.5 million in hosting costs due to the launch and adoption of more SaaS products by our customers, an increase of $8.8 million from growth in our customer support organization, an increase of $3.0 million in amortization of capitalized internal-use software, and an increase of $1.8 million of amortization of acquired technology, partially offset by $33.0 million decrease in stock-based compensation expense as a result of higher RSU expense in the prior period related to the recognition of cumulative stock-based compensation expense upon our IPO.

Cost of maintenance revenue decreased for the three and nine months ended October 31, 2025 primarily driven by a decrease in stock-based compensation expense as a result of higher RSU expense in the prior period related to the recognition of cumulative stock-based compensation expense upon our IPO.

Cost of other revenue decreased for the three and nine months ended October 31, 2025 primarily driven by a $0.5 million and $11.5 million decrease respectively, in stock-based compensation expense, as a result of higher RSU expense in the prior period related to the recognition of cumulative stock-based compensation expense upon our IPO.

Rubrik, Inc. Q3 2026 Form 10-Q 41

Table of Contents

Gross Profit and Gross Margin

	Three Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		$ Change		% Change
	2026		2025		$ Change		% Change
	(dollars in thousands)
Gross profit
Subscription	$	~~276~~307,~~548~~430	$	~~175~~213,~~025~~749	$	~~101~~93,~~523~~681	5844	%
Maintenance	1,321		3,518		(2,197)		(62)	%
Other	4,353		4,249		104		2	%
Other	4,160		1,489		2,671		179	%
Total gross profit	$	311,783	$	217,998	$	93,785	43	%
Total gross profit	$	282,029	$	180,032	$	101,997	57	%

	Nine Months Ended October 31,
			Three Months Ended April 30,
	2025		2024		$ Change			% Change
					2026			2025
	(dollars in thousands)
Gross margin
Gross profit
Subscription					82		%	80	%
Subscription	$	731,230	$	419,015	$	312,215		75	%
Other					34		%	33	%
Maintenance	4,815		9,554		(4,739)			(50)	%
Total gross margin					81		%	78	%
Other	10,283		(7,418)		17,701			(239)	%
Total gross profit	$	746,328	$	421,151	$	325,177		77	%

	Three Months Ended October 31,				Nine Months Ended October 31,
	2025		2024		2025		2024
Gross margin
Subscription	82	%	79	%	81	%	72	%
Maintenance	88	%	81	%	83	%	64	%
Other	34	%	14	%	31	%	(26)	%
Total gross margin	81	%	76	%	80	%	67	%

Subscription gross margin increased for the three months ended April 30, 2026, primarily driven by economies of scale as our subscription revenue base expanded faster than our associated cost of revenue.

Subscription gross margin increased for the three and nine months ended October 31, 2025 as a result of higher RSU expense in the prior periods related to the recognition of cumulative stock-based compensation expense upon our IPO, partially offset by an increase in hosting costs associated with our development and launch of more SaaS products.

Maintenance gross margin increased for the three and nine months ended October 31, 2025 as a result of higher RSU expense in the prior periods related to the recognition of cumulative stock-based compensation expense upon our IPO.

Other gross margin increased for the three and nine months ended October 31, 2025 as a result of higher RSU expense in the prior periods related to the recognition of cumulative stock-based compensation expense upon our IPO.

Operating Expenses

Research and Development

	Three Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		$ Change		% Change
	2026		2025		$ Change		% Change
	(dollars in thousands)
Research and development	$	97114,~~581~~341	$	8081,~~050~~815	$	1732,~~531~~526	2240	%

	Nine Months Ended October 31,
	2025		2024		$ Change		% Change
	(dollars in thousands)
Research and development	$	271,503	$	451,657	$	(180,154)	(40)	%

Research and development expenses increased for the three months ended April 30, 2026 primarily due to an increase of $19.9 million in employee related costs driven by an increase in headcount, of which $13.2 million is an increase in stock-based compensation expense. In addition, hosting and software expenses increased by $9.8 million.

Research and development expenses increased for the three months ended October 31, 2025 primarily driven by an increase of $12.9 million in employee compensation and related expenses. Research and development expenses decreased for the nine months ended October 31, 2025. Employee compensation and related expenses decreased by $188.5 million due to a decrease of $201.9 million in stock-based compensation expense as a result of higher RSU expense in the prior periods related to the recognition of cumulative stock-based compensation expense upon our IPO in April 2024.

Rubrik, Inc. Q3 2026 Form 10-Q 42

Table of Contents

Sales and Marketing

	Three Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		$ Change		% Change
	2026		2025		$ Change		% Change
	(dollars in thousands)
Sales and marketing	$	193,~~151~~098	$	~~158~~169,~~907~~993	$	3423,~~244~~105	2214	%

	Nine Months Ended October 31,
	2025		2024		$ Change		% Change
	(dollars in thousands)
Sales and marketing	$	545,129	$	706,163	$	(161,034)	(23)	%

Sales and marketing expenses increased for the three months ended April 30, 2026 primarily due to an increase of $11.5 million in marketing expense as a result of advertising costs, marketing events and related costs to promote and expand our market presence, and an increase of $7.0 million in employee related costs driven by an increase in headcount.

~~Sales and marketing expenses increased for the three months ended October 31~~Rubrik, ~~2025 primarily driven by an increase of $16~~Inc.9 ~~million~~Q1 in2027 ~~employee~~Form compensation and related expenses. Sales and marketing expenses decreased for the nine months ended October 31, 2025. Employee compensation and related expenses decreased by $189.4 million due to a decrease of $218.0 million in stock10-~~based~~Q ~~compensation expense as a result of higher RSU expense in the prior periods related to the recognition of cumulative stock-based compensation expense upon our IPO in April 2024.~~32

Table of Contents

General and Administrative

	Three Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		$ Change		% Change
	2026		2025		$ Change		% Change
	(dollars in thousands)
General and administrative	$	6656,~~780~~978	$	6559,~~862~~281	$	~~918~~(2,303)	1(4)	%

	Nine Months Ended October 31,
	2025		2024		$ Change		% Change
	(dollars in thousands)
General and administrative	$	192,733	$	281,248	$	(88,515)	(31)	%

General and administrative expenses decreased for the three months ended April 30, 2026 primarily driven by a decrease of $6.0 million in stock-based compensation expense mainly related to performance-based equity awards. The decrease is offset by an increase of $1.5 million in employee related costs driven by an increase in headcount and an increase of $1.3 million in third-party consulting and professional services expenses.

General and administrative expenses increased for the three months ended October 31, 2025 primarily driven by an increase of $11.8 million in charitable donations, partially offset by decrease in employee compensation and related expenses. General and administrative expenses decreased for the nine months ended October 31, 2025. Employee compensation and related expenses decreased by $114.1 million due to a decrease of $116.1 million in stock-based compensation expense as a result of higher RSU expense in the prior periods related to the recognition of cumulative stock-based compensation expense upon our IPO in April 2024.

Other Non-Operating Income (Expense)

Three Months Ended October 31,

Three Months Ended April 30,

2025

2024

$ Change

% Change

2026

2025

$ Change

% Change

(dollars in thousands)

Interest income

1615,~~591~~898

7,~~468~~696

98,~~123~~202

~~122~~107

Interest expense

(1,~~080~~070)

(109,~~310~~813)

98,~~230~~743

(9089)

Other income (expense), net

~~(965)~~590

(15,~~333~~622)

~~368~~6,212

(28110)

	Nine Months Ended October 31,
	2025		2024		$ Change		% Change
	(dollars in thousands)
Interest income	$	36,480	$	17,688	$	18,792	106	%
Interest expense	(16,134)		(31,179)		15,045		(48)	%
Loss on debt extinguishment	(6,653)		—		(6,653)		(100)	%
Other income (expense), net	(6,515)		(3,406)		(3,109)		91	%

Interest income increased for the three months ended April 30, 2026 due to higher cash, cash equivalents, and investment balances.

Interest ~~income~~expense ~~increased~~decreased for the three ~~and nine~~ months ended ~~October~~April 3130, ~~2025~~2026 ~~due~~as toour ~~higher~~2023 ~~cash,~~Amended ~~cash~~Credit ~~equivalents~~Facility with Goldman Sachs BDC, Inc. and ~~investment~~the ~~balances.~~other lenders party thereto was fully repaid in June 2025.

Rubrik, Inc. Q3 2026 Form 10-Q 43

Table of Contents

Interest expense decreased for the three and nine months ended October 31, 2025 as our 2023 Amended Credit Facility was fully repaid in June 2025.

Loss on debt extinguishment increased for the nine months ended October 31, 2025 due to the write-off of unamortized debt discount and issuance costs and prepayment premium paid upon the full repayment of borrowings under our 2023 Amended Credit Facility.

Other income (expense), net includes foreign exchange gains and losses and fluctuations are driven by the strengthening or weakening of the US dollar against foreign currencies on our foreign-denominated intercompany payables.

Income Tax Expense

	Three Months Ended October 31,
	Three Months Ended April 30,
	2025		2024		$ Change		% Change
	2026		2025		$ Change		% Change
	(dollars in thousands)
Income tax expense	$	24,~~892~~637	$	1,~~948~~274	$	~~944~~3,363	48264	%

	Nine Months Ended October 31,
	2025		2024		$ Change		% Change
	(dollars in thousands)
Income tax expense	$	6,003	$	5,117	$	886	17	%

Our income tax expense increased for the three months ended April 30, 2026 due to increased profits in our foreign subsidiaries.

Our income tax expense increased for the three months ended October 31, 2025 due to an increase in our foreign earnings, partially offset by higher tax benefits from stock-based compensation deductions in the UK.

Our income tax expense increased for the nine months ended October 31, 2025 due to a one-time benefit associated with several of our foreign subsidiaries making an election to be treated as U.S. branches for federal income tax purposes effective in fiscal 2024, partially offset by higher tax benefits from stock-based compensation deductions in the UK.

Our effective tax rate may fluctuate significantly and could be adversely affected to the extent that earnings are lower than anticipated in countries that have lower statutory tax rates and higher than anticipated in countries that have higher statutory tax rates. In addition, tax authorities may challenge our transfer pricing policies, resulting in a higher effective tax rate.

Liquidity and Capital Resources

ToAs ~~date~~of April 30, 2026, we ~~have~~had ~~financed~~cash, ~~our~~cash ~~operations~~equivalents, ~~principally~~and ~~through~~short-term ~~proceeds~~investments ~~received~~of ~~from~~$1.75 billion. ~~issuance~~Our ofcash ~~equity~~equivalents and ~~debt~~investments ~~securities~~primarily ~~and~~consist ~~payments~~of ~~received~~money ~~from~~market ~~customers~~funds, certificate of deposit, U.S. Intreasuries, ~~April~~commercial ~~2024~~paper, wecorporate ~~completed~~bonds, and U.S. government agencies securities. We have generated significant operating losses from our ~~IPO~~operations ~~which~~as ~~resulted~~reflected in ~~proceeds~~our ofaccumulated ~~approximately~~deficit of $~~710.~~3.23 ~~million,~~billion ~~net~~as of ~~underwriting~~April 30, ~~discounts and commissions~~2026. InWe ~~May~~expect ~~2024,~~to ~~our~~continue ~~underwriters~~to ~~exercised~~incur ~~their~~operating ~~option~~losses, toand ~~purchase~~our anoperating ~~additional~~cash ~~3,472,252~~flows ~~shares~~may offluctuate ~~our~~between ~~Class~~positive Aand ~~common~~negative ~~stock~~amounts atfor the ~~IPO~~foreseeable ~~Price of $32~~future.00 ~~per~~As ~~share.~~a Weresult, ~~received~~we ~~net~~may ~~proceeds~~require ofadditional ~~approximately~~capital ~~$104.9~~resources ~~million,~~to ~~net~~execute ofstrategic ~~underwriters’~~initiatives ~~discounts~~to ~~and~~grow ~~commissions~~our business.

InOur ~~June~~primary ~~2022,~~sources ~~we entered into a $195.0 million credit facility (the "Prior Credit Facility"), consisting~~ of ~~initial~~cash ~~term~~are ~~loans~~payments inreceived anfrom ~~aggregate~~our ~~principal~~customers ~~amount~~as ofwell ~~$175.0~~as ~~million~~net ~~and~~proceeds ~~delayed~~from ~~draw~~the ~~term~~issuance ~~loan commitments in an aggregate principal amount~~ of ~~$20.0~~our ~~million.~~Convertible ~~The Prior Credit Facility was scheduled to mature in June 2027~~Notes. WeOur ~~borrowed~~primary ~~the~~uses ~~full amount~~ of ~~the~~cash ~~initial~~include ~~term~~personnel-related ~~loans in June 2022~~expenses, ~~the~~third-party ~~proceeds~~cloud ofinfrastructure ~~which~~expenses, ~~were~~sales ~~used~~and ~~for~~marketing ~~general~~expenses, ~~corporate~~overhead ~~purposes~~costs, and ~~subsequently~~strategic ~~drew~~acquisitions ~~approximately~~we ~~$14.5~~may ~~million~~make offrom ~~delayed~~time ~~draw term loans~~ to ~~pay accrued quarterly interest payments under the Prior Credit Facility~~time.

InOur ~~August~~billings ~~2023,~~grow wewith ~~amended~~new ~~and~~business ~~restated~~growth. ~~the~~The ~~Prior~~majority ~~Credit~~of ~~Facility~~our ~~(the~~billings ~~"Amended~~are ~~Credit~~driven ~~Facility"),~~by toinvoicing ~~increase~~our ~~the~~customers ~~total~~for ~~borrowing~~multi-year ~~capacity thereunder to $330~~commitments.0 ~~million~~However, ~~consisting~~this ofmay ~~initial~~evolve ~~term~~as ~~loans~~customers inhave anopted ~~aggregate~~to, ~~principal amount of approximately $289.5 million~~ and ~~delayed~~may ~~draw~~continue ~~term~~to ~~loan~~opt ~~commitments in an aggregate principal amount of approximately $40.5 million. The Amended Credit Facility was scheduled~~ to, ~~mature~~pay inus ~~August~~on ~~2028.~~an Weannual, ~~borrowed~~monthly ~~the~~or ~~full~~consumption ~~amount~~basis ofbased ~~the initial term loans and approximately $4.1 million of delayed draw term loans under the Amended Credit Facility~~ on ~~the~~products ~~closing~~purchased ~~date~~due ofto the ~~Amended~~growth ~~Credit Facility~~ in ~~order~~our toSaaS ~~(i) refinance~~ and ~~replace~~Cloud inproduct ~~full~~offerings. ~~the~~In ~~outstanding~~addition, ~~term~~our ~~loans~~billings ~~under~~are ~~the~~subject ~~Prior~~to ~~Credit Facility~~seasonality, ~~(ii)~~with ~~finance~~billings ~~the~~in ~~consideration for~~ the ~~acquisition~~fourth ofquarter ~~Laminar,~~being ~~and~~substantially ~~(iii)~~higher ~~pay~~than ~~the~~in ~~accrued quarterly interest under~~ the ~~Prior~~other ~~Credit~~three ~~Facility then due~~quarters.

~~In June 2025~~Rubrik, ~~we repaid the outstanding balance of $327~~Inc.9 ~~million~~Q1 ~~under~~2027 ~~the~~Form ~~Amended~~10-Q ~~Credit Facility and terminated the Amended Credit Agreement.~~33

Rubrik, Inc. Q3 2026 Form 10-Q 44

Table of Contents

InWe ~~June~~believe ~~2025,~~that weour ~~completed~~existing acash, ~~private~~cash ~~offering~~equivalents toand ~~qualified~~short-term ~~institutional~~investments ~~buyers~~will ofbe ~~$1.15~~sufficient ~~billion~~to ~~aggregate~~fund ~~principal~~our ~~amount~~operating ~~of 0.00% convertible senior notes due 2030 (the “Convertible Notes" or "Notes"). The Convertible Notes are general unsecured obligations of the Company~~ and ~~will~~capital ~~mature~~needs onfor ~~June 15,~~at ~~2030,~~least ~~unless earlier converted, redeemed or repurchased. Net proceeds from~~ the ~~issuance~~next of12 ~~the Convertible Notes were approximately $1~~months.~~13 billion. The outstanding principal of the Convertible Notes was $1.15 billion as of October 31, 2025.~~

InOur ~~connection~~longer-term ~~with~~future ~~the~~capital ~~Convertible~~requirements ~~Notes~~will depend on many factors, weincluding ~~entered~~our ~~into~~subscription ~~privately~~growth ~~negotiated~~rate, ~~capped~~subscription ~~call~~renewal ~~transactions~~activity, ~~with~~including ~~certain~~the ~~affiliates~~timing and the amount of ~~certain~~cash ~~initial~~received ~~purchasers~~from ofcustomers, the ~~Convertible~~expansion ~~Notes~~of sales and ~~other~~marketing ~~financial~~activities, ~~institutions (~~the ~~“Capped~~timing ~~Calls”)~~and ~~for~~extent aof ~~cost~~spending ofto ~~$88.6~~support ~~million.~~development ~~The~~efforts, ~~Capped~~the ~~Calls~~introduction ~~are~~of ~~expected~~new ~~generally~~and toenhanced ~~reduce~~products, and the ~~potential~~continuing ~~dilution~~market toadoption of our ~~Class~~platform. AWe ~~common~~believe ~~stock~~we ~~upon~~will ~~any~~meet ~~conversion~~longer-term ofexpected ~~the~~future ~~Convertible~~cash ~~Notes~~requirements and~~/or~~ ~~offset~~obligations ~~any~~through a combination of cash ~~payments~~flows wefrom ~~are~~operating ~~required~~activities, toavailable ~~make~~cash inand ~~excess~~short-term ofinvestment ~~the~~balances, ~~principal~~and ~~amount~~potential offuture ~~converted~~debt ~~Convertible~~or ~~Notes,~~equity asfinancings. We may in the ~~case~~future ~~may~~enter ~~be,~~into ~~with~~arrangements ~~such~~to ~~reduction~~acquire ~~and/~~or ~~offset~~invest ~~subject~~in tocomplementary abusinesses, ~~cap~~services, ~~based~~and ontechnologies, ~~the~~including ~~cap~~intellectual ~~price~~property ~~initially~~rights. ~~equal~~We continue to ~~$175.10~~assess ~~per~~our ~~share.~~capital Westructure ~~used~~and aevaluate ~~portion~~the merits of ~~the~~deploying ~~net~~available ~~proceeds~~cash. ~~from~~We ~~the~~may ~~Convertible~~be ~~Notes~~required to ~~pay~~seek ~~the~~additional ~~$88.6~~equity ~~million~~or ~~cost~~debt offinancing. In the ~~Capped~~event ~~Calls~~that ~~and~~additional ~~repay~~financing ~~the~~is ~~outstanding~~required ~~balance~~from ofoutside ~~$327.9~~sources, ~~million~~we ~~under~~may ~~the~~not ~~Amended~~be ~~Credit~~able ~~Facility.~~to Weraise ~~expect~~it on terms acceptable to ~~use~~us ~~the~~or ~~remaining~~at ~~net~~all. ~~proceeds~~If ~~from~~we ~~the~~are ~~Convertible~~unable ~~Notes~~to ~~for~~raise ~~general~~additional ~~corporate~~capital ~~purposes~~when desired, ~~which~~or ~~may~~if ~~include~~we ~~acquisitions~~cannot expand our operations or ~~strategic~~otherwise ~~investments~~capitalize inon ~~complementary~~our ~~businesses~~business oropportunities ~~technologies,~~because ~~working~~we lack sufficient capital, ~~operating~~our ~~expenses~~business, financial condition, and ~~capital~~operating ~~expenditures~~results would be adversely affected.

InConvertible ~~July~~Senior 2025, we acquired all outstanding stock of Predibase, a developer platform. We accounted for this transaction as a business combination. The acquisition date fair value of the purchase consideration was $109.1 million, of which $14.5 million was in cash and the remainder in common stock. The acquisition of Predibase is to help us accelerate our agentic AI adoption from pilot to production at scale. Notes

In ~~October~~June 2025, we completed ~~two~~a ~~immaterial~~private ~~acquisitions~~offering ~~for~~to ~~aggregate~~qualified ~~purchase~~institutional ~~consideration~~buyers of $111.15 billion aggregate principal amount of 0.00% ~~million~~convertible senior notes due 2030. The Convertible Notes are general unsecured obligations of the Company and ~~accounted~~will ~~for~~mature ~~them~~on asJune 15, ~~business~~2030, ~~combinations~~unless earlier converted, redeemed or repurchased. AnNet ~~aggregate~~proceeds from the issuance of the Convertible Notes were approximately $91.913 ~~million~~billion. ~~was~~The ~~paid~~outstanding inprincipal ~~cash~~of on the ~~respective~~Convertible ~~acquisition~~Notes ~~dates~~was $1.15 billion as of April 30, 2026.

~~Our~~In ~~billings~~connection ~~grow~~ with ~~new~~the ~~business~~Convertible ~~growth.~~Notes, ~~The~~we ~~majority~~entered ofinto ~~our~~privately ~~billings~~negotiated ~~are~~capped ~~driven~~call bytransactions ~~invoicing~~with ~~our~~certain ~~customers~~affiliates ~~for~~of ~~multi-year~~certain ~~commitments.~~initial ~~However,~~purchasers ~~this~~of ~~may~~the ~~evolve~~Convertible asNotes ~~customers have opted to,~~ and ~~may~~other ~~continue~~financial toinstitutions ~~opt~~(the ~~to,~~“Capped ~~pay~~Calls”) usfor ona ancost ~~annual~~of or$88.6 ~~consumption~~million. ~~basis~~The ~~based~~Capped onCalls ~~products~~are ~~purchased~~expected ~~due~~generally to reduce the ~~growth~~potential indilution to our ~~SaaS~~Class ~~product~~A ~~offerings.~~common Instock ~~addition,~~upon ~~our~~any ~~billings~~conversion ~~are~~of ~~subject~~the toConvertible ~~seasonality,~~Notes ~~with~~and/or ~~billings~~offset inany ~~the~~cash ~~fourth~~payments ~~quarter~~we ~~being~~are ~~substantially~~required ~~higher~~to ~~than~~make in ~~the~~excess ~~other~~of ~~three~~the ~~quarters.~~principal Asamount of ~~October 31,~~converted ~~2025~~Convertible Notes, weas ~~had~~the ~~cash,~~case ~~cash~~may ~~equivalents~~be, ~~and~~with ~~short-term~~such ~~investments~~reduction ~~of $1.60 billion. Our cash equivalents~~ and/or ~~investments~~offset ~~primarily~~subject ~~consist~~to ofa ~~money~~cap ~~market~~based ~~funds,~~on ~~certificate~~the ofcap ~~deposit,~~price ~~U.S.~~initially ~~treasuries,~~equal ~~commercial~~to ~~paper, corporate bonds, and U~~$175.S.10 ~~government~~per ~~agencies securities~~share. We ~~have~~used ~~generated~~a ~~significant~~portion ~~operating~~of ~~losses~~the ~~from~~net ~~our~~proceeds ~~operations~~from asthe ~~reflected~~Convertible inNotes ~~our~~to ~~accumulated~~pay ~~deficit~~the of $388.~~10 billion~~6 asmillion cost of ~~October 31,~~the ~~2025.~~Capped WeCalls ~~expect~~and torepaid ~~continue~~the tooutstanding ~~incur~~balance ~~operating~~of ~~losses,~~$327.9 ~~and~~million under our ~~operating~~prior ~~cash~~credit ~~flows~~facility. ~~may~~We ~~fluctuate~~expect ~~between~~to ~~positive~~use ~~and negative amounts for~~ the ~~foreseeable~~remaining ~~future~~net ~~due~~proceeds tofrom the ~~investments~~Convertible weNotes ~~intend~~for togeneral ~~make~~corporate aspurposes, ~~described~~which ~~above.~~may Asinclude aacquisitions ~~result,~~or westrategic ~~may~~investments ~~require~~in ~~additional~~complementary ~~capital~~businesses ~~resources~~or totechnologies, ~~execute~~working ~~strategic~~capital, ~~initiatives~~operating toexpenses ~~grow~~and ~~our~~capital ~~business~~expenditures.

We believe that our existing cash and cash equivalents will be sufficient to fund our operating and capital needs for at least the next 12 months.

Our longer-term future capital requirements will depend on many factors, including our subscription growth rate, subscription renewal activity, including the timing and the amount of cash received from customers, the expansion of sales and marketing activities, the timing and extent of spending to support development efforts, the introduction of new and enhanced products, and the continuing market adoption of our platform. We believe we will meet longer-term expected future cash requirements and obligations through a combination of cash flows from operating activities, available cash and long-term investment balances, and potential future debt or equity financings. We may in the future enter into arrangements to acquire or invest in complementary businesses, services, and technologies, including intellectual property rights. We continue to assess our capital structure and evaluate the merits of deploying available cash. We may be required to seek additional equity or debt financing. In the event that additional financing is required from outside sources, we may not be able to raise it on terms acceptable to us or at all. If we are unable to raise additional capital when desired, or if we cannot expand our operations or otherwise capitalize on our business opportunities because we lack sufficient capital, our business, financial condition, and operating results would be adversely affected.

The following table summarizes our cash flows for the periods presented:

	Nine Months Ended October 31,
	Three Months Ended April 30,
	2025		2024
	2026		2025
	(in thousands)
Net cash provided by (used in) operating activities	$	189,863	$	(35,369)
Net cash provided by operating activities	$	81,689	$	39,655
Net cash used in investing activities	$	(811,472)	$	(387,600)
Net cash (used in) provided by investing activities	$	(36,183)	$	34,165
Net cash provided by financing activities	$	~~736~~17,~~012~~215	$	~~396~~15,~~100~~341

Rubrik, Inc. Q3 2026 Form 10-Q 45

Table of Contents

Operating Activities

Our largest source of operating cash is payments received from our customers. We typically invoice our customers in advance for multi-year contracts. Therefore, a substantial source of our cash is from such prepayments, which are included on our unaudited condensed consolidated balance sheets in deferred revenue. We generally experience seasonality based on when we enter into agreements with our customers. Given the seasonality in our business, the operating cash flow benefit from increased collections from our customers generally occurs in the subsequent quarter after billing. We expect seasonality, timing of billings, billings terms, and collections from our customers to have a material impact on our cash flow from operating activities from period to period. Our primary uses of cash in operating activities are for employee compensation and related expenses, sales commissions, fees for third-party professional services, colocation and hosting costs, marketing programs, and ~~discretionary~~prepayments ~~cash payments~~ of ~~our~~other ~~debt~~spend, ~~interest~~including ~~expense~~hosting ~~pursuant to the terms of our Amended Credit Facility and~~ prepayments ~~of other spend~~. Our cash flow from operating activities may fluctuate due to the timing of cash payments received from our customers and payments relative to expenses.

For the ~~nine~~three months ended ~~October~~April 3130, ~~2025~~2026, net cash provided by operating activities of $~~189~~81.97 million resulted primarily from a net loss of $~~261~~41.9 million, partially offset by $~~244~~73.54 million of stock-based compensation, $7929.3 million of amortization of deferred commissions, $2612.41 million for depreciation and amortization, ~~$6.7 million of loss on debt extinguishment,~~ and $936.74 million of net cash inflow from changes in operating assets and liabilities. The net cash inflow from changes in operating assets and liabilities was primarily the result of a $~~267~~57.04 million ~~increase~~decrease in ~~deferred~~accounts ~~revenue from increased billings~~receivable, ~~and~~ a $1743.1 million increase in ~~accrued expenses and other liabilities. The cash inflow was partially offset by a $89.4 million increase in~~ deferred ~~commissions,~~revenue afrom ~~$42.7~~increased ~~million increase in accounts receivable~~billings, and a $5913.78 million ~~increase~~decrease in prepaid expenses and other assets. The increase in prepaid expenses and other assets includes $77.0 million prepayment, of which $47.2 million is incremental year over year, made during the three months ended October 31, 2025 for our hosting costs that are related to the launch and adoption of more SaaS products by our customers.

~~For the nine months ended October 31~~Rubrik, ~~2024, net cash used in operating activities of $35~~Inc.4 ~~million~~Q1 ~~resulted~~2027 ~~primarily~~Form ~~from a net loss of $1,039.9 million, partially offset by $827.9 million of stock~~10-~~based~~Q compensation, $66.4 million of amortization of deferred commissions, $29.1 million for non-cash interest related to debt, $21.5 million for depreciation and amortization, and $62.8 million of net cash inflow from changes in operating assets and liabilities. The net cash inflow from changes in operating assets and liabilities was primarily the result of a $177.0 million increase in deferred revenue from increased billings and a $3.9 million increase in accounts payable. The cash inflow was partially offset by a $90.4 million increase in deferred commissions, a $14.3 million increase in prepaid expense and other assets and a $14.3 million increase in accounts receivable.34

Table of Contents

other assets. The cash inflow was partially offset by a $80.4 million decrease in accrued expenses and other liabilities, and a $26.6 million increase in deferred commissions.

For the three months ended April 30, 2025, net cash provided by operating activities of $39.7 million resulted primarily from a net loss of $102.1 million, partially offset by $73.5 million of stock-based compensation, $24.8 million of amortization of deferred commissions, $8.1 million for depreciation and amortization, and $35.1 million of net cash inflow from changes in operating assets and liabilities. The net cash inflow from changes in operating assets and liabilities was primarily the result of a $89.7 million increase in deferred revenue from increased billings and a $12.0 million decrease in accounts receivable. The cash inflow was partially offset by a $36.8 million decrease in accrued expenses and other current liabilities, a $21.4 million increase in deferred commissions, and a $7.8 million increase in prepaid expense and other assets.

Investing Activities

For the ~~nine~~three months ended ~~October~~April 3130, ~~2025~~2026, net cash used in investing activities of $~~811~~36.52 million resulted from $1292.290 ~~billion~~million in purchases of investments, $203.98 million ~~paid for acquisitions, $11.0 million~~ in capitalized internal-use software, and $114.13 million in purchases of property and equipment, partially offset by $~~520~~263.9 million in proceeds from maturities of investments.

For the ~~nine~~three months ended ~~October~~April 3130, ~~2024~~2025, net cash ~~used~~provided inby investing activities of $~~387~~34.62 million resulted from $~~641~~162.36 million in ~~purchases~~proceeds from maturities and sales of investments, partially offset by $11120.32 million in purchases of ~~property and equipment~~investments, ~~and~~ $63.95 million in capitalized internal-use software, ~~offset~~and by $~~271~~2.98 million in ~~proceeds~~purchases ~~from~~of ~~maturities~~property and ~~sales of investments~~equipment.

Financing Activities

For the ~~nine~~three months ended ~~October~~April 3130, ~~2025~~2026, net cash provided by financing activities of $~~736~~17.02 million resulted primarily from $~~800~~16.26 million in proceeds from issuance of ~~the Convertible Notes, net of full repayment of our 2023 Amended Credit Facility, $29.0 million in proceeds from issuance of~~ common stock under employee stock purchase plan and $30.6 million from the exercise of stock options~~, partially offset by $88~~.~~6 million paid to purchase Capped Calls and $6.3 million in taxes paid related to net share settlement of equity awards.~~

For the ~~nine~~three months ended ~~October~~April 3130, ~~2024~~2025, net cash provided by financing activities of $~~396~~15.13 million resulted ~~primarily~~ from $~~815~~13.25 million in proceeds from ~~our IPO and underwriters' exercise of over-allotment option, net of underwriting discounts and commissions, $11.1 million in proceeds from~~ issuance of common stock under employee stock purchase plan, and $61.68 million from the exercise of stock options~~, partially offset by $432~~.~~5 million in taxes paid related to the net share settlement of equity awards that vested upon our IPO, and $3.5 million for payment of deferred offering costs.~~

Rubrik, Inc. Q3 2026 Form 10-Q 46

Table of Contents

Material Cash Requirements

Our material cash requirements primarily consist of operating lease commitments for our offices and data centers, non-cancelable purchase commitments related to third-party cloud hosting services, and long-term debt. Except as already disclosed in Note 7~~. Leases~~, ~~Note 8.~~ Debt and Note 9.8, Commitments and Contingencies in our unaudited condensed consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q, there has been no other material change in our material cash requirements other than in the ordinary course of business since our fiscal year ended January 31, ~~2025~~2026. See our Annual Report for additional information regarding our contractual obligations.

In June 2025, we amended an existing hosting service contract with a third party. The amendment extended the original contract term by approximately two years to April 2029, which resulted in an increase of $375.0 million in minimum spending amount. As of October 31, 2025, we had $336.3 million remaining on this commitment.

Critical Accounting Policies and Estimates

~~Our~~Refer ~~unaudited~~to ~~condensed~~Part ~~consolidated~~II, ~~financial~~Item ~~statements~~7, ~~and~~“Critical ~~related~~Accounting ~~notes~~Policies ~~thereto~~and ~~included~~Estimates” ~~elsewhere~~of inour ~~this~~Annual ~~Quarterly~~ Report on Form 10-QK ~~are~~for ~~prepared in accordance with GAAP. The preparation of these unaudited condensed consolidated financial statements requires us to make estimates and assumptions that affect~~ the ~~reported~~fiscal ~~amounts~~year ofended ~~assets,~~January ~~liabilities~~31, ~~revenue,~~2026. ~~and~~There ~~expenses~~have asbeen ~~well~~no asmaterial ~~related~~changes ~~disclosures.~~to ~~We evaluate~~ our ~~estimates~~Critical ~~and~~Accounting ~~assumptions~~Policies ~~on an ongoing basis. Our estimates are based on historical experience~~ and ~~various other assumptions that we believe to be reasonable under the circumstances~~Estimates. ~~Our actual results could differ from these estimates.~~

There have been no material changes to our critical accounting policies and estimates as compared to the critical accounting policies and estimates discussed in our Annual Report.

Recently Issued Accounting Pronouncements

See Note 2, Basis of Presentation and Summary of Significant Accounting Policies, in the notes to our unaudited condensed consolidated financial statements included in Part I, Item I of this Quarterly Report on Form 10-Q for a discussion of recent accounting pronouncements.

~~JOBS~~Rubrik, ~~Act~~Inc. ~~Accounting~~Q1 ~~Election~~2027 Form 10-Q 35

We are an emerging growth company, as defined in the JOBS Act. The JOBS Act provides that an emerging growth company can take advantage of an extended transition period for complying with new or revised accounting standards. This provision allows an emerging growth company to delay the adoption of some accounting standards until those standards would otherwise apply to private companies. We have elected to use the extended transition period under the JOBS Act for the adoption of certain accounting standards until the earlier of the date we (i) are no longer an emerging growth company or (ii) affirmatively and irrevocably opt out of the extended transition period provided in the JOBS Act. As a result, our unaudited condensed consolidated financial statements may not be comparable to companies that comply with new or revised accounting pronouncements as of public company effective dates. Based on the market value of our Class A common stock held by non-affiliates as of July 31, 2025, we will cease to qualify as an emerging growth company, effective as of January 31, 2026.

Rubrik, Inc. Q3 2026 Form 10-Q 47

Table of Contents

Item 3. Quantitative and Qualitative Disclosures About Market Risk

We have operations in the United States and internationally, and we are exposed to market risk in the ordinary course of our business.

Interest Rate Risk

As of ~~October~~April 3130, ~~2025~~2026, we had cash, cash equivalents, and short-term investments of $1.6075 billion and restricted cash of $716.46 million. Our cash, cash equivalents, and short-term investments are held for working capital purposes. We do not enter into investments for trading or speculative purposes. Our investments are exposed to market risk due to fluctuations in interest rates, which may affect our interest income. A hypothetical 1% increase or decrease in interest rates would not have a material effect on the fair market value of our portfolio.

In June 2025, we issued $1.15 billion aggregate principal amount of Convertible Notes in a private offering to qualified institutional buyers. The fair value of the Convertible Notes is subject to market risk and other factors due to the conversion feature. The fair value of the Convertible Notes generally increases as our Class A common stock price increases, and generally decreases as our Class A common stock price declines. The market value changes affect the fair value of the Convertible Notes, but do not impact our financial position, cash flows or results of operations due to the fixed nature of the debt obligation.

Foreign Currency Risk

Our reporting currency is the U.S. dollar and the functional currency for all of our foreign subsidiaries are the respective local currencies. All of our sales contracts are denominated in U.S. dollars. A portion of our operating expenses are incurred outside of the United States, denominated in foreign currencies, and subject to fluctuations due to changes in foreign currency exchange rates. Our unaudited condensed consolidated results of operations and cash flows are, therefore, subject to fluctuations due to changes in foreign currency exchange rates and may be adversely affected in the future due to changes in foreign exchange rates. To date, we have not entered into any hedging arrangements with respect to foreign currency risk or other derivative financial instruments, although we may choose to do so in the future. We do not believe a 10% increase or decrease in the relative value of the U.S. dollar would have a material impact on our results of operations.

Item 4. Controls and Procedures

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of our disclosure controls and procedures as of the end of the period covered by this Quarterly Report on Form 10-Q. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Securities Exchange Act of 1934, as amended (the "“Exchange Act"”), means controls and other procedures of a company that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to provide reasonable assurance that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure. Based on such evaluation, our Chief Executive Officer and Chief Financial Officer concluded that, as of the end of the period covered by this Quarterly Report on Form 10-Q, our disclosure controls and procedures were effective at the reasonable assurance level.

Changes in Internal Control over Financial Reporting

There were no changes in our internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the period covered by this Quarterly Report on Form 10-Q that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 4836

Table of Contents

Inherent Limitations on Effectiveness of Controls

Our management, including our Chief Executive Officer and Chief Financial Officer, believes that our disclosure controls and procedures and internal control over financial reporting are designed to provide reasonable assurance of achieving their objectives and are effective at the reasonable assurance level. However, management does not expect that our disclosure controls and procedures or our internal control over financial reporting will prevent or detect all errors and all fraud. A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within the company have been detected. The design of any system of controls also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Over time, controls may become inadequate because of changes in conditions, or the degree of compliance with the policies or procedures may deteriorate. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected.

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 4937

Table of Contents

PART II. OTHER INFORMATION

Item 1. Legal Proceedings

From time to time, we are involved in various legal proceedings arising from activities in the normal course of business. We are not presently a party to any litigation the outcome of which, we believe, if determined adversely to us, would individually or taken together have a material adverse effect on our business, financial condition, results of operations, and cash flows. Defending any legal proceedings is costly and can impose a significant burden on management and employees. The results of any current or future litigation cannot be predicted with certainty, and regardless of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources, and other factors.

Item 1A. Risk Factors

Investing in our Class A common stock involves various risks, including those described below. You should consider and read carefully all of the risks and uncertainties described below, together with all of the other information contained in this Quarterly Report on Form 10-Q, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our unaudited condensed consolidated financial statements and related notes, before making an investment decision. The risks described below are not the only ones we face. The occurrence of any of the following risks or additional risks and uncertainties not presently known to us or that we currently believe to be immaterial could materially and adversely affect our business, financial condition, or results of operations. In such case, the trading price of our Class A common stock could decline, and you may lose some or all of your original investment.

Risks Related to Our Business

Our recent rapid growth may not be indicative of our future growth. Our rapid growth also makes it difficult to evaluate our future prospects.

Our revenue was $~~938~~387.51 million and $~~628~~278.45 million for the ~~nine~~three months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024~~2025, respectively. You should not rely on the revenue growth of any prior ~~quarterly or annual~~ period as an indication of our future performance. Even if our revenue continues to increase, we expect that our revenue growth rate will fluctuate in the future as a result of a variety of factors,. ~~including~~While we have largely completed both the sales of Rubrik-branded Appliances transitioning from us to our contract manufacturers in fiscal 2025 and the transition for new and existing customers to sales of ~~Rubrik~~RSC ~~Security~~in ~~Cloud~~fiscal 2026, we expect our subscription revenue to continue to benefit from customers exercising or forfeiting their Subscription Credits (~~"RSC"~~which are customer options that are accounted for as material rights) through fiscal 2027, ~~for~~although ~~which~~we anexpect ~~increasing~~the ~~amount~~benefits ofto significantly reduce sequentially. These business transitions cause fluctuations to our ~~software~~total revenue ~~will~~growth beand ~~recognized~~limit ~~ratably~~the comparability of our revenue with past performance.

Overall growth of our revenue also depends on a number of factors, including our ability to:

•expand the features and functionality of our data security products as well as increase the amount of data sources protected across enterprise, cloud, SaaS, unstructured data, and identity providers;

•securely deploy generative AI while delivering exceptional accuracy and efficiency using agentic applications;

•extend our product leadership to expand our addressable market;

•differentiate our ~~data security~~ products from ~~products~~those offered by others;

•successfully develop a substantial sales pipeline for our products;

•hire sufficient sales personnel to support our growth and reduce the time for such personnel to achieve desired productivity levels;

•attract new customers and expand sales to our existing customers, including by effectively marketing and pricing our data security products and successfully transitioning existing customers to RSC;

•increase awareness of our brand on a global basis as a data security company to successfully compete with other companies;

•provide our customers with support that meets their needs;

•effectively leverage and expand our partner ecosystem;

•navigate macroeconomic headwinds, including those related to inflation, tariffs, and geopolitical conditions, as well as supply chain constraints affecting the availability and pricing of compatible commodity servers needed to deploy our solutions;

•protect against security incidents;

•successfully protect our intellectual property in the United States and other jurisdictions; and

•expand to new international markets and grow within existing markets.

~~We may not successfully accomplish any of these objectives~~Rubrik, ~~and as a result, it is difficult for us to forecast our future results of operations~~Inc. IfQ1 ~~the~~2027 ~~assumptions~~Form ~~that~~10-Q we use to plan our business are incorrect or if we are unable to maintain consistent revenue or revenue growth, our stock price could be volatile and we may not be able to achieve and maintain profitability. You should not rely on our revenue for any prior quarterly or annual periods as any indication of our future revenue or revenue growth.38

Rubrik, Inc. Q3 2026 Form 10-Q 50

Table of Contents

We may not successfully accomplish any of these objectives, and as a result, it is difficult for us to forecast our future results of operations. If the assumptions that we use to plan our business are incorrect or if we are unable to maintain consistent revenue or revenue growth, our stock price could be volatile and we may not be able to achieve and maintain profitability.

In addition, we expect to continue to expend substantial financial and other resources on:

•expansion and enablement of our sales, services, and marketing organizations to increase brand awareness and drive adoption of our solutions;

•product development, including investments in our product development team and the development of new products, new features, and functionality for our platform and products;

•our cloud infrastructure technology, including systems architecture, scalability, availability, performance, and security;

•our use and development of AI technologies and tools;

•our partner ecosystem;

•international expansion;

•acquisitions or strategic investments;

•our information security program; and

•general administration, including increased legal, human resources, and accounting expenses associated with being a public company.

These investments may not result in increased revenue for our business. If we are unable to maintain or increase our revenue at a rate sufficient to offset the expected increase in our costs, our business, financial condition, and results of operations will be harmed, and we may not be able to achieve or maintain profitability. Additionally, we may encounter unforeseen operating expenses, difficulties, complications, delays, decreased revenue growth associated with general macroeconomic and market conditions, volatility, or disruptions (including the effect of those events on our customers) and other unknown factors that may result in losses in future periods. If our revenue does not meet our expectations in future periods, our business, financial condition, and results of operations may be harmed.

If the market for data security and AI solutions does not grow, our ability to grow our business and our results of operations may be adversely affected.

We believe our future success will depend in large part on the growth, if any, in the market for data security and AI solutions. Traditionally, the cybersecurity industry has been focused on securing information technology infrastructure to prevent, detect, and investigate cyberattacks. Our platform brings a new approach to cybersecurity, which involves protecting our customers’ data across enterprise, cloud, SaaS, unstructured data, and identity providers, observing the data itself to proactively identify emergent threats, remediating data security threats, and recovering protected data following a cybersecurity event, as well as helping customers manage risks associated with AI agents. The market for data security and AI solutions, such as our platform and data security products, is at an early stage and rapidly evolving. As such, it is difficult to predict this market’s potential growth, if any, customer adoption and retention rates, customer demand for data security platforms, or the success of competitive products. In the past, customer adoption of our platform and data security products has been driven by the need for data resilience due to increasing ransomware activity. We do not know whether the trends of increasing ransomware activity, or of increasing adoption of our platform and data security products such as ours that we have experienced in the past, will continue in the future. Any expansion in this market depends on a number of factors, including the cost, performance, and perceived value associated with our platform and data security products and similar solutions of our competitors, including preference to manage security with existing infrastructure security tools alone, rather than investing in a platform based ~~data security~~ solution. The markets for some of our solutions are new, unproven, and evolving, and our future success depends on growth and expansion of these markets. If our platform and data security products do not achieve widespread adoption or there is a reduction in demand for our platform and data security products due to a lack of customer acceptance, technological challenges, competing products or solutions, privacy concerns, decreases in corporate spending, weakening economic conditions, or otherwise, it could result in early terminations, reduced customer retention rates, or decreased revenue, any of which would adversely affect our business, financial condition, and results of operations. You should consider our business and growth prospects in light of the risks and difficulties we encounter in this new and evolving market.

We have a limited operating history, particularly with respect to our ~~offering~~offerings of RSC and RAC, which makes it difficult to forecast our future results of operations.

Although we were founded in December 2013, we only began offering our products and services in the fiscal year ended January 31, 2016, and we began offering RSC as a cloud native SaaS solution in fiscal 2023 and introduced the RAC suite in fiscal 2026. As a result of our limited operating history, our ability to accurately forecast our future results of operations is limited and subject to a number of uncertainties, including our ability to plan for and forecast future growth. Our historical revenue growth should not be considered indicative of our future performance. Further, in future periods, we expect our revenue growth to fluctuate, slow, and possibly decline for a number of reasons, including mix shifts in our platform and data security products, as well as the impact on our revenue recognition resulting from our transition from selling our products primarily on the basis of subscription term-based licenses to SaaS subscriptions. The timing for this transition and related implications on our revenue recognition and trends will depend on our ability to complete the transition of existing customers to RSC in

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 5139

Table of Contents

aof ~~timely~~uncertainties, ~~manner.~~including Weour ~~implemented~~ability ~~certain initiatives~~ to ~~accelerate~~plan ~~our~~for ~~existing~~and ~~customers’~~forecast ~~migration~~future togrowth. ~~RSC~~Our ashistorical ~~part~~revenue ofgrowth ~~our~~should ~~business~~not ~~transition~~be toconsidered ~~SaaS,~~indicative ~~including enforcement~~ of ~~migration~~our ~~deadlines~~future performance. ~~These~~In ~~initiatives~~future ~~may have been~~periods, ~~or continue to be, perceived negatively by~~ our ~~customers.~~revenue ~~For~~growth ~~example~~may fluctuate, ~~these~~slow ~~initiatives~~or ~~may~~decline ~~require~~due ~~customers~~ to ~~prioritize~~a ~~preparation~~number ~~for~~of ~~their migration over other organizational needs~~factors, ~~potentially~~including ~~resulting~~changes in ~~diversion~~product ~~of resources~~mix. ~~For~~While ~~certain~~we ~~existing~~have ~~customers,~~largely ~~the~~completed ~~perceived~~both ~~benefits from undertaking~~ the ~~migration~~transition ~~may~~of besales ~~outweighed~~of byRubrik-branded ~~the~~Appliances ~~anticipated~~from ~~time~~us ~~and effort required~~ to ~~prepare~~our ~~for~~contract ~~and~~manufacturers ~~execute the migration, resulting~~ in ~~potential~~fiscal ~~delays~~2025 inand ~~customers’~~the transition tofor ~~RSC.~~new Weand ~~expect~~existing ~~these~~ customers ~~may~~to ~~consume~~sales ~~our platform and products through a mix~~ of RSC ~~and~~in afiscal ~~transitional license for Cloud Data Management ("RCDM-T")~~2026, ~~for~~we anexpect ~~extended~~our ~~period~~subscription ~~of time, resulting in the continued recognition of a portion of the associated~~ revenue ~~for~~to ~~some~~continue ofto ~~these~~benefit from customers ~~upfront~~exercising ator ~~the~~forfeiting ~~time~~their weSubscription ~~transfer~~Credits ~~control~~(which ofare ~~the license to the~~ customer. ~~Conversely,~~options ifthat ~~some~~are ofaccounted ~~these~~for ~~customers~~as ~~complete~~material ~~their~~rights) ~~transition~~through tofiscal ~~RSC~~2027, ~~sooner~~although ~~than~~ we expect, ~~less~~the ~~revenue~~benefits ~~would~~to besignificantly ~~recognized~~reduce ~~upfront~~sequentially. ~~during~~These ~~this~~business ~~period,~~transitions ~~which could~~ cause ~~our~~fluctuations ~~revenue~~ to ~~be lower than~~ our ~~estimates~~total ~~or forecasts or even result in a decrease in our~~ revenue growth ~~rates.~~and ~~Any~~limit ofthe ~~these~~comparability ~~factors~~of ~~could result in continued fluctuations in~~ our revenue ~~growth~~with ~~and~~past ~~adversely impact our ability to accurately predict our future revenue~~performance.

In addition, we operate in a new market for data security and AI solutions, and as such we have encountered, and will continue to encounter, risks and uncertainties frequently experienced by growing companies in new and rapidly changing markets, such as the risks and uncertainties described throughout this section. Further, our business and growth strategies are also dependent on continued development, and implementation and integration of our AI offerings and initiatives, including ~~Rubrik Agent Cloud~~RAC, which is designed to accelerate enterprise AI agent deployments. While we have invested significantly in our AI offerings and initiatives and intend to continue doing so in the future, AI technology is expected to continue to rapidly advance. We may not be successful in obtaining and maintaining market acceptance of our AI offerings and initiatives, including ~~Rubrik Agent Cloud~~RAC, particularly as competitive technologies and solutions are introduced. Any of these outcomes could harm our business, results of operations, and financial condition.

Moreover, in future periods, our revenue growth could slow or decline due to slowing demand for our platform or data security products, increasing competition, decreased productivity of our sales and marketing organization, failure to retain existing customers or expand existing subscriptions, changing technology, a decrease in the growth of our overall market, evolving macroeconomic conditions, such as high inflation and recessionary environments, or our failure, for any reason, to continue to take advantage of growth opportunities. If our assumptions regarding these risks and uncertainties and our future revenue growth are incorrect or change, or if we do not address these risks successfully, our financial condition and results of operations could differ materially from our expectations, and our business could suffer.

If we are unable to attract new customers, our future results of operations could be harmed.

To expand our customer base, we need to convince organizations to allocate a portion of their discretionary budgets to purchase our platform and ~~data security~~ products. Our sales efforts often involve educating organizations about the uses and benefits of our data security and AI solutions. We may have difficulty convincing organizations of the value of adopting our ~~data security~~ solutions. Even if we are successful in convincing organizations that a platform like ours is critical to secure their data, they may not decide to purchase our ~~data security~~ solutions for a variety of reasons, some of which are out of our control. For example, any deterioration in general economic conditions has in the past caused, and may in the future cause, our current and prospective customers to delay or cut their overall security and IT operations spending. Macroeconomic concerns, customer financial difficulties, and constrained spending on security and IT operations may result in decreased revenue and adversely affect our financial condition and results of operations. In particular, uncertainty related to ~~recent~~geopolitical ~~global~~conditions, ~~tariffs~~supply chain issues, and trade tensions may impact customer adoption and use of our offerings and revenue from sales of our products and services. Additionally, if the incidence of cyberattacks were to decline, or enterprises or governments perceive that the general level of cyberattacks has declined, our ability to attract new customers could be adversely affected. We may face additional difficulties in attracting organizations that use legacy data management products to purchase our data security products if they believe that these legacy products are more cost-effective or provide a level of IT security that is sufficient to meet their needs. Furthermore, the use of our data security products to manage data security, movement, and restoration across data centers is relatively new, and if we are unable to convince organizations of the benefits of our ~~data security~~ products, then our business, financial condition, and results of operations could be adversely impacted.

We have a history of operating losses and may not achieve or sustain profitability in the future.

We have experienced net losses in each period since inception. We generated net losses of $(~~261~~41.9) million and $(1102.041) ~~billion~~million for the ~~nine~~three months ended ~~October~~April 3130, ~~2025~~2026 and ~~2024~~2025, respectively. As of ~~October~~April 30, 2026 and January 31, ~~2025~~2026, we had an accumulated deficit of $(3.1023) billion and $(3.19) billion, respectively. While we have experienced rapid revenue growth in recent periods, we are not certain whether or when we will obtain a high enough volume of sales to achieve or maintain profitability in the future. In particular, as we expand the availability of our platform, increase our ability to secure data across multiple different sources, and add more capabilities, our ability to achieve and maintain profitability will be highly dependent on our ability to successfully market our platform and data security products to new and existing customers. We also expect our costs and expenses to increase in future periods, which could negatively affect our future results of operations if our revenue does not increase. In particular, we intend to continue to expend significant funds to further develop our offerings, including by introducing new features and functionality and securing additional applications, and to expand our sales, marketing, and services teams to drive new customer adoption, expand the use of our data security products by existing customers, support international expansion, and implement additional systems and processes to

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 5240

Table of Contents

does not increase. In particular, we intend to continue to expend significant funds to further develop our data security products, including by introducing new features and functionality and securing additional applications, and to expand our sales, marketing, and services teams to drive new customer adoption, expand the use of our data security products by existing customers, support international expansion, and implement additional systems and processes to effectively scale operations. We will also face increased compliance costs associated with growth, the planned expansion of our customer base and pipeline, international expansion, and being a public company. In addition, our data security and AI solutions operate on a public cloud infrastructure provided by third-party vendors, including Google Cloud ("“GCP"”), Microsoft Azure ("“Azure"”), and Amazon Web Services ("“AWS"”), and our costs and gross margins are significantly influenced by the prices we are able to negotiate with these public cloud providers. To the extent we are able to drive adoption of our platform and data security products, we may incur increased costs related to our public cloud contracts, which would negatively impact our gross margins. Our efforts to grow our business may be costlier than we expect, or the rate of our growth in revenue may be slower than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. In addition, our efforts and investments to implement systems and processes to scale operations may not be sufficient or may not be appropriately executed. As a result, we may incur significant losses in the future for a number of reasons, including the other risks described herein, unforeseen expenses, difficulties, complications, or delays, and other unknown events. If we are unable to achieve and sustain profitability, the value of our business and Class A common stock may significantly decrease.

Furthermore, we have historically sold our products to customers as perpetual licenses with associated maintenance contracts or as subscription term-based licenses with associated support, and with respect to the latter, we recognized a portion of the revenue upfront at the time we transferred control of the subscription term-based license to the customer and deferred the remainder. ~~Moving~~We ~~forward,~~have wesubstantially ~~expect~~completed ~~that~~our ~~substantially~~transition ~~all~~to offering our platform primarily through SaaS subscriptions, and a significant majority of our new and existing customers ~~will~~have ~~continue~~adopted ~~to adopt~~ RSC ~~primarily~~ on a SaaS subscription basis. As of the end of fiscal ~~2024~~2026, ~~RSC~~SaaS subscriptions represented a majority of our total revenue. InWe ~~addition,~~have wealso ~~have~~largely ~~historically~~completed ~~sold~~the transition of sales of Rubrik-branded Appliances tofrom ~~help~~us to our ~~customers~~contract ~~secure~~manufacturers ~~their~~in ~~enterprise~~fiscal ~~data~~2025. InWe ~~the~~expect ~~third~~our ~~quarter~~subscription ofrevenue ~~fiscal~~to ~~2023,~~continue weto ~~began~~benefit ~~transitioning~~from ~~the~~customers ~~sale~~exercising ofor ~~Rubrik-branded~~forfeiting ~~Appliances~~their ~~from~~Subscription usCredits to(which ~~our~~are ~~contract~~customer ~~manufacturers,~~options ~~and~~that are accounted for as amaterial ~~result,~~rights) ~~the~~through ~~amount~~fiscal of2027, ~~revenue~~although we ~~recognize~~expect ~~from~~the ~~sales~~benefits ofto ~~Rubrik-branded~~significantly ~~Appliances~~reduce ~~has~~sequentially. ~~and~~These ~~will~~business transitions may continue to ~~decline~~cause ~~over~~fluctuations ~~time.~~to Weour ~~expect~~total ~~these~~revenue ~~transitions~~growth toand ~~adversely~~limit ~~affect~~the comparability of our revenue aswith ~~well~~past asperformance. ~~our~~In ~~profitability~~addition, ~~through~~ the ~~fiscal~~stock-based ~~year~~compensation ~~ending~~expense ~~January~~related ~~31,~~to ~~2027.~~our ~~However,~~RSUs ~~this~~has ~~timing~~resulted in and will ~~depend~~continue to result in ~~part~~significant onincreases ~~when~~in aour ~~substantial~~expenses ~~portion~~in offuture ~~our~~periods, ~~existing~~which ~~customers~~may ~~complete~~negatively ~~their~~impact ~~transition~~our ability to ~~RSC~~achieve profitability.

InIf ~~addition, following the completion of~~ our ~~IPO,~~customers ~~the~~do ~~stock-based~~not ~~compensation~~renew ~~expense~~their ~~related~~subscriptions tofor our ~~RSUs~~platform ~~has~~and ~~resulted~~products inor ~~and~~expand ~~will~~their ~~continue~~subscriptions to ~~result~~increase inthe ~~significant~~amount ~~increases~~of indata ~~our~~secured, ~~expenses~~secure innew ~~future periods~~applications, ~~which~~or ~~may~~include ~~negatively~~new ~~impact~~features or capabilities, our ~~ability~~results toof ~~achieve~~operations ~~profitability.~~could be harmed.

IfIn order for us to maintain or improve our ~~customers~~results doof ~~not~~operations, it is important that our customers renew their subscriptions for our ~~platform~~data ~~and~~security solutions, add data security or AI products, orand ~~expand~~increase the volume of their ~~subscriptions~~data toprotected by our solutions. Our AI solutions, including RAC, are relatively new, and customer adoption and expansion of these solutions may be uncertain. We expand our commercial purchase relationships with our existing customers as they increase the ~~amount~~volume of their data ~~secured,~~protected by our data security solutions and secure ~~new~~additional applications and workloads. Our customers have no obligation to renew their subscription for our data security solutions after the expiration of their contractual subscription period, which is generally three years, and in the normal course of business, some customers have elected not to renew their subscriptions. In addition, customers may elect to shorten the term of their subscription, select a lower subscription edition, or ~~include~~purchase ~~new~~less ~~features~~capacity. Our customer retention and expansion may also decline or ~~capabilities~~fluctuate as a result of a number of factors, including our customers’ satisfaction with our data security solutions, our pricing, customer prioritization of security, our customers’ security and IT operations spending, our customers’ ability to procure Rubrik-branded Appliances or other compatible third-party commodity servers to implement our data security products, mergers and acquisitions involving our customers, industry developments, competition, changing regulatory environments, and macroeconomic uncertainty related to recent global tariffs, the direct and indirect impact of which continues to evolve. Moreover, customers tend to expand their usage of our data security solutions over time as the amount of data they need to protect grows. As a result, strong customer retention over time generally leads to a higher degree of usage of our solutions. Therefore, a decline in customer retention may have a significant impact on our results of operations, including a decline in our average subscription dollar-based net retention rate, which could because ~~harmed~~the price of our Class A common stock to decline or fluctuate. If our efforts to maintain and expand our relationships with our existing customers are not successful, our business, financial condition, and results of operations may suffer.

InIf ~~order for us to maintain or improve~~ our ~~results of operations, it is important that our customers renew their subscriptions for our data security~~ solutions, ~~add~~fail ~~data~~or ~~security~~do ~~products,~~not ~~and~~perform ~~increase the volume of their data protected by our data security solutions. We expand our commercial purchase relationships with our existing customers~~ as ~~they~~intended ~~increase~~or ~~the~~are ~~volume~~perceived ~~of their data protected by our data security solutions and secure additional applications and workloads. Our customers have no obligation~~ to renew their subscription for our data security solutions after the expiration of their contractual subscription period, which is generally three years, and in the normal course of business, some customers have ~~elected not to renew their subscriptions. In addition~~defects, ~~customers may elect to shorten the term of their subscription~~errors, ~~select a lower subscription edition,~~ or ~~purchase less capacity. Our customer retention and expansion may also decline or fluctuate as a result of a number of factors~~vulnerabilities, ~~including~~ our ~~customers’~~brand ~~satisfaction with our data security solutions, our pricing, customer prioritization of security, our customers’ security~~ and ITreputation ~~operations~~will ~~spending,~~be ~~our customers’ ability to procure Rubrik-branded Appliances or other compatible third-party commodity servers to implement our data security products~~harmed, mergers and acquisitions involving our customers, industry developments, competition, changing regulatory environments, and macroeconomic uncertainty related to recent global tariffs, the direct and indirect impact of which continues to evolve. Our strategies and initiatives to accelerate the transition of our existing customers to RSC, even if executed properly by our sales and support teams, may result in customer dissatisfaction, the loss of customers, or reduced usage of our platform, any of which would ~~harm~~adversely ~~our~~affect ~~business, financial condition, and results of operations. Moreover, customers tend to expand their usage of~~ our data security solutions over time as the amount of data they need to protect grows. As a result, strong customer retention over time generally leads to a higher degree of usage of our data security solutions. Therefore, a decline in customer retention may have a significant impact on our results of operations, including a decline in our average subscription dollar-based net retention rate, which could cause the price of our Class A common stock to decline or fluctuate. If our efforts to maintain and expand our relationships with our existing customers are not successful, our business, ~~financial condition,~~ and results of operations ~~may suffer~~.

~~Rubrik~~Our solutions are complex and, ~~Inc~~like all software, have in the past contained and may in the future contain undetected defects, errors, or vulnerabilities. Q3From ~~2026~~time ~~Form~~to ~~10-Q~~time, 53we identify certain vulnerabilities in our information systems. While we take steps designed to mitigate the risks associated with known vulnerabilities, there can be no assurance that any vulnerability mitigation measures will be effective. Moreover, we may also experience delays in developing and deploying remedial measures and patches designed to address any identified vulnerabilities. Real or perceived defects, errors, or vulnerabilities in our solutions, the failure of our solutions to secure, observe, and restore our customers’ data, misconfiguration of our solutions, the exploitation of any known or unknown vulnerabilities, or

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

Ifthe ~~our~~failure ~~data~~of ~~security~~customers to deploy our solutions ~~fail~~in combination with industry best practices could harm our reputation, result in a loss of, or dodelay ~~not~~in, ~~perform~~market asacceptance ~~intended~~of our solutions, result in a loss of existing or potential customers, and adversely affect our business, financial condition, and results of operations. We are ~~perceived~~continuing to ~~have~~evolve the features and functionality of our products through updates and enhancements, and as we do so, we may inadvertently introduce defects, errors, or vulnerabilities that may not be detected until after deployment by our customers. In addition, implementation or use of our ~~brand~~solutions that is not correct or as intended may result in adverse consequences such as inadequate performance and ~~reputation~~disruptions ~~will~~in beservice. ~~harmed~~Moreover, ~~which~~if ~~would~~we ~~adversely~~acquire ~~affect~~companies ~~our~~or ~~business~~technologies ~~and~~developed ~~results~~by ofthird ~~operations~~parties, difficulties integrating such acquired technologies may result in product flaws or software vulnerabilities.

~~Our data security solutions are complex and~~Additionally, ~~like all software, have in the past contained and may in the future contain undetected defects, errors, or vulnerabilities. From time to time,~~ we ~~identify~~cannot ~~certain~~assure ~~vulnerabilities~~you inthat our ~~information~~solutions ~~systems. While we take steps designed to mitigate the risks associated with known vulnerabilities, there can be no assurance that any vulnerability mitigation measures~~ will beprevent ~~effective.~~all ~~Moreover,~~data weloss ~~may also experience delays in developing and deploying remedial measures and patches designed to address any identified vulnerabilities. Real~~ or ~~perceived~~other ~~defects,~~types ~~errors, or vulnerabilities in our data security solutions, the failure~~ of ~~our~~ data security ~~solutions to secure~~incidents, ~~observe,~~especially ~~and~~in ~~restore~~light ~~our customers’ data, misconfiguration~~ of ~~our data security solutions,~~ the ~~exploitation~~rapidly ofchanging ~~any~~security ~~known~~threat orlandscape ~~unknown~~that ~~vulnerabilities, or the failure of customers to deploy~~ our ~~data security~~ solutions inseek ~~combination~~to ~~with~~address. ~~industry~~Due ~~best~~to ~~practices could harm our reputation, result in~~ a ~~loss~~variety of, orboth ~~delay~~internal ~~in,~~and ~~market~~external ~~acceptance~~factors, of our ~~data security~~ solutions, ~~result~~could inbecome avulnerable ~~loss of existing or potential customers, and adversely affect our business, financial condition, and results of operations. We are continuing~~ to ~~evolve the features and functionality of our data~~ security ~~products~~incidents ~~through~~(both ~~updates~~from ~~and~~intentional ~~enhancements,~~attacks and asaccidental wecauses) ~~do so, we may inadvertently introduce defects, errors, or vulnerabilities~~ that ~~may~~could ~~not~~cause bethem ~~detected~~to ~~until~~fail ~~after~~to ~~deployment~~adequately bysecure ~~our customers. In addition, implementation~~ or ~~use~~observe ~~of our~~ data ~~security solutions that is not correct~~ or asto ~~intended~~restore ~~may~~data ~~result~~ in ~~adverse~~the ~~consequences~~event ~~such~~of asa ~~inadequate~~security ~~performance and disruptions in service~~incident. ~~Moreover, if we acquire companies or technologies developed by third parties, difficulties integrating such acquired technologies may result in product flaws or software vulnerabilities.~~

~~Additionally~~Moreover, weour ~~cannot~~solutions ~~assure~~are ~~you~~adopted ~~that~~by, ~~our~~and ~~data~~part ~~security~~of ~~solutions~~the ~~will~~supply ~~prevent~~chain ~~all~~of, ~~data~~a ~~loss~~large orand ~~other~~increasing ~~types~~number of ~~data~~organizations ~~security incidents~~worldwide, ~~especially~~our insolutions ~~light~~have ofbeen and may in the ~~rapidly~~future ~~changing~~be ~~security~~subject ~~threat~~to ~~landscape~~continued, ~~that~~persistent ~~our~~research ~~data~~and ~~security~~reconnaissance ~~solutions~~by ~~seek~~threat actors in order to ~~address~~discover and exploit weaknesses in our technology that can be exploited. ~~Due~~If toour asolutions ~~variety~~are ofcompromised, ~~both~~a ~~internal~~significant ~~and~~number ~~external~~or, ~~factors~~in some instances, all of our ~~data~~customers ~~security~~and ~~solutions~~their data could ~~become~~be ~~vulnerable~~adversely toaffected. ~~security~~The ~~incidents~~potential ~~(both~~liability ~~from~~and ~~intentional~~associated ~~attacks~~consequences ~~and~~we ~~accidental~~could ~~causes)~~suffer ~~that~~as a result of such a large-scale event could ~~cause~~be ~~them~~catastrophic toand ~~fail~~result toin ~~adequately~~irreparable ~~secure~~harm. orSince ~~observe~~our ~~data~~business oris tofocused ~~restore~~on providing data insecurity ~~the~~services ~~event~~to ofour acustomers, an actual or perceived security incident affecting our solutions would be especially detrimental to our reputation and our business.

~~Moreover,~~Because ~~our~~we ~~data~~can ~~security~~access ~~solutions~~customer ~~are~~data ~~adopted~~in ~~by,~~certain ~~and~~limited ~~part of the supply chain of~~circumstances, asuch ~~large~~as ~~and~~when ~~increasing~~providing ~~number~~customer ~~of organizations worldwide~~support, ~~our solutions have been~~ and ~~may~~such incustomer ~~the~~data ~~future be subject to continued, persistent research and reconnaissance by threat actors~~ in ~~order~~some tocases ~~discover~~may ~~and~~contain ~~exploit~~personal ~~weaknesses~~data inor ~~our~~confidential ~~technology~~information, ~~that~~a ~~can be exploited. If our data~~ security ~~solutions are compromised~~compromise, aor ~~significant~~an ~~number~~accidental or, inintentional ~~some~~misconfiguration ~~instances,~~or ~~all~~malfunction of our ~~customers~~platform, ~~and their data~~ could beresult ~~adversely~~in ~~affected.~~personal ~~The~~data ~~potential liability~~ and ~~associated~~other ~~consequences~~confidential weinformation ~~could~~being ~~suffer~~compromised. asWe aand ~~result~~our ofservice ~~such~~providers ahave ~~large-scale~~been ~~event~~subject ~~could~~to becyberattacks ~~catastrophic~~that ~~and~~have ~~result~~occurred in ~~irreparable~~the ~~harm.~~past ~~Since~~and ~~our~~may ~~business~~occur isin ~~focused~~the onfuture, ~~providing~~and ~~data security services to~~ our customers, ~~an actual~~ or ~~perceived~~other ~~security~~organizations ~~incident~~may ~~affecting~~lose ~~our~~trust ~~data~~in ~~security~~ solutions ~~would~~such beas ~~especially detrimental to our reputation and our business~~ours.

~~Because~~Organizations weare ~~can~~increasingly ~~access~~subject ~~customer~~to ~~data~~a inwide ~~certain~~variety ~~limited~~of ~~circumstances~~cyberattacks on their networks, ~~such~~systems, asand ~~when~~data. ~~providing~~If ~~customer~~any ~~support,~~of ~~and~~our ~~such~~customers ~~customer~~experience ~~data~~a incyberattack ~~some~~while ~~cases~~using ~~may~~our ~~contain~~solutions ~~personal~~and ~~data~~are orunable ~~confidential~~to ~~information~~secure, aobserve, ~~security~~or ~~compromise~~restore their data, orsuch ancustomers ~~accidental~~could ordiscontinue ~~intentional~~use ~~misconfiguration~~of orour ~~malfunction~~solutions, regardless of whether our ~~platform~~solutions were adequately deployed, ~~could~~configured, ~~result~~or inused ~~personal~~to ~~data~~protect ~~and~~the ~~other~~data ~~confidential~~in ~~information~~the ~~being~~customer’s ~~compromised~~environment. WeReal ~~and~~or perceived security incidents involving our ~~service~~customers' ~~providers~~networks ~~have~~could ~~been~~cause ~~subject~~disruption toor ~~cyberattacks~~damage ~~that~~to ~~have~~their ~~occurred~~networks inor ~~the~~other ~~past~~negative consequences and ~~may~~could ~~occur~~result in ~~the~~negative ~~future~~publicity to us, ~~and~~damage to our ~~customers~~reputation, orand other ~~organizations~~customer ~~may~~relations ~~lose~~issues, ~~trust~~any inof ~~data~~which ~~security~~may ~~solutions~~adversely ~~such~~affect asour ~~ours~~revenue and results of operations.

~~Organizations~~In ~~are~~addition, ~~increasingly~~errors ~~subject~~in toour asolutions ~~wide~~could ~~variety~~cause ofsystem ~~cyberattacks~~failures, onloss ~~their~~of ~~networks~~data, ~~systems~~or other adverse effects for our customers, ~~and~~which ~~data.~~may Ifresult ~~any~~in the assertion of ~~our~~warranty ~~customers~~and ~~experience~~other aclaims ~~cyberattack~~for ~~while~~substantial ~~using~~damages ~~our~~against ~~data~~us. ~~security~~The ~~solutions~~potential liability and ~~are~~associated ~~unable~~consequences towe ~~secure,~~could ~~observe,~~suffer oras ~~restore~~a ~~their~~result ~~data,~~of such ~~customers~~an incident could ~~discontinue~~be ~~use~~catastrophic ofand ~~our~~cause ~~data~~irreparable ~~security~~harm ~~solutions,~~to ~~regardless~~our reputation and results of ~~whether~~operations. Although our ~~data~~agreements ~~security~~with ~~solutions~~our ~~were~~customers ~~adequately~~typically ~~deployed,~~contain ~~configured,~~provisions orthat ~~used~~are intended to ~~protect~~limit ~~the~~our ~~data~~exposure into ~~the~~such ~~customer’s~~claims, ~~environment.~~it ~~Real~~is orpossible ~~perceived~~that ~~security~~these ~~incidents~~provisions ~~involving~~may ~~our~~not ~~customers'~~be ~~networks~~effective ~~could~~or ~~cause~~enforceable ~~disruption~~under orthe ~~damage~~laws toof ~~their~~some ~~networks~~jurisdictions. orWhile ~~other~~we ~~negative~~seek ~~consequences~~to ~~and~~insure ~~could~~against ~~result~~these intypes ~~negative~~of ~~publicity~~claims, toour ~~us,~~insurance ~~damage~~policies tomay not adequately limit our ~~reputation,~~exposure. ~~and~~These ~~other~~claims, ~~customer~~even ~~relations~~if ~~issues~~unsuccessful, ~~any~~could ofbe ~~which~~costly ~~may~~and ~~adversely~~time ~~affect~~consuming ~~our~~to ~~revenue~~defend and could harm our business, financial condition, results of operations, and cash flows.

In addition, errors in our data security solutions could cause system failures, loss of data, or other adverse effects for our customers, which may result in the assertion of warranty and other claims for substantial damages against us. The potential liability and associated consequences we could suffer as a result of such an incident could be catastrophic and cause irreparable harm to our reputation and results of operations. Although our agreements with our customers typically contain provisions that are intended to limit our exposure to such claims, it is possible that these provisions may not be effective or enforceable under the laws of some jurisdictions. While we seek to insure against these types of claims, our insurance policies may not adequately limit our exposure. These claims, even if unsuccessful, could be costly and time consuming to defend and could harm our business, financial condition, results of operations, and cash flows.

Rubrik, Inc. Q3 2026 Form 10-Q 54

Table of Contents

Our information technology systems or data, or those of third parties with whom we work, have in the past been, and may in the future be, compromised, which may cause us to experience significant adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences. As a data security company, we have been and may in the future be specifically targeted by various threat actors who try to compromise our information technology systems or data.

As a SaaS provider, the reliability and continuous availability of our platform is critical to our success. In the ordinary course of our business, we or the third parties with whom we work, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share, or otherwise process proprietary, confidential, and other sensitive data, including customer data (such as confidential customer information or customer content that we may store and protect on behalf of customers), which may include data about individuals, including various data categories and elements associated with an individual, intellectual property, and trade secrets (collectively, Sensitive Information). We collect such information from individuals located both in the United States and abroad and may store or process such information outside the country in which it was collected.

~~Organizations~~Rubrik, particularly organizations like ours that provide data security solutions, experience and are subject to a wide variety of attacks on their networks, systems, and endpoints, and techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequentlyInc. ~~For~~Q1 ~~example,~~2027 inForm ~~March 2023, we announced that a malicious third party gained unauthorized access to a limited amount of information in one of our non~~10-~~production~~Q information technology testing environments. In addition, in February 2025, we announced that we observed anomalous activity on a server that contained log files, certain of which were accessed by an unauthorized actor. Neither of these incidents resulted in access to data that we secure on behalf of customers or access to our internal code, and there was no disruption to our business or financial systems or to other operations. However, there can be no guarantee that any attack in the future will have a similarly minimal impact, should one occur.42

~~Cyberattacks,~~Table ~~malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability~~ of our Sensitive Information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent, continuing to rise, increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft, misuse, or accidental disclosure), sophisticated nation states, and nation-state-supported actors. Some actors now engage in and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our data security solutions. We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), computer generated or altered fraudulent content (i.e., “deep fakes,” which may be increasingly difficult to identify), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, other inadvertent compromises of our systems and data (including those arising from process, coding, or human error), ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or commodity appliance failures, loss of data or other information technology assets, adware, telecommunications failures, attacks enhanced or facilitated by artificial intelligence ("AI"), and other similar threats.Contents

Organizations, particularly organizations like ours that provide data security solutions, experience and are subject to a wide variety of attacks on their networks, systems, and endpoints, and techniques used to sabotage or to obtain unauthorized access to networks in which data is stored or through which data is transmitted change frequently. For example, we have experienced cyber incidents in the past that involved unauthorized access to certain of our systems, but did not result in access to data that we secure on behalf of customers or access to our internal code or disruption to our business or financial systems or to other operations. However, there can be no guarantee that any attack in the future will have a similarly minimal impact, should one occur.

Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our Sensitive Information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent, continuing to rise, increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft, misuse, or accidental disclosure), sophisticated nation states, and nation-state-supported actors. Some actors now engage in and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our solutions. We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), computer generated or altered fraudulent content (i.e., “deep fakes,” which may be increasingly difficult to identify), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, other inadvertent compromises of our systems and data (including those arising from process, coding, or human error), ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or commodity appliance failures, loss of data or other information technology assets, adware, telecommunications failures, attacks enhanced or facilitated by AI, and other similar threats.

In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive information and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Given our data security solutions’ capabilities and marketing and promotional programs related to ransomware recovery, we face heightened risk of being targeted by bad actors.

Moreover, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be increasingly difficult to integrate companies into our information technology environment and security program.

We rely on third parties to provide and/or operate critical business systems, process sensitive information, and to help us deliver services to our customers and their end-users. These third parties process customer information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. For example, our data security solutions are built to be available on the infrastructure of third-party public cloud providers such as GCP, Azure, and AWS. We also rely on other third-party service providers, contract manufacturers, and original equipment manufacturers (OEMs), or collectively with contract manufacturers, Manufacturers, to provide other products or services, or otherwise to assist us with operating our business. While we conduct diligence on these third parties, our ability to monitor these third parties’ information security practices is limited, and these third parties have not had and may not have adequate information security measures in place. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been or will not be compromised.

Rubrik, Inc. Q3 2026 Form 10-Q 55

Table of Contents

other products or services, or otherwise to assist us with operating our business. While we conduct diligence on these third parties, our ability to monitor these third parties’ information security practices is limited, and these third parties have not had and may not have adequate information security measures in place. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been or will not be compromised.

We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). However, we have been and may in the future be unable to detect and remediate all such vulnerabilities in our information systems (including our platform and data security products) on a timely basis and there can be no assurance that any vulnerability mitigation measures that we implement will be effective. Further, the process for evaluating potential vulnerabilities and developing and deploying remedial measures and patches designed to address identified vulnerabilities has been and may in the future be lengthy and subject to delays. Vulnerabilities in our information systems have been, and could in the future be, exploited and result in a security incident.

We employ a shared responsibility model where our customers are responsible for using, configuring and otherwise implementing security measures related to our platform, services and products in a manner that meets applicable cybersecurity standards, complies with laws, and addresses their information security risk. As part of this shared responsibility security model, we make certain security features available to our customers that can be implemented at our customers’ discretion or identify security areas or measures for which our customers are responsible. For example, our customers are responsible for adding and enforcing multi-factor authentication to access their accounts. In certain cases where our customers choose not to implement, or incorrectly implement, such features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we are not the cause of customer security issue or incident that may result, our customer relationships reputation, and revenue may be adversely impacted.

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

features available to our customers that can be implemented at our customers’ discretion or identify security areas or measures for which our customers are responsible. For example, our customers are responsible for adding and enforcing multi-factor authentication to access their accounts. In certain cases where our customers choose not to implement, or incorrectly implement, such features or measures, misuse our services, or otherwise experience their own vulnerabilities, policy violations, credential exposure or security incidents, even if we are not the cause of customer security issue or incident that may result, our customer relationships reputation, and revenue may be adversely impacted. Furthermore, threat actors may also gain access to other networks and systems after a compromise of our networks and systems. For example, threat actors may use an initial compromise of one part of our environment to gain access to other parts of our environment, or leverage a compromise of our networks or systems to gain access to the networks or systems of third parties with whom we work, such as through phishing or supply chain attacks.

Any of the previously identified vulnerabilities or cybersecurity threats have in the past caused and may in the future cause a security incident or other interruption resulting in consequences such as unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our Sensitive Information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could partially or fully disrupt our ability (and that of third parties upon whom we rely) to provide our platform. Additionally, our business depends upon the appropriate and successful implementation of our platform by our customers. If our customers fail to use our platform according to our specifications or are unwilling or unable to deploy such patches we make available for vulnerabilities effectively or in a timely manner, our customers may suffer a security incident or other interruptions on their own systems or other adverse consequences. Even if such an incident is unrelated to our security practices, it could result in our incurring significant economic and operational costs in investigating, remediating, and implementing additional measures to further protect our customers from their own security issues or vulnerabilities and could result in reputational harm.

Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry standard, reasonable security measures to protect our information technology systems and sensitive information. Additionally, applicable data privacy and security obligations have in the past required us and may in the future require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to implement other requirements, such as providing credit monitoring. Such disclosures, and compliance with such requirements, are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. Though we have expended, and anticipate continuing to expend, significant resources to try to protect against security incidents by implementing technical, administrative, and physical measures designed to protect the privacy and security of data running through our, and our third parties’, systems, it is virtually impossible for us to entirely eliminate the risk of such security incidents or interruptions.

If we (or a third party with whom we work, including our suppliers) experience a security incident or are perceived to have experienced a security incident, which has happened in the past, we may experience adverse consequences such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing data (including data about individuals); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant material consequences may prevent or cause customers to stop purchasing our ~~data security~~ solutions, deter new customers from purchasing our ~~data security~~ solutions, and negatively impact our ability to grow and operate our business. As a data security company, we could be exposed to additional reputational risks should a security incident occur.

Rubrik, Inc. Q3 2026 Form 10-Q 56

Table of Contents

Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to security incidents, vulnerabilities, or our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

~~Our~~The ~~use~~limited number of ~~generative~~contract manufacturers and ~~other~~original AIequipment ~~tools~~manufacturers ~~may~~that ~~pose~~produce ~~risks~~commodity servers that are compatible with our solutions are susceptible to ~~business~~supply chain disruptions and ~~operations~~have recently experienced shortages of key components for their servers, ~~including~~which may adversely affect our ~~proprietary~~ability ~~software~~to accurately forecast demand for these commodity servers or successfully manage the relationship with such manufacturers, and ~~systems~~could negatively impact demand for our offerings, and ~~may~~adversely ~~subject~~affect usour tobusiness ~~legal~~and ~~liability~~financial results.

WeA ~~use~~limited AInumber ~~tools~~of inManufacturers our business, including generative AI and agentic AI, and we expect to use AI tools in the future, including to generate code and other materials incorporated into our products, proprietary software, and systems, and for other internal and external uses, and we are making investments to expand our generative and agentic AI capabilities, including recent and future product offerings such as Rubrik Agent Cloud, which is designed to accelerate enterprise AI agent deployments. Advanced generative AI tools, which may produce ~~content~~commodity ~~indistinguishable~~servers ~~from~~ that ~~generated by humans,~~ are acompatible ~~relatively novel development,~~ with ~~benefits,~~our ~~risks, and liabilities still unknown~~solutions. Recent decisions of governmental entities and courts (such as the U.S. Copyright Office, U.S. Patent and Trademark Office, and U.S. Court of Appeals for the Federal Circuit) interpret U.S. copyright and patent law as limited to protecting works and inventions created by human authors and inventors, respectively. We ~~are~~do ~~therefore~~not ~~unlikely~~own ~~to be able to obtain U.S. copyright~~ or ~~patent~~operate ~~protection~~any ~~for~~manufacturing ~~works~~facilities ~~or inventions wholly created by a generative AI tool,~~ and ~~our~~rely ~~ability~~on tothese ~~obtain~~Manufacturers ~~U.S. copyright and patent protection~~ for ~~source code, text, images, inventions, or other materials, which are developed with some use of generative AI tools, may be limited, if available at all. Likewise, the availability of~~ such ~~IP protections in other countries is unclear~~products. InThese ~~addition,~~Manufacturers wemanage ~~may have little or no insight into and no control over~~ the ~~content~~supply ~~and~~chain ~~materials~~for ~~used by vendors to train~~ these ~~generative~~products AI tools, or that otherwise use or incorporate these generative AI tools into their own offerings. There is ongoing litigation over whether the use of copyrighted materials to train the AI models used in these tools is lawful, and ~~the impact of decisions in such litigation on our use of generative AI tools is unknown. Furthermore~~, ~~our~~alone ~~vendors who use generative and agentic AI tools in their own offerings may not meet existing~~ or ~~rapidly~~together ~~evolving regulatory or industry standards, including~~ with respect to the rights of others, privacy and data security. Additionally, our use of third-party generative and agentic AI tools, including to develop source code, text, images, inventions, or other materials, may expose us ~~to greater risks than utilizing contracted human developers, as third-party vendors of AI tools typically do not provide warranties~~ or ~~indemnities~~our ~~with~~distributors ~~respect to the output generated by such AI tools,~~ and ~~generative~~resellers and agentic AI tools may also hallucinate, providing erroneous output or making erroneous decisions. Furthermore, some AI tools may be offered under terms that do not protect the confidentiality of the prompts or inputs that users submit to such tools and may use prompts or inputs to train shared AI models, potentially resulting in third-party users receiving outputs containing information from prompts or inputs (~~including~~“Channel ~~confidential~~Partners”), ~~competitive,~~negotiate ~~proprietary,~~component ~~or personal data) that we submitted to the tool~~costs. ~~The~~Our ~~disclosure~~reliance ~~and~~on ~~use~~Manufacturers ~~of personal data in AI technologies is also subject to various privacy laws~~ and ~~other~~Channel ~~privacy~~Partners ~~obligations.~~reduces ~~Prior to implementing an AI tool (including generative AI tools),~~ our AIcontrol ~~governance~~over committee (including leaders from our Engineering, Product, Legal, and Information Security teams) performs an analysis and review of each AI tool for which pre-approval is required according to our policies, including evaluation of potential legal, security, and business risks and steps that can be taken to mitigate any such risks. The selection criteria and analysis include consideration of how use of the AIassembly ~~tool could raise issues relating to confidential information~~process, ~~personal~~quality ~~data and privacy~~assurance, ~~customer~~production ~~data and contractual obligations~~costs, ~~open source software, copyright~~ and ~~other intellectual property rights, transparency, output accuracy and reliability, and security.~~

~~Additionally~~Rubrik, while we employ practices designed to evaluate, track, and mitigate risk around our use of third-party AI tools, our practices may not be error free, and our use of such tools may inadvertently violate a third party’s rights, be non-compliant with the applicable terms of use or our other legal obligations, or result in a security or privacy risk or data leakageInc. ~~Our~~Q1 ~~use~~2027 ofForm AI technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. For example, we may face new or enhanced governmental scrutiny, or claims from third parties claiming infringement of their intellectual property rights or mandatory compliance with open10-~~source~~Q software or other license terms with respect to software or other materials or content we believed to be available for use and not subject to license terms or other third-party proprietary rights. Any of these claims could result in legal investigations or proceedings. Furthermore, if we are found to be in violation of third party rights based on our use of AI tools, we could be required to purchase costly licenses, comply with the requirements of third-party licenses, or limit or cease using the implicated software or other materials or content, unless and until we can re-engineer such software, materials, or content to avoid infringement or change the use of, or remove, the implicated third-party materials, which could reduce or eliminate the value of our technologies and services. Our use of generative and agentic AI tools to generate code may also present additional security risks because the generated source code may contain security vulnerabilities. Additionally, vendors of AI tools may fail to comply with their contractual obligations to us regarding the confidentiality or security of any data or other inputs provided to such vendor or outputs generated by their AI tools. Our sensitive information or that of our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of third-party AI technologies.44

Rubrik, Inc. Q3 2026 Form 10-Q 57

Table of Contents

Weproduct ~~also~~supply. ~~market~~If ~~some~~the ofrelationships ~~our~~with ~~own~~Manufacturers ~~products~~are not properly managed or ~~features~~if asManufacturers ~~generative~~experience AIdelays, ~~tools~~interruptions, ~~and~~or AIsupply-chain ~~infrastructure~~disruptions, ~~services~~including ~~("AI~~due ~~Products").~~to ~~Some~~international ofconflicts ~~our~~and ~~customers,~~geopolitical ~~especially~~tensions ~~those~~(such inas ~~highly~~the ~~regulated~~imposition ~~industries,~~of ~~may~~new betrade ~~reluctant~~restrictions orand ~~unwilling~~tariffs due to ~~adopt~~escalating AItensions, ~~Products.~~hostilities, ~~Accordingly~~or trade disputes), ~~adoption~~health ofepidemics AIor ~~features~~pandemics, innew ~~our~~trade ~~products~~laws and ~~marketing~~regulations, ~~our~~capacity ~~products~~constraints, asor AIquality ~~Products~~control ~~could~~problems ~~reduce~~in ortheir ~~delay~~operations, ~~customer~~the ~~adoption.~~ability ~~Because~~for AIcustomers ~~models~~to ~~and~~procure AIcompatible ~~agents~~commodity ~~can~~servers ~~hallucinate~~could ~~and~~be ~~provide~~impaired. ~~erroneous~~For ~~output~~example, orkey ~~make~~components ~~erroneous~~of ~~decisions,~~the ~~offering~~commodity AIservers ~~Products~~that ~~could~~are ~~result~~compatible inwith ~~customer~~our ~~dissatisfaction~~solutions orhave ~~potentially~~been, ~~claims~~and ~~against~~continue usto ~~arising~~be, ~~out~~adversely ofaffected ~~erroneous~~by ~~output~~global orchip ~~decisions.~~shortages ~~Some~~and ofallocation ~~our~~constraints, AIin ~~Products~~part ~~may~~due ~~require~~to uselevated toindustry ~~train~~demand, orwhich ~~fine-tune~~in AIcertain ~~models~~cases ~~using~~have ~~datasets~~resulted ~~collected~~in byextended uslead ortimes ~~from~~and ~~third-party~~increased ~~vendors~~server prices. ~~While~~In weresponse ~~have~~to ~~processes~~such ~~and~~extended ~~practices~~delays ~~designed~~or toincreased ~~ensure~~costs, ~~that~~ we ~~and~~may ~~any~~in ~~vendors~~the ~~that~~future weprovide ~~use~~certain tocommercial ~~source~~accommodations, ~~training~~which ~~data~~could ~~have~~reduce ~~the~~our ~~necessary~~margins ~~rights~~or toadversely ~~use~~affect ~~such~~our ~~datasets~~business ~~for~~if ~~training~~such ~~our~~practices AIbecome ~~Products,~~widespread weor ~~may~~prolonged. ~~not~~If insuch ~~every~~conditions ~~instance~~persist beor ~~able~~worsen, topotential ~~confirm~~new ~~that~~customers ~~all~~could ofdefer, ~~the~~delay, ~~information~~scale ~~contained~~back, or in ~~such~~some ~~datasets~~cases ~~has~~forego ~~been~~purchases ~~obtained~~or ~~with~~deployments ~~the~~of ~~necessary~~our ~~permissions~~solutions ~~for~~until uscompatible tocommodity ~~use~~servers ~~for~~are ~~purposes~~available ofor ~~our~~total AIsolution ~~Products~~costs decline. ~~For~~Any ~~example~~such disruptions, weshortages, ~~may~~or ~~use~~resulting ~~publicly~~delays ~~available~~may ~~data~~also torequire ~~train~~us or our AIChannel ~~Products~~Partners ~~that~~to ~~contains~~adjust ~~information~~forecasts, ~~that~~reschedule ~~was~~orders, ~~unlawfully~~or ~~acquired~~qualify ~~from~~alternative ~~third parties without our knowledge~~Manufacturers. ~~While~~If we ~~have~~or ~~employed~~our ~~processes~~Channel ~~designed~~Partners toare ~~help~~required usto ~~avoid~~change ~~using~~or ~~any~~qualify ~~personal~~a ~~data~~new toManufacturer ~~train~~for orany ~~fine-tune~~reason, ~~our~~including AIfinancial ~~Products~~considerations, itreduction ~~may~~of bemanufacturing ~~difficult~~output ~~for~~made usavailable to ~~avoid~~us, or ~~identify~~the ~~all~~termination ~~instances~~of ~~where~~our aor ~~user~~our ~~might~~Channel ~~nonetheless~~Partners’ ~~submit~~contract ~~personal~~with ~~data~~the toManufacturers, ~~our~~we AImay ~~Products.~~lose ~~Furthermore,~~revenue ifand weincur ~~were~~increased costs to ~~receive~~the ~~claims~~extent ~~from~~that ~~third~~we ~~parties~~are ~~asserting~~even ~~rights~~able ~~against~~to ~~our~~identify ~~use~~and ofqualify ~~certain~~a ~~datasets~~new ~~used~~Manufacturer. toIn ~~train~~addition, our AIcontract ~~Products,~~manufacturers it may beterminate ~~difficult~~the agreement with us or ~~impossible~~our ~~for~~Channel usPartners towith ~~disentangle~~prior ~~our~~notice ~~trained~~for ~~models~~reasons ~~from~~such ~~the~~as ~~subject~~failure ~~matter~~to ofperform ~~the~~a ~~claims~~material contractual obligation.

A large majority of the customer enterprise data we secure relies upon Rubrik-branded Appliances, which are currently built on servers supplied and designed by Super Micro Computer, Inc. (“Supermicro”). If we are unable to manage our relationship with Supermicro effectively, or if Supermicro continues to suffer delays or disruptions for any reason, including due to the global chip shortage that the broader industry is currently experiencing, any other component allocation constraints, increased manufacturing lead-times, capacity constraints, quality control problems in its manufacturing operations, or international trade disputes, tariffs or other protectionist measures, or fails to meet our requirements for timely delivery, or if Supermicro no longer produces the servers for our Rubrik-branded Appliances, our indirect costs may increase and our end-customer’s ability to procure Rubrik-branded Appliances in a timely manner would be impaired to the extent that any alternative commodity servers are available at all. Our agreement with Supermicro does not provide long-term price assurances for certain components used in Rubrik-branded Appliances, and increases in component or server costs could increase the total price customers pay to implement our solutions. While we have largely completed the sales of Rubrik-branded Appliances transitioning from us to our contract manufacturers in fiscal 2025, any such cost increases, including those resulting from chip shortages or allocation constraints, could adversely affect customer demand for our offerings or the timing of purchases and deployments. While customers would have the ability to purchase compatible third-party commodity servers from other OEMs, and we have the ability to qualify new commodity servers for Rubrik-branded Appliances, this may create increased costs or delays for our customers and impact their customer experience, which could negatively impact our sales and our business. See the section titled “Business—Manufacturing” in our Annual Report for additional information regarding our contractual relationship with Supermicro.

Certain of our OEMs carry products that compete with our solutions and may not continue producing or supporting compatible commodity servers for our customers in the future. We or our Channel Partners provide forecasts and purchase orders to Manufacturers for compatible commodity servers, and these orders may only be rescheduled or canceled under certain limited conditions. If we inaccurately forecast demand for our solutions and need for compatible commodity servers, our Manufacturers may have excess or inadequate inventory, and we may incur cancellation charges or penalties, which could adversely impact our operating results. If we experience increased demand for compatible commodity servers, then we, our Channel Partners, or Manufacturers may need to increase component purchases, contract manufacturing capacity, or internal test and quality functions. Our customers’ orders may represent a relatively small percentage of the overall orders received by Manufacturers from their customers. As a result, fulfilling our customers’ orders may not be considered a priority in the event Manufacturers are constrained in their ability to fulfill all of their customer obligations in a timely manner. Although we have largely transitioned the sale of Rubrik-branded Appliances from us to our contract manufacturers, if Manufacturers are unable to provide adequate supplies of high-quality products, or if we, our Channel Partners, or Manufacturers are unable to obtain adequate quantities of components, or control the costs of components, it could cause a delay in the fulfillment of our customers’ orders, in which case our business, financial condition, and results of operations could be adversely affected.

Tariffs and other restrictive trade policies, such as those regarding hardware and technology infrastructure from China, have had and may continue to have an indirect impact on the total price customers pay for our products and may also impact production and supply of our Rubrik-branded Appliances and the commodity servers compatible with our solutions. These impacts could negatively affect customer experience, demand, and the attractiveness of our solutions relative to alternatives.

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

Our use of generative, agentic and other AI tools may pose risks to business and operations, including our proprietary software and systems, and may subject us to legal liability.

We use and increasingly rely upon AI tools in our business, including generative AI and agentic AI, including to generate code and other materials incorporated into our products, proprietary software, and systems, and for other internal and external uses, and we are making investments to expand our generative and agentic AI capabilities, including recent and future product offerings such as Rubrik Agent Cloud, which is designed to accelerate enterprise AI agent deployments. Advanced generative AI tools, which may produce content indistinguishable from that generated by humans, are a relatively novel development, with benefits, risks, and liabilities still unknown. Recent decisions of governmental entities and courts (such as the U.S. Copyright Office, U.S. Patent and Trademark Office, and U.S. Court of Appeals for the Federal Circuit) interpret U.S. copyright and patent law as limited to protecting works and inventions created by human authors and inventors, respectively. We are therefore unlikely to be able to obtain U.S. copyright or patent protection for works or inventions wholly created by a generative AI tool, and our ability to obtain U.S. copyright and patent protection for source code, text, images, inventions, or other materials, which are developed with some use of generative AI tools, may be limited, if available at all. Likewise, the availability of such IP protections in other countries is unclear. In addition, we may have little or no insight into and no control over the content and materials used by vendors and model providers to train these generative AI tools, or that otherwise use or incorporate these generative AI tools into their own offerings. There is ongoing litigation over whether the use of copyrighted materials to train the AI models used in these tools is lawful, and the impact of decisions in such litigation on our use of generative AI tools is unknown. Furthermore, our vendors who use generative and agentic AI tools in their own offerings may not meet existing or rapidly evolving regulatory or industry standards, including with respect to the rights of others, privacy and data security. Additionally, our use of open-source and other third-party generative and agentic AI tools, including to develop source code, text, images, inventions, or other materials, may expose us to greater risks than utilizing contracted human developers, as such AI tools typically do not come with warranties or indemnities with respect to the output generated by such AI tools, and generative and agentic AI tools may also hallucinate, providing erroneous output or making erroneous decisions. Furthermore, some AI tools may be offered under terms that do not protect the confidentiality of the prompts or inputs that users submit to such tools and may use prompts or inputs to train shared AI models, potentially resulting in third-party users receiving outputs containing information from prompts or inputs (including confidential, competitive, proprietary, or personal data) that we submitted to the tool. The disclosure and use of personal data in AI technologies is also subject to various privacy laws and other privacy obligations. Prior to implementing an AI tool (including generative AI tools), our AI governance committee (including leaders from our Engineering, Product, Legal, and Information Security teams) performs an analysis and review of each AI tool for which pre-approval is required according to our policies, including evaluation of potential legal, security, and business risks and steps that can be taken to mitigate any such risks. The selection criteria and analysis include consideration of how use of the AI tool could raise issues relating to confidential information, personal data and privacy, customer data and contractual obligations, open source software, copyright and other intellectual property rights, transparency, output accuracy and reliability, and security.

Additionally, while we employ practices designed to evaluate, track, and mitigate risk around our use of third-party AI tools, our practices may not be error free, and our use of such tools may inadvertently violate a third party’s rights, be non-compliant with the applicable terms of use or our other legal obligations, or result in a security or privacy risk or data leakage. Our use of AI technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. For example, we may face new or enhanced governmental scrutiny, or claims from third parties claiming infringement of their intellectual property rights or mandatory compliance with open-source software or other license terms with respect to software or other materials or content we believed to be available for use and not subject to license terms or other third-party proprietary rights. Any of these claims could result in legal investigations or proceedings. Furthermore, if we are found to be in violation of third party rights based on our use of AI tools, we could be required to purchase costly licenses, comply with the requirements of third-party licenses, or limit or cease using the implicated software or other materials or content, unless and until we can re-engineer such software, materials, or content to avoid infringement or change the use of, or remove, the implicated third-party materials, which could reduce or eliminate the value of our technologies and services. Our use of generative and agentic AI tools to generate code may also present additional risks in a variety of contexts, such as the risk generated source code may contain security vulnerabilities, bugs, or other unexpected behavior. The use of agentic AI tools also poses a security risk to our information technology environment, as effective integration of agentic AI tools into our product development and other internal workflows may involve provisioning agentic AI tools with access to and the ability to modify certain of our systems and data, meaning that a compromise, misuse, unauthorized access to, or other unintended use of such an agentic AI tool could have adverse impacts on large portions of our systems and data. Furthermore, the rapid evolution of AI technologies may at times outpace the development of effective security controls that account for the risks such technologies introduce. Though we take efforts designed to mitigate risks introduced by AI technologies, our efforts may not always be successful, particularly for novel or emerging risks. Moreover, certain of the AI tools we currently, or may in the future, use are developed and maintained by third parties, and such technologies may not be designed, tested, or validated for deployment in enterprise environments as complex as ours. Though we perform due diligence into third-party providers of AI tools and, where appropriate, impose contractual requirements regarding their information security practices, we may not be able to control the way third-party products or services are developed, trained or

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

maintained. Due to the rapid evolution of AI tools (including generative AI and agentic AI), such tools may perform unexpectedly in our enterprise environment, and could result in downtime or otherwise introduce cybersecurity vulnerabilities. Additionally, vendors of AI tools may fail to comply with their contractual obligations to us regarding the confidentiality or security of any data or other inputs provided to such vendor or outputs generated by their AI tools. Our sensitive information or that of our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of third-party AI technologies.

We also market some of our own products or features as generative AI tools and AI infrastructure services (“AI Products”). Some of our customers, especially those in highly regulated industries, may be reluctant or unwilling to adopt AI Products. Accordingly, adoption of AI features in our products and marketing our products as AI Products could reduce or delay customer adoption. Because AI models and AI agents can hallucinate and provide erroneous output or make erroneous decisions, offering AI Products could result in customer dissatisfaction or potentially claims against us arising out of erroneous output or decisions. Some of our AI Products may require us to train or fine-tune AI models using datasets collected by us or from third-party providers. While we have processes and practices designed to ensure that we and any third-party providers of training data have the necessary rights to use such datasets for training our AI Products, we may not in every instance be able to confirm that all of the information contained in such datasets has been obtained with the necessary permissions for us to use for purposes of our AI Products. For example, we may use publicly available data to train our AI Products that contain information that was unlawfully acquired from third parties without our knowledge. While we have employed processes designed to help us avoid using any personal data to train or fine-tune our AI Products, it may be difficult for us to avoid or identify all instances where a user might nonetheless submit personal data to our AI Products. Furthermore, if we were to receive claims from third parties asserting rights against our use of certain datasets used to train our AI Products, it may be difficult or impossible for us to disentangle our trained models from the subject matter of the claims.

Our AI Products may also rely on certain third party providers of AI technology. Our success in deploying AI features and tools for our AI Products is reliant on these third parties and their platforms. We cannot control the quality, availability or pricing of such third-party platforms, especially in a highly competitive environment. If any such third-party platforms become incompatible with our offerings or unavailable for use or have degradations in performance, or if the providers of such models unfavorably change the terms on which their AI platforms are offered or terminate their relationship with us, our solutions may become less appealing to our customers. In addition, for any third party providers of AI platforms that host platforms on our behalf any disruption, outage, or loss of information, data breaches, cybersecurity threats or other data loss through such hosted services could disrupt our operations or solutions, damage our reputation, cause a loss of confidence in our solutions, or result in legal claims or proceedings, for which we may be unable to recover damages from the affected provider.

Several jurisdictions around the globe, including in Europe, have proposed, enacted, or are considering laws governing AI tools, including the EU’s AI Act. In the United States, where our operations are headquartered, several states are applying their data and consumer protection laws to AI, and/or have enacted, or are enacting or considering legal frameworks on AI, such as the California Bot Disclosure Law, the Utah Artificial Intelligence Policy Act, the Colorado Artificial Intelligence Act and the ~~draft~~ CCPA’s regulations onregarding automated decision-making technology. We expect other jurisdictions will adopt similar laws, and, as a result of the rapidly evolving regulatory landscape, implementation standards, enforcement practices, and available scope of protection are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, or standards may have on our business (including our positioning with respect to our competition) and may not always be able to anticipate how to respond to these laws or regulations. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI. These obligations may make it harder for us to conduct our business using AI, lead to regulatory fines or penalties, require us to disclose or provide greater transparency regarding the nature of our AI Products and the data we have employed to train them, require us to change our business practices, retrain our AI Products, or prevent or limit our use of AI. For example, the FTC has required other companies to delete (or “disgorge”) both the personal data that the FTC alleged were collected in violation of privacy laws as well as the algorithms and other insights that were developed or generated using such data. If we cannot use AI or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Also, the rapid evolution of AI technologies may require the expenditure of significant resources to design, develop, test and maintain our products and services to help ensure that our AI features and tools are implemented in accordance with applicable law and regulation and in a socially responsible manner and to minimize any real or perceived unintended harmful impacts. We also may need to expend further resources to adjust our business practices, as these laws and regulations evolve, especially where requirements across jurisdictions are inconsistent.

Any of these risks could be difficult to eliminate or manage, and, if not addressed, could adversely affect our business, financial condition, results of operations, and growth prospects.

WeRubrik, ~~expect~~Inc. ~~our~~Q1 ~~revenue~~2027 ~~mix~~Form ~~and certain business factors to impact the amount of revenue recognized period~~10-~~to-period,~~Q ~~which could make period-to-period revenue comparisons not meaningful and difficult to predict.~~47

We expect our revenue mix to vary over time due to a number of factors, including the timing of when customers adopt RSC and the mix of our subscriptions for different data security products. Our subscription revenue includes revenue from sales of subscription term-based licenses, a portion of which is recognized upfront when we transfer control of the subscription term-based license to the customer, and revenue from sales of SaaS subscriptions and support, which is recognized ratably over the contract period. Due to the

Rubrik, Inc. Q3 2026 Form 10-Q 58

Table of Contents

~~proportion~~Changes ofin our ~~contracts~~revenue ~~trending~~mix ~~from~~may ~~subscription~~cause ~~term-based~~fluctuations ~~licenses~~in torevenue ~~SaaS~~recognized ~~subscriptions, the timing of the migration of our existing customers~~ from ~~Cloud~~period ~~Data Management~~ to ~~RSC~~period, aswhich ~~well~~could asmake ~~the estimates and assumptions used to account for certain customers’ Subscription Credits (as defined below) related to their Refresh Rights (as defined below), our revenue may fluctuate and~~ period-to-period revenue comparisons ~~may~~ not be meaningful, and our past results may not be indicative of future performance. We cannot be certain how long these factors may persist. For example, as certain of our existing customers prepare to migrate to RSC, we expect certain of them to consume our solutions through a mix of RSC and RCDM-T during which time we will continue recognizing a portion of the associated revenue upfront. These factors make it challenging to forecast our revenue as the mix of solutions and services, the timing of our customers’ RSC transition, as well as the size of contracts, are difficult to predict.

WeOur ~~rely~~revenue ~~upon~~mix ~~third-party~~may ~~cloud~~vary ~~providers~~over time due to ~~host~~a number of factors, including the mix of our subscriptions for different data security ~~solutions,~~products and ~~any~~the ~~disruption~~timing of, remaining customer migrations to RSC or ~~interference~~other ~~with~~SaaS offerings. Our subscription revenue includes revenue from sales of subscription term-based licenses, ~~our~~a ~~use~~portion of ~~third~~which is recognized upfront when we transfer control of the subscription term-~~party~~based ~~cloud~~license ~~products~~to ~~would~~the ~~adversely~~customer, and revenue from sales of SaaS subscriptions and support, which is recognized ratably over the contract period. As we have substantially completed our transition from subscription term-based licenses to SaaS subscriptions and migrated a significant majority of our existing customers to RSC, the proportion of revenue recognized upfront versus ratably over time has evolved. However, the timing of remaining customer migrations, as well as the estimates and assumptions used to account for certain customer arrangements, including Subscription Credits (which are customer options that are accounted for as material rights) related to Refresh Rights, may continue to affect the amount and timing of revenue recognized. In addition, future changes in our ~~business~~product offerings, ~~financial~~pricing ~~condition~~models, contract structures, customer purchasing patterns, or other business initiatives may further affect our revenue mix and ~~results~~the timing of ~~operations~~revenue recognized. These factors make it challenging to forecast our revenue as the mix of solutions and services, the timing of our customers’ RSC transition, as well as the size of contracts, are difficult to predict.

Customers of RSC and our other cloud services need to be able to access our data security solutions at any time, without interruption or degradation of performance, and we provide them with service-level commitments with respect to uptime. We ~~leverage~~rely upon third-party cloud providers ~~for substantially all of the infrastructure that supports our data security solutions. Our cloud services depend on the cloud infrastructure hosted by these third-party providers~~ to ~~support~~host our ~~configuration~~solutions, ~~architecture, features,~~ and ~~interconnection~~any ~~specifications,~~disruption ~~as well as secure the information stored in these virtual data centers, which is transmitted through third-party internet service providers. Any limitation on the capacity~~ of ~~our third-party hosting providers~~, ~~including due to technical failures, shifts in product capabilities~~ or ~~licensing~~interference ~~models~~with, ~~natural disasters, fraud, or security attacks, could impede~~ our ~~ability~~use ~~to fulfill our current contractual commitments, onboard new customers, or expand the usage~~ of ~~our~~third-party ~~existing~~cloud ~~customers,~~products ~~which~~would ~~could~~ adversely affect our business, financial condition, and results of operations.

Customers of RSC and our other cloud services need to be able to access our solutions at any time, without interruption or degradation of performance, and we provide them with service-level commitments with respect to uptime. We leverage third-party cloud providers for substantially all of the infrastructure that supports our solutions. Our cloud services depend on the cloud infrastructure hosted by these third-party providers to support our configuration, architecture, features, and interconnection specifications, as well as secure the information stored in these virtual data centers, which is transmitted through third-party internet service providers. Any limitation on the capacity of our third-party hosting providers, including due to technical failures, shifts in product capabilities or licensing models, natural disasters, fraud, global conflicts or security attacks, could impede our ability to fulfill our current contractual commitments, onboard new customers, or expand the usage of our existing customers, which could adversely affect our business, financial condition, and results of operations.

In addition, third-party cloud providers run their own platforms that we access, and we are, therefore, vulnerable to their service interruptions. We have in the past and may in the future experience interruptions, delays, and outages in service and availability from time to time as a result of problems with our third-party cloud providers’ infrastructure. Lack of availability of this infrastructure could be due to a number of potential causes that we cannot predict or prevent, including technical failures, natural disasters, fraud, or cyber security attacks. Such outages could lead to the triggering of our service-level commitments and extensions of affected services at no charge to our customers, which may impact our business, financial condition, and results of operations. In addition, if our security, or that of any of these third-party cloud providers, is compromised, our software is unavailable, or our customers are unable to use our software within a reasonable amount of time or at all, our business, financial condition, and results of operations could be adversely affected. In some instances, we may not be able to identify the cause or causes of these performance problems within a period of time acceptable to our customers. It is possible that our customers and potential customers would hold us accountable for any breach of security affecting a third-party cloud provider’s infrastructure, and we may incur significant liability from those customers and from third parties with respect to any breach affecting these systems. We may not be able to recover a material portion of our liabilities to our customers and third parties from a third-party cloud provider. It may also become increasingly difficult to maintain and improve our performance, especially during peak usage times, as our software becomes more complex and the usage of our software increases. Any of the above circumstances or events may harm our business, financial condition, and results of operations.

We may not be able to successfully manage our growth, and if we are not able to grow efficiently, our business, financial condition, and results of operations could be harmed.

As usage and adoption of our platform and data security products grow, we will need to devote additional resources to improving our capabilities, features, and functionality. In addition, we will need to appropriately scale our internal business operations and our services organization to serve our growing customer base. Any failure of or delay in these efforts could result in impaired product performance and reduced customer satisfaction, resulting in decreased sales to new customers, lower average subscription dollar-based net retention rates, or the issuance of service credits or requested refunds, which would hurt our revenue growth and our reputation. Further, any failure in optimizing the costs associated with use of third-party cloud services as we scale could negatively impact our margins. Our expansion efforts will be expensive and complex and will require the dedication of significant management time and attention. We could also face inefficiencies, vulnerabilities, or service disruptions as a result of our efforts to scale our internal infrastructure, which may result in extended outages, loss of customer trust, and harm to our reputation. We cannot be sure that the expansion of and improvements to our internal infrastructure will be effectively implemented on a timely basis, if at all, and such failures could harm our business, financial condition, and results of operations.

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

expansion of and improvements to our internal infrastructure will be effectively implemented on a timely basis, if at all, and such failures could harm our business, financial condition, and results of operations.

The markets in which we participate are competitive, and if we do not compete effectively, our business, financial condition, and results of operations could be harmed.

The data security market is new and intensely competitive, characterized by rapidly changing technology and evolving standards, changing customer requirements, and frequent new product introductions. Our main competitors fall into the following categories:

~~Rubrik,~~•Data ~~Inc.~~management Q3and ~~2026~~protection ~~Form~~vendors, 10such as Dell-QEMC, 59IBM, Commvault, Veeam, and Cohesity;

Table of Contents

•Data management and protection vendors, such as Dell-EMC, IBM, Commvault, Veeam, and Cohesity (which recently acquired Veritas’ data protection business);

•Cloud and SaaS data management vendors with products that compete in some of our markets; and

•Vendors that provide cyber/ransomware detection and investigation, data security posture management, identity security posture management, Active Directory and Entra ID security and protection, insider threat detection, data classification, and other data security or data governance technologies.

The principal competitive factors in our industry include product functionality, product integration, platform coverage, ability to scale, price, worldwide sales infrastructure, global technical support, labor and development costs, name recognition, and reputation. The ability to converge data security and data management in a cloud architecture is also a significant competitive factor in our industry. If we are unable to address these factors, our competitive position could weaken, and we could experience a decline in revenue that could adversely affect our business.

Many of our current and potential competitors have longer operating histories and may have substantially greater financial, technical, sales, marketing, and other resources than we do, as well as larger installed customer bases, greater name recognition, lower labor and development costs, and broader product solutions, including servers. Some of these competitors can devote greater resources to the development, promotion, sale, and support of their data security products than we can. As a result, these competitors may be able to respond more quickly to new or emerging technologies and changes in customer requirements. For example, many of our competitors are also investing in AI technology to improve their data security products, which could enable them to respond more quickly to new or emerging threats and changes in customer requirements.

It is also costly and time-consuming to change data management systems. Most of our new or potential customers have already installed data management systems, which gives an incumbent competitor an advantage in retaining a customer due to significant risk to data continuity from switching vendors. The incumbent competitor already understands the data, applications, network infrastructure, user demands, and information technology needs of the customer, such that some customers are reluctant to invest the time, money, and resources necessary to implement configuration, integration, training, and other operational complexities that arise from another vendor. In addition, for any of our existing customers that have not yet transitioned to RSC, any perceived negative impacts or incremental costs associated with the transition to RSC, or a more rapid transition than planned by the customer, may result in customer dissatisfaction and give our competitors an opportunity to acquire these customers.

Our current and potential competitors may establish cooperative relationships among themselves or with third parties or may merge with each other. If so, new competitors, alliances, or merged entities that include our competitors may emerge that could acquire significant market share. In addition, large operating systems, applications, and cloud vendors have introduced products or functionality that include some of the same functions offered by our ~~data security~~ solutions. In the future, further development by these vendors could cause our ~~data security~~ solutions to become redundant, which could seriously harm our business, financial condition, and results of operations.

In addition, we expect to encounter new competitors, including public cloud providers and SaaS companies that build native data security and management solutions, as we expand in current markets or enter new markets. Furthermore, many of our existing competitors are broadening their operating systems platform coverage. We expect that competition will increase as a result of future software industry consolidation. Increased competition could harm our business by causing, among other things, price reductions of our ~~data security~~ solutions, reduced profitability, and loss of market share.

Our estimates of market opportunity, forecasts of market growth, and potential return on investment may prove to be inaccurate, and even if the market in which we compete achieves the forecasted growth, our business could fail to grow at similar rates, if at all.

Market opportunity estimates and growth forecasts, whether obtained from third-party sources or developed internally, are subject to significant uncertainty and are based on assumptions and estimates that may not prove to be accurate. The ~~data~~markets ~~security~~in ~~market~~which iswe operate are at an early stage and isare rapidly evolving. AsThese wemarkets ~~are~~include ~~working~~data tomanagement, ~~create a market for~~ data security, ~~from other existing markets that focused on other elements of cybersecurity~~identity, ~~our market is at an early stage~~ and ~~rapidly evolving~~AI. As a result, the size and future growth of this market are difficult to accurately estimate and subject to change. In addition, third-party estimates of the addressable market for the ~~security~~markets ~~and~~in ~~data~~which ~~management~~we ~~sectors~~operate reflect the opportunity available from all participants and potential participants, and we cannot predict with precision our ability to address this demand or the extent of market adoption of our platform and data security products. Moreover, the market segments we are targeting may grow at different rates. The variables that go into the calculation of our market opportunity are subject to change over time, and there is no guarantee that any particular number or percentage of addressable businesses covered by our market opportunity estimates will purchase our data security solutions or generate any particular level of revenue for us. Any expansion in our market opportunity depends on a number of factors, including the cost, performance, and

Rubrik, Inc. Q3Q1 ~~2026~~2027 Form 10-Q 6049

Table of Contents

potential participants, and we cannot predict with precision our ability to address this demand or the extent of market adoption of our solutions. Moreover, the market segments we are targeting may grow at different rates. The variables that go into the calculation of our market opportunity are subject to change over time, and there is no guarantee that any particular number or percentage of addressable businesses covered by our market opportunity estimates will purchase our solutions or generate any particular level of revenue for us. Any expansion in our market opportunity depends on a number of factors, including the cost, performance, and perceived value associated with our ~~data security~~ solutions and the products of our competitors. Even if the areas in which we compete achieve the forecasted growth, our business could fail to grow at similar rates, if at all.

There are a limited number of contract manufacturers and original equipment manufacturers of commodity servers that are compatible with our data security solutions, and failure to accurately forecast demand for these commodity servers or successfully manage the relationship with such manufacturers could negatively impact the ability to sell our offerings.

A limited number of Manufacturers produce commodity servers that are compatible with our data security solutions. We do not own or operate any manufacturing facilities and rely on these Manufacturers for such products. These Manufacturers manage the supply chain for these products and, alone or together with us or our distributors and resellers ("Channel Partners"), negotiate component costs. Our reliance on Manufacturers and Channel Partners reduces our control over the assembly process, quality assurance, production costs, and product supply. If the relationships with Manufacturers are not properly managed or if Manufacturers experience delays, interruptions, or supply-chain disruptions, including due to international conflicts and geopolitical tensions (such as the imposition of new trade restrictions and tariffs due to escalating tensions, hostilities, or trade disputes), health epidemics or pandemics, new trade laws and regulations, capacity constraints, or quality control problems in their operations, the ability for customers to procure compatible commodity servers could be impaired. If we or our Channel Partners are required to change or qualify a new Manufacturer for any reason, including financial considerations, reduction of manufacturing output made available to us, or the termination of our or our Channel Partners’ contract with the Manufacturers, we may lose revenue, incur increased costs, and our customer relationships may be damaged. In addition, our contract manufacturers may terminate the agreement with us or our Channel Partners with prior notice for reasons such as failure to perform a material contractual obligation.

Certain of our OEMs carry products that compete with our data security solutions and may not continue producing or supporting compatible commodity servers for our customers in the future. We or our Channel Partners provide forecasts and purchase orders to Manufacturers for compatible commodity servers, and these orders may only be rescheduled or canceled under certain limited conditions. If we inaccurately forecast demand for our data security solutions and need for compatible commodity servers, our Manufacturers may have excess or inadequate inventory, and we may incur cancellation charges or penalties, which could adversely impact our operating results. If we experience increased demand for compatible commodity servers, then we, our Channel Partners, or Manufacturers may need to increase component purchases, contract manufacturing capacity, or internal test and quality functions. Our customers’ orders may represent a relatively small percentage of the overall orders received by Manufacturers from their customers. As a result, fulfilling our customers’ orders may not be considered a priority in the event Manufacturers are constrained in their ability to fulfill all of their customer obligations in a timely manner. Although we have largely transitioned the sale of Rubrik-branded Appliances from us to our contract manufacturers, if Manufacturers are unable to provide adequate supplies of high-quality products, or if we, our Channel Partners, or Manufacturers are unable to obtain adequate quantities of components, or control the costs of components, it could cause a delay in the fulfillment of our customers’ orders, in which case our business, financial condition, and results of operations could be adversely affected.

Tariffs and other restrictive trade policies, such as those recently announced regarding hardware and technology infrastructure from China, have had and may continue to have an indirect impact on the total price customers pay for our products and may also impact production and supply of our Rubrik-branded Appliances and the commodity servers compatible with our data security solutions. These impacts could negatively affect customer experience, demand, and the attractiveness of our solutions relative to alternatives.

If customers have not utilized their Subscription Credits before they expire, this could result in customer dissatisfaction and our future results of operations could be harmed.

The customer enterprise data we secure relies upon compatible hardware. Historically, we sold Rubrik-branded Appliances produced by contract manufacturers to our customers. We started transitioning the sale of Rubrik-branded Appliances from us to our contract manufacturers in fiscal 2023 and offered limited-time incentives, Subscription Credits (which are customer options that are accounted for as material rights), upon qualification, to certain existing customers in exchange for historically offered rights to next generation Rubrik-branded Appliances at no cost, which we refer to as Refresh Rights. If customers have not utilized their Subscription Credits before they expire, this could result in customer dissatisfaction or a decision not to purchase our solutions, which would have an adverse impact on our results of operations.

Rubrik, Inc. Q3 2026 Form 10-Q 61

Table of Contents

manufacturers in fiscal 2023 and offered limited-time incentives ("Subscription Credits"), upon qualification, to certain existing customers in exchange for historically offered rights to next generation Rubrik-branded Appliances at no cost, which we refer to as Refresh Rights. If customers have not utilized their Subscription Credits before they expire, this could result in customer dissatisfaction or a decision not to purchase our data security solutions, which would have an adverse impact on our results of operations.

We rely on the performance of highly skilled personnel, including senior management and engineering, services, sales, and technology professionals. If we are unable to retain or motivate key personnel or hire, retain, and motivate qualified personnel, our business will be harmed.

We believe our success has depended, and continues to depend, on the efforts and talents of our senior management team, particularly Bipul Sinha, our Chairman of our board of directors, Chief Executive Officer, and co-founder, and Arvind Nithrakashyap, our Chief Technology Officer and co-founder, as well as our other key employees in the areas of research and development and sales and marketing.

From time to time, there may be changes in our senior management team or other key employees resulting from the hiring or departure of these personnel. Our executive officers and certain other key employees are employed on an at-will basis, which means that these personnel could terminate their employment with us at any time. The loss of one or more of our executive officers, or the failure by our executive team to effectively work with our employees and lead our company, could harm our business. We also are dependent on the continued service of our existing software engineers because of the complexity of our ~~data security~~ solutions. In addition, a significant portion of our software engineers are located in Palo Alto, California and Bangalore, India. These locations offer access to a deep pool of highly skilled professionals, which is crucial for the development and maintenance of our complex ~~data security~~ solutions. However, this concentration also exposes us to potential continuity risk if these specific locations are negatively impacted by unforeseen events, such as natural disasters, political unrest, or disruptions in critical infrastructure. In particular, the ongoing conflict between India and Pakistan could disrupt our Bangalore-based operations, specifically our renewals and software engineering teams, which could negatively impact our business.

In addition, to execute our growth plan, we must attract and retain highly qualified personnel. Competition for these personnel is intense, especially for engineers experienced in designing and developing cloud-based infrastructure products, for experienced sales professionals, and for cybersecurity professionals. If we are unable to attract such personnel at appropriate locations, we may need to hire in new regions, which may add to the complexity and costs of our business operations. From time to time, we have experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have. As has occurred in the past, if we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or we have breached certain legal obligations, resulting in a diversion of our time and resources. In addition, prospective and existing employees often consider the value of the equity awards they receive in connection with their employment. If the perceived value of our equity awards declines, experiences significant volatility, or increases such that prospective employees believe there is limited upside to the value of our equity awards, it may adversely affect our ability to recruit and retain employees. If we fail to attract new personnel or fail to retain and motivate our current personnel, our business and growth prospects would be harmed.

We derive substantially all of our revenue from our data security platform. Failure of our platform to satisfy customer demands or achieve continued market acceptance over competitors would harm our business, financial condition, results of operations, and growth prospects.

We derive substantially all of our revenue from our platform, and we have directed, and intend to continue to direct, a significant portion of our financial and operating resources to developing more features and functionality for our platform.

Our growth will depend in large part on our ability to attract new customers and expand sales to existing customers, expand the features and functionality of our platform, hire sufficient sales personnel to support our growth, and decrease the ramp time for our sales personnel. In addition, the success of our business is substantially dependent on the actual and perceived viability, benefits, and advantages of our platform as a preferred provider for data security. As such, market adoption of our platform and data security products is critical to our continued success. Demand for our platform and data security products is affected by a number of factors, including increased market acceptance by new and existing customers, increased market acceptance of our AI offerings, such as Rubrik ~~Agent Cloud~~, increased activity by or prevalence of cybersecurity bad actors, including the use of ransomware, effectiveness of our sales and marketing strategy, the extension of our platform to new applications and use cases, the timing of development and release of new capabilities by us and our competitors, technological change, and growth or contraction of the market in which we competeInc. ~~Failure~~Q1 to2027 ~~successfully~~Form ~~address~~10-Q or account for these factors, satisfy customer demands, achieve continued market acceptance over competitors, and achieve growth in sales of our data security products would harm our business, financial condition, results of operations, and growth prospects.50

Rubrik, Inc. Q3 2026 Form 10-Q 62

Table of Contents

Our growth will depend in large part on our ability to attract new customers and expand sales to existing customers, expand the features and functionality of our platform, hire sufficient sales personnel to support our growth, and decrease the ramp time for our sales personnel. In addition, the success of our business is substantially dependent on the actual and perceived viability, benefits, and advantages of our platform. As such, market adoption of our platform, data security and agentic AI operations solutions is critical to our continued success. Demand for our platform and data security products is affected by a number of factors, including increased market acceptance by new and existing customers, increased market acceptance of our AI offerings, such as Rubrik Agent Cloud, increased activity by or prevalence of cybersecurity bad actors, including the use of ransomware, effectiveness of our sales and marketing strategy, the extension of our platform to new applications and use cases, the timing of development and release of new capabilities by us and our competitors, technological change, and growth or contraction of the market in which we compete. Failure to successfully address or account for these factors, satisfy customer demands, achieve continued market acceptance over competitors, and achieve growth in sales of our data security products would harm our business, financial condition, results of operations, and growth prospects.

We expect fluctuations in our financial results, making it difficult to project future results, and if we fail to meet the expectations of securities analysts or investors with respect to our results of operations, our stock price and the value of your investment could decline.

Our results of operations have fluctuated in the past and are expected to fluctuate in the future due to a variety of factors, many of which are outside of our control. As a result, our past results may not be indicative of our future performance. In addition to the other risks described herein, factors that may affect our results of operations include:

•changes in our revenue mix;

•changes in actual and anticipated growth rates of our revenue, customers, and key operating metrics;

•fluctuations in demand for or pricing of our ~~data security~~ solutions;

•our ability to attract new customers;

•the level of awareness and prevalence of cybersecurity threats, particularly advanced cyberattacks and ransomware attacks;

•timing of our ~~existing~~ customers’ ~~transition~~exercising toor ~~RSC~~forfeiting their Subscription Credits (which are customer options that are accounted for as material rights), including the impact on our revenue recognition and ~~customer~~causing ~~retention~~fluctuations to our total revenue growth and ~~expansion~~limit the comparability of our revenue with past performance;

•our ability to retain our existing customers, particularly large customers, and secure renewals of subscriptions, as well as the timing of customer renewals or non-renewals;

•the pricing and quantity of subscriptions renewed, as well as our ability to accurately forecast customer expansions and renewals;

•downgrades in customer subscriptions;

•customers and potential customers opting for alternative ~~data security~~ solutions, including developing their own in-house solutions;

•timing and amount of our investments to expand the capacity of our third-party cloud service providers;

•seasonality in sales, results of operations, and remaining performance obligations;

•investments in new ~~data security products~~offerings, including protection of new enterprise, cloud, SaaS, unstructured data, ~~and~~ identity providers, new features, and functionality;

•fluctuations or delays in development, release, or adoption of new features and functionality for our ~~data security~~ solutions;

•delays in closing sales, including the timing of renewals, which may result in revenue being pushed into the next fiscal quarter, particularly because a large portion of our sales occur toward the end of each fiscal quarter;

•fluctuations or delays in purchasing decisions in anticipation of new data security products or enhancements by us or our competitors;

•changes in customers’ budgets, the timing of their budget cycles and purchasing decisions, and payment schedules;

•our customers’ ability to procure Rubrik-branded Appliances or compatible commodity servers from Manufacturers, particularly in light of supply chain constraints that have resulted in extended lead times and increased server prices, and any commercial accommodations we may provide in response;

•the number of qualified customers that elect to utilize their Subscription Credits (which are customer options that are accounted for as material rights) before they expire;

•our ability to control costs, including hosting costs and our operating expenses;

•the amount and timing of payment for operating expenses, particularly research and development and sales and marketing expenses, including commissions;

•timing of hiring personnel for our research and development and sales and marketing organizations;

•the amount and timing of non-cash expenses, including stock-based compensation expense and other non-cash charges;

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

•the amount and timing of costs associated with recruiting, educating, and integrating new employees and retaining and motivating existing employees;

•the effects of acquisitions and their integration;

•general economic conditions, both domestically and internationally, as well as economic conditions specifically affecting industries in which our customers participate;

•fluctuations in foreign currency exchange rates;

•the impact of new accounting pronouncements;

•changes in regulatory or legal environments that may cause us to incur, among other things, expenses associated with compliance;

•the impact of changes in tax laws or judicial or regulatory interpretations of tax laws, which are recorded in the period such laws are enacted or interpretations are issued and may significantly affect the effective tax rate of that period and following periods;

•health epidemics or pandemics;

Rubrik, Inc. Q3 2026 Form 10-Q 63

Table of Contents

•changes in the competitive dynamics of our market, including consolidation among competitors or customers; and

•significant security incidents related to, technical difficulties with, or interruptions to, the delivery and use of our ~~data security~~ solutions.

Any of these and other factors, or the cumulative effect of some of these factors, may cause our results of operations to vary significantly. If our quarterly results of operations fall below the expectations of investors and securities analysts who follow our stock, the price of our Class A common stock could decline substantially, and we could face costly lawsuits, including securities class action suits.

In addition, while we recognize our SaaS subscription revenue ratably over the term of the subscription, our customers typically pay us for new multi-year subscriptions upfront and then annually upon one-year renewals. Recently, due to the growth in our SaaS product offerings, changes in our customer mix, and the uncertain macroeconomic environment, we have experienced an increase in customers electing annual, monthly, or consumption payments instead of multi-year upfront payments, which has caused and may continue to cause volatility in our period over period cash flow and may have an adverse effect on our business and results of operations.

Our ability to introduce new data security products and features is dependent on adequate research and development resources and our ability to successfully complete acquisitions. If we do not adequately fund our research and development efforts or complete acquisitions successfully, we may not be able to compete effectively, and our business and results of operations may be harmed.

To remain competitive, we must continue to offer new data security products and enhancements to our platform and existing solutions. This is particularly true as we further expand and diversify our capabilities. Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of the market is essential. If we elect not to or are unable to develop solutions internally due to certain constraints, such as high employee turnover, lack of management ability, or a lack of other research and development resources, we may choose to expand into a certain market or strategy via an acquisition for which we could potentially pay too much or fail to successfully integrate into our operations. Further, many of our competitors expend a considerably greater amount of funds on their respective research and development programs, and those that do not may be acquired by larger companies that would allocate greater resources to our competitors’ research and development programs. Our failure to maintain adequate research and development resources or to compete effectively with the research and development programs of our competitors would give an advantage to such competitors, and our business, financial condition, and results of operations could be adversely affected. Moreover, there is no assurance that our research and development or acquisition efforts will successfully anticipate market needs and result in significant new marketable solutions or enhancements to our solutions, design improvements, cost savings, revenues, or other expected benefits. If we are unable to generate an adequate return on such investments, we may not be able to compete effectively, and our business and results of operations may be adversely affected.

We depend and rely on SaaS technologies and cloud infrastructure services from third parties to operate our business, and interruptions or performance problems with these technologies may adversely affect our business and results of operations.

We rely on hosted SaaS applications and cloud infrastructure services from third parties in order to operate critical functions of our business, including AI-built applications, enterprise resource planning, order management, billing, project management, human resources, technical support, accounting, and other operational activities. If these services become unavailable due to extended outages, interruptions, or because they are no longer available on commercially reasonable terms, our expenses could increase, our ability to manage finances could be interrupted, and our processes for managing sales of our ~~data security~~ solutions and supporting our customers could be impaired until equivalent services, if available, are identified, obtained, and implemented, all of which could adversely affect our business and results of operations.

~~If we are unable to maintain successful relationships with our Channel Partners and technology alliance partners~~Rubrik, orInc. ifQ1 ~~our~~2027 ~~Channel~~Form ~~Partners~~10-Q or technology alliance partners fail to perform, our ability to market, sell, and distribute our data security solutions will be limited, and our business, financial condition, and results of operations will be harmed.52

In addition to our sales force, we rely on our Channel Partners, which include our managed service providers and distributors and resellers, to sell and support our data security solutions. A vast majority of sales of our data security solutions flow through our Channel Partners with the support of our sales force. Our three largest Channel Partners, Arrow Enterprise Computing Solutions, Exclusive Networks, and Ingram Micro Inc., and their respective affiliates collectively generated approximately 73% and 76% of our revenue for fiscal 2025 and fiscal 2024, respectively. Our agreements with our Channel Partners, including our agreements with our three largest Channel Partners, are non-exclusive, renew automatically in one-year term increments, and may be terminated by either party at any time. Further, our Channel Partners fulfill our sales on a purchase order basis and do not impose minimum purchase requirements or related terms on sales. Our Channel Partners enable us to extend our reach, in particular with smaller customers and in geographies where we have less sales presence. Additionally, we have entered, and intend to continue to enter, into technology alliance partnerships with third parties to support our future growth plans.

Rubrik, Inc. Q3 2026 Form 10-Q 64

Table of Contents

WeIf ~~derive a substantial amount of our revenue from sales through Channel Partners, and~~ we ~~expect~~are tounable ~~continue~~ to ~~derive~~maintain asuccessful substantial amount of our revenue from Channel Partners in future periods. Our agreements with our Channel Partners are generally non-exclusive and do not prohibit them from working with our competitors or offering competing products, and many of our Channel Partners may have more established relationships with our ~~competitors. If our~~ Channel Partners ~~choose to place greater emphasis on solutions other than our own, fail to effectively market~~ and ~~sell~~technology ~~our~~alliance ~~data security solutions~~partners, or ~~fail~~if ~~to meet the needs of~~ our ~~customers, then our ability to grow our business and sell our data security solutions may be adversely affected. In addition, the loss of one or more of our larger~~ Channel Partners or technology alliance partners, ~~who~~fail ~~may cease marketing our data security solutions with limited or no notice, and any inability~~ to ~~replace them~~perform, ~~could adversely affect~~ our ~~business,~~ability ~~financial~~to ~~condition~~market, ~~and results of operations. Moreover~~sell, ~~our ability to expand our distribution channels depends in part on our ability to maintain successful relationships with our Channel Partners~~ and ~~educate~~distribute ~~and train~~ our ~~current and future Channel Partners about our data security~~ solutions, ~~which~~will ~~can~~ be ~~complex. If we fail to effectively manage our existing sales channels~~limited, ~~or if our Channel Partners are unsuccessful in fulfilling the orders for our data security solutions, or if we are unable to enter into arrangements with,~~ and ~~retain a sufficient number of, high quality Channel Partners in each of the regions in which we sell data security solutions and keep them motivated to sell~~ our ~~data security solutions, our~~ business, financial condition, and results of operations will be harmed. Even if we are successful, these relationships may not result in greater customer usage of our data security products or increased revenue. Our ability to influence, or have visibility into, the actions or efforts of our Channel Partners may be limited. If our partners, including our Channel Partners, fail to comply with applicable laws, including anti-corruption, export control and sanctions, antitrust, or competition laws, or engage in activities that result in or may result in liability, we may also be adversely affected through reputational harm, as well as other negative consequences, including litigation, government investigations and penalties.

In addition, ~~the~~to ~~financial~~our ~~health~~sales offorce, we rely on our Channel Partners, ~~and~~which include our ~~continuing~~managed ~~relationships~~service ~~with~~providers ~~them~~and ~~are~~distributors ~~important~~and resellers, to sell and support our ~~success~~solutions. ~~Some~~A vast majority of ~~these~~sales ~~Channel~~of ~~Partners~~our ~~may~~solutions beflow ~~unable~~through toour ~~withstand~~Channel ~~adverse~~Partners ~~changes~~with inthe ~~economic~~support ~~conditions,~~of ~~including~~our ~~the~~sales ~~current~~force. ~~macroeconomic~~Our ~~uncertainty~~three largest Channel Partners, ~~which~~Arrow ~~could~~Enterprise ~~result~~Computing inSolutions, ~~insolvency~~Exclusive orNetworks, ~~the~~and ~~inability~~Ingram ofMicro ~~such~~Inc., ~~Channel~~and ~~Partners~~their torespective ~~obtain~~affiliates ~~credit~~collectively togenerated ~~finance~~approximately ~~purchases~~68% and 73% of our ~~data~~revenue ~~security~~for ~~solutions~~fiscal 2026 and ~~services. In addition~~2025, ~~weakness~~respectively. inOur ~~the~~agreements ~~end-user~~with ~~market~~our ~~could~~Channel ~~negatively~~Partners, ~~affect~~including ~~the~~our ~~cash~~agreements ~~flows~~with of our three largest Channel Partners, ~~who~~are ~~could~~non-exclusive, renew automatically in ~~turn~~one-year term increments, ~~delay~~and ~~paying~~may ~~their~~be ~~obligations~~terminated toby useither party at any time. Further, ~~which~~our ~~would~~Channel ~~increase~~Partners fulfill our ~~credit~~sales ~~risk~~on ~~exposure.~~a ~~Our~~purchase ~~business~~order ~~could~~basis beand ~~harmed~~do ifnot ~~the~~impose ~~financial~~minimum ~~condition~~purchase ofrequirements ~~some~~or ofrelated ~~these~~terms on sales. Our Channel Partners ~~substantially~~enable ~~weakened~~us to extend our reach, in particular with smaller customers and in geographies where we ~~were~~have ~~unable~~less sales presence. Additionally, we have entered, and intend to ~~timely~~continue ~~secure~~to ~~replacement~~enter, ~~Channel~~into ~~Partners~~technology alliance partnerships with third parties to support our future growth plans.

We derive a substantial amount of our revenue from sales through Channel Partners, and we expect to continue to derive a substantial amount of our revenue from Channel Partners in future periods. Our agreements with our Channel Partners are generally non-exclusive and do not prohibit them from working with our competitors or offering competing products, and many of our Channel Partners may have more established relationships with our competitors. If our Channel Partners choose to place greater emphasis on solutions other than our own, fail to effectively market and sell our solutions, or fail to meet the needs of our customers, then our ability to grow our business and sell our solutions may be adversely affected. In addition, the loss of one or more of our larger Channel Partners or technology alliance partners, who may cease marketing our solutions with limited or no notice, and any inability to replace them, could adversely affect our business, financial condition, and results of operations. Moreover, our ability to expand our distribution channels depends in part on our ability to maintain successful relationships with our Channel Partners and educate and train our current and future Channel Partners about our solutions, which can be complex. If we fail to effectively manage our existing sales channels, or if our Channel Partners are unsuccessful in fulfilling the orders for our solutions, or if we are unable to enter into arrangements with, and retain a sufficient number of, high quality Channel Partners in each of the regions in which we sell solutions and keep them motivated to sell our solutions, our business, financial condition, and results of operations will be harmed. Even if we are successful, these relationships may not result in greater customer usage of our data security products or increased revenue. Our ability to influence, or have visibility into, the actions or efforts of our Channel Partners may be limited. If our partners, including our Channel Partners, fail to comply with applicable laws, including anti-corruption, export control and sanctions, antitrust, or competition laws, or engage in activities that result in or may result in liability, we may also be adversely affected through reputational harm, as well as other negative consequences, including litigation, government investigations and penalties.

In addition, the financial health of our Channel Partners and our continuing relationships with them are important to our success. Some of these Channel Partners may be unable to withstand adverse changes in economic conditions, including the current macroeconomic uncertainty, which could result in insolvency or the inability of such Channel Partners to obtain credit to finance purchases of our solutions and services. In addition, weakness in the end-user market could negatively affect the cash flows of our Channel Partners who could, in turn, delay paying their obligations to us, which would increase our credit risk exposure. Our business could be harmed if the financial condition of some of these Channel Partners substantially weakened, and we were unable to timely secure replacement Channel Partners.

If we do not effectively expand and train our sales force, we may be unable to add new customers or retain and increase sales to our existing customers, and our business will be adversely affected.

We depend on our sales force to obtain new customers and retain and increase sales with existing customers. Our ability to achieve significant revenue growth will depend, in large part, on our success in recruiting, training, and retaining sufficient numbers of sales personnel, as well as effectively managing leadership transitions and maintaining stability within our sales organization. Changes in sales leadership or organizational structure may result in temporary disruption, changes in strategy or execution, or challenges in maintaining sales team morale and productivity, and may increase the risk of attrition within our sales organization, including the potential loss of key sales personnel. We have expanded our sales organization significantly in recent periods and expect to continue to add additional sales capabilities in the near term. There is significant competition for sales personnel with the skills and technical knowledge that we require. New hires require significant training and may take significant time before they achieve full productivity, and this delay is accentuated by our long sales cycles. Our recent hires and planned hires may not become productive as quickly as we expect, and we may be unable to hire or retain sufficient numbers of qualified individuals in the markets where we do or plan to do business. In addition, a large percentage of our sales force is new to our company and selling our ~~data security~~ solutions, and therefore, this group may be less effective than our more seasoned sales personnel. Furthermore, hiring sales personnel in new countries, or expanding our existing presence, requires upfront and ongoing expenditures that we may not recover if the sales personnel fail to achieve full productivity. We may also incur additional compensation and training costs for our sales force, including as part of sales incentive realignment, as we work to migrate existing customers to RSC while ensuring retention and expansion. These additional costs may be higher than we expect depending on timing to complete the transition to RSC and any unforeseen challenges that arise, including due to additional costs faced by customers. Moreover, we could face challenges in our ability to retain sales personnel if the migration to RSC results in the loss of existing customers. We cannot predict whether, or to what extent, our sales will increase as we expand our sales force or how long it will take for sales personnel to become productive. If we are unable to hire and train a sufficient number of effective sales personnel, or the sales personnel we hire are not successful in obtaining new customers or retaining and increasing sales to our existing customer base, our business, financial condition, and results of operations will be adversely affected.

~~Our sales cycles can be long and unpredictable~~Rubrik, ~~and~~Inc. ~~our~~Q1 ~~sales~~2027 ~~efforts~~Form ~~require~~10-Q ~~considerable time and expense.~~53

Our revenue may fluctuate because of the length and unpredictability of the sales cycle for our data security solutions, particularly with respect to large organizations and government entities. For example, in light of current macroeconomic conditions, we have observed a lengthening of our sales cycles, which may be attributed to higher cost-consciousness around information technology budgets. Customers often view the subscription to our platform as a significant strategic decision and, as a result, frequently require considerable time to evaluate, test, and qualify our platform, including from a security and privacy perspective, prior to entering into or expanding a relationship with us. Large enterprises and government entities in particular often undertake a significant evaluation process that further

Rubrik, Inc. Q3 2026 Form 10-Q 65

Table of Contents

~~lengthens~~productivity. ~~our~~We ~~sales~~cannot ~~cycle.~~predict ~~Additionally~~whether, ~~RSC~~or ~~and~~to ~~other~~what ~~SaaS~~extent, ~~solutions~~our ~~may~~sales ~~elongate~~will increase as we expand our sales ~~cycles~~force asor how long it will take for sales personnel to become productive. If we are unable to hire and train a ~~result~~sufficient number of ~~additional~~effective sales personnel, or the sales personnel we hire are not successful in obtaining new customers or retaining and increasing sales to our existing customer ~~security~~base, our business, financial condition, and ~~privacy~~results ~~evaluations~~of operations will be adversely affected.

Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense.

Our revenue may fluctuate because of the length and unpredictability of the sales cycle for our solutions, particularly with respect to large organizations and government entities. For example, in light of current macroeconomic conditions, such as higher cost-consciousness around information technology budgets, as well as constraints affecting the availability or pricing of compatible commodity servers needed to deploy our solutions, including as a result of global chip shortages or allocation constraints, we have observed a lengthening of our sales cycles. Customers often view the subscription to our platform as a significant strategic decision and, as a result, frequently require considerable time to evaluate, test, and qualify our platform, including from a security and privacy perspective, prior to entering into or expanding a relationship with us. Large enterprises and government entities in particular often undertake a significant evaluation process that further lengthens our sales cycle. Additionally, RSC and other SaaS solutions may elongate our sales cycles as a result of additional customer security and privacy evaluations.

Our sales team develops relationships with our customers and works with our Channel Partners on account penetration, account coordination, sales, and overall market development. We spend substantial time and resources on our sales efforts without any assurance that our efforts will produce a sale. Data security product purchases are frequently subject to budget constraints, multiple approvals, and unanticipated administrative, processing, and other delays. As a result, it is difficult to predict whether and when a sale will be completed.

If we fail to adapt and respond effectively to rapidly changing technology, including technologies related to AI, evolving industry standards, changing regulations, or to changing customer needs, requirements, or preferences, our ~~data security~~ solutions may become less competitive.

Our ability to attract new users and customers and increase revenue from existing customers depends in large part on our ability to enhance, improve, and differentiate our existing offering, increase adoption and usage of our ~~data security~~ solutions, and introduce new ~~data security~~ products and capabilities. The market in which we compete is relatively new and subject to rapid technological change, including advances in AI, evolving industry standards, and changing regulations, as well as changing customer needs, requirements, and preferences. The success of our business will depend, in part, on our ability to adapt and respond effectively to these changes on a timely basis. Because the market for our data security solutions is relatively new, it is difficult to predict customer adoption, increased customer usage and demand for our data security solutions, the size and growth rate of this market, the entry of competitive products, or the success of existing competitive products. If we are unable to enhance our ~~data security~~ solutions and keep pace with rapid technological change, including developments related to AI and automated systems, or if new technologies emerge that are able to deliver competitive products at lower prices, more efficiently, more conveniently, or more securely than our ~~data security~~ solutions, our business, financial condition, and results of operations could be adversely affected.

To remain competitive, we need to continuously modify and enhance our ~~data security~~ solutions to adapt to changes and innovation in existing and new technologies. We expect that we will need to continue to differentiate our data management and data security capabilities, as well as expand and enhance our data security and AI solutions to support a variety of use cases. This development effort will require significant engineering, sales, and marketing resources. Any failure to effectively offer ~~data security~~ solutions for these adjacent use cases could reduce customer demand for our platform. Further, our ~~data security~~ solutions must also integrate with a variety of network, commodity appliance, mobile, cloud, and software platforms and technologies, and we need to continuously modify and enhance our ~~data security~~ solutions to adapt to changes and innovation in these technologies. This development effort may require significant investment in engineering, support, marketing, and sales resources, all of which would affect our business and results of operations. Any failure of our ~~data security~~ solutions to operate effectively with widely adopted data infrastructure platforms, applications, and technologies would reduce the demand for our ~~data security~~ solutions. If we are unable to respond to customer demand in a cost-effective manner, our ~~data security~~ solutions may become less marketable and less competitive or obsolete, and our business, financial condition, and results of operations could be adversely affected.

The competitive position of our ~~data security~~ solutions depends in part on their ability to operate with third-party products and services, including those of our technology alliance partners, and if we are not successful in maintaining and expanding the compatibility of our ~~data security~~ solutions with such products and services, our business may be harmed.

The competitive position of our ~~data security~~ solutions depends in part on their ability to operate with products and services of third parties, including software companies, software services, and infrastructure, and our ~~data security~~ solutions must be continuously modified and enhanced to adapt to changes in commodity appliance, software, networking, browser, and database technologies. In the future, one or more technology companies, whether our technology alliance partners or otherwise, may choose not to support the operation of their software, software services, and infrastructure with our data security solutions, or our data security solutions may not support the capabilities needed to integrate with such software, software services, and infrastructure. In addition, to the extent that a third party was to develop software or services that compete with ours, that provider may choose not to support our offering. We intend to facilitate the compatibility of our platform with various third-party software, software services, and infrastructure offerings by maintaining and expanding our business and technical relationships. If we are not successful in achieving this goal, our business, financial condition, and results of operations may be harmed.

~~Incorrect or improper implementation or use of our data security solutions could result in customer dissatisfaction and harm our business~~Rubrik, ~~financial~~Inc. ~~condition,~~Q1 ~~and~~2027 ~~results~~Form of10-Q ~~operations.~~54

Our data security solutions are deployed in a wide variety of IT infrastructures, including large-scale, complex technology environments, and we believe our future success will depend, at least in part, on our ability to support such deployments. Implementations of our data security solutions may be technically complicated, and it may not be easy to maximize the value of our data security solutions without proper implementation, training, and support. Some of our customers have experienced difficulties implementing our data security solutions in the past and may experience implementation difficulties in the future. If we or our customers are unable to implement our

Rubrik, Inc. Q3 2026 Form 10-Q 66

Table of Contents

~~data security solutions successfully~~services, ~~customer~~and ~~perceptions~~infrastructure ofwith our ~~data~~solutions, ~~security~~or our solutions may benot ~~impaired~~support the capabilities needed to integrate with such software, ~~our~~software ~~reputation~~services, and ~~brand~~infrastructure. ~~may~~In ~~suffer~~addition, to the extent that a third party was to develop software or ~~customers~~services that compete with ours, that provider may choose not to ~~renew~~support ~~their~~our ~~subscriptions~~offering. orWe ~~purchase~~intend ~~additional~~to ~~data~~facilitate ~~security~~the ~~products~~compatibility ~~from~~of usour platform with various third-party software, software services, and infrastructure offerings by maintaining and expanding our business and technical relationships. If we are not successful in achieving this goal, our business, financial condition, and results of operations may be harmed.

~~Any~~Incorrect ~~failure~~or byimproper ~~customers~~implementation ~~to appropriately implement our data security solutions~~ or ~~any~~use ~~failure~~ of our ~~data security~~ solutions ~~to effectively integrate and operate within our customers’ data management infrastructure~~ could result in customer dissatisfaction, ~~impact the perceived reliability of our data security solutions, result in negative press coverage, negatively affect our reputation,~~ and harm our business, financial condition, and results of operations.

WeOur ~~use~~solutions ~~third-party~~are ~~open~~deployed in a wide variety of IT infrastructures, including large-~~source~~scale, ~~software~~complex technology environments, and we believe our future success will depend, at least in part, on our ~~data~~ability ~~security~~to support such deployments. Implementations of our solutions may be technically complicated, ~~which~~and ~~could~~it ~~negatively~~may ~~affect~~not be easy to maximize the value of our ~~ability~~solutions without proper implementation, training, and support. Some of our customers have experienced difficulties implementing our solutions in the past and may experience implementation difficulties in the future. If we or our customers are unable to ~~sell~~implement our ~~data~~solutions ~~security~~successfully, customer perceptions of our solutions may be impaired, our reputation and brand may suffer, or ~~subject~~customers usmay choose not to ~~litigation~~renew their subscriptions or ~~other~~purchase ~~actions~~additional products from us.

~~Our~~Any ~~data~~failure ~~security~~by ~~solutions~~customers ~~include third-party open-source software, and we intend~~ to ~~continue~~appropriately toimplement ~~incorporate third-party open-source software in~~ our ~~data security~~ solutions inor ~~the~~any ~~future.~~failure ~~There is a risk that the use~~ of ~~third-party open-source software in~~ our ~~software~~solutions ~~could impose conditions or restrictions on our ability~~ to ~~monetize~~effectively ~~our~~integrate ~~software~~and oroperate ~~require~~within ~~making available the source code of all or part of~~ our ~~software~~customers’ ~~that~~data ~~include,~~management ~~incorporate~~infrastructure orcould ~~rely~~result ~~upon such open-source software. Although we have internal policies~~ in ~~place~~customer ~~designed~~dissatisfaction, toimpact ~~monitor~~ the ~~incorporation~~perceived reliability of ~~open-source software into~~ our ~~data security~~ solutions ~~to avoid such restrictions~~, weresult ~~cannot~~in benegative ~~certain~~press ~~that~~coverage, wenegatively ~~have~~affect ~~not incorporated open-source software in~~ our ~~data~~reputation, ~~security~~and ~~solutions~~harm ~~in a manner that is inconsistent with~~ our ~~licensing model or the licensing terms of any such open-source software. Open-source software is incorporated into or relied upon by many other software projects~~business, ~~including~~financial ~~open source projects as well as AI tools~~condition, and ~~there~~results isof ~~a risk that those dependent open-source libraries may be subject to inconsistent licensing terms that affect our ability to use the software~~operations. ~~This could create further uncertainties as to the governing terms for the open-source software we incorporate.~~

InWe ~~addition,~~use ~~the terms of certain open~~third-~~source~~party ~~licenses to which we are subject have not been interpreted by U.S. or foreign courts, and there is a risk that~~ open-source ~~software~~components ~~licenses could be construed~~ in ~~a manner that imposes unanticipated restrictions or conditions on~~ our ~~use of such software. Additionally~~solutions, ~~we may from time to time face claims from third parties claiming ownership of, or demanding release of, the software or derivative works that we developed using such open-source software,~~ which could ~~include~~negatively ~~proprietary~~affect ~~portions of~~ our ~~source~~ability ~~code, or otherwise seeking~~ to ~~enforce~~sell ~~the~~our ~~terms~~solutions ofor ~~the~~subject ~~open-source licenses. These claims could result in litigation and could require~~ us to ~~make~~litigation ~~those proprietary portions of our source code freely available, purchase a costly license~~ or ~~cease~~other ~~offering the implicated software or services unless and until we can re-engineer them to avoid infringement~~actions. ~~This re-engineering process could require significant additional research and development resources, and we may not be able to complete it successfully.~~

InOur ~~addition~~solutions toinclude ~~risks~~third-party ~~related~~open-source tocomponents, ~~license~~including ~~requirements~~software and models, ~~use~~and ofwe intend to continue to incorporate third-party open-source ~~software~~components ~~can~~in ~~lead~~our tosolutions ~~greater~~in ~~risks~~the ~~than~~future. There is a risk that the use of third-party ~~commercial~~open-source components in our software could impose conditions or restrictions on our ability to monetize our software or require making available the source code of all or part of our software that include, asincorporate or rely upon such open-source ~~licensors~~components. ~~generally~~Although dowe ~~not~~have ~~provide~~internal ~~warranties.~~policies ~~Use~~in place designed to monitor the incorporation of open-source ~~software~~components ~~may~~into ~~also~~our ~~introduce~~solutions ~~security~~to ~~risks~~avoid assuch itrestrictions, ~~may~~we ~~contain~~cannot ~~security~~be ~~vulnerabilities,~~certain ~~and~~that ~~hackers~~we ~~and~~have ~~other~~not ~~third~~incorporated ~~parties~~open-source ~~may~~components ~~exploit~~in our solutions in a manner that is inconsistent with our licensing model or the ~~public~~licensing ~~availability~~terms of any such open-source components. Open-source software tois ~~determine~~incorporated ~~how~~into or relied upon by many other software projects, including open source projects as well as AI tools, and there is a risk that those dependent open-source libraries may be subject to ~~compromise~~inconsistent licensing terms that affect our ~~data~~ability ~~security~~to ~~solutions~~use the software. This could create further uncertainties as to the governing terms for the open-source components we incorporate.

In addition, ~~licensors~~the terms of certain open-source ~~software~~licenses ~~included~~to which we are subject have not been interpreted by U.S. or foreign courts, and there is a risk that open-source licenses could be construed in a manner that imposes unanticipated restrictions or conditions on our ~~data~~use ~~security~~of ~~solutions~~such ~~may~~components. Additionally, we may from time to time face claims from third parties claiming ownership of, ~~modify~~or ~~the~~demanding ~~terms~~release of, ~~their~~the ~~license~~software ~~agreements~~or ~~applicable~~derivative toworks ~~any~~that ~~updates~~we indeveloped using such aopen-source ~~manner~~components, ~~that~~which ~~those~~could ~~license~~include ~~terms~~proprietary ~~may~~portions ~~include~~of ~~restrictions~~our ~~that~~source ~~make~~code, or otherwise seeking to enforce the ~~use~~terms of ~~such~~the ~~software~~open-source ~~incompatible~~licenses. ~~with~~These ~~our~~claims ~~business,~~could ~~and~~result ~~thus~~in litigation and could, ~~among~~require ~~other~~us ~~consequences~~to make those proprietary portions of our source code freely available, ~~prevent~~purchase usa ~~from~~costly ~~using~~license or ~~incorporating~~cease ~~new~~offering ~~updates~~the ofimplicated ~~such~~ software ~~that~~or ~~are~~services ~~subject~~unless and until we can re-engineer them to ~~the~~avoid ~~modified~~infringement. ~~license~~This re-engineering process could require significant additional research and development resources, and we may not be able to complete it successfully.

In addition to risks related to license requirements, use of third-party open-source components can lead to greater risks than use of third-party commercial components, as open-source licensors generally do not provide warranties. Use of open-source components may also introduce security risks as it may contain security vulnerabilities, and hackers and other third parties may exploit the public availability of such open-source components to determine how to compromise our solutions.

In addition, licensors of open-source components included in our solutions may, from time to time, modify the terms of their license agreements applicable to any updates in such a manner that those license terms may include restrictions that make the use of such components incompatible with our business, and thus could, among other consequences, prevent us from using or incorporating new updates of such components that are subject to the modified license.

In addition, any source code that we contribute to open-source projects becomes publicly available, subject to the relevant open source license. As a result, our ability to protect some of our intellectual property rights in such source code may be limited or lost entirely, and we would be unable to prevent our competitors or others from using such contributed source code in accordance with the relevant open source license.

~~Any of these risks could be difficult to eliminate or manage~~Rubrik, ~~and~~Inc. ifQ1 ~~not~~2027 ~~addressed,~~Form ~~could~~10-Q ~~have a negative effect on our business, financial condition, and results of operations.~~55

Our success depends, in part, on the integrity and scalability of our systems and infrastructures. System interruption or delays from third-party data center hosting facilities and the lack of integration, redundancy, and scalability in our systems and infrastructures could impair the delivery of our data security solutions and harm our business.

Our success depends, in part, on our ability to maintain the integrity of our systems and infrastructure, including websites, information, and related systems. System interruption and the lack of integration and sufficient redundancy in our information systems and infrastructures may harm our ability to operate websites, respond to customer inquiries, and generally maintain cost-efficient operations. We may experience occasional system interruptions that make some or all systems or data unavailable or prevent us from efficiently providing data security solutions.

Rubrik, Inc. Q3 2026 Form 10-Q 67

Table of Contents

~~We currently utilize third-party data center hosting facilities located in the United States and internationally.~~ Any ~~damage to, or failure~~ of, ~~the~~these ~~data~~risks ~~facilities generally~~ could ~~result~~be indifficult ~~interruptions in our data security solutions. As we continue~~ to ~~add~~eliminate ~~data~~or ~~center hosting facilities and add capacity in our existing data facilities~~manage, ~~we may move or transfer our data~~ and ~~our~~if ~~customers’~~not ~~data. Despite precautions taken during this process~~addressed, ~~any~~could ~~unsuccessful~~have ~~data~~a ~~transfers~~negative ~~may~~effect ~~impair the delivery of our data security solutions. We also rely~~ on affiliate and third-party computer systems, broadband, and other communications systems and service providers in connection with the provision of services generally, as well as to facilitate, process, and fulfill transactions. Interruptions in our ~~data security solutions may reduce our revenue~~business, ~~cause~~financial ~~us to issue credits or pay penalties~~condition, cause customers to terminate their subscriptions or data security solutions contracts, or harm our renewal rates or our ability to attract new customers. Our business will also be harmed if our customers and ~~potential~~results ~~customers~~of ~~believe our data security solutions are unreliable~~operations.

~~Fire,~~Our ~~flood,~~success ~~power loss~~depends, ~~telecommunications~~in ~~failure~~part, ~~hurricanes,~~on ~~tornadoes,~~the ~~earthquakes,~~integrity ~~acts~~and ofscalability ~~war or terrorism, acts~~ of ~~God,~~our ~~and similar events or disruptions may damage or interrupt computer, broadband, or other communications~~ systems and infrastructures ~~at any time~~. ~~Any~~System ~~of these events could cause system~~ interruption, or delays, ~~and loss of critical data, and could prevent us~~ from ~~providing~~third-party ~~our~~ data ~~security~~center ~~solutions.~~hosting ~~While~~facilities weand ~~have~~the ~~backup~~lack ~~systems for certain aspects~~ of ~~our operations~~integration, ~~disaster recovery planning by its nature cannot be sufficient for all eventualities. In addition~~redundancy, weand ~~may~~scalability ~~not~~in ~~have~~our ~~adequate~~systems ~~insurance~~and ~~coverage~~infrastructures tocould ~~compensate~~impair ~~for losses from a major interruption. As we continue to expand~~ the ~~number~~delivery of our ~~customers~~solutions and data security solutions products available to our customers, we may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in data security solutions. If any of these events were to occur, it could harm our business~~, financial condition, and results of operations~~.

WeOur ~~rely~~success depends, in part, on ~~software~~our ability to maintain the integrity of our systems and ~~data~~infrastructure, ~~licensed~~including ~~from~~websites, ~~other~~information, ~~parties~~and related systems. ~~Defects~~System ininterruption orand the ~~loss~~lack of ~~software~~integration orand ~~access~~sufficient toredundancy ~~data~~in ~~from~~our ~~third~~information ~~parties~~systems ~~could~~and ~~increase~~infrastructures may harm our ~~costs~~ability to operate websites, respond to customer inquiries, and ~~harm~~generally ~~the~~maintain ~~quality~~cost-efficient ofoperations. ~~our~~We may experience occasional system interruptions that make some or all systems or data ~~security~~unavailable or prevent us from efficiently providing solutions.

~~Components~~We ofcurrently ~~our~~utilize third-party data ~~security~~center ~~solutions~~hosting ~~include~~facilities orlocated ~~rely~~in ~~upon~~the ~~software~~United States and ~~data licensed from third parties~~internationally. ~~Our~~Any ~~business~~damage ~~could~~to, beor ~~disrupted~~failure ~~if any~~ of, the ~~software or~~ data wefacilities ~~license~~generally ~~from~~could ~~others~~result ~~and~~in ~~functional~~interruptions ~~equivalents~~in ~~thereof~~our ~~were~~solutions. ~~either~~As nowe ~~longer~~continue ~~available~~ to usadd ordata nocenter ~~longer~~hosting ~~offered~~facilities onand ~~commercially~~add ~~reasonable~~capacity ~~terms.~~in Inour ~~either~~existing ~~case~~data facilities, we may bemove ~~required~~or totransfer ~~either redesign~~ our data ~~security~~and ~~solutions~~our tocustomers’ ~~function with software or~~ data. ~~available~~Despite ~~from~~precautions ~~other~~taken ~~parties~~during orthis ~~develop these components ourselves~~process, ~~which~~any ~~would~~unsuccessful ~~result~~data intransfers ~~increased~~may ~~costs~~impair ~~and could result in delays in~~ the ~~release~~delivery of ~~new~~our ~~data security~~ solutions. ~~Furthermore,~~We wealso ~~might~~rely beon ~~forced~~affiliate toand ~~limit~~third-party ~~the~~computer ~~features~~systems, ~~available~~broadband, inand ~~our~~other ~~current~~communications orsystems ~~future~~and ~~data~~service ~~security~~providers ~~solutions.~~in Ifconnection wewith ~~fail~~the toprovision ~~maintain or renegotiate any~~ of ~~these~~services ~~software or data licenses~~generally, weas ~~could~~well ~~face~~as ~~significant delays and diversion of resources in attempting~~ to ~~license~~facilitate, process, and ~~integrate~~fulfill ~~functional equivalents~~transactions. ~~While~~Interruptions ~~we believe that~~ in ~~most~~our ~~cases~~solutions ~~there~~may ~~are~~reduce ~~commercially~~our ~~reasonable~~revenue, ~~alternatives~~cause us to ~~the~~issue ~~third-party~~credits ~~software~~or ~~and~~pay ~~data we currently license~~penalties, ~~this~~cause ~~may~~customers ~~not~~to ~~always~~terminate betheir ~~the~~subscriptions ~~case,~~ or itsolutions ~~may~~contracts, ~~be time consuming~~ or ~~expensive~~harm toour ~~replace~~renewal ~~existing~~rates ~~third-party software~~ or ~~data~~our orability ~~find~~to aattract ~~replacement~~new ~~third-party provider~~customers. Our ~~use~~business ofwill ~~additional~~also orbe ~~alternative~~harmed ~~third-party~~if ~~software~~our orcustomers ~~data or third-party providers would require us to enter into license agreements with third parties,~~ and wepotential ~~may~~customers ~~not~~believe beour ~~able~~solutions toare ~~enter into such agreements on advantageous terms~~unreliable.

Fire, flood, power loss, telecommunications failure, hurricanes, tornadoes, earthquakes, acts of war or terrorism, acts of God, and similar events or disruptions may damage or interrupt computer, broadband, or other communications systems and infrastructures at any time. Any of these events could cause system interruption, delays, and loss of critical data, and could prevent us from providing our solutions. While we have backup systems for certain aspects of our operations, disaster recovery planning by its nature cannot be sufficient for all eventualities. In addition, we may not have adequate insurance coverage to compensate for losses from a major interruption. As we continue to expand the number of our customers and solutions products available to our customers, we may not be able to scale our technology to accommodate the increased capacity requirements, which may result in interruptions or delays in the delivery or performance of our solutions. If any of these events were to occur, it could harm our business, financial condition, and results of operations.

We rely on software and data licensed from other parties. Defects in or the loss of software or access to data from third parties could increase our costs and harm the quality of our solutions.

Components of our solutions include or rely upon software and data licensed from third parties. Our business could be disrupted if any of the software or data we license from others and functional equivalents thereof were either no longer available to us or no longer offered on commercially reasonable terms. In either case, we may be required to either redesign our solutions to function with software or data available from other parties or develop these components ourselves, which would result in increased costs and could result in delays in the release of new solutions. Furthermore, we might be forced to limit the features available in our current or future data security or AI solutions. If we fail to maintain or renegotiate any of these software or data licenses, we could face significant delays and diversion of resources in attempting to license and integrate functional equivalents. While we believe that in most cases there are commercially reasonable alternatives to the third-party software and data we currently license, this may not always be the case, or it may be time consuming or expensive to replace existing third-party software or data or find a replacement third-party provider. Our use of additional or alternative third-party software or data or third-party providers would require us to enter into license agreements with third parties, and we may not be able to enter into such agreements on advantageous terms.

We are subject to governmental export and import controls and economic sanctions laws and regulations that could impair our ability to compete in international markets or subject us to liability and reputational harm if we violate the controls.

Our data security solutions are subject to U.S. export controls, including the Export Administration Regulations, and we incorporate encryption technology into our ~~data security~~ solutions. Our data security solutions and the underlying technology may be exported outside of the United States only in compliance with the applicable regulations and any required export authorizations, including byan export license, applicability of a license exception, or other appropriate government authorizations, ~~including~~such as the filing of an encryption classification request or self-classification report, as applicable. Obtaining the necessary export license or other authorization for a particular sale may be time-consuming and may result in the delay or loss of sales opportunities.

Furthermore, we are required to comply with economic and trade sanctions laws and regulations of the countries where we do business, including those administered and enforced by the U.S. government (~~including~~for example, through the Office of Foreign Assets Control of the U.S. Treasury Department and the U.S. Department of State). These economic and trade sanctions prohibit or restrict the provisions of products and services to embargoed jurisdictions or sanctioned persons, unless otherwise authorized.

While we have taken certain precautions to prevent our data security solutions from being provided in violation of trade controls and are in the process of enhancing our policies and procedures relating to trade controlsRubrik, ~~our data security solutions may have been in the past, and could in the future be, provided inadvertently and without our knowledge in violation of such laws~~Inc. ~~Violations~~Q1 of2027 ~~U.S.~~Form ~~trade~~10-Q ~~controls can result in significant fines or penalties and possible criminal liability for responsible employees and managers, in addition to potential reputational harm.~~56

If our partners, including our Channel Partners, fail to obtain appropriate import, export, or re-export licenses or permits, we may also be adversely affected through reputational harm, as well as other negative consequences, including government investigations and penalties.

Rubrik, Inc. Q3 2026 Form 10-Q 68

Table of Contents

~~Also,~~of ~~various~~the ~~countries,~~U.S. inTreasury ~~addition~~Department toand the ~~United~~U.S. ~~States,~~Department ~~regulate the import and export~~ of certain encryption and other technology, including import and export licensing requirements, and have enacted laws that could limit our ability to distribute our data security solutions or could limit our customers’ ability to implement our data security solutions in those countriesState). ~~Changes~~These ineconomic ~~our data security solutions or future changes in export~~ and ~~import~~trade ~~regulations~~sanctions ~~may~~prohibit ~~create delays in the introduction of our data security solutions in international markets, prevent our customers with international operations from deploying our data security solutions globally~~ or, inrestrict ~~some cases, prevent~~ the ~~export~~provisions ~~or import~~ of ~~our~~products ~~data~~and ~~security~~services ~~solutions~~ to ~~certain~~embargoed ~~countries,~~jurisdictions ~~governments,~~and orsanctioned persons ~~altogether. From time to time~~, ~~various~~unless ~~governmental~~otherwise ~~agencies have proposed additional regulation of encryption technology~~authorized.

~~Any~~While ~~change~~we inhave ~~export~~taken orcertain ~~import~~precautions ~~regulations,~~to ~~economic~~prevent ~~sanctions,~~our orsolutions and related ~~laws~~technology orand ~~regulations,~~services orfrom ~~change~~being provided in ~~the~~violation ~~countries,~~of ~~governments,~~trade ~~persons,~~controls orand ~~technologies~~are ~~targeted~~in bythe ~~such~~process ~~regulations,~~of ~~could~~enhancing ~~result~~our incompliance ~~decreased~~policies ~~use~~and ofprocedures ~~our~~relating ~~data~~to ~~security~~trade controls, our solutions bymay have been in the past, orand could in ~~our~~the ~~decreased~~future ~~ability~~be, toprovided ~~export~~inadvertently and/or ~~sell~~without our ~~data~~knowledge ~~security~~in ~~solutions~~violation ~~to,~~of ~~existing~~such ortrade ~~potential~~control ~~customers~~laws ~~with~~and ~~international operations~~regulations. ~~Any~~Violations ~~decreased use~~ of ~~our~~U.S. ~~data~~trade ~~security~~controls ~~solutions~~ or ~~limitation~~other onapplicable ~~our~~laws/regulations ~~ability~~can toresult ~~export~~in orsignificant ~~sell~~fines ~~our~~or ~~data~~penalties ~~security~~and ~~solutions~~possible ~~would~~criminal ~~adversely~~liability ~~affect~~for ~~our~~responsible ~~business,~~employees ~~financial~~and ~~condition~~managers, ~~results~~in ofaddition ~~operations,~~to ~~and~~potential ~~growth~~reputational ~~prospects~~harm.

Also, various countries, in addition to the United States, regulate the import and export of certain encryption software and related technology, including import and export licensing requirements, and have enacted laws that could limit our ability to distribute our solutions or could limit our customers’ ability to implement our solutions in those countries. Changes in our solutions or future changes in export and import regulations may create delays in the introduction of our solutions in international markets, prevent our customers with international operations from deploying our solutions globally or, in some cases, prevent the export or import of our solutions to certain countries, governments, or persons altogether. From time to time, various governmental agencies have proposed, and are expected to implement additional regulation of encryption technology.

Any change in export or import regulations, economic sanctions, or related laws or regulations, or change in the countries, governments, persons, or technologies targeted by such regulations, could result in decreased use of our solutions by, or in our decreased ability to export or sell our solutions to, existing or potential customers. Any decreased use of our solutions or limitation on our ability to export or sell our solutions would adversely affect our business, financial condition, results of operations, and growth prospects.

We are subject to anti-corruption, anti-bribery, and similar laws, and non-compliance with such laws can subject us to criminal or civil liability and harm our business, financial condition, and results of operations.

We are subject to the U.S. Foreign Corrupt Practices Act ("“FCPA"”), U.S. domestic bribery laws, the UK Bribery Act, and other anti-corruption and anti-bribery laws in the countries in which we conduct ~~activities~~business. Anti-corruption and anti-bribery laws are interpreted broadly to ~~generally~~ prohibit companies, their officers and employees, and their third-party intermediaries from authorizing, offering, or providing, or in some cases receiving, directly or indirectly, improper payments or benefits to or from ~~recipients~~persons in the public or private sector. As a public company, ~~the~~we ~~FCPA~~are ~~separately~~also ~~requires~~required ~~that~~by wethe FCPA to keep accurate books and records and maintain internal accounting controls sufficient to assure management’s control, authority, and responsibility over our assets. As we engage in and increase our international business and sales to the public sector, we may engage with business partners and third-party intermediaries, including Channel Partners, to market and sell our ~~data security~~ solutions and to obtain necessary permits, licenses, and other regulatory approvals from government authorities. In addition, we or our third-party intermediaries may have direct or indirect interactions with officials, employees, or other representatives of government agencies or state-owned or affiliated entities. We can be held liable for the corrupt or other illegal activities of these third-party intermediaries and our employees, representatives, contractors, partners, and agents, even if we do not explicitly authorize or have actual knowledge of such unlawful activities.

While we have policies and procedures and conduct training designed to address compliance with such laws, our employees and agents may take actions in violation of our policies and applicable law, for which we may be ultimately held responsible. As we increase our international sales and business, our risks under these laws may increase.

Detecting, investigating, responding to, and resolving actual or alleged violations of anti-corruption laws can ~~require~~lead to a materially significant diversion of time, resources, and attention from senior management, as well as significant defense costs and other professional fees. In addition, noncompliance with anti-corruption and anti-bribery laws, could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, enforcement actions, fines, damages, other civil or criminal penalties or injunctions, suspension, or debarment from contracting with certain persons, reputational harm, adverse media coverage, and other collateral consequences. If any subpoenas or investigations are launched, or governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal proceeding, our business, financial condition, and results of operations could be harmed.

Downturns or upturns in our sales may not be immediately reflected in our financial condition and results of operations.

We recognize a significant portion of our revenue ratably over the term of subscriptions to our ~~data security~~ solutions. As a result, any decreases in new subscriptions or renewals in any one period may not immediately be fully reflected as a decrease in revenue for that period but would negatively affect our revenue in future quarters. This also makes it difficult for us to rapidly increase our revenue through the sale of additional subscriptions in any period. If our quarterly results of operations fall below the expectations of investors and securities analysts who follow our stock, the price of our Class A common stock would decline substantially, and we could face costly lawsuits, including securities class actions.

Rubrik, Inc.

Q1 2027 Form 10-Q

Table of Contents

of additional subscriptions in any period. If our quarterly results of operations fall below the expectations of investors and securities analysts who follow our stock, the price of our Class A common stock would decline substantially, and we could face costly lawsuits, including securities class actions.

Seasonality may cause fluctuations in our revenue and related metrics.

Historically, we have experienced seasonality in revenue and related metrics, as we typically sell a higher percentage of subscriptions to new customers, and expansion and renewal subscriptions with existing customers in the fourth quarter of our fiscal year. We believe that this results from the procurement, budgeting, and deployment cycles of many of our customers, particularly our enterprise customers. We expect that this seasonality may continue to affect our revenue and related metrics in the future and might become more pronounced as we continue to target enterprise customers.

~~Rubrik~~Our subscription annual recurring revenue (“Subscription ARR”), ~~Inc~~cloud annual recurring revenue (“Cloud ARR”), and certain other operational data are operating metrics that are subject to assumptions and limitations, including that the factors that impact Subscription ARR will vary from those that impact subscription revenue. Q3As ~~2026~~such, ~~Form~~these ~~10-Q~~metrics 69may not provide an accurate indication of our actual performance or our future results.

~~Table~~Subscription ARR, Cloud ARR, and other non-GAAP operational metrics are based on numerous assumptions and limitations, are calculated using our internal data from non-financial systems, have not been independently audited by third party financial audit firms as is typical for GAAP financials, and may not accurately reflect actua

Filing Compare · Rubrik, Inc.