Prepared remarks
Good day, everyone, and welcome to today's Rubrik Second Quarter Fiscal Year 2025 Results Conference Call. At this time, all participants are in a listen-only mode. Later, you will have the opportunity to ask questions during the question-and-answer session. Please note today's call will be recorded. It is now my pleasure to turn the conference over to Melissa Franchi, Vice President, Head of Investor Relations. Please go ahead.
Hello, everyone. Welcome to Rubrik's second quarter fiscal year 2025 financial results conference call. On the call with me today are Bipul Sinha, CEO, Chairman and Co-Founder of Rubrik; and Kiran Choudary, Chief Financial Officer. Our earnings press release was issued today after the market closed and may be downloaded from the Investor Relations page at www.ir.rubrik.com. Also, on this page, you'll be able to find a slide deck with financial highlights that, along with our earnings release, includes a reconciliation of GAAP to non-GAAP financial results. During this call, we will make forward-looking statements, including statements regarding our financial outlook for Q3 and the full fiscal year 2025, our expectations regarding market trends, our market position, opportunities including generative AI, growth strategies and our initiatives. These statements are only predictions that are based on what we believe today and actual results may differ materially. These forward-looking statements are subject to risks and other factors that could affect our performance and financial results, which we discuss in detail in our filings with the SEC. Rubrik assumes no obligation to update any forward-looking statements we may make on today's call. With that, I'll hand the call over to Bipul.
Thank you, Melissa, and thank you everyone for joining us today. Now, let's get started. We delivered an outstanding Q2. We outperformed across all guided top-line and profitability metrics, and are raising our annual guidance. Here are a few numbers that highlight the quarter. Our subscription ARR reached $919 million, growing 40% year-over-year. Our subscription revenue was $191 million, growing 50% year-over-year. Our subscription NRR remained strong above 120%. And finally, our all-important profitability measure, subscription ARR contribution margin improved by over 1300 basis points year over year. We continue to focus and make great strides in improving our business efficiency and profitability. Now, let me give you the broader context of our business that enables these great results. Rubrik is winning in the cyber resilience market. As more organizations realize that cyber-attacks and breaches are inevitable, cyber resilience is becoming the number one topic in cybersecurity.
In my conversations with CIOs and CISOs around the world, what is clear is in spite of spending millions of dollars on cyber-attack prevention tools, it is not a question of if, but when they will experience a successful cyber-attack. Every Board of Directors is asking for a cyber resilience strategy to ensure that their businesses get back up and running as fast as possible. The recent global IT outage is a great reminder that resilience is required in an interconnected digital economy that can easily be disrupted by human error or a threat actor. What is driving Rubrik's results is our highly differentiated platform, purpose-built to deliver complete cyber resilience. Rubrik's Security Cloud combines Data Security Posture Management (DSPM) with cyber recovery in a Zero Trust data security platform. We are the only vendor in the market to offer integrated DSPM plus cyber recovery, which enables cyber resilience.
Our unique AI-powered architecture delivers data risk, data set, and rapid cyber recovery at scale, enabling our customers to deal with situations before, during, and after cyberattacks. Other products in the market generally make cyber recovery time up to 100 times longer, because they can't natively deliver four things needed for fast cyber recovery: the scope of the attack, time of infection, sensitivity of impacted data, and finally, malware hunting and quarantining. These are complex problems to solve. We solve these because our architecture leverages AI and machine learning inside our integrated dataset engine. This is how we deliver cyber resilience natively, not with bolt-on security tools or third-party integrations. Our customers choose Rubrik because we can confidently meet their cyber recovery time objective. We transform cyber recovery from a long, drawn-out existential affair to a simple short operation, so organizations can continue running their businesses.
As a result, we win the vast majority of deals in head-to-head competition. This quarter, a Fortune 500 European Automotive supplier selected Rubrik as its de facto cyber resilience platform, replacing their complex legacy data protection solution, which they believed was vulnerable in the event of a cyber event. Another example, an American multinational investment bank and financial services organization replaced a competing new-gen vendor solution with Rubrik, given our superior cyber recovery speed at scale, and our more robust and integrated security capabilities. We've been successful in the marketplace because of our differentiated single management and security controls across enterprise, cloud, and SaaS workloads, while delivering incredible simplicity, performance, and scalability. This quarter, a U.S. Insurance company replaced its existing data backup and recovery vendor with Rubrik Security Cloud Enterprise Edition and SaaS data protection for M365.
This customer was dissatisfied with their current WAN provider, a competing new-gen vendor, as it could not operate at the scale and speed the business required nor protect their M365 environment. During the proof of concept, we demonstrated a recovery time of about 35 seconds, compared to over five hours for the incumbent. The customer security team also endorsed Rubrik for our suite of native security features such as anomaly detection, threat hunting and monitoring, and sensitive data discovery, which their existing vendor lacked. We are also striking a chord with customers operating in the public cloud, due to our ability to drive immediate cloud cost savings while delivering fast cyber recovery time. A Fortune 500 global leader in prestige beauty expanded their RSC footprint by purchasing cloud-native protection for Azure, extending Rubrik for complete cyber resilience across both datacenter and cloud workloads.
This customer selected Rubrik for our ability to deliver complete cyber resilience in addition to significant cloud cost savings. We also significantly expanded our cyber resilience footprint at ARIA, the innovation company in Italy, across cloud-native and unstructured workloads to secure the company's digital transformation. ARIA manages sensitive healthcare data of 10 million Lombardi citizens. In addition, we have helped hundreds of customers quickly come back online, after the recent global IT disruption. Our customers were grateful for our ability to get their businesses back up and running quickly. An IT leader at a large hospital network wrote, 'Rubrik was instrumental in helping the hospital continue services during this massive outage. We did not have to cancel any appointments, and we were able to provide all services to patients. It would have been a different story with our previous solution.'
What Rubrik does matters. Now moving on to DSPM. Our view is that cyber resilience not only requires cyber recovery, but also data security posture. Cyber recovery is about wartime, while data posture is about before and during cyber-attack preparation. DSPM gives visibility into sensitive data exposure to minimize surface area of attack and the risk of data exfiltration. This quarter, a large European agricultural company expanded Rubrik's cyber resilience footprint by adding Rubrik DSPM to reduce the risk of data exposure and exfiltration. This customer replaced their existing DSPM vendor, noting Rubrik's superior ease of use and greater visibility across multi-cloud environments. Another example, a U.S. consumer services company added Rubrik DSPM to provide visibility into where its sensitive data resides and reduce its attack surface. Rubrik automated the discovery and classification of the company's sensitive data in only a few hours, which would have otherwise taken months of manual work across 10 full-time employees according to the customer.
In addition, what we are seeing is that generative AI brings urgency to DSPM. Before an organization's proprietary data gets fed into Large Language Models, data sensitivity and user access must be managed. AI trust, safety, and preparation must be established, and DSPM plays a critical role in this. Now, let's talk about our partnership across the security and data landscape. These relationships are a key part of our go-to-market motion. We recently made a few notable announcements that deepened and widened our partner relationships. Last month, we announced a new partnership and technology integration with Mandiant, part of Google Cloud. This collaboration offers our customers a tightly integrated end-to-end solution spanning cyber threat detection, incident response, and data recovery. Through this partnership, joint customers will be able to ensure that in the event of an attack, the Mandiant and Rubrik team will work together to help the business get back up and running as fast as possible.
We continue to strengthen our partnerships with cloud providers as well. As an example, this quarter Rubrik was named Microsoft Healthcare and Life Sciences Partner of the Year for 2024. This award comes on the heels of our win last year as Microsoft Partner of the Year in the U.S. and in the UK. This accolade represents our commitment to protecting all data, including patient data, while enabling seamless operations in healthcare organizations and driving innovative solutions in partnership with Microsoft. Now, let's turn to business efficiency and profitability. This quarter, we improved our subscription ARR contribution margin by over 1,300 basis points year-on-year. We are pleased with the margin improvement, and we are relentlessly focused on opportunities to continue these improvements. While we invest in our innovation platform and go-to-market engine to capture the cyber resilience opportunity, let me be very clear.
We are equally focused on delivering leverage and profitability in our business model. These are key components to building an enduring business, and we are executing well on that path. A big thank you to all Rubrikans around the world for their hard work and diligent focus. In closing, I will leave you with three takeaways. First, cyber resilience is where the cybersecurity market is going, and we are a leader in cyber resilience. Second, we are winning against the competition because of our highly differentiated and unique architecture. This is why our customers can rapidly recover from cyberattacks at scale. And finally, in addition to growth at scale, we believe our path to profitability is clear, and we continue to make great strides in building a durable business. With that, I'm pleased to pass it over to our Chief Financial Officer, Kiran Choudary.
Thank you, Bipul. Good afternoon, everyone, and thank you for joining us today. As Bipul shared, we've had a very strong second quarter all around. Notwithstanding the broader macro environment, our team continues to execute very well and take advantage of the market opportunity, which is reflected in our results. The quarter was highlighted by continued prioritization of cyber resilience among our customers, momentum in large deals, and notable improvement in profitability. This drove results ahead of the high end of our guidance across all of our key operating metrics including subscription ARR and subscription ARR contribution margin. Today, I will briefly recap our second quarter fiscal 2025 financial results and key operating metrics and then provide guidance for the third quarter and full-year fiscal 2025. All comparisons unless otherwise noted are on a year-over-year basis. As a reminder, our key top-line metric is subscription ARR, which we believe best illustrates our success in acquiring new customers and maintaining and expanding our relationships with existing customers.
Our highly differentiated platform combining DSPM and Cyber Recovery drives our leadership in the cyber resilience market. This is highlighted by our second quarter performance. Subscription ARR was $919 million in the second quarter, up 40%. We continue to drive adoption of Rubrik's equity cloud, which resulted in $678 million of cloud ARR, up 80%. Our subscription ARR growth benefited by a couple of percentage points from transitioning our declining maintenance base to RSC. Our strong results were driven by a combination of new logo lands to Rubrik and existing customer expansions. We have a compelling land and expand model that allows for a significant expansion opportunity after our initial contract. The three main vectors that drive expansion with our customers are: one, the growth of data from applications already secured by Rubrik; two, additional applications secured on our platform; and three, adoption of additional data security products.
As an example, the adoption of additional security functionality now contributes over one-third of our subscription net retention rate, up from approximately a quarter in the year-ago period. This land and expand motion drove another quarter of greater than 120% average subscription net retention rate. We ended Q2 with 1,969 customers with subscription ARR of $100,000 or more, up 35%. These larger customers now contribute 81% of our subscription ARR, up from 78% in the year-ago period as we become an increasingly strategic partner to our enterprise customers. For our Q2 in fiscal 2025, subscription revenue was $191 million, up 50%. Total revenue was $205 million, up 35%. Turning to the geographic mix of revenue, revenue from the Americas grew 36% to $147 million. Revenue from outside the Americas grew 34% to $58 million. Before turning to gross margins, expenses, and profitability, I would like to note that I will be discussing non-GAAP results going forward.
We are committed to balancing strong growth at scale with improving profitability. We are focused on delivering strong gross margins, improving our subscription ARR contribution margin, and growing free cash flow. Our non-GAAP gross margin was 77% in Q2, in line with the year-ago period and up from 70% in fiscal 2023. Gross margin benefited from changing product mix and improving efficiency of our customer support organization. These benefits were offset by higher cloud hosting costs due to the development in and growth of our cloud solutions, which we expect to continue to scale in the future. We anticipate total gross margin to stay at the lower end of our long-term target of 75% to 80%. As a reminder, we look at subscription ARR contribution margin as a key measure of operating leverage supporting our path to profitability. This is calculated as subscription ARR less non-GAAP cost of subscription revenue and less non-GAAP operating expense, divided by subscription ARR.
We find this to be a more relevant metric to demonstrate improvement in operating leverage than operating margins or free cash flow because it removes the impact from our cloud transformation as well as evolving contract duration and payment terms. We believe the improvement in our subscription ARR contribution margin demonstrates our ability to drive operating leverage and profitability at scale. Subscription ARR contribution margin was negative 8% in the last 12 months, compared to negative 22% in the year-ago period, an improvement of over 1,300 basis points. Last 12 months operating expenses in this calculation include the $23 million in employer payroll taxes we accrued in Q1. Adjusting for this one-time expense, our subscription ARR contribution margin for Q2 would be negative 6%, an improvement of 1,600 basis points from last year. The improvement in subscription contribution margin was driven by our growing scale and continued focus on driving efficiencies across the organization.
We are pleased to see the leverage in our go-to-market spend, in particular with sales and marketing expense as a percent of revenue moving down 1,200 basis points year over year as we see the benefits of increasing productivity from our sales force, a ramping renewal base, organizational efficiencies, and improving effectiveness in our cost of acquisition. However, we believe we are still in the early innings of these benefits. In particular, as our renewal base continues to scale and becomes a bigger part of the revenue, we expect to see further improvements in sales and marketing expenses as a percentage of sales. Free cash flow is negative $32 million, compared to negative $13 million in the second quarter of fiscal 2024. The decrease in free cash flow related to last year was primarily due to an increasing mix of annual as well as monthly consumption payments due to growth in our cloud and SaaS products.
Also related to last year, we incurred expenses associated with the acquisition of Laminar, which was completed in August 2023. Despite these headwinds, we improved free cash flow margin year-over-year during the first half of this fiscal year, excluding the impact of one-time employer payroll taxes related to the IPO. Turning to our balance sheet, we ended the second quarter in a strong cash position with $607 million in cash, cash equivalents, restricted cash, and marketable securities and $307 million in debt. Turning now to our outlook. We remain confident about the demand for our differentiated offerings and the powerful secular cyber resilience trends fueling our growth. We expect to continue to execute well and deliver strong subscription ARR growth ahead. Revenue on revenue growth can fluctuate due to a number of variables including the pace at which we add new RSC customers and the pace at which we continue to migrate our existing customers to RSC.
In terms of operating investments, we plan to continue to make focused high ROI investments in R&D and go to market to drive innovation and momentum in the large and growing market we operate in. We assume contract duration and payment terms continue to contract modestly through the second half with the growth in our cloud and SaaS products, which will be headwinds to free cash flow. Hence, we point subscription ARR contribution margins to measure operating leverage and profitability. Now turning to guidance for the third quarter of fiscal 2025. In Q3, we expect revenue of $216 million to $218.5 million, up 31% to 32%. In terms of profitability, we expect non-GAAP subscription ARR contribution margins of negative 8% to negative 7%. We expect non-GAAP EPS of negative $0.41 to negative $0.39 based on approximately 185 million weighted average shares outstanding. For the full year fiscal 2025, we are pleased to raise our guidance across both our top line and profitability metrics.
We now expect subscription ARR in the range of $1.026 billion to $1.032 billion reflecting a year-over-year growth rate of 31% to 32%. To help with modeling seasonality for the year, we expect net new subscription ARR in the third and fourth quarter to be roughly equal. We expect revenue for the full year fiscal 2025 in the range of $830 million to $838 million implying 32% to 33% growth. We plan to continue to invest into this enormous opportunity ahead of us while delivering efficient growth at scale. We expect non-GAAP subscription ARR contribution margins between negative 7% and negative 6%, reflecting further margin improvement from Q2. We expect non-GAAP EPS of negative $2.12 to negative $2.06 based on approximately 155 million weighted average shares outstanding for the full year. We expect free cash flow of negative $67 million to negative $57 million or negative $44 million to negative $34 million excluding the $23 million in one-time payroll taxes associated with our IPO.
This implies positive free cash flow in the second half of the fiscal year. In closing, the large and growing market for cyber resilience, our vision for this category, unique strength of our product offerings and proven go-to-market motion collectively support our subscription ARR growth outlook. We are proud of our performance this past quarter and look forward to continuing the momentum into year-end and beyond. We look forward to seeing many of you on the road in the coming months, including at the upcoming Goldman Sachs Technology Conference. With that, we'd like to open up the call for any questions.
Questions and answers
We'll now turn to Saket Kalia from Barclays. Your line is open.
Okay, great. Hey, guys. Thanks for taking my questions here and nice result.
Thank you, Saket. We are excited.
Absolutely. For sure. Bipul, maybe for you, can you just talk a little bit about what customers are saying about cyber resilience in the wake of the CrowdStrike outage? I mean, you mentioned some interesting things in your prepared remarks about how well protected your customers were, but I'm sure it's early to see any financial benefit from CrowdStrike. But I'm just kind of curious how this is changing customer thinking about cyber resilience, if at all?
Cyber resilience is top of mind for every organization around the world, because what folks have realized is that they have invested millions of dollars in cyber prevention tools and they still are not sure whether they can continue operating their business in the event of a cyber breach or successful cyber-attack. So, every Board of Directors and every CEO is thinking about how they keep their businesses up and running. And our results reflect that. If you look at our subscription and ARR growth, we grew 40% year-over-year to over $900 million. If you look at our total revenues, we grew 35%, but the subscription revenue, which is the real indicator of our business, grew 50% year-over-year. And these are the trends that are helping our business. In fact, this CrowdStrike event was a little unfortunate due to human error. CrowdStrike is a great partner, and we jointly helped hundreds of customers recover. But this incident led people to see a preview of what could happen if they face a real cyber incident or cyber-attack that could take down the global economy and significantly impact IT systems. So, this issue has triggered a lot of discussions, and many Boards of Directors are asking questions about resilience. That focus will only increase in the coming months and quarters, and we believe there will be much more momentum around cyber resilience.
Super helpful. Thanks, Bipul.
We'll move next to Fatima Boolani with Citi. Your line is open.
Good afternoon. Thank you for taking my question. Bipul, just a question for you about the market landscape and a little bit from a competitive lens, but just kind of broadly speaking. You know, we've seen a lot of activity in the data security posture management space, both in the private markets from newer companies, but also certainly, customers voting with their wallets driving better attach rates for you and your products around DSPM. So, I'm just wondering if you can sort of comment and maybe give us a little bit more quantitative granularity as to how much better those products are tracking one year in with Laminar. And then, relatedly, a large enterprise SaaS company that you do have a partnership with just kind of acquired a backup and recovery company. So, I was hoping you could set the record straight on how this doesn't diminish your advantages and your differentiation when there are potentially embedded options in some of the data stores that you do actively protect. Thank you.
Thank you, Fatima. There are three questions in that question. Let me first give you my sense of this Salesforce issue and then I'll come back to competition and DSPM. Look, this Salesforce acquisition of Own actually validates our strategy. We are telling customers and organizations and governments around the world that SaaS data is important to protect. SaaS is becoming mission-critical, and a SaaS vendor acquiring a SaaS data security, SaaS cyber resilience company validates our whole strategy. But we are focused on all the applications across the enterprise, cloud, and SaaS landscape. Salesforce is one of the 20 plus applications that we actually provide cyber resilience on, and businesses want a single policy engine, a single security control across all of their application landscape. Otherwise, they are turning 30, 40 knobs to ensure that the business is running. So, this actually is very positive for us and it brings focus to why cyber resilience is important, and Salesforce is our partner.
In fact, we jointly created a solution with them. And what we are hearing from our customers, I'll give you an example: a large health insurance company, a Fortune 500 health insurance company, called us and said they want to consolidate their data protection and cyber resilience landscape on a single platform. So, it's very positive for us. If you look at our results, returning to the competition, we are winning the cyber resiliency market. If you look at our success in the marketplace, we are winning a vast majority of deals across both our legacy competition and new-gen competition. In fact, a financial data company had more than a $1 million ACV land, replacing a new gen vendor over their cyber recovery capabilities and they saw Rubrik as a native cybersecurity platform that delivers cyber resilience. So architecture matters when you are talking about cyber resilience and what Rubrik did was to natively build data risk, data threat, and cyber recovery capability into an integrated platform across all the data landscape.
So, we have again a very unique product in a very large market, and that's what is leading to our wins. You talked about DSPM. In fact, DSPM is an integral piece of the cyber resilience strategy because data risk and data threat is essentially DSPM, which is our expanded view of the DSPM. And generative AI is also accelerating the demand for DSPM because before people feed their data into LLMs or RAG models, they want to understand what is the risk, who has access to this data, and are we feeding data that falls into the wrong hands. So, Gen AI trust, Gen AI security, and Gen AI responsibility depend upon the data that gets fed into it. And we see interesting traction in that space. Obviously, DSPM is a new product for us, but we now have more than 50 customers using our DSPM product. In fact, a leading cybersecurity company brought cloud cyber resilience with the combination of DSPM plus cyber recovery, and we are seeing this in numerous cases around the world.
Thank you for the detail. I appreciate it.
We'll move next to Andrew Nowinski with Wells Fargo. Your line is open.
Great. Thank you. Congrats on another great quarter post your IPO. I guess I want to ask you a question about the pending Veritas acquisition or merger, I should say. Now once the deal is closed and they're merged with Cohesity, it sounds like they'll be able to migrate most of those customers, those Veritas customers, over to the Cohesity platform using an automated tool. So, won't it be harder to convince those former Veritas customers to switch to Rubrik and still be on a much better platform than they were previously on?
Thank you, Andrew. In fact, when we first heard about the Cohesity-Veritas merger, we had that discussion within our company. And what we concluded was that Veritas product is a single product in the customer environment, unlike Cisco or Microsoft or one of those large companies with many products in the customer environment where they have, in some ways, a relationship and durability with the account. When you have a single product and if you're trying to replace that single product, the customer will naturally ask what else exists out there in the marketplace. Cyber resilience is the number one concern of every business, and if they're looking around the marketplace, they will definitely give Rubrik a chance. If you look at our win rate against both legacy and new-gen competition, we are winning vast majority of deals. So, in fact, Cohesity prompting Veritas customers for change is actually going to set many customers loose in terms of them looking around to find what else is out there. That we believe is a tremendous opportunity. Moreover, whenever you have two companies merging, there is a lot of rationalization that needs to happen, both in terms of product, people, and roadmap. And if I'm a Veritas customer today, I'm thinking about my product's promised roadmap; will it be delivered? It's an open question and that creates opportunity for us.
Thank you so much, Bipul.
We'll move next to John DiFucci with Guggenheim Securities. Your line is open.
Great. Thank you and good afternoon, everyone. This is Howard Ma on for John. On Rubrik Security Cloud, it's either for Bipul or Kiran. You called out the increased contribution to NRR from the adoption of additional security products. That's obviously positive. But can you comment more on the two other pieces, so workload expansion or upsell and additional apps secured by Rubrik? And this is kind of a two-part. The first part is, are you seeing any signs of slowdown in these two other drivers? Or do you still see a lot of white space in both cloud data protection and cyber resilience? And the second part is, can you remind us of your product roadmaps related to the first? If there is a lot of white space out there, which additional applications are you adding in the near term? Thank you.
Thank you, Howard. If you look at Rubrik's offerings, we have a very comprehensive data security platform. What we are doing is going to customers and saying that, 'Hey, you have a legacy backup and recovery architecture. How do we transform that architecture into a data security platform to deliver cyber resilience?' In our data security platform, we have a comprehensive suite of data security products that we attach as part of our enterprise addition as well as business addition. If you look at our product expansion, a third of our NRR is contributed by data security products that we attach on our platform. So, we are not seeing any slowdown in customer demand or the attachment of our data security products. In fact, more than 50% of our new customers again this quarter came in to adopt enterprise addition at the first purchase. So, we are continuing to see strong demand and strong expansion on our platform.
Obviously, you saw us announce Salesforce.com as the cyber resiliency target for us as the next SaaS. As these SaaS platforms become more and more critical in the enterprise, we will continue to expand our platform to cover more and more SaaS applications. Our strategy, which by the way our customers really love, is the consolidation of cyber resilience across all apps that are in their data center, across AWS, Azure, GCP as native cloud apps, as well as all the apps in their SaaS landscape and a single policy engine, a single security control across all apps, so that when chips are down, when you are under attack, and you have to recover, you are not turning 20 to 30 knobs as I said before. That's the Rubrik's native advantage of a unique platform in a large and growing market with cyber resilience emerging to be the number one category within cybersecurity.
We'll move next to Gregg Moskowitz with Mizuho. Your line is open.
Your line is open. Okay. Thank you very much, and good afternoon, guys. I had a follow-up to Saket's question just regarding the CrowdStrike IT outage. Bipul, from what you can ascertain, I was just wondering if the outage has led to an increase in pipeline build or velocity for Rubrik or is that simply too difficult to gauge? And then secondly, curious about how the usage has been looking for Rubrik AI, if you could give us an update there as well? Thank you.
Thank you, Gregg. In fact, when that global IT meltdown happened, we were also discussing the ramifications of such an outage. In fact, CrowdStrike and us together, as I was saying before, recovered 100 customers, and it showed the power of the Rubrik platform that we could isolate a single file and recover a large number of systems. Obviously, it's too early to gauge the impact of this particular outage, but anecdotally, we are hearing a lot about Board of Directors calling their security and IT leaders asking them about how will they bounce back upon such an incident. If this is a preview of what could happen in a cyberattack, how do we keep our business ongoing operations? They've all spent a lot of money on preventive solutions, but you can't prevent the unpreventable. We believe that it will be one of the many factors that will only propel this market going forward. Your second question is around Ruby.
Just to set this up, Ruby is Rubrik's generative AI agent, and we focus on increasing the productivity of IT and security operations teams because more and more IT teams are being asked to do cybersecurity work such as threat hunting, threat quarantining, and IOC management, which they are not equipped with nor have they been trained on. We have created Ruby as our multi-year strategy to really bring productivity to cyber resilience work. What we have done is we have created this as our standard offering as part of our Enterprise Edition because all the capabilities that Ruby supports are part of the Enterprise Edition. Our goal is to really extend the Ruby skills going forward. It will continue to evolve the Rubrik platform as advancements in generative AI, agentic systems, and everything else happen around it. Our ultimate goal is that if you can use Facebook, you should also be able to achieve complete cyber resilience.
Think of Ruby as someone that we are shipping with our product, acting as a guide for our customers to achieve cyber resilience outcomes. You'll see us doing a lot more in terms of building this platform and continuing to add skill sets to it, but it's not a separately monetizable event for us because we believe all the productivity gains benefit our customers.
Terrific. Thank you.
We'll move next to Joel Fishbein with Truist Securities. Your line is open.
Thanks for taking the question and congrats on the strong execution. Kiran, one for you. Obviously, you made some significant progress on the margin side of the business. I just would love to drill down a little bit deeper maybe on where will we see leverage come from moving forward? I know you spoke about sales and marketing, but if you could give us a little bit more granularity that would be really helpful. Thank you.
Hi, Joel. Thanks for your question. Yes, we have made significant progress on margin. As you know, the key margin metric for us is subscription ARR contribution margin, because we run the business on ARR, given our cloud transformation, and we have improved that metric quarter-over-quarter by 240 basis points. If you remove the impact of the payroll tax from the IPO, that is a 1,600-basis point improvement year-over-year. The key areas driving efficiency here are the big investment areas, which are primarily sales and marketing and R&D. We've been working on this for some time and continue to make progress. I'll just highlight a few areas. In sales efficiency, it's primarily from more productivity. We are generating multiple deliverables, which allows our sales force to land and expand. With greater productivity, we are doubling down on enablement and leadership development and also getting more return on investments in some of our growing markets like international and federal.
We're also continuing to work hard on lowering the cost of acquisition in terms of marketing efficiency, targeting account focus, and more partner leverage as well. The last area I would say is natural leverage for us with scale, which is renewals. It's still a minority in our business, but as we grow and the renewals base grows, we get natural leverage in our model. In R&D, which is our second largest area of investment, we continue to innovate really well using our global R&D centers, which gives us the ability to innovate with greater leverage or cost leverage as well. So those are the two areas I would say we are very focused on driving efficiencies in the business.
We'll move next to Eric Heath with KeyBanc Capital Markets. Your line is open.
Great. Thanks for taking the question and really strong set of results here. So, I just wanted to come back to the conversation on data security and DSPM. Bipul, maybe if you could share kind of how the evolution is going in terms of your engagement with customers. Is this driving more conversations and engagement with the CISO or the Chief Information Security Officer in that organization? And then maybe just given some of the early proof points with the adoption of 50 customers, what kind of uplift you're seeing with the adoption of the enterprise proactive tier? Thanks.
Thank you so much for your question. Let me first talk about what I'm hearing from the customers. A large multinational fast-food company, which is an existing customer, has a CISO who is looking at the DSPM and said Rubrik is the secret sauce because they are confident they can go to the board and say their company is able to withstand a cyberattack. The reason they are looking at DSPM is they want to understand data security risk and threat. Risk relates to the sensitivity of the data and who has access to it, and threat addresses who is doing what to the data. Unless they understand the data and can deliver cyber recovery, they won't achieve peace of mind. Another example is with a Fortune 50 oil and gas company. In my CISO conversations, they have been focusing on cyber resilience, really overhauling their cyber resilience by replacing legacy vendors. I've had similar conversations with CIOs from Fortune 500 healthcare companies, stressing the importance of strategic partnerships to deliver cyber resilience because that is a board mandate.
In all of these cases, the data security, DSPM, and cyber recovery are emerging as very strong use cases. That’s why we are focused on integrating cyber recovery and DSPM on our platform to deliver complete cyber resilience. It is very early in refining our packaging and how we bring all of these capabilities together, but we are seeing strong traction in the DSPM area along with our enterprise edition.
Thanks, Bipul.
We'll move next to Yi Fu Lee with Cantor Fitzgerald. Your line is open.
Congrats on the strong back-to-back fiscal 2Q. Thank you for taking my question for Bipul or Kiran. My question revolves around the Mandiant Threat Intelligence collaboration. It makes total sense for us that you're joining first-class Mandiant incident response with Rubrik's ransomware response team together. So, my question revolves around the penetration of Google Cloud sector. How do you think about that, Bipul and Kiran? We understand you're very strong with the Microsoft partnership, Microsoft Azure Cloud. And any color on AWS as well, later on in the future roadmap? That's it for me.
We value all our partners. We are not partial to one. We want to build a multi-partnership strategy where we create win-win partnerships across Microsoft, Google, AWS, and all other vendors because we are a Switzerland solution. We deliver cyber resiliency across numerous platforms, whether it's on-premises, datacenter platforms, cloud platforms, or SaaS platforms. Our Mandiant partnership is a significant step in that direction. Think about Rubrik's data security intelligence, which encompasses our data security capabilities combined with Mandiant's cyber defense solution. We have come together to provide customers with complete threat intelligence, comprehensive incident response, and clean room recovery on Google Cloud. Our customers can now integrate the threat feeds they receive from Mandiant with Rubrik. This means we're pre-calculating the existing threats in the data while running operations. That's the power of these relationships. Together, we’re delivering a parallel level of cyber resilience. We'll continue forming such partnerships to add value to customers and ensure we create a generational company that provides significant value in our ecosystem.
Thanks for that, Bipul. Congrats again.
We'll move next to Todd Coupland with CIBC. Your line is open.
Yeah. Good evening. I had a two-part question. One, I just will follow-up on the Veritas-Cohesity question. You talked about how it's opening up a window. Has that started yet? And when would you expect it to ramp up over what time period? And then I had a quick follow-up.
We are definitely seeing customers calling us more and being worried about cyber resilience, as they have questions surrounding the uncertainty of the Veritas-Cohesity merger. There are many discussions in the marketplace, and they are concerned about the roadmap of the features they need. We're starting to hear more and more about this, and we are definitely responding to those requests. Obviously, we have a superior product and a unique platform that combines DSPM and cyber recovery, providing comprehensive capabilities before, during, and after a cyber-attack. This positions us really well in the marketplace and we believe it will create more opportunities for us.
Great. Thank you. And then the follow-up is, we haven't really talked about the economy and impact on enterprise spending. I understand cyber is a priority and the CrowdStrike incident certainly raises that point as an obvious conclusion. But what impact, if any, is the current economy having on pipeline size of deals, time to close, etc? Just give us an update on that. Thanks a lot.
I’m a fiscally conservative guy. I always think about what am I missing? I look around and see are there leading indicators that I can read the tea leaves on and adjust. But we are not seeing any changes, particularly regarding our product and our demand. Our market momentum remains unchanged. We are not seeing any change in the macro environment in our segment and cyber resilience is top of mind for our customers, for all board members around the world. Our biggest concern is the conversations that we are not included in because those are the only deals we're losing. We are excited about what's ahead of us. We delivered an outstanding first half, are confident about the rest of this year, and are looking forward to finishing strong.
Thank you very much.
We'll move next to Brad Zelnick with Deutsche Bank. Your line is open.
Great. Thanks so much for taking my questions. Congrats on a great first half and raising the full year guidance. Kiran, I was just wondering if you can comment on the confidence level that you have and the visibility to the guidance here that we have implied for the back half? And maybe if you can frame it in terms of just the methodology that you've been using thus far. Anything that we should know, I know the prior question asked about macro. But any factors and key assumptions that we should be thinking about or changes would be helpful.
Brad, thanks for the question. So as Bipul shared, we had strong momentum and outperformed the quarter. The first half, when you look at the growth rate, we had double-digit growth in net new ARR, and that's really given us the confidence to raise the outlook for the second half. If you look at the implied guidance for the second half net new ARR, we have raised it by over 5%. Obviously, our execution has been strong, but there is still an uncertain macro environment. We are being prudent and thoughtful with the guidance, but we feel pretty confident in the outlook based on the pipeline we see and our ability to execute in this market.
We'll move next to Dan Ives with Wedbush Securities. Your line is open.
This is John on for Dan. Congratulations on the quarter. Considering the robust growth in subscription ARR throughout the quarter and the acquisition of new customers, what strategic initiative do you have in place to maintain or boost growth as we move forward into the rest of the year and possibly into full year 2026? Thank you.
Thank you so much for the question. As I was saying before, I always think about what am I missing and where do we go next? If you look at, we are already approaching $1 billion ARR, and that's a big milestone for us. But I'm thinking about $3 billion as the next major milestone and beyond. We're focusing on what we need to put in place to maintain high-speed growth and continue to scale while providing diversity of products in the marketplace to reach that target. We have not lost sight of the fact that many software vendors without a strategic vision are struggling in the market. If you look at their growth rates, they have diminished. So, we consistently think about where we are today and what's the next milestone to continue growing and giving Rubrik the best opportunity to reach its highest potential.
We'll move next to Shrenik Kothari with Baird. Your line is open.
Hey. Thanks for taking my question, and congrats on the great quarter. Hey, Bipul. With Rubrik being named Microsoft Healthcare and Life Science Partner of the Year and as you set to host your first healthcare summit coming up this week, can you elaborate how Rubrik is uniquely positioned to first address the unique healthcare challenges, and what is driving the success in the vertical and how the strong relationship with key partners like Microsoft can be central to our go-to-market in this particular vertical? Thank you.
Thank you, Shrenik. Look, what you're seeing in the marketplace today is something we have been working on for the last three years. That's why we always think ahead, considering where the market is moving, how it will respond, and how we can build products and solutions today to create an impact. If you look at the healthcare market segment, I call it protect the unprotected. The healthcare market segment is going through tremendous digital transformation to gain efficiencies due to the high cost of healthcare. The result of this digital transformation is that the average healthcare organization has three times more sensitive content than any other organization in the economy. Hence, it is a very target-rich environment and attackers prioritize targeting healthcare because they often lack the maturity needed to deliver cyber resilience. They are seeking solutions to keep hospitals operational and to ensure they can admit patients, delivering healthcare outcomes even in the event of a cyber-attack.
In fact, one of the largest healthcare systems in the U.S. has partnered with Rubrik for cyber resilience and is making a significant migration to Azure. Our ability to deliver healthcare outcomes across all mission-critical healthcare systems, whether electronic health records, cloud transformation, email systems, active directory, user management, or authentication systems, positions us with the most comprehensive solution in the marketplace. We have been working on this for many years to have a unique offering for this specific market.
Appreciate it. Thanks.
And we'll take our last question from James Fish with Piper Sandler. Your line is open.
Hey, guys. Thanks for the questions here. Circling back actually on Fatima's question around Salesforce. First, how should we think about Rubrik's exposure to Salesforce today within that expansion driver of applications? And second, you guys talked about a lot of wins in which you really consolidated down vendors. I guess what type of TCO benefits are customers seeing on consolidating down to Rubrik, and how many backup solutions are typically in these environments that you're replacing? Thanks, guys. Good quarter.
Thank you. If you look at our offering, we are consolidating cyber resilience for over 20 distinct applications into Rubrik, and Salesforce is one of those 20. When we sell the Rubrik platform, we are consolidating multiple tools. These include tools around enterprise data protection, native cloud data protection, SaaS data protection, database data protection, and unstructured data security. We are also providing data security posture management for the cloud and data center, as well as cyber resilience for Active Directory and Identity Management. Thus, we are consolidating seven or eight categories of products into our platform, and our customers benefit from over a 25% total cost of ownership savings when they adopt Rubrik in totality. Customers don't have to start using every feature of Rubrik on day one. If they begin by adopting our cloud-native solution, we deliver significant cloud cost savings, and the same applies when we start with their SaaS or on-prem solutions. We have been developing these platforms for many years, and this is not something two people in a garage could accomplish quickly. These are deep and wide solutions with extensive technology embedded over more than ten years.
Thank you, ladies and gentlemen. This does conclude the Rubrik Second Quarter Fiscal Year 2025 Results Conference Call. We appreciate your participation. And you may disconnect at any time. Have a wonderful evening.