I rocked up to an interview with Rubrik co-founder, chairman and CEO Bipul Sinha, armed with what I thought were challenging questions about Rubrik’s growth, an IPO, his succession and more. I was met with whip-smart rebuttals and got a lesson in VC outcomes. He swatted away my negative suggestions as easily as a Wimbledon tennis champ dismissing a no-hope opponent.
Update: Index Engines CEO comment added as a bootnote at the end of this article. 13 July 2022. Competitive takeout example added as bootnote 2; 18 July 2022.
Rubrik is a data protection, security and management company that started up in 2014 and has amassed more than $550 million in funding. It has more than 2,000 customers and made more than $2.5 billion in cumulative software sales. My first question focussed on an IPO.
Blocks and Files: Is an IPO still the preferred exit?
Bipul Sinha: “We want to build an enduring institution that lasts longer than my professional career. And, in my mind, the long-lasting company is always a public company, because public companies attract better talent which propels the company forward. So we want to be a public company. We are watching the market. We are developing ourselves better and better, and we will be ready when the market is ready.”
When do you think the market will be ready?
Bipul Sinha: “Nobody knows that; it’s a billion dollar question.”
Sinha has started posting short LinkedIn messages that suggest, to me, he’s viewing things from a distance – he’s looking at lessons learned, as if he’s stepping back a little.
Rubrik is eight years old, with Sinha in his post all that time, and an IPO in the next year or two looks unlikely given the world and US economic situation.
Snowflake had its IPO after eight years and with a new CEO, Frank Slootman. SpringPath was acquired by Cisco five years after it was founded. Tegile was bought by Western Digital eight years after it was started up. Nvidia bought SwiftStack nine years after its founding and Google bought Velostrata seven years after that firm was set in motion.
The economy is suffering from the COVID pandemic, Chinese problems with consequent supply chain issues, the Ukraine war, and then there’s inflation. That’s a pretty poor hand at the moment – a pretty poor environment in which to go public.
With this background and the reflective LinkedIn posts I wondered if Bipul was thinking about stepping back from the CEO role.
Assuming it takes two years for the current issues to get themselves worked out, and the environment becomes a little bit more positive for running an IPO, that’ll be ten years for you to be in charge for Rubrik. Have you thought about succession planning? Would it be conceivable that you might not be running Rubrik when it goes public?
Bipul Sinha: “The thing is that my focus is to continue to build the company. And as long as VC and the board believe that the company has the right leader, I’ll continue to go on.”
It strikes me though that ten years is a long time to be in charge.
Bipul Sinha: “That’s not true. I mean, if you look at founder-led companies, from Fortinet to Oracle, to even other iconic founder-led companies, these companies run for long time with founders. Bill Gates was the CEO of Microsoft for 20 years.
“The thing is that, again, we want to build a Rubrik into a long-lasting, enduring institution. That’s the goal.”
When talking to companies such as Veeam the backup market seems pretty immune to competitive takeouts. Backup software is very sticky and growth comes two ways: increasing data volumes from existing customers and protecting new, greenfield workloads. Is this how Rubrik sees the market?”
Bipul Sinha: “I will give you one data point in the last six and a half years. We have sold over growth or close to $2.5 billion worth of product cumulative – and our growth rate as you know is extremely high. So, so, if the data protection market is growing at a low single digit or something around that, we will not be growing this fast unless they are replacing. And we are replacing legacy backup and recovery with Rubrik data security solution.”
Would you see Rubrik acquiring other data protection companies?
Bipul Sinha: “Why would we acquire a legacy solution when we have the best in class solution?”
There’s a company called Index Engines. And it has a technology which Dell sells as Cyber Sense. It can do full content scanning of backup data sets, and the resulting index used for detecting possible ransomware attack patterns. So this is new technology. I think Index engines is a relatively new company. It’s not a legacy company.
Bipul Sinha: “I’m not going to comment on Index Engines per se, but I’ll give you a very interesting perspective. … Index Engines works on a storage interface to scan so it works on a legacy architecture. So it is fundamentally incompatible with our view of the world. Any company that says that, ‘hey, I can take new technology to scan my data’ is definitely selling storage. We are not. … They are all legacy technology. What we have done is built our single software that combines metadata and data together. We have built our own AI engine inside it.
“All the companies that is claiming ‘here is a marketplace; you can take random third-party software to scan your data’ means that they’re selling storage – they’re selling a legacy full-cost solution. Thinking about it: having third-party software running on your backup data will create a supply chain risk. … Our architecture is a zero trust architecture, which is completely different from the legacy.”
What you say to customers is ‘Hello, your technology or your existing data protection data security backup set is not fit for purpose, you should use ours.’ That’s a difficult sell.
Bipul Sinha: “Here’s the thing. If we look at Rubrik’s success, we are able to make that sale and use it. … We are replacing legacy with a modern data security solution.”
Rubrik is winning in competitive takeouts?
Bipul Sinha: “Yes, we have many case studies showing this. (See bootnote 2.)
“We have to change our thinking around this market. This market was built and conceived 20–30 years ago and legacy backup software writes to a storage target. It’s a legacy architecture, which was built for once-in-a-while disaster, human error, things like that. And now now it is cyber disasters. There is a ransomware attack every 11 seconds. This legacy architecture is woefully inadequate, and they are trying to apply band-aid after band-aid – like by bringing software to scan your data for cybersecurity. But the issue is that the fundamental architecture is broken. Because as soon as you have backup software separate from the storage, you are at risk.
“Rubrik has a single software that does both. And that’s why it’s a zero trust architecture.”
Rubrik does write to external storage though.
Bipul Sinha: “What we say is that you keep your data for 30 days, 60, 90 days in Rubrik, because that’s the ransomware interval, and you recover faster on premises, or whatever, wherever. And then, once you’ve gone past the 60–90 days interval, then you write out the data into cheap and deeper storage, because that’s not a ransomware risk or vulnerable data anymore.
“When we write to external storage, we write only for archiving purposes – long-term archival. Which is a different business than the nearline backup. So the main difference is the nearline backup, in the legacy architecture it sits here (in external storage). In the Rubrik architecture, the nearline backup sits here, in direct-attached storage.
“And then it is a scale out, right? It’s not limited to one server. You can go to hundreds of servers.”
VC outcomes
We finished up by talking about VC investment outcomes. Sinha drew a six-box diagram with two rows: one for the right investment and one for a wrong investment.
There are two types of investment. One is into a singular company with unique technology and no direct competitors with that technology. The other is into a company with a variation on technology shared by other suppliers.
A big outcome follows an investment in a company with singular technology which grows to dominate its market. Snowflake is a good example. Where a VC invests in a company with no real technology advantage the outcome will be small, because it is effectively shared between several companies.
Our B&F diagram suggests MayaData, bought by DataCore, was in this category because it was one of many startups providing Kubernetes infrastructure services for cloud-native developers – for example Kasten, Robin.IO, Ondat and Portworx.
Sinha would put Rubrik in the right investment, singular technology box, because no other data protection and security supplier has a unified backup, storage and security architecture. Everyone else uses a legacy architecture with separate storage services accessed across a network, which introduces risk.
That’s his pitch, in a nutshell. He’s sticking to it, and hoping for a “win big outcome” – a great pay day.
Bootnote 1
Tim Williams, founder, investor and CEO of Index Engines, told us: “Index Engines indexes data in backup formats. There is no technical reason why we couldn’t index Rubrik backup data. We aren’t limited to legacy architectures and neither is Dell. … customers have very high-performance expectations for our analysis, which means we need to qualify every backup target we support. We haven’t qualified Rubrik as a backup target to date because we are 100 percent channel, and our channel hasn’t asked us to. That’s the only reason why we don’t support Rubrik.”
Bootnote 2
Colchester Institute’s IT services manager, Ben Lewis said, “Being a long term Veeam customer, we needed a full review to make an informed decision. The review concluded with Rubrik being the top choice due to its overall protection and recovery from cyber breaches. Our choice to move away from Veeam and purchase Rubrik was the best decision we could have made.” In April 2021, Colchester fell victim to a ransomware attack. With Rubrik’s data protection and rapid recovery capability Colchester were able to recover 100% of their data without having to pay the ransom.
