Zach Schneider

Zachary Schneider inquired about the monetization curve for Exposure Command and Incident Command, and which upsell levers offer the highest probability of meaningfully lifting net retention without broad pricing increases.

Answer

CEO Corey Thomas described Incident Command as being in its 'first inning' with significant upside but not a current sales priority. Exposure Command, while a disappointment last year, showed unit uptake in Q4 and Q1, suggesting it's further along ('fourth or fifth inning') with operational improvements expected to drive growth and retention.

Zach Schneider asked about the current monetization curve for Rapid7's Exposure Command and Incident Command platforms, and which upsell levers offer the highest probability of meaningfully lifting net retention without relying on broad pricing increases over the next 12 months.

Answer

Corey Thomas, CEO, stated that Incident Command is in its 'first inning,' with initial focus on AI-managed services, and is not a core sales priority yet, but has significant upside. For Exposure Command, he acknowledged it was a 'big disappointment' last year but saw positive unit uptake in Q4 2025 for upgrade motions, which, if continued, could improve growth and retention. He noted that more operational improvements are needed for Exposure Command.

Zach Schneider asked about the benefits observed since the Observo AI acquisition, despite its minimal near-term revenue contribution, and how Observo is being positioned competitively against private vendors and platform peers.

Answer

Tomer Weingarten, CEO of SentinelOne, emphasized Observo AI as an AI-native data pipeline offering superior ease of use and rapid onboarding. He explained that combined with SentinelOne's data lake, it creates a complete data suite for SIEM replacement, enabling hyper-automation and advancing the vision of a fully autonomous cybersecurity platform.

Zach Schneider asked about how deal sizes, renewal patterns, and subsequent expansions differ across Rubrik's product tiers (Enterprise, Business, Foundation), particularly for multi-year contracts.

Answer

Rubrik CFO Kiran Choudary confirmed that nearly half of new lands are Enterprise Edition, with Foundation serving as a key entry point. He explained that expansion paths are diverse, including upgrading to higher-tier editions or adding more workloads such as Microsoft 365, native cloud, Oracle, or database protection, regardless of the initial edition.

Zach Schneider inquired about the differences in deal sizes, renewal patterns, and subsequent expansions across Rubrik's product tiers (Enterprise, Business, Foundation), especially for multi-year contracts, noting that nearly half of new deals land in the Enterprise tier.

Answer

CFO Kiran Choudary confirmed that close to half of new lands are in the Enterprise Edition, with a mix of Business and Foundation, the latter being larger. He explained that expansion paths vary: customers starting with Foundation or Business can upgrade to higher-tier editions, while those starting with Enterprise can expand by adding more workloads (e.g., M365, native cloud, Oracle, database), indicating that expansion is not limited by the initial starting edition.

Zach Schneider asked about the deal sizes, renewal patterns, and subsequent expansions across Rubrik's different product tiers (Enterprise, Business, Foundation), especially for multi-year contracts, given that nearly half of new deals land in the Enterprise tier.

Answer

CFO Kiran Choudary confirmed that close to half of new lands are in the Enterprise Edition, with the remainder split between Business and Foundation (Foundation being larger). Kiran Choudary explained that expansion paths vary: customers starting with Foundation or Business can upgrade to a higher-tier edition, or those starting with Enterprise can expand by adding more workloads, indicating that starting in a higher edition does not limit further expansion.

Zach Schneider, on for Shrenik Kothari at Baird, asked about the adoption of the 'proactive addition SKU,' inquiring what percentage of large enterprise accounts have adopted it and whether it is primarily a new land or a post-land upsell motion.

Answer

Co-Founder, CEO & Chairman Bipul Sinha explained that Rubrik's strategy is to deliver comprehensive cyber resilience, which has two core components: cyber risk and cyber recovery. The cyber risk piece combines DSPM and identity solutions, while the Enterprise Edition serves as the complete cyber recovery tool. He stated that this comprehensive strategy is being applied across all workloads in both land and expand motions, driving strong overall product adoption and growth.

Zach Schneider, on for Shrenik Kothari, asked about the role of hyperscaler partnerships in driving security wins and inquired about potential pricing model changes to capitalize on AIML package usage.

Answer

CEO Shlomi Ben Haim emphasized that partnerships with AWS, GCP, and Azure are crucial for accelerating large deals via marketplaces. CFO Ed Grabscheid added that while AI package usage has stabilized, monetization is in its infancy and is being evaluated, with plans to capture value as the market matures.