Commvault is a backup company that has spent seven years arguing it is a security company, and the argument is better than its reception. The technical case is sound: when ransomware encrypts an estate, the thing that determines whether the business survives is not the firewall that failed but whether a clean, trusted copy of the data can be restored into a working environment quickly enough to matter. That is a security outcome delivered by a backup vendor. Commvault has rebuilt its product around it, and holds a position in the analyst rankings that few incumbents of its age retain.
The market has been less persuaded than the product deserves. Subscription recurring revenue reached $1,054m in the June quarter, growing 22%, with the cloud portion at $424m growing 38%. Non-GAAP operating margin hit a record 22.8%. The shares trade at roughly 5 times subscription recurring revenue. Rubrik, addressing the same problem with lower margins and negative GAAP earnings, trades at about 11 times. The entire investment question is whether that gap reflects a durable difference in what the two companies are, or a difference in how they are perceived.
Two things complicate the picture and both belong at the top. In January 2026 the shares fell 31% in a day when net new recurring revenue missed and retention slipped. In April 2026 Reuters reported that Commvault had engaged Goldman Sachs to explore a sale after takeover interest including from Thoma Bravo. Nothing has been announced since, the company has never commented, and no mention of a process appears in any subsequent filing. A reader should treat it as unresolved rather than dead, and should note that the share price has recovered a long way with that possibility in the background.
The franchise
Commvault began inside Bell Labs in the late 1980s, was spun out in 1996 and listed in 2006. For most of that history it sold one thing: enterprise backup software with unusually wide coverage of the systems large organisations actually run. That breadth is still the franchise. Forrester, placing Commvault a leader in data resilience with the highest score for current offering, described it as holding the most comprehensive list of supported workloads of any vendor evaluated.
Coverage sounds like a checklist item and is not. A bank running mainframe data alongside twenty-year-old Unix systems, three hypervisors, a SAP estate, Microsoft 365, two public clouds and a Kubernetes platform cannot buy a product that protects the modern half elegantly and the rest not at all. The awkward workloads are usually the ones carrying the regulated data. Vendors founded in the last decade generally decline to support them, which is a rational engineering decision and a commercial ceiling. Commvault’s willingness to keep supporting them is why it remains in large heterogeneous accounts and why its product is harder to build than it looks.
The company has been named a leader in Gartner’s evaluation of backup and data protection platforms fifteen consecutive times, most recently in July 2026. That is a genuine achievement and also worth reading carefully: in the 2026 iteration Veeam was placed highest on ability to execute, and Commvault’s position moved slightly downward year on year. The franchise is intact and not obviously strengthening.
Scale today is approximately 14,000 subscription customers, of which more than 10,000 use the cloud service, with about 40% of cloud customers new to Commvault rather than migrated from its own installed base. Nearly half of managed cloud customers run two or more products. Roughly 3,300 employees, about 40% of them in India, support a business generating $1.18bn of revenue.
Business model
The model is a subscription transition entering its final phase, and the accounting reflects three overlapping businesses. Term software subscriptions, where the customer runs Commvault themselves under a time-limited licence, represent roughly $630m of recurring revenue growing in the low teens. The cloud service, launched as Metallic in 2019 and now folded into Commvault Cloud, holds $424m growing 38%. Behind both sits a declining perpetual licence and maintenance base, worth roughly $133m of recurring revenue and shrinking about 11% a year, which is the residue of the old company.
Profitability is the distinguishing feature. Non-GAAP operating margin has sat near 20% for five years and reached 22.8% in the June quarter, and unlike most companies in adjacent security categories Commvault is profitable on a GAAP basis as well, at 8.2%. Free cash flow was $237m in the year to March 2026 and is guided to $250m to $260m for the current year. Roughly 60% of that goes to buybacks, which have reduced the share count from about 47m to 41.4m. Cloud gross margin reached 70.6%, improving more than six points year on year, which is the metric that determines whether the cloud business is structurally as good as the software one.
Two changes to disclosure this year deserve attention because they reduce comparability. From the current financial year Commvault no longer reports total recurring revenue, only the subscription and cloud figures, which means the run-off of the old maintenance base is no longer visible. Separately, reported subscription revenue was redefined to include support attached to term licences, and prior periods restated, so the subscription revenue line before and after that change is not the same measure. Neither is improper. Both make the business harder to track from the outside at exactly the point where the question is whether growth is decelerating.
And it is. Total revenue growth has fallen from 26% in the June 2025 quarter through 18%, 19% and 13% to 11% in the June 2026 quarter, with full-year guidance implying about 10%. Management’s framing is that recurring revenue is the real measure and that it grows 22%. The sceptical framing, which several analysts have adopted, is that net new subscription recurring revenue was $39m in the most recent quarter against $39m two quarters earlier, and that in constant currency it is flat to slightly down year on year. Both readings are defensible from the same disclosure.
From backup to cyber recovery
The repositioning rests on a distinction worth stating precisely, because it is the whole of the company’s claim to be a security vendor rather than an infrastructure one.
Backup answers a narrow question: can the data be restored. It was designed for accidents, meaning hardware failure, deletion and corruption, where the copy is assumed to be trustworthy and the environment it restores into is assumed to be intact. Cyber recovery answers a much harder question: can a clean, working, trusted environment be reconstituted while an attacker may still be present, and can that be demonstrated rather than hoped for.
Each clause of that is a separate engineering problem. The copy must be immutable and isolated, or the attacker encrypts the backups too, which is now standard practice in ransomware operations. The last clean recovery point must be identifiable, because modern intrusions dwell for weeks and the most recent backup is frequently already contaminated. There must be somewhere isolated to restore into and test, since restoring into a compromised production environment reinfects immediately. The rebuild must cover infrastructure and identity, not only files, because an application without its networking, load balancers, access policies and directory is not a running service. And it must have been rehearsed, since an untested recovery plan is a document rather than a capability.
This is why the category has migrated from the infrastructure budget towards the security budget, and it is a genuine migration rather than a marketing one. It is also why the incident response question that matters to a board is no longer whether backups exist.
The platform
Commvault Cloud, relaunched under the Unity branding in November 2025, organises the portfolio around three claims: data security, cyber recovery and identity resilience.
Cleanroom Recovery is the most genuinely differentiated component. It provisions an isolated recovery environment in the cloud on demand, restores backups into it, scans them for malware and anomalies, and validates that the result works before anything returns to production. The significance is commercial as much as technical: building an isolated recovery environment has historically required a customer to own and maintain a second site that does nothing most of the time, which only the largest organisations could justify. Making it a metered cloud service moves rehearsed recovery within reach of companies that could never previously afford it, and rehearsal is the part organisations skip.
Cloud Rewind, acquired with Appranix in 2024 for a reported $26m, addresses rebuilding rather than restoring. It maps a cloud application’s full dependency graph, including networking, name resolution, load balancing and access policies, and reconstructs the entire stack to a chosen point in time. Clumio, bought in the same year for roughly $47m against $262m of venture funding raised, added large-scale native protection for Amazon storage and database services. Satori Cyber, acquired in 2025 for an undisclosed sum, brought data discovery, classification and access governance, which is where Commvault touches the same ground as the data security vendors.
Around those sit Air Gap Protect, which is Commvault-operated immutable storage sold by the terabyte; Threat Scan, which examines backup content to identify clean recovery points and was integrated with Google Threat Intelligence in August 2026; deception tooling; and identity resilience covering Active Directory and Entra forest recovery, a product line management says more than doubled in the year. Synthetic Recovery, introduced in late 2025, restores an estate while surgically excluding the compromised portions. Three artificial intelligence products were announced in April 2026, of which one is generally available.
A June 2026 agreement made Commvault Cloud a native service inside Azure, purchasable through the Microsoft marketplace and creditable against customers’ committed Azure spend. That is a meaningful distribution advantage and simultaneously a concentration: Microsoft hosts the cloud service, is now its largest route to market, and sells competing native backup capability.
The Rubrik problem
No assessment of Commvault survives contact with the Rubrik comparison, so it is better to confront it directly than to work around it.
| Commvault (June 2026 quarter) | Rubrik (July 2026 quarter) | |
|---|---|---|
| Subscription recurring revenue | $1,054m, growing 22% | $1,660m, growing 33% |
| Cloud recurring revenue | $424m, growing 38% | $1,480m, growing 39% |
| Quarterly revenue | $314m, growing 11% | $427m, growing 38% |
| Net revenue retention | 114% blended; cloud above 120% | Above 119% |
| Non-GAAP operating margin | 22.8% | Approximately 7.8% |
| GAAP operating margin | Positive 8.2% | Negative 16.8% |
| Enterprise value to subscription ARR | Approximately 5.1 times | Approximately 11.2 times |
| Market capitalisation | Approximately $5.4bn | Approximately $19.2bn |
The market pays more than twice as much per unit of recurring revenue for the company earning a third of the margin and losing money on a reported basis. Four reasons account for most of it, and only one of them is sentiment.
The first is that Rubrik’s growth is accelerating in absolute terms while Commvault’s is not. Rubrik adds roughly $100m of net new subscription recurring revenue a quarter and that figure is rising; Commvault adds around $39m and that figure is flat. Growth rates converge slowly, but the direction of net new business is the cleaner signal and it currently favours Rubrik decisively.
The second is architectural coherence. Rubrik sells one thing built one way. Commvault sells a cloud service, a self-managed term licence and a declining maintenance base, and the blend obscures what the underlying business is doing, a problem its own metric changes have worsened rather than solved.
The third is the buyer. Rubrik is bought by security teams from security budgets and has positioned itself accordingly from inception. Commvault is frequently still bought by infrastructure teams, and carries thirty years of perception as a backup vendor. The product gap between the two is far narrower than the perception gap, which is precisely the problem: repositioning a category is easier than repositioning a reputation.
The fourth is disclosure. Rubrik reports how many customers spend above $100,000 a year, and the figure is 3,084, growing 23%. Commvault reports that its cloud customers above that threshold grew 45% without saying how many there are. An investor comparing the two has a cohort table for one and a growth rate for the other.
Commvault’s answer to all of this is real and rarely stated forcefully enough. It earns three times the operating margin, generates positive GAAP earnings, converts revenue to cash at a similar rate, and dilutes shareholders far less. If both businesses were private and judged on cash generated per unit of revenue, the ranking would invert.
The moat
Workload breadth is the durable asset. Supporting the full range of systems a thirty-year-old enterprise actually runs is a body of unglamorous engineering that accumulates rather than being designed, and it is the reason Commvault stays in large heterogeneous accounts that newer vendors cannot fully serve. It is also self-reinforcing: each awkward platform supported is another reason a complex customer cannot consolidate elsewhere.
Switching costs are genuine. Backup is embedded in operational routine, retention policy, audit evidence and disaster recovery documentation, and the historical archive itself is difficult to migrate. Replacing a data protection platform in a large organisation is a multi-year programme with regulatory exposure, which is why displacement in this market is slow and why incumbents persist long after they stop being fashionable.
Cleanroom Recovery is the strongest genuinely differentiated capability, because it converts a facility only large enterprises could afford into a metered service, and because the rehearsal it enables is the part of cyber recovery organisations most reliably neglect.
The limits are equally clear. Commvault holds no control point in the security stack: it does not own the endpoint, the network or the identity provider, and it participates in security operations by integration rather than by ownership. Its cloud service runs on infrastructure owned by a company that competes with it. Its scale is a fraction of the platform vendors now describing data resilience as a module. And in a category where the incumbent advantage is switching cost rather than product superiority, the moat protects the installed base far better than it wins new logos, which is precisely the pattern the net new recurring revenue figure describes.
One further item belongs in an honest assessment on a security site. In early 2025 a nation-state actor exploited a zero-day vulnerability in Commvault software to access the company’s own Azure-hosted cloud environment. The vulnerability was added to the United States catalogue of known exploited vulnerabilities, and the American cyber defence agency issued an advisory in May 2025 warning that application credentials belonging to customers of that service may have been accessed. Commvault disclosed and remediated it. For a vendor whose proposition is resilience against exactly this class of adversary, being compromised by one is a reputational fact that a profile should state rather than omit.
Competitive landscape
Data protection has consolidated into five recognised leaders and a set of platform vendors treating the category as a feature. The contest is between specialists differentiating on recovery capability and generalists arguing that resilience should be bought alongside everything else.
| Competitor | Where it is strongest | Commvault advantage | Commvault vulnerability |
|---|---|---|---|
| Rubrik | Security-buyer positioning, single architecture, accelerating net new business | Three times the operating margin and positive GAAP earnings | Wins the high-end security evaluation and commands twice the multiple |
| Veeam | Placed highest on execution in 2026, vast mid-market base, over $2bn of recurring revenue | Depth in complex heterogeneous enterprise estates | Larger, privately funded, and now extending into data security through Securiti |
| Cohesity | Scale after absorbing the Veritas data protection business, reported IPO ambitions | Cleaner balance sheet and an uninterrupted product roadmap | A merged installed base creates a large pool of accounts to defend and attack |
| Druva | Fully software-as-a-service delivery with no self-managed legacy | Coverage of workloads a cloud-only vendor cannot address | No transition to manage and a simpler story to tell buyers |
| Dell and IBM | Installed hardware estates, procurement relationships and bundling | Independent of any hardware platform, and rated ahead of both | Incumbent bundles can be economically difficult to refuse |
| Microsoft | Owns the estate, the hosting platform and the customer agreement | Cross-platform coverage and genuine cyber recovery depth | Hosts the cloud service, is its largest channel, and competes with it natively |
The honest reading on share is that Commvault gains against legacy installations, meaning Veritas, older Dell and IBM deployments, and loses the fashionable high-end security evaluation to Rubrik, while Veeam dominates below the enterprise tier. Roughly 700 new subscription customers in a recent quarter and 40% of cloud customers arriving new to the company support the first half of that; flat net new recurring revenue supports the second.
January 2026 and the sale process
On 27 January 2026 Commvault reported a quarter with 19% revenue growth, net new subscription recurring revenue of $39m against roughly $45m guided, cloud net revenue retention down to 121% from 127% a year earlier, a trimmed full-year recurring revenue growth guide and a restructuring programme. The shares fell 31% the following day, from $129.36 to $89.13, removing about $1.7bn of value. Securities class actions followed, covering the period from January 2025 to January 2026 and alleging that pricing and duration concessions and a mix shift toward lower-value cloud contracts were masking a weaker competitive position.
The severity relative to the miss is instructive. A $6m shortfall on net new recurring revenue does not by itself justify a third of a company’s value. What the market repriced was the realisation that the growth had been flattered by conversion of the existing base rather than by new demand, and that retention was falling while the company described its momentum in terms that did not acknowledge either.
The chief financial officer had resigned weeks earlier, in December 2025, leaving the chief executive running finance through an interim arrangement. In April 2026 the previous chief financial officer, Gary Merrill, returned to the role, and a board member was appointed president of customer and field operations. Two changes in that seat inside eighteen months is a governance fact worth noting during a period when the reliability of the company’s own forecasting was the issue.
On 10 April 2026 Reuters reported that Commvault had engaged Goldman Sachs to explore a sale following takeover interest, including a reported earlier approach from Thoma Bravo. The shares rose 17% intraday. Since then there has been no announcement of a transaction, no confirmation that talks ended, no reference to strategic alternatives in the annual report filed in May, the quarterly report filed in August, the proxy statement or either earnings call, and no comment from the company, its adviser or the named bidder. The shares subsequently rallied roughly 92% from their March low before falling 17% in late July on guidance. A reader should assume some portion of the current price reflects an outcome that has not been agreed and may never be.
The investment debate
Commvault trades near $132, giving a market capitalisation around $5.4bn. Cash of $930m approximately offsets $900m of zero-coupon convertible notes due in 2030, which convert near $237 and are therefore well out of the money, so enterprise value is close to market capitalisation. That is roughly 4.2 times guided revenue and 5.1 times subscription recurring revenue. The range over the past year runs from $71.75 to $198.18, which is an extraordinary band for a profitable business growing revenue at 10%.
The constructive case is that this is a genuinely profitable software company being valued as though it were in decline. Cloud recurring revenue grows 38% at a gross margin above 70% and improving. Operating margin is at a record and guided higher. Free cash flow of $250m to $260m against a $5.4bn enterprise value is a yield approaching 5%, with 60% returned through buybacks that have already retired an eighth of the shares. The Azure native arrangement is a real distribution advantage. Fifteen consecutive years as a Gartner leader and the top current offering score from Forrester indicate the product is not the problem. And there is a reported private equity bid backdrop that establishes some floor under the valuation.
The bearish case is that the growth engine has stalled and the disclosure has become less helpful at the same time. Total revenue growth has fallen to 11% and is guided to about 10%. Net new subscription recurring revenue is flat, and in constant currency arguably declining. Term software, which is still 60% of the recurring base, was flat sequentially in the most recent quarter, held back by hardware supply constraints, longer contract durations that reduce annualised value, and weaker than usual conversion of the remaining perpetual base. Cloud deals land at materially lower prices than the software deals they replace. Retention has fallen for several consecutive quarters. Total recurring revenue is no longer disclosed and subscription revenue has been redefined, both in the year that growth decelerated. And Rubrik is winning the evaluations that set the category’s narrative.
Three disclosure gaps compound the difficulty. There is no customer cohort table, so the quality of the customer base cannot be compared with the competitor that publishes one. Term software recurring revenue is not stated and must be derived by subtraction. And the withdrawal of total recurring revenue removes visibility of the declining maintenance base at the moment when how fast it runs off determines the growth rate. Analyst opinion sits at a buy with an average target near $161, but the July target cuts came with explicit statements that the recurring revenue guidance could not be underwritten.
What to watch
Net new subscription recurring revenue is the number that matters, in constant currency, and it is the number that caused the January repricing. It has been approximately flat for three quarters. A return to growth would substantiate management’s account. Continued flatness with the reported growth rate drifting down toward it would confirm that the conversion cycle was doing the work.
Term software is the second. It is 60% of the recurring base and it stopped growing sequentially in the June quarter. Management attributed that to hardware constraints, contract duration and conversion timing, all of which are transitory explanations. If term returns to growth they were right; if it does not, the company is a cloud business carrying a large flat annuity, which is a different valuation question.
Beyond those: whether cloud gross margin continues improving from 70.6%, since it determines whether the cloud business ends up as profitable as the software one; whether net revenue retention stabilises after several quarters of decline; whether the guided operating margin near 21% and free cash flow of $250m to $260m are delivered; and whether the company resumes disclosing figures it has withdrawn, which would be the clearest signal that management is confident in what they would show.
On the sale process, the sequence to watch is an announced transaction, a confirmed termination, or continued silence. Silence has now persisted for five months, and each month makes an outcome less likely without making it impossible.
Bottom line
Commvault makes a strong product for a problem that genuinely moved from the infrastructure budget to the security budget, and it is one of very few companies in adjacent security categories that converts that into cash and reported profit rather than adjusted profit. The workload breadth is a real moat, Cleanroom Recovery is a real differentiator, and fifteen years of analyst leadership is not obtained by accident.
What it has not solved is that the growth was substantially a conversion of its own installed base, that the conversion is nearly complete, and that the underlying rate of new business is flat. The January repricing was the market working this out, and nothing since has settled the question in either direction. The company is also fighting a perception problem that its product no longer deserves but its history creates, against a competitor that started where Commvault is trying to arrive.
The valuation gap to Rubrik is roughly two to one on recurring revenue, and it is not obviously wrong in either direction, which is another way of saying that the case rests on evidence not yet available. Net new subscription recurring revenue in constant currency, and whether term software resumes growth, will settle it. Both are reported quarterly, and neither depends on whether a bidder returns.
