Commvault Surpasses Expectations, Yet Stock Drops on Guidance

Commvault released its numbers for the second quarter of fiscal year 2027, ending September 30, and saw its stock decline on the Nasdaq despite surpassing estimates. The adjusted earnings per share was $1.38, above the consensus of $1.24 compiled by Investing.com. Revenue totaled $312.39 million, compared to the expected $310.24 million.

The metric used by the company to measure its subscription business, annual recurring revenue (ARR), reached $1.104 billion, a 20% increase year-over-year, according to the statement. The SaaS portion of this revenue grew 35% to $454 million.

The Number That Market Punished

The new net ARR from subscriptions was $51 million at constant currency. In the conference call, the company detailed that $30 million came from SaaS and $21 million from term software licenses. For the fiscal year, Commvault raised its ARR subscription projection to a range of $1.205 billion to $1.215 billion, with a midpoint of $1.210 billion, up from $1.205 billion in the previous estimate.

A $5 million increase in the midpoint, after a quarter exceeding expectations, was interpreted as caution. Investors who had driven the stock higher in previous weeks anticipated a larger revision. The intensity of the decline varied throughout the session according to the consulted source.

The opposing view has its supporters. A modest upward revision, with SaaS growing 35%, indicates that the migration of the installed base to the cloud continues at the pace that the company has been signaling. The decline speaks more about the price the market had already baked in than about demand. For those tracking Commvault as a thermometer for companies' cyber resilience budgets, the quarter shows steady demand and growth without acceleration.

The Demand Coming from Ransomware

The context in which Commvault sells became clearer in recent weeks, particularly in Japan. IDC Frontier, a subsidiary of SoftBank, was hit by ransomware on October 7, affecting 495 companies and local governments. In the report released on October 14, the provider stated that snapshot copies could be recovered for 194 of those clients who had contracted the feature. The others depended on their own backups.

In the same time frame, GMO Internet suspended the Onamae.com Desktop Cloud service after identifying malicious software on client servers, with up to 26,739 servers potentially affected, according to the company. Prime Minister Sanae Takaichi ordered on October 26 that the cabinet assemble an emergency cybersecurity measures package within about a week.

None of these incidents involved Commvault, and the company did not mention them in the results. However, they illustrate the central argument of the backup and recovery sector: when the cloud provider itself is the target, the copy that saves the operation is the one out of the reach of the attacker.

The Outlook for Buyers in the U.S., Japan, and Brazil

In the United States, Commvault's main market, along with competitors like Rubrik, Veeam, and Cohesity, the quarter confirms that spending on resilience holds strong even when IT budgets are contested by AI projects. Investor pressure is on the pace, not on the existence of demand.

In Japan, the IDC Frontier incident has turned backup into a boardroom topic. The difference between 194 clients with recoverable snapshots and the other 301 is precisely the clause that IT directors in Japan will revisit in domestic cloud contracts in the coming months, now with the government promising measures.

In Brazil, Resolution CD/ANPD No. 15, of 2024, requires communication of security incidents involving personal data within three business days. For local cloud operators and hosting providers, an event like that of IDCF Cloud would put hundreds of controllers in front of the same deadline simultaneously, depending on information from a single provider.

Commvault did not disclose on Tuesday whether the wave of attacks on cloud providers is already reflected in signed contracts. Until this is reflected in the numbers, the thermometer investors have chosen is the speed of new ARR, not the size of the base: to reach the midpoint of $1.210 billion from the current $1.104 billion, the company needs to add about $106 million in two quarters, slightly above the pace of $51 million it just delivered.