MSP Partner Business Intelligence Intern

Commvault Q2 FY 2027: recovery breadth carries the quarter. Analyst(s): Fernando Montenegro Publication Date: October 29, 2026 Commvault's Q2 FY 2027 results show subscription revenue up 21% and SaaS revenue up 33%, with growth coming from customers adding identity recovery, cloud protection, and additional products on top of their existing data protection footprint. What is covered in this article: * Commvault's Q2 FY 2027 financial results * Multiproduct adoption and what it says about the platform pitch * Identity resilience as an entry point into recovery planning * Cloud protection and new-customer acquisition * Guidance and Final Thoughts The News: Commvault (NASDAQ: CVLT) reported Q2 FY 2027 results for the quarter ended September 30, 2026. Total revenue was $312 million, up 13% year over year (YoY). Subscription revenue reached $269 million, up 21% YoY, including software-as-a-service (SaaS) revenue of $106 million, up 33%. Subscription annualized recurring revenue (ARR) grew 20% YoY to $1,104 million, with $51 million of net new subscription ARR on a constant-currency basis. Subscription net dollar retention was 113%. The legacy business continued to shrink, as expected. Perpetual license revenue fell 40% YoY to $7 million, and perpetual support revenue fell 23% to $23 million. On profitability, non-GAAP operating margin was 21.9%, up 327 basis points YoY, while operating margin under generally accepted accounting principles (GAAP) was 9.7%. Non-GAAP diluted earnings per share (EPS) rose 52% to $1.38. Operating cash flow was $75 million, and free cash flow was $71 million. One reporting change is worth keeping in mind when comparing against older quarters. Starting in FY 2027, Commvault counts term-based support within subscription revenue and includes enterprise support in subscription ARR, with prior periods restated, and it no longer discloses total ARR. Product announcements during the quarter included Active Directory Pre Recover, which targets clean recovery of Active Directory in minutes rather than hours; an expansion of its Federal Risk and Authorization Management Program (FedRAMP) High cyber resilience services to managed service providers (MSPs); and an integration of Threat Scan with Google Threat Intelligence to help identify clean recovery points. "With AI accelerating both innovation and risk in the enterprise, resilience continues to be a business imperative," said Commvault's CEO. "Enterprises globally are increasingly turning to Commvault to stay resilient as they navigate more data, more identities, and greater complexity." Analyst Take: Customers are buying more of what Commvault recovers, not just more backup, as identity recovery and cloud protection drive subscription growth. The easy way to read this quarter is as a SaaS acceleration story, and the numbers support that read. We feel the more useful framing is about breadth: what customers can recover, and in what order, rather than how much data they back up. That shift matters because recovery after a serious incident is rarely about a single dataset. Applications depend on identities, identities depend on directory services, and much of the estate now sits in SaaS and multiple clouds. Commvault's quarter suggests customers are buying against that dependency chain. Buyer data from ETR, part of Futurum, points to steady rather than dramatic momentum. Commvault's overall Net Score was 13 in the October 2026 Technology Spending Intentions Survey (TSIS, n=267), up three points YoY, with about 27% of respondents planning to increase spend and about 10% planning to replace it. For an established vendor in a category where incumbency carries real weight, we read that as a healthy installed base that is expanding, with some churn pressure that has not gone away. Multiproduct adoption expands customer relationships. According to the company, 53% of managed SaaS customers now use at least two products, up from about 45% a year earlier, and customers using three to eight products were its fastest-growing cohorts. One example from the call involved a large global asset manager that, after reviewing its recovery objectives and storage costs, expanded into Clumio, operational recovery, and AirGap Protect. To us, that is consolidation driven by the buyer as much as by the vendor's sales motion, which is a more durable reason to expand. Subscription net dollar retention of 113% sits within management's usual 112% to 116% range. That metric lags, and by design it excludes acquired subscription ARR until an acquisition is fully integrated (typically 12 months), so expansion from recently acquired customers will show up later, if at all. The open question is whether a broader recovery bundle consistently beats a set of specialist offerings once security teams, not just infrastructure teams, are part of the buying decision. Identity recovery becomes part of recovery planning. Identity ARR nearly doubled YoY, according to management, and identity resilience together with data security contributed about 30% of net new subscription ARR. That is a meaningful share for offerings that, not long ago, were add-ons to a backup sale. We think the logic is sound. In a ransomware event, if Active Directory is not available, very little else comes back, so restoring identity services is often the first step in the recovery sequence rather than a separate project. The company cited its largest Active Directory transaction to date, with an existing healthcare customer protecting directory services across global data centers. Cloud protection brings in new customers. Cloud-centric offerings grew 50% YoY. Clumio adds deeper protection for Amazon Web Services (AWS) workloads and, since its April extension, Google Cloud Storage, while newer coverage for Azure DevOps and Google Workspace widens the set of applications Commvault can sell into. The more telling figure is customer mix. About 40% of SaaS customers acquired in the quarter were new to Commvault, up from about 30% a year earlier, which suggests the cloud portfolio is opening new relationships rather than only migrating existing ones. Public sector is following a similar path, with more than half of federal bookings now in SaaS and cloud. SaaS gross margin reached 70%, up 650 basis points YoY, which matters more each quarter as SaaS becomes a larger share of the mix. Guidance and Final Thoughts. Q2 subscription revenue of $269 million came in above the company's prior guidance of $264 million to $268 million. For Q3 FY 2027, Commvault expects subscription revenue of $293 million to $297 million and a non-GAAP operating margin of 20.5% to 21%, which includes costs for its SHIFT conference. For the full year, the company raised its outlook to subscription revenue of $1,127 million to $1,133 million, subscription ARR of $1,205 million to $1,215 million, a non-GAAP operating margin of 21% to 21.5%, and free cash flow of $255 million to $265 million. Management also expects SaaS ARR to exceed $500 million. Commvault's next phase depends on turning broader platform adoption into sustained subscription growth while keeping margins where they are. A larger renewal pool in the second half gives it room to attach identity recovery and cloud protection to existing contracts. What we will watch: does identity recovery keep pace once the early, high-urgency deals are done? Can new-customer acquisition in cloud hold at current levels? And how much of the AI resilience story turns into budget lines customers can point to? We expect to hear more on all three at SHIFT next month. Declaration of generative AI and AI-assisted technologies in the writing process: This content has been generated with the support of artificial intelligence technologies. Due to the fast pace of content creation and the continuous evolution of data and information, The Futurum Group and its analysts strive to ensure the accuracy and factual integrity of the information presented. However, the opinions and interpretations expressed in this content reflect those of the individual author/analyst. The Futurum Group makes no guarantees regarding the completeness, accuracy, or reliability of any information contained herein. Readers are encouraged to verify facts independently and consult relevant sources for further clarification. Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article. Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.

New Commvault identity security and cyber resilience applications. Commvault, a specialist in cyber resilience in the AI era, is expanding its portfolio with new solutions to make identity systems more secure. The new capabilities help organizations detect and remediate hidden risks and unwanted changes in environments such as Active Directory, Entra ID and Okta before cybercriminals can exploit them. Identity systems are an increasingly attractive target for hackers, because through compromised accounts they gain direct access to business-critical data. Eighty percent of large enterprises use multiple identity providers, which leads to increasing complexity in access rights, policies and the management of both human and non-human identities. Insight into 'Tier 0' assets and continuous auditing. Commvault's new solutions give cybersecurity and identity teams more control and insight into their infrastructure. For example, continuous auditing of identity providers makes it possible to immediately detect changes in configurations, permissions and identities within Active Directory, Entra ID and Okta. In addition, the software maps so-called Tier 0 assets: the business-critical systems and accounts with the highest access rights. By making clear who holds these rights, hidden vulnerabilities can be exposed before cybercriminals take control of the identity infrastructure. "Cybercriminals do not need to break into every system individually; they only need to get hold of the identities that manage these systems," explains Pranay Ahlawat (photo), Chief Technology & AI Officer at Commvault. "Because of the proliferation of AI agents and non-human identities, this risk is only increasing. Our goal is to give customers insight into who is in control, detect dangerous changes and restore trusted access when something goes wrong." AI support and recovery to a trusted state. In addition to detection, the new features offer AI-driven recommendations to identify the cause of exposed identities and address risky access rights. Teams receive support in rolling back unwanted adjustments and restoring trusted identity configurations. According to Emanuel Figueroa, Senior Research Analyst at IDC, this functionality fills an important gap in the market. IDC research shows that only 47 percent of organizations have a completed plan for identity recovery. "Stopping a cyberattack puts an end to the attack itself, but not to its consequences," says Figueroa. "Access management mechanisms are often unable to restore a directory to a verified, secure state. Identity recovery is therefore becoming a crucial purchasing criterion." Availability. The new capabilities, including Identity Attack Intelligence and Cross-provider Identity Auditing, will become available worldwide as 'early access' in the coming quarters. They are offered as part of Commvault IDRecover, a suite focused on mapping identity risks, monitoring suspicious changes and recovering identity systems. Commvault will explain the developments in more detail during its SHIFT 2026 event in Nashville. About Witold Kepinski. Witold Kepinski (1969) is a board member, Editor-in-Chief and Director Content of Dutch IT Channel and Dutch IT Leaders. Witold Kepinski has been active in the IT media and tech business sector for 25 years. With a specialized team of editors, bloggers and video makers, Witold Kepinski provides insight into tech business trends and applications with which IT decision-makers and Channel Partners make an impact.