Commvault Systems, Inc. (CVLT)

How it makes money

Commvault sells almost entirely by subscription. A customer either buys a term software licence that it runs itself, or buys the same capability as a SaaS service that Commvault hosts; both are recognised as subscription revenue, which reached $768.3 million in fiscal 2026, 30% more than the year before. Around this sit three smaller streams: customer support contracts ($320.4 million), a shrinking book of legacy perpetual licences ($43.2 million, down 22%) and professional services such as implementation, consulting and training ($51.7 million). The economics are recurring rather than transactional — total annual recurring revenue was $1,121.6 million at 31 March 2026, up 21%, of which SaaS ARR was $400.2 million, and the SaaS net dollar retention rate was 122%, meaning existing SaaS customers spent 22% more than a year earlier. Commvault reaches buyers mostly through other people: roughly 90% of fiscal 2026 revenue came through indirect channels — resellers, distributors, systems integrators, OEMs and cloud marketplaces — and only about 10% directly.

Revenue by segment

Backup software is wired into a customer's whole estate — servers, virtual machines, containers, databases, endpoints and SaaS applications — and holds years of retained copies under retention and compliance rules. Ripping it out means re-certifying recovery for every workload and deciding what to do with the existing archive, which makes replacement slow and risky rather than impossible; the 122% SaaS net dollar retention reported for fiscal 2026 is consistent with customers staying and expanding. The limits are real, though: the company itself says it competes with Rubrik, Cohesity and Veeam and with the hyperscalers' own tools, that many rivals have greater financial resources and larger installed bases, and that roughly 90% of its revenue reaches the customer through non-exclusive channel partners who also carry competing products.

Backup and recovery is closer to insurance than to discretionary IT: data must be protected whatever the economy does, retention is often a legal obligation, and ransomware does not wait for an upturn — which is why the subscription base kept compounding (total ARR +21% in fiscal 2026) and support revenue grew even modestly. What does move with the cycle is the size and timing of new deals. Commvault's own filing says enterprise sales and implementation cycles are long and unpredictable, and that economic volatility, trade policy and tariffs can push customers to defer spending; a portion of revenue also depends on government budget cycles. The result is a recurring floor with cyclical expansion on top: renewals hold up in a downturn, new capacity, seat growth and upgrades slow down.

Key risks

• An intensely competitive industry against better-resourced rivals — Commvault states that its industry is intensely competitive and that many competitors have greater financial resources, larger installed customer bases and broader product lines, which may let them outcompete it on features, pricing and market reach.
• Dependence on indirect sales channels — The company relies on resellers, distributors, systems integrators and OEMs under non-exclusive agreements. Losing a key partner, or a partner choosing to push a competing product, could materially reduce revenue.
• Pricing pressure and the cost of delivering SaaS — Commvault flags that it may be unable to price competitively while managing the cost of delivering its subscription and SaaS offerings; cloud infrastructure spending is ongoing and substantial, and may not produce the expected return if demand falls short.
• Long and unpredictable enterprise sales cycles — Sales and implementation cycles with large customers are long and hard to forecast, which makes the timing of revenue uncertain and can swing results from one quarter to the next.
• Product defects and security vulnerabilities — The solutions are complex and may contain undetected errors, defects or vulnerabilities. For a vendor whose job is protecting other companies' data, such failures would damage customer confidence and raise support costs.
• Reliance on third-party platforms and interoperability — The products must interoperate with third-party operating systems, cloud environments and hardware. Changes made by those providers, or supply chain disruption, could delay releases or increase costs.
• Macroeconomic, trade and geopolitical volatility — Volatility in the global economy, including changes in trade policy and tariffs, may cause customers to cut or delay IT spending and may slow collections.
• Concentration of operations in India and international exposure — Significant operations in India expose the company to wage inflation, competition for talent and political or labour disruption, while international sales bring currency swings, local regulation and geopolitical conflict.
• Restructuring carried out in fiscal 2026 — New restructuring plans were implemented during fiscal 2026 and the company cannot guarantee they will deliver the intended savings or that they will not disrupt the organisation.
• Indebtedness, including the convertible notes — Existing and future debt, including the senior convertible notes, limits financial flexibility and could require cash or lead to dilution of existing shareholders.
• IT failures and cybersecurity incidents at Commvault itself — The company may suffer IT system failures, network disruption or cybersecurity incidents of its own, which could interrupt operations, trigger regulatory penalties and erode customer trust.
• Exposure to government customers — A portion of revenue comes from government entities, where budget cycles and procurement rules make demand unpredictable and add compliance obligations.

Top customers account for 32% of revenue

The concentration is in distribution, not in end demand. Commvault discloses that one channel partner accounted for 32% of fiscal 2026 revenues (35% in fiscal 2025 and 36% in fiscal 2024) and a second for 11% (below 10% in the prior two years). These are distributors that resell to thousands of end customers, so the underlying demand is spread out — but the commercial relationship runs through a very small number of non-exclusive intermediaries, and the filing names reliance on indirect channels as a risk factor in its own right. No individual end customer is disclosed as exceeding 10% of revenues.