Commvault, which sells software that backs up corporate data and rebuilds it in a clean environment after a ransomware attack, beat both lines of its fiscal first quarter on 28 July and raised guidance for subscription revenue and margins. Its shares fell 19.3% over the following two sessions, from $149.46 to $120.66, and by 19 August had recovered only to $137.32. Adjusted earnings came in at $1.42 against $1.16 expected, with Piper Sandler downgrading the stock for want of a catalyst.

That is the sharpest illustration of a problem running through this whole rung of software. Seven vendors — data recovery, fraud approval, identity checks, regulated filings — rose an average of roughly 10.5% over the past month. They are not one demand curve, and the month was not a grind: Workiva was up 32.4% and Freshworks 18.3%, while Commvault fell 6.4%.

The bid is doing the work at Commvault

The reported numbers are decelerating. Revenue growth has gone 19.5%, then 13.3%, then 11.4%, and first-quarter operating income rose just 2.5% on that 11.4% — negative operating leverage. Underneath, the conversion from perpetual licences to subscription is genuinely hiding demand: subscription annual recurring revenue (ARR) rose 22% to $1.05bn, software-as-a-service (SaaS) ARR rose 38% to $424m, and SaaS gross margin crossed 70% for the first time, up 635 basis points to 70.6%. Nearly a third of net new subscription ARR came from identity-resilience and data-security products rather than backup.

But net dollar retention was 114%, flat year on year — a rate at which existing customers are not doing the heavy lifting. And management reiterated, rather than raised, its full-year ARR target of $1.20-1.21bn. That was the line that broke.

The competitive backdrop explains the reluctance. Rubrik lifted its share of data protection from 3.9% to 5.5% and Veeam from 9.2% to 12.9%, leaving Commvault grouped with Cohesity behind them. Rubrik grows 39% and trades at 18.3x trailing gross profit; Commvault grows 11% and trades at 5.79x, against 9.2x a year ago. What lifted the stock was not the P&L. It gapped 10.2% on 10 April on nine times normal volume, when it emerged that Commvault was weighing a sale after approaches from private equity, with Goldman Sachs advising and Thoma Bravo reported to have renewed interest.

Riskified is buying its acceleration

Riskified is not a subscription business. It decides whether to approve or decline an online checkout and assumes the fraud liability itself, taking a fee on the merchant volume it clears. Second-quarter revenue accelerated to 21.8% growth, its fastest in over four years, and guidance was raised for the second time this year to $400-410m. Gross merchandise volume grew only 13%, so the take rate rose.

The cost of underwriting rose faster. Cost of revenue climbed 31.4% to $54.3m, gross margin fell 490 basis points to 45.0%, and gross profit grew 11.7%. Management blames a heavier mix of lower-margin ticketing and new merchants ramping, and calls it temporary — but its own third-quarter guidance pairs about 27% revenue growth with 11-14% gross-profit growth. Retention is about 105%; the acceleration is new logos, not existing merchants. Against that, $223.6m of cash and no debt is 24% of the market value. Competition is thickening: Stripe Radar added a standalone multi-processor product in 2026, alongside Signifyd, Forter and Accertify.

Workiva is the one the numbers carry

Workiva sells the software that assembles regulated filings and controls documentation, with audit trails, for roughly 6,200 corporate clients. The fear priced into it was that agentic AI automates exactly this work first. The quarter says otherwise: revenue up 18.6% to $255.3m, gross margin up 343 basis points to 80.4%, and non-GAAP operating margin of 16.8%, up 1,300 basis points — its 2027 target reached a year early. Net revenue retention was 111%, contracts above $300,000 grew 34%, and premium AI tiers carry a price premium north of 20%. Its largest session of the month was 29 July, when it launched three compliance agents and an intelligence layer. At 5.32x trailing gross profit, up from 3.68x three months ago, it is still cheaper than the 6.99x it commanded a year ago.

The remaining four are a reminder that the grouping is loose. Alarm.com, a cloud platform for home and commercial security systems, grew 9.2% and is the cheapest name at 4.22x gross profit. Freshworks sells helpdesk and IT service management software, not security, and its 16% growth rests on an employee-experience line at $567m ARR. Mitek, in identity and check-fraud verification, moved 1.0% with no earnings in the window. Red Violet, an identity-data business, posted record revenue of $26.7m and trades at 11.38x gross profit, the group's richest. The 19 August session that lifted Workiva 8.0% was a rotation out of semiconductors into beaten-down enterprise software — the same day Commvault fell 3.8%.

The setup

Where it stands — One month of shared gains covers three unrelated engines: a takeover bid, a fraud-loss squeeze, and a genuine margin inflection.

Would confirm — Commvault raising its $1.20-1.21bn ARR target, or Riskified's gross profit growth closing on its revenue growth.

Would invalidate — Commvault's sale process ending without a deal, or Riskified's gross margin falling below 45% again in the third quarter.

Watch next — Commvault's fiscal second quarter in late October; Riskified's third quarter, guided to 27% revenue and 11-14% gross-profit growth.

Valuation — Commvault 5.79x trailing gross profit and 5.39x forward, versus 9.2x a year ago and Rubrik's 18.3x.