Commvault Systems Inc.

Commvault earns revenue mainly from term-based software licenses and subscription or software-as-a-service arrangements, alongside customer-support contracts and professional services, having largely finished moving away from one-time perpetual license sales toward these recurring forms. Recomputed from its own reported figures, its net income has recently been positive in every period covered, following an earlier period in that same history where it was not.

CompanyGraph currently maps very few other companies as running the same kind of recurring-revenue, lock-in-based system that Commvault does. Separately, its recomputed financial pattern suggests its returns owe more to financial leverage than to operating margin, a different mechanism than a subscription base simply compounding on its own as it grows.

Commvault depends on outside cloud and technology providers, naming Microsoft and Azure, to host and run parts of its own products and operations, and on an unnamed third party that assembles the hardware inside its appliances. It also depends on a small number of unnamed channel partners for much of its revenue, and on a workforce concentrated in a limited set of countries, India among them.

A range of large organizations across sectors such as telecommunications, financial services, pharmaceuticals, healthcare and business services rely on Commvault to protect and recover their data, naming Lumen, Wealthsimple, Merck, ADP and UNC Health Care among its customers in its own materials. Its reseller, integrator and cloud-marketplace partners also depend on it, since they bundle or resell its software as part of what they sell to their own customers.

CompanyGraph currently maps very few other companies as running the same kind of subscription lock-in system Commvault does, naming Rubrik as the closest match, though whether rivals could copy this position is not something this evidence can confirm. Commvault itself names features such as encryption, immutability, anomaly detection and unified governance, plus repeated recognition as a Leader in Gartner's Magic Quadrant ranking, as what it believes sets it apart, though these are the company's own claims rather than something CompanyGraph has independently verified. Structurally near is not the same as moving together or being interchangeable, it means CompanyGraph sees a shared way of operating or a detected pattern, not a price relationship or a comparison verdict.

Commvault's own filings describe replacing an existing cyber-resilience system as often costly and slow, and say incumbents benefit from already being familiar with a customer's environment, data structure and operational needs, an advantage a replacement would have to rebuild from nothing, though no certification or approval is named as a source of lock-in. Consistent with this, the expansion and retention pattern it discloses among existing subscription customers shows more being spent by the accounts that stay than is lost to cancellation or downgrade, though that pattern has recently eased somewhat.

As a general pattern, CompanyGraph tests whether companies with this kind of subscription business are limited mainly by how long they keep customers renewing relative to what it cost to win them and by how much of what locks a customer in erodes over time, a pattern to test against Commvault rather than a measurement of Commvault itself. Commvault's own account of what limits its growth instead points to its ability to maintain and expand its network of resellers and partners, customers' internal budget and approval processes, reluctance to replace an existing system, contract timing, and competition for skilled employees.

Commvault itself names intense competition from rivals with greater resources and larger established customer bases as the first risk to its business, followed by its reliance on resellers, systems integrators, distributors and other indirect channels to reach customers. It also flags concentration in a small number of unnamed channel partners for a large share of its revenue, dependence on outside technology providers including Microsoft Azure and on third-party hardware and supply chains, and a workforce concentrated in a small number of countries including India, as risks in its own filings.

Commvault names a wide set of outside rules it must operate under, including United States export-control and sanctions regimes, competition and consumer-protection authorities, and data-privacy regimes in the United States, the European Union and the United Kingdom, along with anti-bribery law in both. It also names exposure to tariffs and other trade restrictions affecting its supply chains and costs, and currency exposure centered on the euro alongside a number of other currencies tied to where it operates and sells.