SECURITY ATLAS / EVALUATION BRIEF
Rubrik Security Cloud
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/rubrik-security-cloud-recovery/

THE ATLAS TAKE
Rubrik Security Cloud is worth evaluating when protection policies need to be understandable across a substantial enterprise workload estate. SLA Domains make schedule, retention and copy destinations explicit, which provides a useful operating language. Atlas would then ask the harder question: can the organization restore the whole application when production trust is lost? Retention lock and orchestrated recovery address different parts of that problem. The trial should exercise both without assuming that every cloud, SaaS, identity or vault capability belongs to the selected enterprise data-protection purchase.

SCOPE
The comparison scopes RSC-managed enterprise data protection with CDM, retention-locked SLA Domains and Orchestrated Recovery for vSphere. Cloud, SaaS, identity recovery and separate vault or simulation entitlements must be verified rather than inherited from the brand.

WORTH A LOOK WHEN
Enterprise teams organizing supported backup workloads around consistent policies and rehearsed vSphere recovery.

THINK TWICE WHEN
The proposal equates policy assignment with application recoverability or omits the recovery infrastructure.

IMPLEMENTATION
1. Choose a complete application
Include data, identity, networking and external dependencies in the recovery scope, with explicit acceptable data loss and downtime.

2. Verify independent authority
Test retention protections on disposable data and document who can change protection or authorize recovery.

3. Rehearse the actual destination
Run an isolated vSphere plan and capture dependency order, manual interventions and a successful business transaction.

OPERATING REALITY
Administrators must reconcile workload coverage, policy exceptions and capacity while maintaining separate recovery authority. Application owners need to review dependencies and restore results. New machines should not silently remain outside protection or recovery plans, and plan tests need to be repeated after significant application or infrastructure changes.

COMMERCIAL CONSIDERATIONS
Quote the selected RSC/CDM protection, retention and Orchestrated Recovery configuration. Separately identify vault, cloud, SaaS and identity services, plus recovery compute and storage.
- Protected workload/capacity and selected entitlements
- Copy destinations, retention and recovery infrastructure
- Recovery testing, application validation and separate services

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Review actual workload-to-SLA assignments
Acceptance evidence: Retain coverage exceptions and intended copy settings.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Attempt an unauthorized disposable-copy change
Acceptance evidence: Keep the applicable retention outcome and administrative audit.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Recover a synthetic application through its plan
Acceptance evidence: Record data age, elapsed recovery time and business validation.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which actions can quorum authorization approve in this retention mode?
- Is every archive destination immutable under its own controls?
- Which configuration, keys and identity services are needed if the usual console is unavailable?

EVIDENCE GAPS
- Atlas has not independently benchmarked restoration or retention resilience.
- Some Rubrik technical pages were accessible through indexed text only; verify current release behavior.

SOURCES
Rubrik: SLA Domains API (Documentation)
https://developer.rubrik.com/Rubrik-Security-Cloud-API/Data-Protection/SLA-Domains/
Rubrik retention-lock operating model (Product information)
https://www.rubrik.com/blog/technology/2021/09/ransomware-and-insider-threat-protection-with-retention-lock
Rubrik: creating a vSphere Recovery Plan (Documentation)
https://docs.rubrik.com/en-us/saas/saas/creating_disaster_rp_vsphere.html

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.