Provisional editorial research based on public documentation, not tested effectiveness.
First edition · Reviewed · Rubric 1.1
Six dimensions, each scored 0.0–5.0 in tenths. Gaps stay visible.
Compare documented backup-policy, retained-copy and restoration capabilities for mixed enterprise VM, database and file workloads. Rubrik RSC with CDM and vSphere Orchestrated Recovery; Cohesity self-managed DataProtect (not NetBackup or Cloud Protection Service); Veeam Data Platform Premium with Backup & Replication 13 and Recovery Orchestrator 13; Commvault software 11.42 plus explicitly named Air Gap Protect/Cleanroom components. Optional modules count only where the assessment names them. SaaS-only backup, standalone vaults, identity-only recovery and endpoint security are excluded. Scores measure documented capability and operator safeguards, not measured recovery speed or incident success.
Each row is one 0.0–5.0 dimension. Every assessed offering has a consistent color, shape, and number. Numbers identify offerings, not rank. Unknown scores are omitted.
Separated marks connect to their exact positions. Separation does not change scores.
Momentum: building history. Numbers identify offerings, not rank; lines between dimensions are profiles, not time.
Missing evidence for this view
Unknown is not a low score. Select an offering above to inspect its evidence.
A position is only half the story
Momentum
Building history
Baseline recorded 2026-09-21. A second comparable review is needed to show movement.
Own movement is the score change. Relative movement subtracts the median change of matched peers, excluding this offering. Dimensions stay separate.
Rubrik Security Cloud· movement by dimension
Dimension
Own movement
Against peers
Operational maturity
Building history
Not available yetNo direction inferred
Shipped innovation
Building history
Not available yetNo direction inferred
Capability breadth
Building history
Not available yetNo direction inferred
Ecosystem & integration
Building history
Not available yetNo direction inferred
Governance & control
Building history
Not available yetNo direction inferred
Operator enablement
Building history
Not available yetNo direction inferred
History appears as a hollow earlier mark connected to the current solid mark in Unfold and Overview. Profile lines between dimensions do not show time. Numbers identify offerings, not rank.
Review history & what changed
The 2026-09-21 baseline incorporates the six-dimension review. Decimal calibration and research corrections are not product momentum. Unknowns stay unknown.
2026-09-21 · baseline · rubric 1.1 · Starting point; no movement inferred.
Veeam Data Platform (medium confidence) and Commvault Cloud (medium confidence) are tied at documented score 3.6 for Operational maturity among assessed offerings in this comparison group.
Rubrik Security Cloud (low confidence) and Cohesity DataProtect (low confidence) and Veeam Data Platform (low confidence) and Commvault Cloud (low confidence) are tied at documented score 3.0 for Shipped innovation among assessed offerings in this comparison group. No distinction is evidenced among the scored offerings.
Unknowns and gaps
Unknown is not low quality. Marks are omitted where a required score is unknown.
Rubrik Security Cloud: no unknown dimensions.
Cohesity DataProtect: Operator enablement
Veeam Data Platform: no unknown dimensions.
Commvault Cloud: no unknown dimensions.
Scenario lens
A scenario highlights priorities and validation questions only. It does not rewrite scores or claim eligibility.
Selected evidence
Rubrik Security Cloud · Rubrik
Rubrik Security Cloud with CDM enterprise protection, retention-locked SLA Domains and Orchestrated Recovery for vSphere · Assessed 2026-09-21 · Research preview
Operational maturity
How clearly can operators configure retained copies and recover through management failures?
Cumulative safeguards for the scoped recovery path. Does not score company age, customer count, availability guarantees or actual incident performance. All earlier anchors must be supported before crediting a later stage.
The reviewed procedures connect policy, retained snapshots and dependency-ordered test recovery. Management-plane recovery independent of normal production identity remains unverified in this evidence set.
Score3.0 / 5.0low confidence
Comparison:
Rationale and sources
Stages 1–3: SLA scheduling and retention are explicit; lock modes and quorum prerequisites are documented; the vSphere test plan specifies resources, networks and boot order. No management-plane recovery or independent-identity rehearsal credit is established here.
How this score is built
Constraints
RSC/CDM policy and vSphere orchestration are assessed together; separate SaaS, identity, vault and simulation products are not assumed included.
Rubrik retention-lock documentation in this source set is versioned 9.0. Confirm mode behavior against the deployed CDM release; it is not a claim that 9.0 is the latest release.
No production restore, destructive retention change or performance benchmark was executed.
Non-immutable archive destinations have a different loss boundary; retention lock does not establish clean data.
Some Rubrik operator pages redirected to sign-in. Recovery actions were checked through indexed official documentation excerpts; current authenticated documentation was not accessed. This access and freshness limit reduces all Rubrik confidence ratings to low.
0 — Affirmative primary evidence establishes no in-scope capability. Missing evidence is unknown, never zero.
1 — A concrete backup schedule or retention control is documented.
2 — Stage 1 plus operator-facing retention or immutability constraints and prerequisites.
3 — Stage 2 plus a documented isolated restore or failover test with target and dependency configuration.
4 — Stage 3 plus documented recovery of the backup management plane and a rehearsal path that explicitly avoids dependence on the normal production identity service.
5 — Stage 4 plus an end-to-end runbook exercising loss of management, recovery credentials, application validation and return to service.
Assessed offerings inEnterprise backup and recovery platforms. Unknown means not scored, not low quality.
First edition on 2026-09-21. This is a new baseline, not historical momentum.
Four named bundles form one enterprise recovery cohort. Scores apply to documented workflows in scope; wider vendor portfolios and acquired products are not merged into scores.
Public sources establish documented controls, not independently measured efficacy, recovery speed or successful incident outcomes. Confidence is at most medium; product-page inferences are low.
Every stage is cumulative. Supported lower anchors retain their credit when a higher prerequisite is unverified. A cell remains unknown only when the first in-scope anchor cannot be established.
Shared decimal refinements credit only distinct parts of the next anchor. Criteria total ten tenths at each base; no jitter, hidden vendor weight or arbitrary tie-breaking is used.
The contemporary baseline already includes policy-managed backup, protected copies and restoration. No offering earns an innovation differentiation claim from AI branding, immutable storage or an orchestration feature alone.
Cohesity operator-documentation access returned HTTP 403 in this pass. Product evidence supports lower capability anchors; self-managed operating procedures remain unknown and are not replaced with Cloud Protection Service procedures.
Source-linked review decisions and limitations are recorded in docs/research/2026-09-21-market-expansion/resilience.md.
How to read these scores
Scores use tenths from 0.0 to 5.0 against published anchors. Fractional scores credit documented requirements toward the next anchor; the inspector exposes the calculation. Equal evidence can still produce a tie. Null means unknown and is never treated as zero. Views never average or blend dimensions into an overall winner. Cohort membership is the only comparison boundary.
What this edition covers.
First edition · reviewed · rubric 1.1. Historical movement will require later dated assessments; no trajectory is inferred from this snapshot.
First edition on 2026-09-21. This is a new baseline, not historical momentum.
Four named bundles form one enterprise recovery cohort. Scores apply to documented workflows in scope; wider vendor portfolios and acquired products are not merged into scores.
Public sources establish documented controls, not independently measured efficacy, recovery speed or successful incident outcomes. Confidence is at most medium; product-page inferences are low.
Every stage is cumulative. Supported lower anchors retain their credit when a higher prerequisite is unverified. A cell remains unknown only when the first in-scope anchor cannot be established.
Shared decimal refinements credit only distinct parts of the next anchor. Criteria total ten tenths at each base; no jitter, hidden vendor weight or arbitrary tie-breaking is used.
The contemporary baseline already includes policy-managed backup, protected copies and restoration. No offering earns an innovation differentiation claim from AI branding, immutable storage or an orchestration feature alone.
Cohesity operator-documentation access returned HTTP 403 in this pass. Product evidence supports lower capability anchors; self-managed operating procedures remain unknown and are not replaced with Cloud Protection Service procedures.
Source-linked review decisions and limitations are recorded in docs/research/2026-09-21-market-expansion/resilience.md.
Enterprise backup and recovery platforms
Compare documented backup-policy, retained-copy and restoration capabilities for mixed enterprise VM, database and file workloads. Rubrik RSC with CDM and vSphere Orchestrated Recovery; Cohesity self-managed DataProtect (not NetBackup or Cloud Protection Service); Veeam Data Platform Premium with Backup & Replication 13 and Recovery Orchestrator 13; Commvault software 11.42 plus explicitly named Air Gap Protect/Cleanroom components. Optional modules count only where the assessment names them. SaaS-only backup, standalone vaults, identity-only recovery and endpoint security are excluded. Scores measure documented capability and operator safeguards, not measured recovery speed or incident success.
