Bacula Enterprise: Enterprise Backup Ledger 2026

Part of the Enterprise Backup Ledger (edition 2026-10-03). How the scores work: methodology.

Snapshot

Tier: Legacy enterprise
Owner: Bacula Systems; no controlling-owner transaction established in accepted history.
Licence model: Commercial annual endpoint/support subscription; HPC/provider core metrics are separate; no protected-TB charge per published page.
Products scored: Bacula Enterprise 18.2.5 and labelled enterprise plugins; Bacula Community/Bareos excluded.
Latest release: 18.2.5 release notes dated 2026-07-20; 18.0.9 older maintained branch 2025-08-26
Next signal: No dated next milestone established in the accepted research.
Archetype: Plugin based enterprise engine
Evidence grade: C. Overall grade uses all scored history/AI steps and lens criteria: 38 A, 0 B, 17 C of 55; the lowest grade covering more than 25% wins. Judgement itself does not demote a sourced fact; unresolved eligibility, baseline or contract estimates do.

Scope of the scores: Product capability cutoff 2026-10-01; scoring edition 2026-10-03. Combined portfolio scores do not imply one SKU or uniform feature parity. History is evidence-bounded; freezes and first-feature GA dates can be incomplete. AI services named in the AI section do not broaden the ten core domains.

Scorecard

Dimension	Score	Direction
Capability today	78.8 / 100	higher is better
Momentum since end of 2022	+8.8 points	higher is better
Credibility	16.0 / 25	higher is better
Commercial risk	10.5 / 25	lower is better
Technical lock-in	11.5 / 25	lower is better
Integrator fit	15.5 / 20	higher is better
AI leverage	2.0 / 20	higher is better
Ledger Index	62.5 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Virtual and physical servers (12)	2.5	3.5	3.5	4
Databases and applications (12)	2	4	4	4.5
Recovery (14)	2.5	3	3.5	4
Cyber resilience (14)	0.5	0.5	3	4
Storage efficiency and targets (10)	3.5	4.5	4.5	4.5
Long-term retention and tape (6)	2.5	4.5	4.5	4.5
Replication and DR (10)	1	2	2	2
Security and compliance (8)	1.5	2.5	3	3.5
New-platform support (VMware exit) (8)	0	3	4	4.5
Management at scale and automation (6)	2.5	3.5	3.5	4
Total / 100	36.6	59.2	70.0	78.8

Year by year: 2016: 36.6 · 2017: 36.6 · 2018: 45.0 · 2019: 59.2 · 2020: 60.6 · 2021: 70.0 · 2022: 70.0 · 2023: 70.0 · 2024: 73.4 · 2025: 73.4 · 2026: 78.8

What moved the score

Year	Domain	Change	Points	Trigger
2018	Management at scale and automation	2.5 → 3.5	+1.2	10.0 (2018-03-28 release-note date): BCloud REST service/client registration; Proxmox LXC/QEMU plugin; XenServer plugin; PostgreSQL10. Evidence A. rn100
2018	New-platform support (VMware exit)	0 → 3	+4.8	10.0 (2018-03-28 release-note date): BCloud REST service/client registration; Proxmox LXC/QEMU plugin; XenServer plugin; PostgreSQL10. Evidence A. rn100
2018	Virtual and physical servers	2.5 → 3.5	+2.4	10.0 (2018-03-28 release-note date): BCloud REST service/client registration; Proxmox LXC/QEMU plugin; XenServer plugin; PostgreSQL10. Evidence A. rn100
2019	Databases and applications	2 → 4	+4.8	12.2 (2019-11-15 release-note date): FIPS140 support; Glacier multi-tier cloud; endpoint dedupe for NDMP; Db2 plugin. Evidence A. rn122
2019	Long-term retention and tape	2.5 → 4.5	+2.4	12.2 (2019-11-15 release-note date): FIPS140 support; Glacier multi-tier cloud; endpoint dedupe for NDMP; Db2 plugin. Evidence A. rn122
2019	Recovery	2.5 → 3	+1.4	12.0 (2019-05-24 release-note date): Client behind NAT/firewall; default TLS encryption; Linux BMR UEFI; Sybase ASE and file-CDP plugins. Evidence A. rn120
2019	Replication and DR	1 → 2	+2.0	12.0 (2019-05-24 release-note date): Client behind NAT/firewall; default TLS encryption; Linux BMR UEFI; Sybase ASE and file-CDP plugins. File CDP is not orchestrated VM failover. Evidence A. rn120
2019	Security and compliance	1.5 → 2.5	+1.6	12.2 (2019-11-15 release-note date): FIPS140 support; Glacier multi-tier cloud; endpoint dedupe for NDMP; Db2 plugin. Evidence A. rn122
2019	Storage efficiency and targets	3.5 → 4.5	+2.0	12.2 (2019-11-15 release-note date): FIPS140 support; Glacier multi-tier cloud; endpoint dedupe for NDMP; Db2 plugin. Evidence A. rn122
2020	Recovery	3 → 3.5	+1.4	12.6 (2020-12-04 release-note date): VMware Instant Recovery; Hyper-V VSS cluster support; external LDAP console authentication; VMware endpoint dedupe. Evidence A. rn126
2021	Cyber resilience	0.5 → 3	+7.0	14.0 (2021-12-22 release-note date): QEMU/Proxmox incremental backup; append/immutable file attributes; ClamAV FD plugin; Director TOTP. Evidence A. rn140
2021	New-platform support (VMware exit)	3 → 4	+1.6	14.0 (2021-12-22 release-note date): QEMU/Proxmox incremental backup; append/immutable file attributes; ClamAV FD plugin; Director TOTP. Evidence A. rn140
2021	Security and compliance	2.5 → 3	+0.8	14.0 (2021-12-22 release-note date): QEMU/Proxmox incremental backup; append/immutable file attributes; ClamAV FD plugin; Director TOTP. Evidence A. rn140
2024	Cyber resilience	3 → 4	+2.8	Observed by 2026-10-01: 18.0 BGuardian/StoreOnce Catalyst immutability; 16.0 SnapLock/Data Domain immutability; 14.0 ClamAV. Detection is not automatically AI. 18.0 StoreOnce/BGuardian shipped 2024; no ML inferred. Evidence A. rn180; rn160; rn140
2024	Management at scale and automation	3.5 → 4	+0.6	REST/automation: BCloud REST service introduced 10.0; JSON console output 14.0; native multitenancy 18.0. Official Terraform provider audit pending. 18.0 multitenancy 2024; no LLM/MCP inferred. Evidence A. rn100; rn140; rn180
2026	Databases and applications	4 → 4.5	+1.2	Observed by 2026-10-01: 18.2.5 MongoDB plugin; 18.2 Amazon RDS; 18.0 Oracle RAC on AIX. Native PIT/DB version matrix needs plugin-specific audit. Evidence A. rn182; rn180
2026	New-platform support (VMware exit)	4 → 4.5	+0.8	Observed by 2026-10-01: 18.2 XCP-ng support; 18.2.2 Libvirt; 14.0 Proxmox incremental; 16.0 AHV plugin. Separate native-plugin methods must not be collapsed to universal CBT. 18.0.5 notes explicitly correct an untrue Cinder incremental/differential statement; platform presence alone does not imply those modes. Evidence A. rn182; rn140; rn160; new; rn180
2026	Recovery	3.5 → 4	+1.4	Observed by 2026-10-01: 18.2 single-item restore for AHV/Azure/Hyper-V/OpenStack/EC2; 18.2.2 Libvirt direct hypervisor restore. VMware Instant Recovery introduced 12.6. Evidence A. rn182; rn126; new
2026	Security and compliance	3 → 3.5	+0.8	Observed by 2026-10-01: 18.2 FIPS140-3/SCRAM-SHA256 support; 18.2.2 Okta; 18.0 encrypted storage/key handling. Certification boundary/certificate number not established. FIPS support is not a verified whole-product validation. Evidence A. rn182; rn180; new
2026	Virtual and physical servers	3.5 → 4	+1.2	Observed by 2026-10-01: 18.2.2 Libvirt: QCOW2 incremental/differential checkpoints, RAW full-only snapshots; physical Windows/Linux BMR updates in 18.2. Evidence A. rn182; new

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-01	16.0: Storage-daemon encryption; SnapLock/Data Domain immutability; AHV plugin; malware detection in backup/verify jobs. (clock: 2023-01-13 release-note date)	D1 Virtual and physical servers	M
2023-07	16.0.7: VMware7/8SIR and ProxmoxVMA dedupe changes per blog; minor fixes per notes, not every change first GA. (clock: 2023-07-11 notes; 2023-08-29 blog)	D1 Virtual and physical servers	M
2023-08	16.0.7 reference release: shipped; 2023-07-11 release-note clock. VMware7/8 single-item restore and ProxmoxVMA dedupe structure improvements. Blog49 days after note date; not a forward promise.	D10 Scale and automation	C
2024-03	18.0: BGuardian poisoning/configuration assessment; StoreOnce Catalyst immutability; OpenStack Cinder plugin; native multitenancy. (clock: 2024-03-27 release-note date)	D1 Virtual and physical servers	M
2024-03	Cybersecurity dashboard: partial; By2024-10-10 blog; exact first GA unresolved. 18.0 notes call WIP; 18.0.4blog promotes BWebSecurityCenterDashboard, later 18.0.9 fixes dashboard. Precise original promise/fullfeature equivalence unresolved.	D4 Cyber resilience	C
2024-03	Quobyte integration: shipped; By18.2.0 2025-05-19; first GA unresolved. 18.2 release adds Quobyte snapshot support; exact earlier completion/feature coverage unresolved.	D10 Scale and automation	C
2024-03	Remote FD/SD daemon configuration: pending; unverified. A feature listed in a release note as WIP is not automatically shipped.	D10 Scale and automation	C
2024-10	18.0.4 security release: shipped; 2024-09-06 release-note clock. Blog promotes BGuardian/securitydashboard/OpenStack/HyperV/EWS; RN is a maintenance release with immutable/read-only aligned volumes and cloud-tier interface. Product-family headlines need feature-specific first GA.	D10 Scale and automation	C
2025-01	18.0.7 StoreOnce/authentication update: shipped; 2024-12-11 release-note clock. StoreOnceCatalyst and AWS tokens/BWeb automation asserted; archive/updated article disagree on publication clock. Does not resolve initial StoreOnce immutability date.	D9 Security	C
2025-05	18.2: Amazon RDS plugin; Windows/Linux BMR updates; single-item restore across AHV/Hyper-V/OpenStack/cloud; XCP-ng support. (clock: 2025-05-19 release-note date)	D1 Virtual and physical servers	M
2025-10	18.2.1: HPC Accelerator improvements; maintenance fixes. (clock: 2025-10-08)	D10 Scale and automation	C
2025-11	18.2.1 HPC accelerator/encryption update: shipped; 2025-10-08 release-note clock. Later blog announces HPC accelerator and expanded OS/encryption support; notes clock 28 days earlier. Not every advertised feature first shipped 18.2.1.	D10 Scale and automation	C
2026-02	18.2.3: Random-order storage policy; job/client-tag copy/migration; encryption for OFFSET streams. (clock: 2026-02-03)	D5 Storage efficiency	C
2026-03	18.2.4: Scan-plugin include/exclude defect fixed: newly discovered objects could be omitted from protection; affected users directed to support. (clock: 2026-03-09)	D10 Scale and automation	C
2026-09	18.2.5 MongoDB/DB2AIX update: shipped; 2026-07-20 release-note clock. MongoDB, GPFS/ZFS/Lustre and DB2AIX listed; article 56 days after note date. Original pre GA promise not recovered.	D2 Databases and applications	C

Centre of gravity: Scale and automation (7), Virtual and physical servers (4), Cyber resilience (1)
Driver mix: Vision 0%, Customer need 73%, Market window 27%, Upstream 0%, Portfolio 0%

Credibility: 16.0 / 25

Criterion	Score	Basis
Cadence	4	20 recorded release rows, including maintenance and component overlaps; rows are not distinct GA counts. Regularity judged from the dated tables, not an asserted promised cadence. 16.0 (2023-01-13 release-note date): Storage-daemon encryption; SnapLock/Data Domain immutability; AHV plugin; malware detection in backup/verify jobs. Evidence A. rn160
Roadmap transparency	3	Public documentation access and versioned release evidence determine this score. Accepted roadmap finding: Unreleased/work-in-progress items appear in release notes; no dated public forward release schedule established. No open-roadmap-tracker reference score is awarded. 16.0 (2023-01-13 release-note date): Storage-daemon encryption; SnapLock/Data Domain immutability; AHV plugin; malware detection in backup/verify jobs. Evidence A. rn160
Say-do	2.5	Recorded ledger: 8 items; 6 shipped, 1 partial, 0 slipped, 1 pending, 0 dropped. Mature dated prospective cohort: 3; 0 documented within 12 calendar months, 1 later than 12 months, 2 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample. Evidence C for the rubric estimate: calibrated to the delivery record below, not a measured census percentage. See the vendor research section F.
Velocity	4	Substantive capabilities in the release tables determine velocity; maintenance-only rows do not become new features. 18.0.7 (2024-12-11 notes; 2025 article clocks): AWS authentication token support and aligned-volume read-only truncation fix; StoreOnce new-feature grouping differs from original 18.0 notes. Evidence A. rn180; blog1807
Lifecycle stability	2.5	Accepted lifecycle finding: New-features page says support for the two most recent versions; exact version-specific EOS dates/contract exclusions unresolved. Grade C where current contract/EOS boundaries remain unresolved. 18.2 release family; 2025-05-19 notes: Director and all StorageDaemons must be upgraded together to 18.2 because they are incompatible with earlier versions. 18.0 introduced catalog 1027; upgrading 18.0→18.2 does not require catalog-conversion script. Version coupling, not licence termination. Evidence C. rn182

Say-do record, 2023 to 2026: Recorded ledger: 8 items; 6 shipped, 1 partial, 0 slipped, 1 pending, 0 dropped. Mature dated prospective cohort: 3; 0 documented within 12 calendar months, 1 later than 12 months, 2 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample.

Commercial risk: 10.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	1.5	Current endpoint/core metrics are known; historical subscription transition and price series unresolved. 2026-10-01 observation: Commercial annual-subscription metric: endpoints/support; HPC core-based tiers. Original switch date and historic prices unresolved. Evidence C. price
Purchase constraints	2.5	Licence metrics, edition gates and purchase routes determine this estimate; undisclosed minimums are not assumed zero. Annual subscription: Endpoint count and support-response tiers; no protected-data/front-end-TB charge per published page. HPC tiers may use CPU cores. Current page is not a historical licence-change date. Evidence A. price
Channel and access	2.5	Partner entry and public documentation access are both considered. Research documentation finding: docs. Training: Partner page names Foundation Course and Expert Series; search index said Admin I but live page says Foundation Course. Launch dates/exam prerequisites unresolved. Evidence A. partner
Owner stability	1	2026-10-01 evidence boundary: Bacula Systems; no controlling-owner transaction established in accepted history. Ownership-risk judgement comes from the recorded corporate/financing events; no unrecorded transaction is assumed. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C.
Cost of staying supported	3	Two recent-version support rule and coordinated Director/StorageDaemon upgrade dependency documented. Current version policy: Two most recent versions receive support per new-features guide; version-specific EOS list not reconstructed. 18.2 release family; 2025-05-19 notes: Director and all StorageDaemons must be upgraded together to 18.2 because they are incompatible with earlier versions. 18.0 introduced catalog 1027; upgrading 18.0→18.2 does not require catalog-conversion script. Version coupling, not licence termination. Evidence A. new; rn182

Security record of the product itself: No in-scope match located in the accepted security-record.md manual product-name filter of the CISA 2026-09-30 catalogue; no deduction. This is not an exhaustive advisory audit or a claim of no exploitation. Arcserve CVE-2015-4068 was added to KEV in 2022, outside the adjustment window. Adjacent array/infrastructure/hosting-plugin CVEs are excluded. Security record: CISA Known Exploited Vulnerabilities catalogue and vendor advisories.

Technical lock-in: 11.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	2.5	2026-10-01 evidence boundary: Independent backup-format specification/readability is not established in the accepted research. Provisional format-dependency estimate, not proof that only a running licensed instance can read it. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C.
Export path	2.5	2026-10-01 evidence boundary: Independent data extraction and post-licence restoration terms are incomplete. Provisional export estimate, not proof of no export or licence-required restore. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C.
Stack coupling	2.5	Director/StorageDaemon and catalog versions must be coordinated, despite broad storage/hypervisor plugins. Daemon/catalog coupling: 10.0 and 18.0 notes require Director and Storage Daemons to be upgraded together; catalog-format migration needed. No generic portability guarantee inferred from shared core. Evidence A. rn100; rn180
Hardware / cloud coupling	0.5	Software disk/cloud/tape targets reduce own-hardware dependency; specific plugin configuration remains. Observed by 2026-10-01: 18.2 Dedup2 configuration; 18.2.5 snapshot accelerator; carry-forward source/global dedupe. Full target matrix pending. Evidence A. rn182; rn122
Skills and tooling coupling	3.5	Named training and product-specific administration imply some skills coupling; no unsourced scarcity/headcount claim. Training: Partner page names Foundation Course and Expert Series; search index said Admin I but live page says Foundation Course. Launch dates/exam prerequisites unresolved. Evidence A. partner

Integrator fit: 15.5 / 20

Criterion	Score	Basis
Partner programme openness	3.5	Published partner routes and entry/tier qualifications earn credit; undisclosed obligations limit the score. Training: Partner page names Foundation Course and Expert Series; search index said Admin I but live page says Foundation Course. Launch dates/exam prerequisites unresolved. Evidence A. partner
Multi-tenancy and self-service	4	Native 18.0 multitenancy, with provider entitlement separate. REST/automation: BCloud REST service introduced 10.0; JSON console output 14.0; native multitenancy 18.0. Official Terraform provider audit pending. Evidence A. rn100; rn140; rn180
API and infrastructure-as-code	4	Official Ansible collection and REST/JSON; download count does not establish support SLA. Official Ansible registry observation 2026-10-01: baculasystems.bacula_enterprise: cumulative 2617 downloads; collection created 2023-05-08, latest 2.1.0 updated 2026-09-07. Installation guide covers directors/storage/clients/plugins; registry creation is not the product launch date. REST/automation: BCloud REST service introduced 10.0; JSON console output 14.0; native multitenancy 18.0. Official Terraform provider audit pending. Evidence A. ansibleIndex; ansibleInstall; rn100; rn140; rn180
Skills and certification	4	Named hands-on Foundation certification/Expert Series; Oct 2 current fee is not a historical licence price. Training: Partner page names Foundation Course and Expert Series; search index said Admin I but live page says Foundation Course. Launch dates/exam prerequisites unresolved. Foundation Course / observation 2026-10-02: Five live online half-days, maximum eight participants; Linux knowledge and systems-administration skills expected. Vendor says completion leads to Bacula Certified status. Listed fee EUR 3,700 / USD 4,200; this is training, not a software licence price or dated price change. First credential launch and exam standard remain unresolved. Evidence A. partner; foundationCurrent

AI leverage: 2 / 20

Strand	Today	Latest step
AI for protection / protecting AI	0	2016: 2016 initial scoring observation: no affirmative released in-scope AI evidence is credited in this strand. Zero is an evidence-bounded score, not a claim that the capability was absent. Evidence C.
AI platform stack	0	2016: 2016 initial scoring observation: no affirmative released in-scope AI evidence is credited in this strand. Zero is an evidence-bounded score, not a claim that the capability was absent. Evidence C.
AI-assisted operations	0	2016: 2016 initial scoring observation: no affirmative released in-scope AI evidence is credited in this strand. Zero is an evidence-bounded score, not a claim that the capability was absent. Evidence C.
Agent openness	2	2023: Official Ansible registry observation 2026-10-01: baculasystems.bacula_enterprise: cumulative 2617 downloads; collection created 2023-05-08, latest 2.1.0 updated 2026-09-07. Installation guide covers directors/storage/clients/plugins; registry creation is not the product launch date. Official Ansible plus REST; not an AI model or MCP. Evidence A. ansibleIndex; ansibleInstall

AI say-do sample: 1 recorded announcement rows; 1 GA/shipped matches, 0 preview/early/limited at announcement, 0 partial, 0 pending, 0 slipped, 0 dropped. Preview-at-announcement overlaps outcome counts. These are promise-row counts, not unique announcements or counts of released AI features; omissions/overlaps in the AI research ledger are preserved. "Shipped" may be a vendor availability assertion rather than an independently verified first-GA day.

Reading

Bacula Enterprise is extending plugin coverage and security controls around its daemon and catalog architecture. Release notes establish database, alternative-hypervisor and immutable-target gains without proving an AI model. Coordinated upgrades, proprietary-plugin rights and product-specific administration remain dependencies.

Open questions and evidence caveats

Unchanged annual values carry the last scored release; they do not certify a frozen compatibility matrix or exact first-feature GA. Some checkpoint-derived jumps may lag the true first shipment.
Unverified AI strands receive zero credited evidence; this is a conservative estimate rather than a vendor-wide absence claim. Preview/limited capabilities add at most half a point beyond the preceding established score.
Say-do counts are a bounded research sample. Same-day/release-note announcements and post-release blogs are not promises delivered instantly. Missing outcome dates do not prove non-delivery.
Commercial/exit terms not reconstructed use explicit provisional midpoint estimates; executed regional contracts may differ.
virtual: 2016 baseline is provisional; no frozen checkpoint fact.
apps: 2016 baseline is provisional; no frozen checkpoint fact.
cyber: 2016 baseline is provisional; no frozen checkpoint fact.
retention: 2016 baseline is provisional; no frozen checkpoint fact.
dr: 2016 baseline is provisional; no frozen checkpoint fact.
security: 2016 baseline is provisional; no frozen checkpoint fact.
platforms: 2016 baseline is provisional; no frozen checkpoint fact.
Bacula Enterprise is commercial and retained; no Community/OSS backup score included. Open-core architecture does not prove proprietary plugin archive portability. Cinder incremental/differential wording corrected in 18.0.5, not credited.