Cohesity DataProtect / NetBackup: Enterprise Backup Ledger 2026

Part of the Enterprise Backup Ledger (edition 2026-10-03). How the scores work: methodology.

Snapshot

Tier: Leader incumbent
Owner: Cohesity combined with Veritas enterprise data-protection business on 2024-12-10; merged private company.
Licence model: DataProtect/NetBackup contract metrics and transition pricing incomplete; separate product entitlements retained.
Products scored: DataProtect and NetBackup, with separate version/lifecycle clocks; FortKnox services named explicitly.
Latest release: NetBackup 11.2 (release blog 2026-06-02); DataProtect latest GA not confirmed
Next signal: Maestro: General interface/additional agents expected later 2026; availability depends on product subscriptions.; Agent Resilience: GA target end-2026; Microsoft/Google agent platforms planned, no dates.
Archetype: Merged protection portfolio
Evidence grade: C. Overall grade uses all scored history/AI steps and lens criteria: 41 A, 2 B, 15 C of 58; the lowest grade covering more than 25% wins. Judgement itself does not demote a sourced fact; unresolved eligibility, baseline or contract estimates do.

Scope of the scores: Product capability cutoff 2026-10-01; scoring edition 2026-10-03. Combined portfolio scores do not imply one SKU or uniform feature parity. History is evidence-bounded; freezes and first-feature GA dates can be incomplete. AI services named in the AI section do not broaden the ten core domains.

Scorecard

Dimension	Score	Direction
Capability today	87.8 / 100	higher is better
Momentum since end of 2022	+6.6 points	higher is better
Credibility	16.5 / 25	higher is better
Commercial risk	16.5 / 25	lower is better
Technical lock-in	14.5 / 25	lower is better
Integrator fit	17.0 / 20	higher is better
AI leverage	12.5 / 20	higher is better
Ledger Index	67.9 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Virtual and physical servers (12)	4	4.5	4.5	4.5
Databases and applications (12)	3.5	4.5	4.5	4.5
Recovery (14)	3.5	4	4.5	4.5
Cyber resilience (14)	1	1	3.5	4.5
Storage efficiency and targets (10)	4	4.5	4.5	4.5
Long-term retention and tape (6)	3	3.5	4	4
Replication and DR (10)	2	3	4.5	4.5
Security and compliance (8)	2.5	3	3	4.5
New-platform support (VMware exit) (8)	0	3	3	3.5
Management at scale and automation (6)	3	3.5	4	4.5
Total / 100	53.8	68.6	81.2	87.8

Year by year: 2016: 53.8 · 2017: 53.8 · 2018: 55.2 · 2019: 68.6 · 2020: 68.6 · 2021: 73.0 · 2022: 81.2 · 2023: 84.2 · 2024: 85.0 · 2025: 85.8 · 2026: 87.8

What moved the score

Year	Domain	Change	Points	Trigger
2018	Recovery	3.5 → 4	+1.4	NetBackup 8.1.2 (2018-09-17 GA): Web UI with RBAC; expanded REST APIs; SmartMeter capacity reporting; VxUpdate replaces LiveUpdate. Native master/media support for AIX/HP-UX retired, distinct from client support. Evidence A. nb; nb812jp
2019	Databases and applications	3.5 → 4.5	+2.4	DataProtect 6.4 (2019-07-18 release blog; initial GA unresolved): Cloud runbooks for AWS/Azure; Oracle RAC/AIX and SAP HANA integration; SAML SSO; Glacier Deep Archive target. Evidence A. doc150dd060
2019	Long-term retention and tape	3 → 3.5	+0.6	DataProtect 6.4 (2019-07-18 release blog; initial GA unresolved): Cloud runbooks for AWS/Azure; Oracle RAC/AIX and SAP HANA integration; SAML SSO; Glacier Deep Archive target. Evidence A. doc150dd060
2019	Management at scale and automation	3 → 3.5	+0.6	DataProtect 6.4 (2019-07-18 release blog; initial GA unresolved): Cloud runbooks for AWS/Azure; Oracle RAC/AIX and SAP HANA integration; SAML SSO; Glacier Deep Archive target. Evidence A. doc150dd060
2019	New-platform support (VMware exit)	0 → 3	+4.8	NetBackup 8.2 (2019-06-28 GA): Agentless VM recovery; Oracle/Db2 app-aware protection; Glacier dedupe; RHV/OpenStack support. Evidence A. doca8ebfa09
2019	Replication and DR	2 → 3	+2.0	DataProtect 6.4 (2019-07-18 release blog; initial GA unresolved): Cloud runbooks for AWS/Azure; Oracle RAC/AIX and SAP HANA integration; SAML SSO; Glacier Deep Archive target. Evidence A. doc150dd060
2019	Security and compliance	2.5 → 3	+0.8	DataProtect 6.4 (2019-07-18 release blog; initial GA unresolved): Cloud runbooks for AWS/Azure; Oracle RAC/AIX and SAP HANA integration; SAML SSO; Glacier Deep Archive target. Evidence A. doc150dd060
2019	Storage efficiency and targets	4 → 4.5	+1.0	DataProtect 6.4 (2019-07-18 release blog; initial GA unresolved): Cloud runbooks for AWS/Azure; Oracle RAC/AIX and SAP HANA integration; SAML SSO; Glacier Deep Archive target. Evidence A. doc150dd060
2019	Virtual and physical servers	4 → 4.5	+1.2	DataProtect 6.4 (2019-07-18 release blog; initial GA unresolved): Cloud runbooks for AWS/Azure; Oracle RAC/AIX and SAP HANA integration; SAML SSO; Glacier Deep Archive target. Evidence A. doc150dd060
2021	Recovery	4 → 4.5	+1.4	DataProtect 6.6 (2021-03-19 available / SiteContinuity GA): SiteContinuity vSphere failover/failback; Oracle point-in-time instant recovery; Couchbase and SAP HANA on IBM Power; Universal Data Adapter integration. Evidence A. p66
2021	Replication and DR	3 → 4.5	+3.0	DataProtect 6.6 (2021-03-19 available / SiteContinuity GA): SiteContinuity vSphere failover/failback; Oracle point-in-time instant recovery; Couchbase and SAP HANA on IBM Power; Universal Data Adapter integration. Evidence A. p66
2022	Cyber resilience	1 → 3.5	+7.0	NetBackup 10.1 (First GA unresolved; RN revised 2022-09-08): Clustered cloud WORM; S3 interface for MSDP; AWS/Azure malware scanners; SQL gMSA recovery. Evidence A. docb31726b4
2022	Long-term retention and tape	3.5 → 4	+0.6	Observed by 2026-10-01: NetBackup archive/tape current edition/version matrix not fully retrieved Archive/tape coverage carried from NetBackup checkpoint; detailed device/legal-hold matrix remains unresolved. Evidence C. nb
2022	Management at scale and automation	3.5 → 4	+0.6	NetBackup 10.1 (First GA unresolved; RN revised 2022-09-08): Clustered cloud WORM; S3 interface for MSDP; AWS/Azure malware scanners; SQL gMSA recovery. Evidence A. docb31726b4
2023	Cyber resilience	3.5 → 4	+1.4	NetBackup 10.3 (First GA unresolved; RN revised 2023-11-20): Multi-person authorization/MFA; entropy computation; system anomaly detection; NBAC and enhanced-auditing EOL. Evidence A. docc0535067
2023	Security and compliance	3 → 4	+1.6	NetBackup 10.3 (First GA unresolved; RN revised 2023-11-20): Multi-person authorization/MFA; entropy computation; system anomaly detection; NBAC and enhanced-auditing EOL. Evidence A. docc0535067
2024	Security and compliance	4 → 4.5	+0.8	NetBackup 10.4 (First GA unresolved; RN revised 2024-03-28): OCSF audit events; client-dedupe policy controls; malware/anomaly/MFA/MPA enhancements; vSAN ESA. Evidence A. doca9642430
2025	New-platform support (VMware exit)	3 → 3.5	+0.8	NetBackup 11.1 (2025-12-01 release blog; HCL indexed GA2025-11-24): AHV InstantAccess VM creation; VMware-to-AHV restore; pgBackRest/Percona XtraBackup; vTPM support limited to AOS 6.8/Q35 via PrismCentral. Vendor-authored mirror notes opened. Evidence A. nb111; nb111jp; nbHcl11
2026	Cyber resilience	4 → 4.5	+1.4	Observed by 2026-10-01: NetBackup 11.1 Freeze Mode/YARA, 11.2 scan checkpoint/restart; Sophos-powered malware scanning available 2026-03-19, product-family parity not inferred. Evidence A. nb111; nb112; doc429e2258
2026	Management at scale and automation	4 → 4.5	+0.6	Observed by 2026-10-01: NetBackup 11.2 Helios unified management; DataProtect 7.2 OAuth2 REST access. Copilot/RecoveryAgent available; general Maestro MCP remains expected later 2026. Evidence A. nb112; p72; doccfcce01d

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-02	Data Cloud 7.0 split-key privileged control: partial; Initial GA unresolved. Press announcement establishes release feature; gated notes/actual GA date still pending.	D10 Scale and automation	C
2023-04	FortKnox Azure warm vault: shipped; By 2023-08-15; first GA unresolved. Warm available in later blog; cold tier separately coming soon.	D4 Cyber resilience	C
2023-05	Turing / Vertex AI RAG integration: partial; Gaia 2024-03-15; specific Vertex integration unverified. Gaia initial backend/corpus does not prove all Turing or Vertex promises shipped.	D10 Scale and automation	C
2023-08	FortKnox Azure cold vault: pending; unverified. Warm-vault availability does not establish cold-vault GA.	D4 Cyber resilience	C
2024-02	Gaia RAG over indexed backups: partial; Planned2024-03-15; subsequent product delivery documented, exact first GA clock unresolved. Initial workloads explicitly M365/OneDrive; broader workload coverage future. Do not apply this initial scope to all on-prem backup data.	D10 Scale and automation	C
2024-07	Cluster API OAuth 2.0/OIDC: shipped; 2024-07-24 GA assertion; version 7.2. Available-at-launch entry corroborated by version-specific release overview: External IdP SSO user-group authorization and centrally revocable API access tokens.	D9 Security	C
2024-07	IBM FlashSystem incremental block/volume backup: shipped; 2024-07-24 GA assertion; version 7.2. Available-at-launch entry corroborated by version-specific release overview: Captures incremental changes while preserving fully hydrated Cohesity snapshots.	D10 Scale and automation	C
2025-04	RecoveryAgent AI cyber-recovery orchestration: shipped; 2025-08-12. 112 days announcement-to-GA; optional manual pauses/scripts and blueprint execution documented.	D4 Cyber resilience	C
2025-09	40 additional cloud connectors: pending; Unverified. Cumulative count needs versioned connector audit.	D10 Scale and automation	C
2025-09	NetBackup DirectIO /SpanFS: pending; Unverified. Direct storage integration requires NetBackup release confirmation.	D10 Scale and automation	C
2026-03	Sophos-powered ML malware scanning: shipped; 2026-03-19 assertion. Release-note version/family cross-check remains pending.	D4 Cyber resilience	C
2026-05	HPE Morpheus VM support: pending; unverified. NetBackup KVM support alone does not establish Morpheus integration delivery.	D1 Virtual and physical servers	M
2026-06	Additional AI agents for Maestro: pending; unverified. Copilot/RecoveryAgent already available; new agents separately future.	D7 AI-assisted operations	V
2026-06	Gaia MCP integration: shipped; By 2026-06-16; first GA unresolved. Requires Gaia entitlement; this is not GA of full Maestro interface.	D11 Ecosystem openness	V
2026-06	Maestro general MCP interface: pending; unverified. Same platform identity/RBAC/audit claimed; full availability still future in Sep 16 announcement.	D11 Ecosystem openness	V

Centre of gravity: Scale and automation (6), Cyber resilience (4), Ecosystem openness (2)
Driver mix: Vision 20%, Customer need 73%, Market window 7%, Upstream 0%, Portfolio 0%

Credibility: 16.5 / 25

Criterion	Score	Basis
Cadence	4	28 recorded release rows, including maintenance and component overlaps; rows are not distinct GA counts. Regularity judged from the dated tables, not an asserted promised cadence. Data Cloud 7.2 (2024-07-24): OAuth 2.0 Cluster API; IBM FlashSystem incremental protection; NetApp SnapDiff v3; MongoDB zone-sharding support. Kubernetes additions remain adjacent scope. Evidence A. p72
Roadmap transparency	2.5	Public documentation access and versioned release evidence determine this score. Accepted roadmap finding: not found; release blogs and press announcements used. No open-roadmap-tracker reference score is awarded. Data Cloud 7.2 (2024-07-24): OAuth 2.0 Cluster API; IBM FlashSystem incremental protection; NetApp SnapDiff v3; MongoDB zone-sharding support. Kubernetes additions remain adjacent scope. Evidence A. p72
Say-do	3	Recorded ledger: 30 items; 12 shipped, 9 partial, 0 slipped, 9 pending, 0 dropped. Mature dated prospective cohort: 15; 3 documented within 12 calendar months, 0 later than 12 months, 12 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample. Evidence C for the rubric estimate: calibrated to the delivery record below, not a measured census percentage. See the vendor research section F.
Velocity	4.5	Substantive capabilities in the release tables determine velocity; maintenance-only rows do not become new features. Data Cloud 7.1 (2023-10-05 release blog; first GA unresolved): TLS 1.3/native PKI renewal; HashiCorp Vault KMS; AHV instant mass restore; EDB PostgreSQL. Evidence A. docaff01b3a
Lifecycle stability	2.5	DataProtect generally 18 months; NetBackup console retirement clocks conflict across languages. 2025-07 policy revision: DataProtect major releases generally supported 18 months; minor/patch upgrade may be required. Hardware EOS/EOL and SaaS terms differ; do not apply this policy to NetBackup. NetBackup 11.1/11.2 versioned notes: Japanese 11.1 notes retire Java administration console but retain BARUI/older-version support. English 11.2 index labels retirement from 11.2. Conflicting version clocks retained. Evidence A. doc2b2c9f72; nb111jp; nb112index

Say-do record, 2023 to 2026: Recorded ledger: 30 items; 12 shipped, 9 partial, 0 slipped, 9 pending, 0 dropped. Mature dated prospective cohort: 15; 3 documented within 12 calendar months, 0 later than 12 months, 12 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample.

Commercial risk: 16.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	2.5	2023 to cutoff model/packaging observations are distinguished from historical introductions. Without a reconstructed price series this is a provisional estimate, not a measured price increase. 2024-12-10: Cohesity completed combination with Veritas enterprise data-protection business. This does not mean all Veritas businesses. Customer/revenue scale statements are vendor claims. Evidence C. merge
Purchase constraints	3	Licence metrics, edition gates and purchase routes determine this estimate; undisclosed minimums are not assumed zero. Current pricing: Exact DataProtect/NetBackup tiers, capacity minimums, list prices and transition terms not found Evidence A. merge
Channel and access	2.5	Partner entry and public documentation access are both considered. Research documentation finding: dev. Developer ecosystem: REST, Postman and SDK links; integrations/recipes are community/best-effort and not covered by vendor support teams. Evidence A. dev
Owner stability	5	Recent combination directly meets the high ownership-change anchor. 2024-12-10: Cohesity completed combination with Veritas enterprise data-protection business. This does not mean all Veritas businesses. Customer/revenue scale statements are vendor claims. Evidence A. merge
Cost of staying supported	3.5	Short major-line support and upgrade obligations; NetBackup policy remains separate. 2025-07 policy revision: DataProtect major releases generally supported 18 months; minor/patch upgrade may be required. Hardware EOS/EOL and SaaS terms differ; do not apply this policy to NetBackup. Evidence A. doc2b2c9f72

Security record of the product itself: No in-scope match located in the accepted security-record.md manual product-name filter of the CISA 2026-09-30 catalogue; no deduction. This is not an exhaustive advisory audit or a claim of no exploitation. Arcserve CVE-2015-4068 was added to KEV in 2022, outside the adjustment window. Adjacent array/infrastructure/hosting-plugin CVEs are excluded. Security record: CISA Known Exploited Vulnerabilities catalogue and vendor advisories.

Technical lock-in: 14.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	3.5	2026-10-01 evidence boundary: Independent backup-format specification/readability is not established in the accepted research. Provisional format-dependency estimate, not proof that only a running licensed instance can read it. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C.
Export path	2.5	2026-10-01 evidence boundary: Independent data extraction and post-licence restoration terms are incomplete. Provisional export estimate, not proof of no export or licence-required restore. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C.
Stack coupling	3	Heterogeneous nodes limited to Cohesity plus one OEM in this release; no universal appliance requirement assumed for NetBackup. DataProtect 6.5 (2020-02-28 available): vSphere I/O-filter CDP; VMware failover runbooks; SQL migration using file CBT; heterogeneous nodes limited to Cohesity plus one OEM. Evidence A. p65
Hardware / cloud coupling	2.5	Deployment/service dependencies determine this score; missing offline/hardware terms are a provisional estimate. APIs are not backup formats: SDK availability establishes automation access, not vendor-independent repository extraction. Evidence C. dev
Skills and tooling coupling	3	Named training and product-specific administration imply some skills coupling; no unsourced scarcity/headcount claim. Developer ecosystem: REST, Postman and SDK links; integrations/recipes are community/best-effort and not covered by vendor support teams. Evidence A. dev

Integrator fit: 17.0 / 20

Criterion	Score	Basis
Partner programme openness	4	Published partner routes and entry/tier qualifications earn credit; undisclosed obligations limit the score. Developer ecosystem: REST, Postman and SDK links; integrations/recipes are community/best-effort and not covered by vendor support teams. Evidence A. dev
Multi-tenancy and self-service	4.5	Documented tenant/provider isolation and self-service earn credit; reporting or multi-site visibility alone does not prove billing/tenant self-service. Observed by 2026-10-01: NetBackup 11.2 Helios unified management; DataProtect 7.2 OAuth2 REST access. Copilot/RecoveryAgent available; general Maestro MCP remains expected later 2026. Evidence C. nb112; p72; doccfcce01d
API and infrastructure-as-code	4	DataProtect Terraform best-effort contrasts with expressly supported selected NetBackup Ansible playbooks. Terraform support boundary: Vendor-owned Terraform provider targets DataPlatform 6.4+; developer recipes/integrations are best-effort and excluded from Support/Field support. Registry downloads do not override this boundary. NetBackup supported Ansible; observation 2026-10-02: Official installation guide supports only specified VeritasOS playbooks. Repository handles provisioning, upgrades, certificates/EEBs and lists 10.5 to 11.2 builds. This support statement differs from DataProtect Terraform best-effort policy; download count not published here. Evidence A. dev; regapi; nbAnsibleDocs; nbAnsibleRepo
Skills and certification	4.5	Named current credentials, hands-on requirements and dated Academy launch; first-year gaps retained. Current certification structure: ProtectionAssociate DataProtect/Multicloud, ImplementationProfessional SmartFiles, ProtectionProfessional NetBackup/Appliances, SecuritySpecialist; professional badge combines three credentials. FAQ suggests 6 to 9months experience, optional coursework,2-year expiry/14-day retake. Landing page instead suggests 3months; record guidance difference. Modern names are not automatically the 2021 names. NetBackup certification current observation 2026-10-01: Cohesity Certified Protection Professional to NetBackup, COH-284:105minutes,$200USD,65 percent pass,2-year expiration, 14-day retake; no prerequisite certification. First launch year not stated; programme rename not assumed new launch. Evidence A. academyCertNow; academyFAQNow; cert284

AI leverage: 12.5 / 20

Strand	Today	Latest step
AI for protection / protecting AI	3.5	2026: 2026-03-19; Available: Sophos malware scanning uses ML; family-specific release/version and accuracy validation pending. Evidence A. doc429e2258
AI platform stack	0.5	2024: 2024-03-15; GA: Gaia RAG search over backup datasets; initial OneDrive corpus is adjacent SaaS scope, not proof of model/vector-database consistent backup. Initial Gaia corpus is adjacent OneDrive; do not award full on-prem backup-data GA. Evidence A. gaia
AI-assisted operations	4.5	2025: 2023-05-23 / 2024-03-15; Announced integration / Gaia GA: Turing/Vertex AI promises and Gaia Azure OpenAI backend are separate clocks and implementations. Gaia SKU required for its MCP functions. RecoveryAgent acts via blueprints and optional manual pauses; mandatory approval everywhere is not established. Evidence A. doc5fc481bf; gaia; doccfcce01d
Agent openness	4	2026: 2026-06-16; Available; retrospective launch year 2024: Copilot provides conversational reporting/anomaly analysis/operational actions; exact first GA/build unresolved. Gaia MCP available with RBAC/auth/audit; broad Maestro still future. Scope-specific score. Evidence C. doccfcce01d

AI say-do sample: 11 recorded announcement rows; 3 GA/shipped matches, 2 preview/early/limited at announcement, 4 partial, 4 pending, 0 slipped, 0 dropped. Preview-at-announcement overlaps outcome counts. These are promise-row counts, not unique announcements or counts of released AI features; omissions/overlaps in the AI research ledger are preserved. "Shipped" may be a vendor availability assertion rather than an independently verified first-GA day. Gaia initial OneDrive RAG is adjacent scope; its MCP availability does not establish broad Maestro GA.

Reading

Cohesity is joining two backup product lines under common management and cyber recovery services. Delivered DataProtect and NetBackup features cover databases, CDP and recovery automation, while broader Maestro and Agent Resilience timing remains open. The combined portfolio brings management and ownership transition work alongside broad workload coverage.

Open questions and evidence caveats

Unchanged annual values carry the last scored release; they do not certify a frozen compatibility matrix or exact first-feature GA. Some checkpoint-derived jumps may lag the true first shipment.
Unverified AI strands receive zero credited evidence; this is a conservative estimate rather than a vendor-wide absence claim. Preview/limited capabilities add at most half a point beyond the preceding established score.
Say-do counts are a bounded research sample. Same-day/release-note announcements and post-release blogs are not promises delivered instantly. Missing outcome dates do not prove non-delivery.
Commercial/exit terms not reconstructed use explicit provisional midpoint estimates; executed regional contracts may differ.
cyber: 2016 baseline is provisional; no frozen checkpoint fact.
dr: 2016 baseline is provisional; no frozen checkpoint fact.
platforms: 2016 baseline is provisional; no frozen checkpoint fact.
Portfolio union is scored: a DataProtect feature is not asserted to ship in NetBackup. NetBackup mirror-only claims carry B where used; current matrices remain incomplete.