HYCU R-Cloud: Enterprise Backup Ledger 2026

Part of the Enterprise Backup Ledger (edition 2026-10-03). How the scores work: methodology.

Snapshot

Tier: Challenger
Owner: HYCU; Bain Capital Ventures/Acrew Series A 2021 and USD53m Series B 2022; no acquisition of HYCU recorded.
Licence model: Hybrid Backup & Recovery/Enterprise Resilience/Unified Resilience quote-based bundles; CSP PayGo no pre-commitment is programme-specific.
Products scored: Hybrid Cloud Edition 5.3; cloud modules contribute only when explicitly named, not blanket Hybrid entitlement.
Latest release: Hybrid Cloud Edition 5.3.0 (release notes 2026-07); security build 5.3.0-3901; exact GA day not found
Next signal: Nutanix AOS 7.6 support: Staff reply 2026-08-18: planned for next Hybrid Edition update; no ETA; current shipping status not established
Archetype: Hybrid controller expansion
Evidence grade: C. Overall grade uses all scored history/AI steps and lens criteria: 31 A, 0 B, 25 C of 56; the lowest grade covering more than 25% wins. Judgement itself does not demote a sourced fact; unresolved eligibility, baseline or contract estimates do.

Scope of the scores: Product capability cutoff 2026-10-01; scoring edition 2026-10-03. Combined portfolio scores do not imply one SKU or uniform feature parity. History is evidence-bounded; freezes and first-feature GA dates can be incomplete. AI services named in the AI section do not broaden the ten core domains.

Scorecard

Dimension	Score	Direction
Capability today	72.8 / 100	higher is better
Momentum since end of 2022	+7.0 points	higher is better
Credibility	17.0 / 25	higher is better
Commercial risk	9.5 / 25	lower is better
Technical lock-in	10.5 / 25	lower is better
Integrator fit	15.0 / 20	higher is better
AI leverage	7.0 / 20	higher is better
Ledger Index	63.8 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Virtual and physical servers (12)	n/a	3	3	3.5
Databases and applications (12)	n/a	3.5	3.5	4
Recovery (14)	n/a	2.5	3.5	3.5
Cyber resilience (14)	n/a	0.5	3	4
Storage efficiency and targets (10)	n/a	2.5	3.5	4
Long-term retention and tape (6)	n/a	1	3	3
Replication and DR (10)	n/a	1.5	3.5	3.5
Security and compliance (8)	n/a	2.5	3	3.5
New-platform support (VMware exit) (8)	n/a	3	3	3
Management at scale and automation (6)	n/a	3.5	4	4
Total / 100	not released	46.2	65.8	72.8

Year by year: 2017: 35.0 · 2018: 35.0 · 2019: 46.2 · 2020: 48.0 · 2021: 50.8 · 2022: 65.8 · 2023: 65.8 · 2024: 65.8 · 2025: 68.2 · 2026: 72.8

What moved the score

Year	Domain	Change	Points	Trigger
2019	Databases and applications	1.5 → 3.5	+4.8	3.5.0 (2018-11 product release): SAP HANA application awareness; multiple apps per VM; AD groups/roles; volume groups/single disk recovery. Exact GA day unresolved where only month/cover is stated. Evidence A. rn350
2019	Management at scale and automation	2 → 3.5	+1.8	4.0.0 (2019-06 product release): Physical machines; HYCU Manager for many controllers; controller backup/automatic restore; file-share protection. Exact GA day unresolved where only month/cover is stated. Evidence A. rn400
2019	Recovery	2 → 2.5	+1.4	3.5.0 (2018-11 product release): SAP HANA application awareness; multiple apps per VM; AD groups/roles; volume groups/single disk recovery. Exact GA day unresolved where only month/cover is stated. Evidence A. rn350
2019	Security and compliance	2 → 2.5	+0.8	3.5.0 (2018-11 product release): SAP HANA application awareness; multiple apps per VM; AD groups/roles; volume groups/single disk recovery. Exact GA day unresolved where only month/cover is stated. Evidence A. rn350
2019	Virtual and physical servers	2 → 3	+2.4	4.0.0 (2019-06 product release): Physical machines; HYCU Manager for many controllers; controller backup/automatic restore; file-share protection. Exact GA day unresolved where only month/cover is stated. Evidence A. rn400
2020	Long-term retention and tape	1 → 2.5	+1.8	4.2.0 (2020-12 product release): Secure-boot VMs; file restore to another VM; QStar ASM tape target; Linux physical protection is Preview. Exact GA day unresolved where only month/cover is stated. QStar-mediated tape archive; not a native tape engine. Evidence A. rn420
2021	Recovery	2.5 → 3.5	+2.8	4.3.0 (2021-09 product release): Independent volume-group protection; scheduled backup validation; 25% change-rate anomaly threshold (configurable); public target warning. Exact GA day unresolved where only month/cover is stated. Evidence A. rn430
2022	Cyber resilience	0.5 → 3	+7.0	4.5.0 (2022-04 product release): PowerScale OneFS integration; Google Bucket Lock/Azure WORM; incremental-forever object archives; secrets management. Exact GA day unresolved where only month/cover is stated. Evidence A. rn450
2022	Long-term retention and tape	2.5 → 3	+0.6	4.5.0 (2022-04 product release): PowerScale OneFS integration; Google Bucket Lock/Azure WORM; incremental-forever object archives; secrets management. Exact GA day unresolved where only month/cover is stated. Evidence A. rn450
2022	Management at scale and automation	3.5 → 4	+0.6	4.6.0 (2022-11 note cover): Azure Government workload protection; onprem-to-AWS migration/DR and return to VMware/AHV; AWS Manager console. Exact GA day unresolved where only month/cover is stated. Evidence A. rn460
2022	Replication and DR	1.5 → 3.5	+4.0	4.6.0 (2022-11 note cover): Azure Government workload protection; onprem-to-AWS migration/DR and return to VMware/AHV; AWS Manager console. Exact GA day unresolved where only month/cover is stated. Evidence A. rn460
2022	Security and compliance	2.5 → 3	+0.8	4.5.0 (2022-04 product release): PowerScale OneFS integration; Google Bucket Lock/Azure WORM; incremental-forever object archives; secrets management. Exact GA day unresolved where only month/cover is stated. Evidence A. rn450
2022	Storage efficiency and targets	2.5 → 3.5	+2.0	4.5.0 (2022-04 product release): PowerScale OneFS integration; Google Bucket Lock/Azure WORM; incremental-forever object archives; secrets management. Exact GA day unresolved where only month/cover is stated. Evidence A. rn450
2025	Databases and applications	3.5 → 4	+1.2	Hybrid Cloud Edition 5.2.0 (2025-09): Release-note cover 2025-09; Hyper-V, PostgreSQL PIT restore, size-anomaly detection, HotAdd and LDAP introduced. Exact GA day not found. Evidence A. rn52
2025	Virtual and physical servers	3 → 3.5	+1.2	Hybrid Cloud Edition 5.2.0 (2025-09): Release-note cover 2025-09; Hyper-V, PostgreSQL PIT restore, size-anomaly detection, HotAdd and LDAP introduced. Exact GA day not found. Evidence A. rn52
2026	Cyber resilience	3 → 4	+2.8	Observed by 2026-10-01: 5.3 R-Shield automatic policy scans and manual restore-point scans; uses HYCU instances; algorithm/ML claim not inferred Evidence A. rn53
2026	Security and compliance	3 → 3.5	+0.8	Observed by 2026-10-01: 2026-07 STIG hardening and AWS/Azure KMS integration announced in update; not blanket product certification STIG hardening/KMS; not blanket validation. Evidence A. new
2026	Storage efficiency and targets	3.5 → 4	+1.0	Observed by 2026-10-01: 2026-07 S3-target expansion includes MinIO/TrueNAS/Pure/VAST/Zadara immutable options; exact versions not found Evidence A. new

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-03	ONTAP and generic file-share protection: shipped; By2023-03; exact first GA day unresolved. ONTAP snapshots, NFS/SMB full/incremental protection and SMB encryption. Correct checkpoint is March2023, not June2024. Dated delivery assertion, not reconstructed earlier promise.	D10 Scale and automation	C
2023-03	VMware vSAN/vVols and vSphere8: shipped; By2023-03; exact first GA day unresolved. Snapshot-based VM/app protection; no exact Hybrid Controller build or original forward promise provided. Dated delivery assertion, not reconstructed earlier promise.	D10 Scale and automation	C
2023-07	Direct AWS S3 tier selection for onprem backups: shipped; By2023-07; exact first GA day unresolved. Standard-IA/OneZone-IA/Glacier named; retention economics depend on tier. Earlier forward promise and exact build unresolved. Dated delivery assertion, not reconstructed earlier promise.	D10 Scale and automation	C
2024-02	Cloud-native compression expansion: shipped; By2024-02; exact first GA day unresolved. Select cloud-native workloads; onprem already supported. No quantified guaranteed cost saving. Dated delivery assertion, not reconstructed earlier promise.	D5 Storage efficiency	C
2024-06	GCS object-level retention lock: shipped; By2024-06; exact first GA day unresolved. Object-level WORM configuration; not first GA in 2025. Cloud target feature, not an onprem controller release. Dated delivery assertion, not reconstructed earlier promise.	D10 Scale and automation	C
2024-12	App-aware SQL recovery on EC2/GCE: shipped; By2024-12; exact first GA day unresolved. Agentless DB discovery, granular/PIT recovery and alternate SQL instance/cross-cloud mobility; no unsupported SQL engine-version list inferred. Dated delivery assertion, not reconstructed earlier promise.	D2 Databases and applications	C
2025-01	Azure Local and Nutanix NDB support: shipped; By2025-01; exact first GA day unresolved. Native agentless integration; vTPM/AOS 6.10 also listed. Complete version matrix remains separate. Dated delivery assertion, not reconstructed earlier promise.	D10 Scale and automation	C
2025-01	NetApp SnapDiff fileshare backups: shipped; By2025-01; exact first GA day unresolved. Scale-out file backup feature; no first 2024 date inferred. Dated delivery assertion, not reconstructed earlier promise.	D10 Scale and automation	C
2025-03	Nutanix near-production malware detection: shipped; By2025-03; exact first GA day unresolved. Rule/anomaly scans of near-production copies, independent of backup storage; not proof every detector uses ML. Dated delivery assertion, not reconstructed earlier promise.	D4 Cyber resilience	C
2026-03	Halcyon R-Shield detection/DXP/key remediation: shipped; By2026-03 log; exact first GA day unresolved. Production model-based detection independent of backup scans; no exact build or first launch date given.	D10 Scale and automation	C
2026-03	R-Cloud MCP unified control plane: partial; Exact GA unverified. Live whats-new entry documents SaaS/cloud scope; precise server docs and onprem equivalence unresolved.	D11 Ecosystem openness	V
2026-03	R-Shield Halcyon AI detection: partial; Exact GA unverified. 5.3 July notes corroborate backup malware scanning, not exact live Halcyon AI scope/entitlement.	D10 Scale and automation	C
2026-05	aiR natural-language backup intelligence: pending; GA unverified. Early adopters/testing explicitly distinguished from general availability; hybrid SKU coverage unresolved.	D7 AI-assisted operations	V
2026-07	R-Shield backup malware scan: shipped; July2026; exact day unresolved. Automatic and on-demand scans and dashboard; controller instances perform scans.	D4 Cyber resilience	C
2026-08	Nutanix AOS 7.6 support: pending; not found. No measurable deadline; current GA not found	D10 Scale and automation	C

Centre of gravity: Scale and automation (9), Cyber resilience (2), Storage efficiency (1)
Driver mix: Vision 13%, Customer need 87%, Market window 0%, Upstream 0%, Portfolio 0%

Credibility: 17 / 25

Criterion	Score	Basis
Cadence	4	29 recorded release rows, including maintenance and component overlaps; rows are not distinct GA counts. Regularity judged from the dated tables, not an asserted promised cadence. Hybrid Cloud Edition 5.2.0 (2025-09): Release-note cover 2025-09; Hyper-V, PostgreSQL PIT restore, size-anomaly detection, HotAdd and LDAP introduced. Exact GA day not found. Evidence A. rn52
Roadmap transparency	3	Public documentation access and versioned release evidence determine this score. Accepted roadmap finding: not found; dated release and vendor announcement pages used. No open-roadmap-tracker reference score is awarded. Hybrid Cloud Edition 5.2.0 (2025-09): Release-note cover 2025-09; Hyper-V, PostgreSQL PIT restore, size-anomaly detection, HotAdd and LDAP introduced. Exact GA day not found. Evidence A. rn52
Say-do	3	Recorded ledger: 21 items; 17 shipped, 2 partial, 0 slipped, 2 pending, 0 dropped. Mature dated prospective cohort: 0; 0 documented within 12 calendar months, 0 later than 12 months, 0 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample. Evidence C for the rubric estimate: calibrated to the delivery record below, not a measured census percentage. See the vendor research section F.
Velocity	4	Substantive capabilities in the release tables determine velocity; maintenance-only rows do not become new features. R-Cloud service feature log 2025 (2025-01 /03 /08 /11): AzureLocal/NDB and SnapDiff; near-production malware detection; Azure SQL DB then managed instances. Evidence A. archive25
Lifecycle stability	3	Accepted lifecycle finding: not found. Grade C where current contract/EOS boundaries remain unresolved. 2020-06-15: Cloud Services Provider programme launches co-branded backup/migration/DR services with pay-as-you-go and no pre-commitments. Technical labs/certification, no-extra-charge advisory services and expanded Authorized-to-Premier incentives are described. This is programme-specific, not a perpetual-to-subscription migration of all on-premises licences. Evidence C. cspProgram20

Say-do record, 2023 to 2026: Recorded ledger: 21 items; 17 shipped, 2 partial, 0 slipped, 2 pending, 0 dropped. Mature dated prospective cohort: 0; 0 documented within 12 calendar months, 0 later than 12 months, 0 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample.

Commercial risk: 9.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	1.5	2023 to cutoff model/packaging observations are distinguished from historical introductions. Without a reconstructed price series this is a provisional estimate, not a measured price increase. 2026-10-01 observation: Hybrid pricing names Backup & Recovery, Enterprise Resilience, Unified Resilience; quote route rather than verified numeric list price Evidence C. pricing
Purchase constraints	2.5	CSP no pre-commitment is documented; on-prem bundle minimums and unit prices are unresolved. 2020-06-15: Cloud Services Provider programme launches co-branded backup/migration/DR services with pay-as-you-go and no pre-commitments. Technical labs/certification, no-extra-charge advisory services and expanded Authorized-to-Premier incentives are described. This is programme-specific, not a perpetual-to-subscription migration of all on-premises licences. Hybrid tiers: Named three plans; HTML feature checkmarks ambiguous, so no inferred tier-by-tier entitlement Evidence C. cspProgram20; pricing
Channel and access	1.5	Partner entry and public documentation access are both considered. Research documentation finding: doc 53. Certification launch 2020-09-23: HYCU Enterprise Cloud Admin Certification launched through Learning Center for Nutanix/VMware protection, with labs, videos and individual sessions; launch promotion free through 2020. Evidence A. certLaunch
Owner stability	1.5	Financing rounds change investor exposure; no controlling-owner acquisition is recorded. 2021-03-30: $87.5m Series A closed, led by Bain Capital Ventures with Acrew; Enrique Salem and Stefan Cohen join board. 2022-06-09: HYCU announces $53m Series B for SaaS service expansion; company financing, not a backup-software licence price. Evidence A. fundA21; seriesb
Cost of staying supported	2.5	Support/upgrade constraints, distinct from licence-expiry restoration: not found. 2020-06-15: Cloud Services Provider programme launches co-branded backup/migration/DR services with pay-as-you-go and no pre-commitments. Technical labs/certification, no-extra-charge advisory services and expanded Authorized-to-Premier incentives are described. This is programme-specific, not a perpetual-to-subscription migration of all on-premises licences. Evidence C. cspProgram20

Security record of the product itself: No in-scope match located in the accepted security-record.md manual product-name filter of the CISA 2026-09-30 catalogue; no deduction. This is not an exhaustive advisory audit or a claim of no exploitation. Arcserve CVE-2015-4068 was added to KEV in 2022, outside the adjustment window. Adjacent array/infrastructure/hosting-plugin CVEs are excluded. Security record: CISA Known Exploited Vulnerabilities catalogue and vendor advisories.

Technical lock-in: 10.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	3	2026-10-01 evidence boundary: Independent backup-format specification/readability is not established in the accepted research. Provisional format-dependency estimate, not proof that only a running licensed instance can read it. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C.
Export path	2.5	2026-10-01 evidence boundary: Independent data extraction and post-licence restoration terms are incomplete. Provisional export estimate, not proof of no export or licence-required restore. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C.
Stack coupling	2	The documented component/management stack is considered; cross-workload or cross-hypervisor recovery is not inferred from an API. Architecture: Versioned Hybrid Cloud Edition docs distinct from SaaS application connectors; independent repository extraction not found Evidence C. rn52; doc51
Hardware / cloud coupling	1	Deployment/service dependencies determine this score; missing offline/hardware terms are a provisional estimate. Architecture: Versioned Hybrid Cloud Edition docs distinct from SaaS application connectors; independent repository extraction not found Evidence C. rn52; doc51
Skills and tooling coupling	2	Named training and product-specific administration imply some skills coupling; no unsourced scarcity/headcount claim. Certification launch 2020-09-23: HYCU Enterprise Cloud Admin Certification launched through Learning Center for Nutanix/VMware protection, with labs, videos and individual sessions; launch promotion free through 2020. Evidence A. certLaunch

Integrator fit: 15 / 20

Criterion	Score	Basis
Partner programme openness	4	Dated CSP launch and explicit historical revenue/deal-registration schedule; no undated-to-current PACE equivalence. CSP programme launch 2020-06-15: Pay-as-you-go with no pre-commitments, certification curriculum and hands-on enablement; original press statement dates the programme. Named Enterprise Cloud Admin credential has its separate September 2020 launch row. Historical tier schedule / undated official datasheet: On-premises Authorized/Premier/Global Solution Provider: annual revenue thresholds none / USD 50,000 / USD 1,000,000; GSP presence in three countries. Validated deal-registration discounts add 10%/20%/20%. Four complete quarters after enrolment define the revenue window; geography can adjust thresholds. No date or current PACE equivalence is inferred. Evidence A. cspProgram20; certLaunch; partnerOverviewUndated
Multi-tenancy and self-service	4	Multitenant service delivery and multi-controller Manager documented; billing details remain incomplete. PACE partner programme / current page: Partners Accelerating Cloud Environments; reseller/service-provider/alliance tracks and multitenant delivery. 500-partner community is a vendor claim; page does not enumerate rank tiers or launch date. 4.0.0 (2019-06 product release): Physical machines; HYCU Manager for many controllers; controller backup/automatic restore; file-share protection. Exact GA day unresolved where only month/cover is stated. Evidence A. partnerCurrent; rn400
API and infrastructure-as-code	3	Documented APIs and official IaC earn credit. Community examples and publisher-owned repositories do not automatically imply vendor support. Observed by 2026-10-01: 5.3 HYCU Manager upgrades, controller power controls, reports, events and SSO; current API/IaC limits not recovered Evidence C. rn53
Skills and certification	4	Enterprise Cloud Admin credential launched September 2020 with labs; free promotion is historical. Certification launch 2020-09-23: HYCU Enterprise Cloud Admin Certification launched through Learning Center for Nutanix/VMware protection, with labs, videos and individual sessions; launch promotion free through 2020. Evidence A. certLaunch

AI leverage: 7.0 / 20

Strand	Today	Latest step
AI for protection / protecting AI	3	2026: 2026-03 release log; Documented available: R-Shield uses Halcyon-trained models for early ransomware/encryption behaviour; operates independently of backup scanning. DXP blocks exfiltration and key-material remediation captures encryption keys. Halcyon model-based live protection distinct from backup YARA. Evidence A. new26
AI platform stack	0.5	2026: 2026-05-14; Early access waitlist: aiR queries protected records and purpose-built agents inspect sensitive data, insider risk, identity/configuration drift and AI-agent activity. Launch explicitly opens an early-access waitlist; no blanket GA or Hybrid Controller entitlement inferred. aiR early-access waitlist; no general GA. Evidence A. air26
AI-assisted operations	0.5	2026: 2026-05-14; Early access waitlist: aiR queries protected records and purpose-built agents inspect sensitive data, insider risk, identity/configuration drift and AI-agent activity. Launch explicitly opens an early-access waitlist; no blanket GA or Hybrid Controller entitlement inferred. Early access only, maximum half-step. Evidence A. air26
Agent openness	3	2026: 2026-03 whats-new entry; Introduced per vendor; exact GA unresolved: Central R-Cloud MCP for SaaS/cloud protection policy/orchestration/integration. Do not infer onprem Hybrid Cloud 5.3 MCP parity. Identity, permissions and audit detail unverified. Official R-Cloud MCP introduced, GA/governance unresolved; specific official-preview-equivalent openness anchor, not Hybrid controller parity. Evidence C. new

AI say-do sample: 3 recorded announcement rows; 0 GA/shipped matches, 1 preview/early/limited at announcement, 2 partial, 1 pending, 0 slipped, 0 dropped. Preview-at-announcement overlaps outcome counts. These are promise-row counts, not unique announcements or counts of released AI features; omissions/overlaps in the AI research ledger are preserved. "Shipped" may be a vendor availability assertion rather than an independently verified first-GA day. AI score names R-Cloud vector data/production detection explicitly; aiR is early access and Hybrid entitlement is not inferred.

Reading

HYCU is expanding hybrid protection while adding cloud database and threat-detection modules. Versioned Hybrid notes show physical-server, database and controller-management gains, while aiR remains early access. Cloud module availability and Hybrid controller entitlement require separate interpretation.

Open questions and evidence caveats

Unchanged annual values carry the last scored release; they do not certify a frozen compatibility matrix or exact first-feature GA. Some checkpoint-derived jumps may lag the true first shipment.
Unverified AI strands receive zero credited evidence; this is a conservative estimate rather than a vendor-wide absence claim. Preview/limited capabilities add at most half a point beyond the preceding established score.
Say-do counts are a bounded research sample. Same-day/release-note announcements and post-release blogs are not promises delivered instantly. Missing outcome dates do not prove non-delivery.
Commercial/exit terms not reconstructed use explicit provisional midpoint estimates; executed regional contracts may differ.
virtual: 2017 baseline is provisional; no frozen checkpoint fact.
apps: 2017 baseline is provisional; no frozen checkpoint fact.
recovery: 2017 baseline is provisional; no frozen checkpoint fact.
cyber: 2017 baseline is provisional; no frozen checkpoint fact.
storage: 2017 baseline is provisional; no frozen checkpoint fact.
retention: 2017 baseline is provisional; no frozen checkpoint fact.
dr: 2017 baseline is provisional; no frozen checkpoint fact.
security: 2017 baseline is provisional; no frozen checkpoint fact.
platforms: 2017 baseline is provisional; no frozen checkpoint fact.
scale: 2017 baseline is provisional; no frozen checkpoint fact.
HYCU starts in 2017 from commercial launch evidence; all initial domain values are provisional where launch capabilities are not individually frozen. Physical Hyper-V/parity and current Linux matrix are limited. Cloud Pinecone/Halcyon/MCP do not expand core Hybrid domains.