OpenText Data Protector: Enterprise Backup Ledger 2026

Part of the Enterprise Backup Ledger (edition 2026-10-03). How the scores work: methodology.

Snapshot

Tier: Legacy enterprise
Owner: OpenText acquired Micro Focus on 2023-01-31; prior HPE software merger completed 2017-09-01.
Licence model: Express socket VM-only and Premium capacity models; licensing portal keys, separately licensed reporting history.
Products scored: Data Protector 26.2 and explicitly labelled DP4CW; legacy core and Cloud Workloads support not treated as one hypervisor method.
Latest release: 26.2 released (date not found); 25.4 lifecycle differs
Next signal: No dated next milestone established in the accepted research.
Archetype: Enterprise engine modernization
Evidence grade: A. Overall grade uses all scored history/AI steps and lens criteria: 38 A, 0 B, 12 C of 50; the lowest grade covering more than 25% wins. Judgement itself does not demote a sourced fact; unresolved eligibility, baseline or contract estimates do.

Scope of the scores: Product capability cutoff 2026-10-01; scoring edition 2026-10-03. Combined portfolio scores do not imply one SKU or uniform feature parity. History is evidence-bounded; freezes and first-feature GA dates can be incomplete. AI services named in the AI section do not broaden the ten core domains.

Scorecard

Dimension	Score	Direction
Capability today	76.6 / 100	higher is better
Momentum since end of 2022	+5.8 points	higher is better
Credibility	17.0 / 25	higher is better
Commercial risk	14.0 / 25	lower is better
Technical lock-in	13.5 / 25	lower is better
Integrator fit	11.5 / 20	higher is better
AI leverage	7.5 / 20	higher is better
Ledger Index	60.4 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Virtual and physical servers (12)	4	4	4.5	4.5
Databases and applications (12)	3.5	4	4.5	4.5
Recovery (14)	3.5	3.5	3.5	4
Cyber resilience (14)	1	2.5	3	4
Storage efficiency and targets (10)	4	4	4.5	4.5
Long-term retention and tape (6)	3	3	3	3
Replication and DR (10)	2	2	2	2
Security and compliance (8)	2.5	3	3	3.5
New-platform support (VMware exit) (8)	0.5	1.5	3	3.5
Management at scale and automation (6)	4	4	4	4
Total / 100	55.8	63.6	70.8	76.6

Year by year: 2016: 55.8 · 2017: 56.6 · 2018: 56.6 · 2019: 63.6 · 2020: 63.6 · 2021: 63.6 · 2022: 70.8 · 2023: 70.8 · 2024: 74.4 · 2025: 75.8 · 2026: 76.6

What moved the score

Year	Domain	Change	Points	Trigger
2017	Security and compliance	2.5 → 3	+0.8	Data Protector 10.00 (Version-specific cumulative release log; GA day not established): TLS 1.2 client-to-Cell-Manager connections secured by default with certificate pinning; centralized command execution; REST browse/restore/scheduler APIs; new web scheduler. Evidence A. log1000
2019	Cyber resilience	1 → 2.5	+4.2	End-2019 checkpoint: Carry-forward 10.03 StoreOnce Catalyst item immutability until retention expiry; not generic S3 Object Lock. Evidence A. log1003
2019	Databases and applications	3.5 → 4	+1.2	End-2019 checkpoint: 2019.08 MySQL table/database restore and cluster backup; 2019.12 MySQL/PostgreSQL agent enhancements; carry-forward 10.01 Oracle12c SYSBACKUP. Evidence A. log201908; log201912; log1001
2019	New-platform support (VMware exit)	0.5 → 1.5	+1.6	End-2019 checkpoint: 2019.12 AHV VM backup/restore is script-based; 10.04 SLES IBM Power is physical agent support, not a hypervisor integration. Script-based AHV is not native agentless CBT. Evidence A. log201912; log1004
2022	Cyber resilience	2.5 → 3	+1.4	End-2022 checkpoint: 11.02 dedupe-store backup immutability; StoreOnce Catalyst item immutability carried from 10.03. Anomaly dashboard 24.1 occurs later. Evidence A. log1102; log1003
2022	Databases and applications	4 → 4.5	+1.2	End-2022 checkpoint: 11.02 full MongoDB replica-set backup/restore; support revision 2022-09 names MongoDB5/6 RHEL8/SLES15 and SQL2022 standalone/AG Windows2016/2019/2022. Incremental MongoDB 11.03 occurs 2023, after checkpoint. Evidence A. log1102; matrix1102; matrix1103
2022	New-platform support (VMware exit)	1.5 → 3	+2.4	End-2022 checkpoint: 11.02 ships DP4CW5.1 with XenServer/KVM/AHV/OpenStack support as separate Cloud Workloads component; core 11.02 H3C CAS external snapshots. Native core AHV CBT not inferred. Includes separate DP4CW component; no core AHV CBT inferred. Evidence A. log1102
2022	Storage efficiency and targets	4 → 4.5	+1.0	End-2022 checkpoint: 11.00 source/server/target software dedupe, 250TB tested; 11.02 dedupe-store immutability. 2022-09 matrix adds Seagate Lyve Cloud via DPD. Evidence A. log1100; log1102; matrix1102
2022	Virtual and physical servers	4 → 4.5	+1.2	End-2022 checkpoint: 11.02 by 2022-09 support revision: RockyLinux9 Disk Agent, AIX 7.3 Catalyst/DD Boost; carry-forward 11.00 physical agents and VMware/Hyper-V support. Evidence A. matrix1102; log1100
2024	Cyber resilience	3 → 4	+2.8	Data Protector 24.3 (Version-specific cumulative release log; GA day not established): SafeZone fibre-channel replication between dedupe appliances with separate Cell Managers/no network connection; malware-status monitoring; HANA user-store keys; expanded password characters. Evidence A. log243
2024	Security and compliance	3 → 3.5	+0.8	Data Protector 24.1 (Version-specific cumulative release log; GA day not established): Backup anomaly dashboard; TOTP MFA requires RBAC; Documentum integration; HANA web restore. Evidence A. log241
2025	Recovery	3.5 → 4	+1.4	25.2 (Released by 2025-06-02 blog; first day unresolved): SAP HANA snapshot ZDB/instant recovery; Hyper-V individual disk recovery; role-specific RBAC dashboard; clustered MBR/GPT instant recovery and SLES Btrfs disaster recovery. Evidence A. completion252; blog252
2026	New-platform support (VMware exit)	3 → 3.5	+0.8	26.2 (not found): Released: HPE Morpheus HVM and pre-restore scan; exact announcement/GA day not exposed Evidence A. r262

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-10	23.4 modern granular recovery: partial; Byversion 23.4; exact first GA day unresolved. VMware/Hyper-V web recovery; MongoDB backup-spec path migration manual. Release evidence is not a recovered earlier promise or deadline.	D3 Recovery	C
2024-05	24.2 Webroot endpoint integration: partial; Byversion 24.2; exact first GA day unresolved. Pre-backup checks of external Webroot malware status; not new native DP antivirus. Release evidence is not a recovered earlier promise or deadline.	D10 Scale and automation	C
2024-05	24.2 incremental anomaly detection: partial; Byversion 24.2; exact first GA day unresolved. Extends 24.1 anomaly analysis to incremental backups. Release evidence is not a recovered earlier promise or deadline.	D10 Scale and automation	C
2024-11	24.4 SafeZone/permanent retention horizon: partial; Byversion 24.4; exact first GA day unresolved. SafeZone replication/import improvements; retention beyond 2038. Release evidence is not a recovered earlier promise or deadline.	D8 Retention and tape	C
2024-11	24.4 identity/reporting: partial; Byversion 24.4; exact first GA day unresolved. gMSA and Magellan migration; not proof of a generative assistant. Release evidence is not a recovered earlier promise or deadline.	D9 Security	C
2025-03	25.1 Entra ID authentication: partial; Byversion 25.1; exact first GA day unresolved. Entra SSO and imported users/groups require RBAC enabled. Release evidence is not a recovered earlier promise or deadline.	D9 Security	C
2025-06	25.2 HANA snapshots/instant recovery: partial; Byversion 25.2; exact first GA day unresolved. HPE3PAR snapshots; CLI current; HANA2 SPS05 to 07 RHEL/SUSE support asserted. Release evidence is not a recovered earlier promise or deadline.	D2 Databases and applications	C
2025-06	HANA instant-recovery GUI: pending; Matching GUI GA unresolved. 25.2 blog explicitly separates current CLI from planned GUI.25.4 extends HANA tape backup; this alone does not prove GUI instant recovery.	D2 Databases and applications	C
2025-09	25.3 StoreOnce immutability/authentication: partial; Byversion 25.3; exact first GA day unresolved. ISV lock and CellManager/client tokens asserted; version-specific RN body still unverified. Release evidence is not a recovered earlier promise or deadline.	D9 Security	C
2025-11	25.4 immutable copy/consolidation: partial; Byversion 25.4; exact first GA day unresolved. Extends 25.3 immutable backups to copy/consolidation. Release evidence is not a recovered earlier promise or deadline.	D4 Cyber resilience	C

Centre of gravity: Security (3), Scale and automation (2), Databases and applications (2)
Driver mix: Vision 0%, Customer need 100%, Market window 0%, Upstream 0%, Portfolio 0%

Credibility: 17.0 / 25

Criterion	Score	Basis
Cadence	4	40 recorded release rows, including maintenance and component overlaps; rows are not distinct GA counts. Regularity judged from the dated tables, not an asserted promised cadence. 23.4 (2023-10 beginning-of-month release assertion; exact day unresolved): Chart attributes VMware/Hyper-V granular recovery and tagging; GA day not found Evidence A. chart; blog234
Roadmap transparency	3	Public documentation access and versioned release evidence determine this score. Accepted roadmap finding: not found; dated release and vendor announcement pages used. No open-roadmap-tracker reference score is awarded. 23.4 (2023-10 beginning-of-month release assertion; exact day unresolved): Chart attributes VMware/Hyper-V granular recovery and tagging; GA day not found Evidence A. chart; blog234
Say-do	2.5	Recorded ledger: 12 items; 1 shipped, 10 partial, 0 slipped, 1 pending, 0 dropped. Mature dated prospective cohort: 8; 0 documented within 12 calendar months, 0 later than 12 months, 8 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample. Evidence C for the rubric estimate: calibrated to the delivery record below, not a measured census percentage. See the vendor research section F.
Velocity	3.5	Substantive capabilities in the release tables determine velocity; maintenance-only rows do not become new features. 25.3 (Released by 2025-09-11 blog; first GA day unresolved): StoreOnce ISV immutability; tunable anomaly detection; CM/client token authentication; HANA Pacemaker/ZDB web granular recovery. Public 25.3 RN route mismatch remains a separate access finding. Evidence A. blog253
Lifecycle stability	4	Three-year LTS commitments documented for 24.4 and 25.4, with staged migration rules. 2024-11-19: 24.4 designated LTS with three-year fully supported lifetime; first day/end date not inferred from blog publication. 2025-11-24: 25.4 designated LTS with three-year support commitment. Exact lifecycle day requires lifecycle table. Evidence A. blog244; blog254

Say-do record, 2023 to 2026: Recorded ledger: 12 items; 1 shipped, 10 partial, 0 slipped, 1 pending, 0 dropped. Mature dated prospective cohort: 8; 0 documented within 12 calendar months, 0 later than 12 months, 8 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample.

Commercial risk: 14.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	2	2023 to cutoff model/packaging observations are distinguished from historical introductions. Without a reconstructed price series this is a provisional estimate, not a measured price increase. 2026-10-01 observation: 25.4 separates Data Protector for Cloud Workloads installer from bundled media; exact licensing/inclusion impact not established Evidence C. r254
Purchase constraints	2.5	Licence metrics, edition gates and purchase routes determine this estimate; undisclosed minimums are not assumed zero. Data Protector: Public comparison chart; current price/metric/SKU quote not found; release downloads require active support contract Evidence A. chart; r262
Channel and access	3	Partner entry and public documentation access are both considered. Research documentation finding: matrix. Certification current observation 2026-10-01: 5-5461 Data Protector Business Administrator Certification Exam:2 hours; preparation 3-5450 Business Administration,5 days. Launch year not printed on current learning path. Evidence A. cert
Owner stability	4	OpenText acquisition in the current risk window; prior Micro Focus lineage retained. 2023-01-31: OpenText completed Micro Focus acquisition; Data Protector ownership lineage changes. Evidence A. otclose
Cost of staying supported	2.5	Staged upgrades plus three-year support; no uniform forced annual renewal inferred. 23.4 version clock: Unsupported releases require staged migration through 11.01 before current upgrade. 2025-11-24: 25.4 designated LTS with three-year support commitment. Exact lifecycle day requires lifecycle table. Evidence A. log234; blog254

Security record of the product itself: No in-scope match located in the accepted security-record.md manual product-name filter of the CISA 2026-09-30 catalogue; no deduction. This is not an exhaustive advisory audit or a claim of no exploitation. Arcserve CVE-2015-4068 was added to KEV in 2022, outside the adjustment window. Adjacent array/infrastructure/hosting-plugin CVEs are excluded. Security record: CISA Known Exploited Vulnerabilities catalogue and vendor advisories.

Technical lock-in: 13.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	3.5	2026-10-01 evidence boundary: Independent backup-format specification/readability is not established in the accepted research. Provisional format-dependency estimate, not proof that only a running licensed instance can read it. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C.
Export path	2.5	2026-10-01 evidence boundary: Independent data extraction and post-licence restoration terms are incomplete. Provisional export estimate, not proof of no export or licence-required restore. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C.
Stack coupling	2.5	The documented component/management stack is considered; cross-workload or cross-hypervisor recovery is not inferred from an API. Administration and changes: Legacy VMware GRE obsolete in 25.4; use web GRE. Reporting server replaced in 24.4 per primary snippet. Evidence C. r254; r244
Hardware / cloud coupling	1.5	Deployment/service dependencies determine this score; missing offline/hardware terms are a provisional estimate. Administration and changes: Legacy VMware GRE obsolete in 25.4; use web GRE. Reporting server replaced in 24.4 per primary snippet. Evidence C. r254; r244
Skills and tooling coupling	3.5	Named training and product-specific administration imply some skills coupling; no unsourced scarcity/headcount claim. Certification current observation 2026-10-01: 5-5461 Data Protector Business Administrator Certification Exam:2 hours; preparation 3-5450 Business Administration,5 days. Launch year not printed on current learning path. Evidence A. cert

Integrator fit: 11.5 / 20

Criterion	Score	Basis
Partner programme openness	2.5	Published partner routes and entry/tier qualifications earn credit; undisclosed obligations limit the score. Certification current observation 2026-10-01: 5-5461 Data Protector Business Administrator Certification Exam:2 hours; preparation 3-5450 Business Administration,5 days. Launch year not printed on current learning path. Evidence A. cert
Multi-tenancy and self-service	2.5	Documented tenant/provider isolation and self-service earn credit; reporting or multi-site visibility alone does not prove billing/tenant self-service. Observed by 2026-10-01: 24.4 reporting replacement noted in primary snippet; API/IaC and tenant limits unverified Evidence C. r244
API and infrastructure-as-code	3	Documented APIs and official IaC earn credit. Community examples and publisher-owned repositories do not automatically imply vendor support. Observed by 2026-10-01: 24.4 reporting replacement noted in primary snippet; API/IaC and tenant limits unverified Evidence C. r244
Skills and certification	3.5	Named Business Administrator exam and five-day preparation; first-launch date unresolved. Certification current observation 2026-10-01: 5-5461 Data Protector Business Administrator Certification Exam:2 hours; preparation 3-5450 Business Administration,5 days. Launch year not printed on current learning path. Evidence A. cert

AI leverage: 7.5 / 20

Strand	Today	Latest step
AI for protection / protecting AI	2.5	2024: 24.1; exact date not found; documented released feature; GA day not found: Version chart attributes AI backup anomaly detection to 24.1; does not establish a generative assistant or autonomous restore. Released anomaly detection; exact GA day unresolved, no autonomous restore. Evidence A. chart
AI platform stack	1	2023: 23.4 version; exact GA day unresolved; Released integration: Magellan interactive analytics/reporting integration; future expanded reports explicitly promised. No backup-restoring generative assistant established. Released Magellan reporting integration, not a general AI service over protected application data. Evidence A. log234
AI-assisted operations	2	2024: 24.2 version; exact GA day unresolved; Released enhancement: Anomaly detection extended from 24.1 backup activity to incremental backups. Dashboard informs operator; not autonomous recovery. AI anomaly analytics informs operators; no generative assistant. Evidence A. log241; log242
Agent openness	2	2017: Data Protector 10.00 (Version-specific cumulative release log; GA day not established): TLS 1.2 client-to-Cell-Manager connections secured by default with certificate pinning; centralized command execution; REST browse/restore/scheduler APIs; new web scheduler. REST browse/restore/scheduling; no MCP. Evidence A. log1000

AI say-do sample: 0 recorded announcement rows; 0 GA/shipped matches, 0 preview/early/limited at announcement, 0 partial, 0 pending, 0 slipped, 0 dropped. Preview-at-announcement overlaps outcome counts. These are promise-row counts, not unique announcements or counts of released AI features; omissions/overlaps in the AI research ledger are preserved. "Shipped" may be a vendor availability assertion rather than an independently verified first-GA day.

Reading

OpenText is adding isolation, anomaly analysis and web recovery to an established enterprise backup engine. The version record shows database depth and LTS support alongside gradual interface changes. Storage-specific integrations and staged upgrades preserve operational and skills dependencies.

Open questions and evidence caveats

Unchanged annual values carry the last scored release; they do not certify a frozen compatibility matrix or exact first-feature GA. Some checkpoint-derived jumps may lag the true first shipment.
Unverified AI strands receive zero credited evidence; this is a conservative estimate rather than a vendor-wide absence claim. Preview/limited capabilities add at most half a point beyond the preceding established score.
Say-do counts are a bounded research sample. Same-day/release-note announcements and post-release blogs are not promises delivered instantly. Missing outcome dates do not prove non-delivery.
Commercial/exit terms not reconstructed use explicit provisional midpoint estimates; executed regional contracts may differ.
Tape retention score carries the 2016 documented tape path because newer LTO/WORM/legal-hold matrix evidence is incomplete. 26.2 is described as released; no exact first-GA day invented. Magellan reporting is not counted as autonomous recovery.