Part of the Enterprise Backup Ledger (edition 2026-10-03). How the scores work: methodology.
Snapshot
- Tier: Regional candidate
- Owner: Sangfor; current control/ownership history not established for the standalone backup candidate.
- Licence model: HCI/CBR/DRaaS module metrics; CDP separately licensed, standalone backup SKU unresolved.
- Products scored: HCI/SCP backup/CDP and explicitly labelled CBR/hosted DRaaS observations; DMP database management excluded.
- Latest release: No qualifying standalone backup-software GA verified
- Next signal: No dated next milestone established in the accepted research.
- Archetype: Integrated platform candidate
- Evidence grade: C. Overall grade uses all scored history/AI steps and lens criteria: 10 A, 3 B, 37 C of 50; the lowest grade covering more than 25% wins. Judgement itself does not demote a sourced fact; unresolved eligibility, baseline or contract estimates do.
Not ranked: Public evidence is insufficient to establish qualifying standalone commercial software release, workload eligibility and current matrices. Reference scores are excluded from rankings; observation year is not asserted as launch year.
Scope of the scores: Product capability cutoff 2026-10-01; scoring edition 2026-10-03. Combined portfolio scores do not imply one SKU or uniform feature parity. History is evidence-bounded; freezes and first-feature GA dates can be incomplete. AI services named in the AI section do not broaden the ten core domains.
Scorecard
| Dimension | Score | Direction |
|---|
| Capability today | 39.8 / 100 | higher is better |
| Momentum since end of 2022 | +14.6 points | higher is better |
| Credibility | 11.5 / 25 | higher is better |
| Commercial risk | 13.0 / 25 | lower is better |
| Technical lock-in | 17.5 / 25 | lower is better |
| Integrator fit | 8.5 / 20 | higher is better |
| AI leverage | 0.0 / 20 | higher is better |
| Ledger Index | 38.8 / 100 | balanced weights |
Capability by domain
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2016 | 2019 | 2022 | Today |
|---|
| Virtual and physical servers (12) | n/a | 1.5 | 1.5 | 2.5 |
| Databases and applications (12) | n/a | 0.5 | 0.5 | 1 |
| Recovery (14) | n/a | 2 | 2 | 2 |
| Cyber resilience (14) | n/a | 0.5 | 0.5 | 2 |
| Storage efficiency and targets (10) | n/a | 1.5 | 1.5 | 2.5 |
| Long-term retention and tape (6) | n/a | 1 | 1 | 1 |
| Replication and DR (10) | n/a | 2.5 | 2.5 | 3.5 |
| Security and compliance (8) | n/a | 1 | 1 | 2 |
| New-platform support (VMware exit) (8) | n/a | 0.5 | 0.5 | 0.5 |
| Management at scale and automation (6) | n/a | 1.5 | 1.5 | 2.5 |
| Total / 100 | not released | 25.2 | 25.2 | 39.8 |
Year by year: 2019: 25.2 · 2020: 25.2 · 2021: 25.2 · 2022: 25.2 · 2023: 25.2 · 2024: 25.2 · 2025: 25.2 · 2026: 39.8
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|
| 2026 | Cyber resilience | 0.5 → 2 | +4.2 | Observed by 2026-10-01: CBR cloud WORM, encrypted transmission/storage and periodic scans are vendor-documented features. Exact administrator deletion and retention bypass limits not established. Documented CBR WORM; privileged bypass and first-GA boundaries incomplete. Evidence C. cbr |
| 2026 | Databases and applications | 0.5 → 1 | +1.2 | Observed by 2026-10-01: CBR advertises OS/database/application recovery but no DB-native consistency/version matrix. DMP separately manages MySQL/Oracle transaction backups; its capabilities cannot be merged into CBR coverage. Generic database recovery, not native Oracle/SQL consistency; DMP excluded. Evidence C. cbr; dmp |
| 2026 | Management at scale and automation | 1.5 → 2.5 | +1.2 | Observed by 2026-10-01: 6.12 backup report exports and successful-backup email within 1 hour; 6.11.2 NetBackup integration job-ID traceability; API documentation still requires inspection. Reports/API catalogue; body and scope unverified. Evidence C. scp612 |
| 2026 | Replication and DR | 2.5 → 3.5 | +2.0 | Observed by 2026-10-01: HCI CDP records I/O at QCOW2 layer and needs CDP licence; excludes physical/RAC shared/USB disks and Turbo VMs. Chinese DRaaS supplies runbooks/drills/recovery/failback; subsecond RPO claim applies hosted cloud VM protection. HCI journal/CDP plus hosted DRaaS runbooks; physical/database exclusions retained. Evidence C. cdp612; cdplimits; draas |
| 2026 | Security and compliance | 1 → 2 | +1.6 | Observed by 2026-10-01: CBR encrypts transmission/storage and advertises strict access control; 6.12 platform audit logs retain actual operator IP. No blanket FIPS/STIG certification inferred. CBR encryption and platform audit; no blanket FIPS/MFA claim. Evidence C. cbr; scp612 |
| 2026 | Storage efficiency and targets | 1.5 → 2.5 | +2.0 | Observed by 2026-10-01: HCI CDP destinations list aSAN/FC/iSCSI/local/NFS, but I/O logs exclude NFS; another restriction limits CDP destination to iSCSI/FC/aSAN. Preserve conflicting scope wording.6.11.3 NFS datastore requires root and excludes 4.1. NFS/CDP scope wording conflict preserved. Evidence C. cdplimits; scp612 |
| 2026 | Virtual and physical servers | 1.5 → 2.5 | +2.4 | Observed by 2026-10-01: Chinese CBR cloud-backup service explicitly protects physical servers, VMware/HCI and public/private-cloud VMs using client/direct-cloud or D2D2C routes. HCI-native VM backup is a separate component; exact physical OS matrix remains unresolved. CBR service versus HCI native component boundary retained. Evidence C. cbr; scp612 |
Direction, 2023 to 2026
Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|
| 2025-10 | HCI brochure: Backup/CDP/DR modules described; brochure identifier 20251014 is not software-release/GA date (clock: 2025-10 document identity) | D6 Replication and DR | C |
| 2025-12 | HCI 6.11.1: Fault isolation for slow disks/controller freeze/host hangs/network loss; network subhealth probing; external shared VM disks for Oracle RAC/MQ; 64 VM disks. Shared disks do not establish native DB backup. (clock: 2025-12-29 documentation update; old KB posted 2025-05-30) | D2 Databases and applications | C |
- Centre of gravity: Replication and DR (1), Databases and applications (1)
- Driver mix: Vision 0%, Customer need 100%, Market window 0%, Upstream 0%, Portfolio 0%
Credibility: 11.5 / 25
| Criterion | Score | Basis |
|---|
| Cadence | 2 | 17 recorded release rows, including maintenance and component overlaps; rows are not distinct GA counts. Regularity judged from the dated tables, not an asserted promised cadence. HCI brochure (2025-10 document identity): Backup/CDP/DR modules described; brochure identifier 20251014 is not software-release/GA date Evidence A. brochure |
| Roadmap transparency | 2 | Public documentation access and versioned release evidence determine this score. Accepted roadmap finding: not found; dated release and vendor announcement pages used. No open-roadmap-tracker reference score is awarded. HCI brochure (2025-10 document identity): Backup/CDP/DR modules described; brochure identifier 20251014 is not software-release/GA date Evidence A. brochure |
| Say-do | 2.5 | Recorded ledger: 0 items; 0 shipped, 0 partial, 0 slipped, 0 pending, 0 dropped. Mature dated prospective cohort: 0; 0 documented within 12 calendar months, 0 later than 12 months, 0 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample. Evidence C for the rubric estimate: calibrated to the delivery record below, not a measured census percentage. See the vendor research section F. |
| Velocity | 2.5 | Substantive capabilities in the release tables determine velocity; maintenance-only rows do not become new features. SCP/HCI 6.12.0 (Feature documentation updated 2026-09-15): Automatic successful-backup email within 1 hour and backup report export; rolling upgrades migrate VMs back; operator-IP audit logs. Linked-clone VDI recovery and GPU passthrough are adjacent features, not coordinated AI workload backup. Evidence A. scp612 |
| Lifecycle stability | 2.5 | Accepted lifecycle finding: not found. Grade C where current contract/EOS boundaries remain unresolved. 6.8 version; GA day unresolved: Offline licence changes no longer require returning/reapplying USB key; virtual licence scope remains HCI. Evidence C. archive680 |
Say-do record, 2023 to 2026: Recorded ledger: 0 items; 0 shipped, 0 partial, 0 slipped, 0 pending, 0 dropped. Mature dated prospective cohort: 0; 0 documented within 12 calendar months, 0 later than 12 months, 0 unresolved. Month-only/ambiguous clocks, same-day release notices and post-release blogs are excluded from that cohort. Pending is unverified, not failure; the ledger is a bounded sample.
Commercial risk: 13.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|
| Price and licence volatility | 2.5 | 2023 to cutoff model/packaging observations are distinguished from historical introductions. Without a reconstructed price series this is a provisional estimate, not a measured price increase. Current undated CBR offer observed 2026-10-01: Cloud backup offer lists 5TB storage, 50M full/10M incremental bandwidth and one validation service; no price or first launch date disclosed. Evidence C. cbr |
| Purchase constraints | 3 | Licence metrics, edition gates and purchase routes determine this estimate; undisclosed minimums are not assumed zero. Integrated HCI modules: Brochure lists different CPU/VM/capacity module metrics; exact standalone backup SKU/price and entitlement not verified Evidence A. brochure |
| Channel and access | 2.5 | Partner entry and public documentation access are both considered. Research documentation finding: brochure. Official API observation 2026-10-01: Guest SCP 6.12 API page updated 2026-09-02 lists 67.96MB ZIP,12 downloads. This is vendor-document downloads, not Terraform/Ansible registry usage. Direct file retrieval returned HTML, not the API ZIP. Evidence A. scpapi |
| Owner stability | 2.5 | 2026-10-01 evidence boundary: Sangfor; current control/ownership history not established for the standalone backup candidate. Ownership-risk judgement comes from the recorded corporate/financing events; no unrecorded transaction is assumed. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C. |
| Cost of staying supported | 2.5 | Support/upgrade constraints, distinct from licence-expiry restoration: not found. 6.8 version; GA day unresolved: Offline licence changes no longer require returning/reapplying USB key; virtual licence scope remains HCI. Evidence C. archive680 |
Security record of the product itself: No in-scope match located in the accepted security-record.md manual product-name filter of the CISA 2026-09-30 catalogue; no deduction. This is not an exhaustive advisory audit or a claim of no exploitation. Arcserve CVE-2015-4068 was added to KEV in 2022, outside the adjustment window. Adjacent array/infrastructure/hosting-plugin CVEs are excluded. Security record: CISA Known Exploited Vulnerabilities catalogue and vendor advisories.
Technical lock-in: 17.5 / 25 (lower is better)
| Criterion | Score | Basis |
|---|
| Formats | 3.5 | 2026-10-01 evidence boundary: Independent backup-format specification/readability is not established in the accepted research. Provisional format-dependency estimate, not proof that only a running licensed instance can read it. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C. |
| Export path | 3 | 2026-10-01 evidence boundary: Independent data extraction and post-licence restoration terms are incomplete. Provisional export estimate, not proof of no export or licence-required restore. Provisional rubric estimate; unknown terms are not evidence of either zero risk or the worst terms. Evidence C. |
| Stack coupling | 4 | Built-in HCI management and service dependencies; no independent backup-engine eligibility established. Stack coupling: Chinese product page presents built-in Sangfor HCI backup/CDP. Brochure describes VMware integration and heterogeneous DR; standalone management-plane eligibility not demonstrated. Evidence A. product; brochure |
| Hardware / cloud coupling | 4 | Heterogeneous agent recovery targets Sangfor hosted-cloud resources; not arbitrary portable export. Recovery destination: Chinese heterogeneous DRaaS recovers agent-protected workloads into Sangfor hosted-cloud resources; do not treat this as portable native backup export. Evidence A. draas |
| Skills and tooling coupling | 3 | Named training and product-specific administration imply some skills coupling; no unsourced scarcity/headcount claim. Official API observation 2026-10-01: Guest SCP 6.12 API page updated 2026-09-02 lists 67.96MB ZIP,12 downloads. This is vendor-document downloads, not Terraform/Ansible registry usage. Direct file retrieval returned HTML, not the API ZIP. Evidence A. scpapi |
Integrator fit: 8.5 / 20
| Criterion | Score | Basis |
|---|
| Partner programme openness | 2.5 | Published partner routes and entry/tier qualifications earn credit; undisclosed obligations limit the score. Official API observation 2026-10-01: Guest SCP 6.12 API page updated 2026-09-02 lists 67.96MB ZIP,12 downloads. This is vendor-document downloads, not Terraform/Ansible registry usage. Direct file retrieval returned HTML, not the API ZIP. Evidence A. scpapi |
| Multi-tenancy and self-service | 2.5 | Documented tenant/provider isolation and self-service earn credit; reporting or multi-site visibility alone does not prove billing/tenant self-service. Observed by 2026-10-01: 6.12 backup report exports and successful-backup email within 1 hour; 6.11.2 NetBackup integration job-ID traceability; API documentation still requires inspection. Evidence C. scp612 |
| API and infrastructure-as-code | 1.5 | Documented APIs and official IaC earn credit. Community examples and publisher-owned repositories do not automatically imply vendor support. Observed by 2026-10-01: 6.12 backup report exports and successful-backup email within 1 hour; 6.11.2 NetBackup integration job-ID traceability; API documentation still requires inspection. Evidence C. scp612 |
| Skills and certification | 2 | Named certification and hands-on curricula earn credit; first-launch or current credential gaps are retained. Official API observation 2026-10-01: Guest SCP 6.12 API page updated 2026-09-02 lists 67.96MB ZIP,12 downloads. This is vendor-document downloads, not Terraform/Ansible registry usage. Direct file retrieval returned HTML, not the API ZIP. Evidence A. scpapi |
AI leverage: 0 / 20
| Strand | Today | Latest step |
|---|
| AI for protection / protecting AI | 0 | none |
| AI platform stack | 0 | none |
| AI-assisted operations | 0 | none |
| Agent openness | 0 | none |
AI say-do sample: 0 recorded announcement rows; 0 GA/shipped matches, 0 preview/early/limited at announcement, 0 partial, 0 pending, 0 slipped, 0 dropped. Preview-at-announcement overlaps outcome counts. These are promise-row counts, not unique announcements or counts of released AI features; omissions/overlaps in the AI research ledger are preserved. "Shipped" may be a vendor availability assertion rather than an independently verified first-GA day.
Reading
Sangfor presents backup and DR capabilities across HCI and cloud services. Public platform notes and service pages describe CDP, WORM and recovery paths with workload restrictions. Standalone backup-software eligibility remains unresolved, so these reference scores are excluded from rankings.
Open questions and evidence caveats
- Unchanged annual values carry the last scored release; they do not certify a frozen compatibility matrix or exact first-feature GA. Some checkpoint-derived jumps may lag the true first shipment.
- Unverified AI strands receive zero credited evidence; this is a conservative estimate rather than a vendor-wide absence claim. Preview/limited capabilities add at most half a point beyond the preceding established score.
- Say-do counts are a bounded research sample. Same-day/release-note announcements and post-release blogs are not promises delivered instantly. Missing outcome dates do not prove non-delivery.
- Commercial/exit terms not reconstructed use explicit provisional midpoint estimates; executed regional contracts may differ.
- virtual: 2016 baseline is provisional; no frozen checkpoint fact.
- apps: 2016 baseline is provisional; no frozen checkpoint fact.
- recovery: 2016 baseline is provisional; no frozen checkpoint fact.
- cyber: 2016 baseline is provisional; no frozen checkpoint fact.
- storage: 2016 baseline is provisional; no frozen checkpoint fact.
- retention: 2016 baseline is provisional; no frozen checkpoint fact.
- dr: 2016 baseline is provisional; no frozen checkpoint fact.
- security: 2016 baseline is provisional; no frozen checkpoint fact.
- platforms: 2016 baseline is provisional; no frozen checkpoint fact.
- scale: 2016 baseline is provisional; no frozen checkpoint fact.
- 2016 is scoring axis origin, not product launch. 2016 to 2018 zeros mean no credited evidence; 2019 is earliest scored platform evidence, not a standalone launch. MCP2021 expands to Managed Cloud Platform, not Model Context Protocol. Agent-based KVM recovery does not meet native agentless new-platform anchor.
- Review 2026-10-03: history starts at 2019, the first year with public evidence, instead of zero scores from 2016.
Related reading
