Object Storage Ledger 2026
Ledger
Object Storage Ledger 2026
NetApp StorageGRID: Object Storage Ledger 2026 Scorecard
StorageGRID is NetApp's object store on appliances, VMs and Linux hosts, with the most complete Object Lock record in this group and a documented deprecation calendar.
Edition October 16, 20268 min read
Where StorageGRID put its effort, 2016 to 2026
Each square is one capability area in one year. The brighter it is, the more the area gained in the Object Storage Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
| ’16 | ’17 | ’18 | ’19 | ’20 | ’21 | ’22 | ’23 | ’24 | ’25 | ’26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| S3 API fidelity | 1 | 2 | |||||||||
| Immutability and compliance | 1 | 1 | 1 | ||||||||
| Durability and resilience | 2 | ||||||||||
| Performance and scale | 3 | 3 | |||||||||
| Deployment freedom | 2 | ||||||||||
| Security and multi-tenancy | |||||||||||
| Operations | |||||||||||
| Protocols beyond S3 | |||||||||||
| Lifecycle and tiering | 1 | ||||||||||
| Ecosystem and openness |
no change+0.5+1+1.5 or moreScores out of 5 per area.
Biggest pushes overall: Immutability and compliance (+4.5), S3 API fidelity (+1), Performance and scale (+1). Already strong in 2015: Durability and resilience, Performance and scale, S3 API fidelity.
Top focus each year: 2019 S3 API fidelity; 2020 Immutability and compliance; 2022 Immutability and compliance; 2024 Lifecycle and tiering; 2025 Immutability and compliance. 6 of 11 years show no gain in any area.
Part of the Object Storage Ledger (edition 2026-10-16). How the scores work: methodology.
Snapshot
- Type: product
- Owner: NetApp, Inc. (Nasdaq: NTAP); StorageGRID came from the Bycast acquisition that closed 2010-05-13 for about 80 million USD
- Licence: Commercial, capacity based, perpetual or subscription, the same for NetApp appliances and software nodes; Object Lock included in the standard licence; no public price
- Latest release: StorageGRID 12.1 (announced 2026-06-23; GA date not stated); 12.0 announced 2025-09-09; 11.9 available November 2024; patches 12.0.0.4 and 11.9.0.12 of 2026-02 fixed CVE-2026-22048
- Support lifecycle: end of support dates not found; deprecated features are removed two major versions later; 11.9 and 12.0 were patched in parallel in 2026-02
- Next milestone: none published with a date
- Object lock: Governance mode, compliance mode, legal hold and bucket default retention, assessed by Cohasset Associates for SEC 17a-4(f), FINRA 4511(c) and CFTC 1.31(c)-(d) (NetApp docs; report date and version not found); lock enabled only at bucket creation; preserved across cross-grid replication since 12.0; KPMG IDW PS 880 audit of 11.6; Veeam Ready Repository Capacity Target with Immutability and Governance for 12.0 on SG5812 appliances (Veeam article 2410, 2026-05-26, strong consistency required, a Veeam hotfix needed); Commvault, Rubrik and Veritas appear on NetApp's validated solutions list without an Object Lock statement
- Tier: Commercial software
- Archetype: Dependable builder
- Evidence grade: B. The Veeam Ready listing (article 2410) and the 12.0 and 12.1 press releases were read directly. docs.netapp.com returned HTTP 403, so the What's new, deprecation, Object Lock and software requirement pages were read as quoted in search results (grade B). Release notes PDFs sit behind a support login. Dates before 11.8 and all scores before 2023 are grade C.
Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 74.0 / 100 | higher is better |
| Momentum since end of 2022 | +8.0 points (2015 to 2022: +12.1) | higher is better |
| Credibility | 15.5 / 25 | higher is better |
| Commercial risk | 11.0 / 25 | lower is better |
| Technical lock-in | 11.0 / 25 | lower is better |
| Integrator fit | 14.0 / 20 | higher is better |
| AI leverage | 5.5 / 20 | higher is better |
| Ledger Index | 61.3 / 100 | balanced weights; see the methodology |
Capability by domain, 2015 to today
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2015 | 2019 | 2022 | Today |
|---|---|---|---|---|
| S3 API fidelity (15) | 3 | 3.5 | 3.5 | 4 |
| Immutability and compliance (12) | 0 | 0 | 4 | 4.5 |
| Durability and resilience (12) | 4 | 4 | 4 | 4.5 |
| Performance and scale (12) | 3.5 | 3.5 | 3.5 | 4.5 |
| Deployment freedom (10) | 2.5 | 3 | 3 | 3 |
| Security and multi-tenancy (10) | 3 | 3 | 3 | 4 |
| Operations (10) | 3 | 3 | 3 | 4 |
| Protocols beyond S3 (7) | 3 | 3 | 3 | 0 |
| Lifecycle and tiering (7) | 3 | 3 | 3 | 4 |
| Ecosystem and openness (5) | 1.5 | 1.5 | 1.5 | 2 |
| Total / 100 | 53.9 | 56.4 | 66.0 | 74.0 |
Year by year: 2015: 53.9 · 2016: 53.9 · 2017: 53.9 · 2018: 53.9 · 2019: 56.4 · 2020: 63.6 · 2021: 63.6 · 2022: 66.0 · 2023: 66.0 · 2024: 72.1 · 2025: 74.0 · 2026: 74.0
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2019 | Deployment freedom | 2.5 → 3 | +1.0 | 11.x: software nodes on RHEL, Ubuntu and Debian hosts in Docker containers (year grade C); Podman since 11.8 with Docker deprecated; one node per VM; minimum 8 cores; no official Kubernetes, KVM or Arm support found |
| 2019 | S3 API fidelity | 3 → 3.5 | +1.5 | 11.x: tenant-level IAM-style policies, platform services for notifications and replication to cloud (version and year grade C) |
| 2020 | Immutability and compliance | 0 → 3 | +7.2 | S3 Object Lock with governance, compliance, legal hold and default bucket retention; the introducing release and its year were not verified (grade C) |
| 2022 | Immutability and compliance | 3 → 4 | +2.4 | Cohasset assessment against SEC 17a-4(f), FINRA 4511(c) and CFTC 1.31(c)-(d) (NetApp docs, date not found) and KPMG IDW PS 880 audit of 11.6 (community post; year grade C) |
| 2024 | Lifecycle and tiering | 3 → 4 | +1.4 | 11.8: per-bucket ILM policies; 11.9: Cloud Storage Pool to an Amazon S3 endpoint with IAM Roles Anywhere credentials; Archive Node removed in 11.9; tenant quotas (grade C) |
| 2024 | Operations | 3 → 3.5 | +1.0 | 11.8 and 11.9: native S3 console, mixed SSD and HDD nodes at one site, data-only storage nodes |
| 2024 | Performance and scale | 3.5 → 4 | +1.2 | 11.8: better PUT performance on new SGF6112 installs; 11.9: data-only storage nodes and 60 TB QLC drives |
| 2024 | S3 API fidelity | 3.5 → 4 | +1.5 | 11.8 and 11.9: native S3 console, SHA-256 checksums on PUT, GET and HEAD, Mountpoint for Amazon S3 support, Object Lock default retention; 12.1 announces batch operations across billions of objects (GA not stated); no per-feature compatibility page read |
| 2024 | Security and multi-tenancy | 3 → 3.5 | +1.0 | 11.8: HashiCorp Vault and local KMS, FIPS 140-2 ready TLS (validation status disputed between blog and docs), UEFI secure boot on appliances |
| 2025 | Durability and resilience | 4 → 4.5 | +1.2 | 12.0: strong-global consistency tolerates site failure in grids of three or more sites; cross-grid replication including Object Lock; rebuild tests not published |
| 2025 | Ecosystem and openness | 1.5 → 2 | +0.5 | 12.0: Grid Management API v4 public; Mountpoint and Dremio integrations; still no open-source component |
| 2025 | Immutability and compliance | 4 → 4.5 | +1.2 | 12.0: Object Lock preserved across cross-grid replication; branch buckets for ransomware recovery; Veeam Ready Capacity Target with Immutability and Governance on 12.0 (2026-05-26); Commvault, Rubrik and Veritas listed as validated solutions without an Object Lock statement |
| 2025 | Operations | 3.5 → 4 | +1.0 | 12.0: Grid Management API v4, automated drive firmware upgrades; NetApp 24x7 support; Terraform provider not verified this edition |
| 2025 | Performance and scale | 4 → 4.5 | +1.2 | 12.0: S3 caching layer for AI and HPC (up to 20x throughput, vendor), support for one trillion objects (docs); 12.1 claims up to 400% more throughput and 10 exabyte federated namespaces (announced, GA not stated); no independent benchmark |
| 2025 | Protocols beyond S3 | 3 → 0 | -4.2 | 12.0: Swift API removed after deprecation in 11.7 (2023); no NFS, SMB, HDFS or Azure Blob front end; Cloud Storage Pools tier outward only |
| 2025 | Security and multi-tenancy | 3.5 → 4 | +1.0 | 12.0: AES-GCM with integrity checking, stronger on-disk encryption, SSH blocked by default; public advisory NTAP-20260217-0001 for CVE-2026-22048 patched in two lines; 12.1 multi-admin verification announced without a GA date |
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2023 | 11.7: Swift API and Archive Node deprecated, CLB service and CIFS audit export removed (month not found) | Protocols | P |
| 2024 | 11.8: per-bucket ILM policies, native S3 console, HashiCorp Vault, UEFI secure boot (month not found) | Lifecycle | C |
| 2024-10 | Dremio and StorageGRID Iceberg lakehouse partner solution | AI | M |
| 2024-11 | 11.9: SHA-256 checksums, Mountpoint for Amazon S3, Cloud Storage Pool to Amazon S3 with IAM Roles Anywhere, data-only nodes; Archive Node removed | S3 API | C |
| 2024-11 | SGF6112 60 TB QLC option, shipping December 2024 | Packaging | M |
| 2025-09 | 12.0: S3 caching layer for AI and HPC, one trillion objects | Performance | V |
| 2025-09 | 12.0: branch buckets and bucket clones for ransomware recovery; Object Lock across cross-grid replication | Immutability | C |
| 2025-09 | 12.0: AES-GCM with integrity checking, SSH blocked by default, strong-global consistency across sites | Security | C |
| 2025-09 | 12.0: Swift API and Docker/NFS audit export removed as scheduled | Protocols | P |
| 2026-02 | Patches 12.0.0.4 and 11.9.0.12 for CVE-2026-22048 in SSO (advisory NTAP-20260217-0001) | Security | C |
| 2026-05 | Veeam Ready Repository listing for StorageGRID 12.0 on SG5812 with Immutability and Governance | Immutability | M |
| 2026-06 | 12.1: federated global namespace across grids up to 10 exabytes, batch operations across billions of objects | Performance | V |
| 2026-06 | 12.1: multi-admin verification | Security | C |
| 2026-06 | 12.1: change tracking for AI agents | AI | V |
- Centre of gravity: Security (3), Protocols (2), AI (2)
- Blind spots (no items): Durability, Deployment, Operations, Ecosystem, Licensing
- Driver mix: Vision 21%, Customer need 43%, Market window 21%, Upstream 0%, Portfolio 14%
- Idea-to-need index: 0.25 (0 = demand-pulled, 1 = thesis-pushed)
Credibility: 15.5 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 3.5 | 11.9 (2024-11), 12.0 (2025-09) and 12.1 (2026-06) land nine to ten months apart; the schedule is not published |
| Roadmap transparency | 2 | Public What's new and deprecation tables; release notes PDFs and downloads behind a support login; no roadmap |
| Say-do | 3.5 | Swift and Archive Node removals happened on the published two-version schedule; 12.0 and 12.1 AI claims carry no GA dates |
| Velocity | 3.5 | Several capabilities per release since 11.8: checksums, cloud pools, caching, branch buckets, consistency changes |
| Lifecycle stability | 3 | Features are removed on a known schedule (Swift, Archive Node, Docker), which is predictable and still churn; support windows not found |
Commercial risk: 11.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 2 | Capacity licence unchanged as far as public sources show; prices not public; Futurum notes 12.1 came without licensing details |
| Purchase constraints | 2.5 | Quote only; appliance or software nodes on the same licence; no free edition |
| Channel and access | 3 | NetApp direct and partners; release notes and downloads need a support login |
| Owner stability | 1 | Large listed owner since 2010; no change |
| Cost of staying supported | 2.5 | Support windows not found; two lines patched in parallel in 2026; appliance generations reach end of support (SG5600) |
Technical lock-in: 11.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 3 | Proprietary object layout and Cassandra metadata; data leaves through the S3 API |
| Export path | 1.5 | Standard S3 reads, cross-grid replication and Cloud Storage Pools to other S3 targets |
| Stack coupling | 2.5 | Own storage, metadata and Grid Manager stack on every node |
| Hardware / cloud coupling | 1.5 | Software nodes on VMware or Linux hosts, or NetApp appliances; the Veeam listing covers the appliance only |
| Skills and tooling coupling | 2.5 | Grid Manager and ILM are NetApp specific; a large NetApp skills pool helps |
Integrator fit: 14.0 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 3.5 | NetApp partner programme with StorageGRID in it; terms not read (grade C) |
| Multi-tenancy and self-service | 3.5 | Tenant accounts with their own users, keys and quotas and a Tenant Manager (grade C this edition) |
| API and infrastructure-as-code | 3.5 | Grid Management API v4 and Tenant Management API; Terraform provider not verified |
| Skills and certification | 3.5 | NetApp certification and training exist; a StorageGRID-specific track was not verified |
AI leverage: 5.5 / 20
How the product uses AI, scored per year like capability. Only GA counts.
| Criterion | 2019 | 2022 | Today | Latest step |
|---|---|---|---|---|
| AI workload support | 1 | 1 | 2.5 | 2025: 12.0: S3 caching layer for AI and HPC and one trillion objects; no GPUDirect or S3 over RDMA GA found; 12.1 federated namespace and 12 TB/s claim announced without GA |
| AI platform stack | 0 | 0 | 1 | 2024: Dremio Iceberg lakehouse partner solution (2024-10); NetApp's wider AI Data Platform sits outside StorageGRID |
| AI-assisted operations | 0 | 0 | 0 | 2015: None |
| Agent openness | 1.5 | 1.5 | 2 | 2025: 12.0: Grid Management API v4; 12.1 change tracking for AI agents announced without GA; no MCP server found |
Year by year: 2015: 2.5 · 2016: 2.5 · 2017: 2.5 · 2018: 2.5 · 2019: 2.5 · 2020: 2.5 · 2021: 2.5 · 2022: 2.5 · 2023: 2.5 · 2024: 3.5 · 2025: 5.5 · 2026: 5.5
AI say-do, 2023 to 2026: 4 AI items announced; 2 GA, 0 still preview, 2 pending, 0 dropped. The 12.0 caching layer has documentation and the Dremio solution shipped; S3 over RDMA was only discussed as a direction, and the 12.1 AI items have no GA date.
StorageGRID approaches AI through capacity and throughput: a caching layer, a trillion-object limit and, in 12.1, a federated namespace and change tracking for agents. None of it involves GPUDirect or RDMA, and there is no AI in operations or an agent interface beyond the management APIs. The 12.1 items should be re-scored once a GA date exists.
Reading
StorageGRID earns the highest immutability score in this group because every part of the anchor is on record: both modes, legal hold, default retention, a Cohasset assessment, a KPMG audit, a 2026 Veeam listing and lock preserved across grids. Durability and lifecycle are strong for the same reason, a documented ILM engine across sites. It loses on protocols, where Swift was removed and nothing replaced it, and on deployment, which stops at VMware and Linux hosts. NetApp removes features on a published schedule, so a buyer should read the deprecation table for the release they plan to run, and ask for the 12.1 GA date before counting its features.
Open questions and items to re-score
- Versioning, multipart upload and lifecycle pages were not read; the API score rests on the Veeam listing, the Object Lock docs and the What's new pages.
- Release dates of 11.7 and 11.8, the 12.1 GA date and the Software Version Support dates.
- The Cohasset report date and the StorageGRID version it covers; the release that introduced S3 Object Lock (2020 step, grade C).
- Whether Commvault, Rubrik and Veritas are validated with Object Lock or only as targets.
- Kubernetes and KVM support, Arm, FIPS validation status and the Terraform provider were not verified.
- The 12.1 features (federated namespace, batch operations, multi-admin verification, change tracking) are announced without a GA date and are not counted in capability.
Related reading
More from Object Storage Ledger 2026
- Overview: all platforms side by side
- Object Storage Ledger Methodology: How Every Score Is Built
- Ceph RGW: Object Storage Ledger 2026 Scorecard
- Cloudian HyperStore: Object Storage Ledger 2026 Scorecard
- DataCore Swarm: Object Storage Ledger 2026 Scorecard
- Dell ObjectScale: Object Storage Ledger 2026 Scorecard
- Everpure FlashBlade: Object Storage Ledger 2026 Scorecard
- Hitachi HCP: Object Storage Ledger 2026 Scorecard
- IBM COS on-prem: Object Storage Ledger 2026 Scorecard
- IBM Storage Ceph: Object Storage Ledger 2026 Scorecard
- MinIO AIStor: Object Storage Ledger 2026 Scorecard
- MinIO CE: Object Storage Ledger 2026 Scorecard
- NooBaa: Object Storage Ledger 2026 Scorecard
- Nutanix Objects: Object Storage Ledger 2026 Scorecard
- OpenShift ODF: Object Storage Ledger 2026 Scorecard
- Quantum ActiveScale: Object Storage Ledger 2026 Scorecard
- Qumulo: Object Storage Ledger 2026 Scorecard
- RustFS: Object Storage Ledger 2026 Scorecard
- Scality ARTESCA: Object Storage Ledger 2026 Scorecard
- Scality RING: Object Storage Ledger 2026 Scorecard
- SeaweedFS: Object Storage Ledger 2026 Scorecard
- VAST Data: Object Storage Ledger 2026 Scorecard
- Versity S3 Gateway: Object Storage Ledger 2026 Scorecard
- Zenko CloudServer: Object Storage Ledger 2026 Scorecard