Qumulo: Object Storage Ledger 2026 Scorecard

Part of the Object Storage Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

• Type: product
• Owner: Qumulo, Inc. (private, USA); Douglas Gourlay President and CEO since 2024-07-09; last public funding round found: Series E of USD 125 million (2020-07); no acquisition found
• Licence: Commercial; licence metric and prices not published; runs on qualified hardware (Cisco, Arrow, HPE, Supermicro, Run Anywhere x86) or as Cloud Native Qumulo on AWS, Azure and Google Cloud
• Latest release: Qumulo Core 7.10.2, the newest entry in the feature log (dates not published); Core 7.8.4 was certified with Veeam v13 in a vendor blog dated 2026-06-18
• Support lifecycle: Not published; the feature log labels one release per quarter (7.5.0.3 to 7.10.0.2) with maintenance releases between them
• Next milestone: none published
• Object lock: Compliance mode only: "Qumulo Core supports only compliance mode" (S3 support and limits); retention and legal hold calls from 7.2.1.1 and 7.2.3.2, enabled per bucket with versioning on; whether bucket default retention works is unclear (a search summary says no). Veeam v13 Object Lock certification for Core 7.8.4 claimed in a vendor blog (2026-06-18), Veeam.com listing not found; SEC 17a-4, FINRA and HIPAA named without an assessment; no Cohasset report found
• Tier: File-first platform with S3
• Archetype: Sharp opportunist
• Evidence grade: C. The S3 support and limits page, the Qumulo Core feature log, the Veeam v13 blog and the products page were read from qumulo.com and docs.qumulo.com, so the S3 and Object Lock scores rest on primary documentation. Release dates are not published, so the years of the S3 steps are inferred from version order. Erasure coding, multi-site replication, security beyond S3 and the AI products were not read, so those scores and all steps before 2022 are grade C.

Scope of the scores: Qumulo Core is a file-first platform with a native S3 API. The scores rate it as an S3 object target, so the file system's strengths show mainly in the protocols, deployment and operations rows. The platform dates from 2015; the S3 steps are dated from the Core releases that added them, and because those release dates are not published their years are approximate.

Scorecard

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Year by year: 2015: 34.7 · 2016: 34.7 · 2017: 34.7 · 2018: 34.7 · 2019: 35.7 · 2020: 38.1 · 2021: 38.1 · 2022: 44.6 · 2023: 44.6 · 2024: 53.1 · 2025: 57.3 · 2026: 58.5

What moved the score

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

• Centre of gravity: AI (3), Immutability (2), Ecosystem (2)
• Blind spots (no items): S3 API, Durability, Performance, Security, Operations, Protocols, Lifecycle, Packaging, Licensing
• Driver mix: Vision 25%, Customer need 25%, Market window 50%, Upstream 0%, Portfolio 0%
• Idea-to-need index: 0.25 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 15.5 / 25

Commercial risk: 14.0 / 25 (lower is better)

Technical lock-in: 11.5 / 25 (lower is better)

Integrator fit: 11.0 / 20

AI leverage: 5.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Year by year: 2015: 3 · 2016: 3 · 2017: 3 · 2018: 3 · 2019: 3 · 2020: 3 · 2021: 3 · 2022: 3 · 2023: 3 · 2024: 3 · 2025: 5.5 · 2026: 5.5

AI say-do, 2023 to 2026: 3 AI items announced; 0 GA, 0 still preview, 3 pending, 0 dropped. Helios AI Agent, Cloud AI Accelerator and NeuralSearch appear as products on the vendor site, but no release note or GA date was read, so all three count as pending.

Qumulo's AI story is a set of named products on its website (NeuralCache, NeuralSearch, Helios AI Agent, Cloud AI Accelerator, Nexus) with no release note or GA date read for any of them. Until their status can be checked they score half a step to one step at most, and there is no MCP server.

Reading

Qumulo scores as a file platform that also speaks S3: the protocols, deployment and operations rows carry it, while the S3 API and immutability rows sit below the object-first products. The S3 surface is narrow by design, with no lifecycle rules, no STS, path-style addressing only, no SSE selection and Object Lock in compliance mode only. Durability and performance are grade C, because erasure coding and replication were not read for this edition and the throughput figure is a vendor claim. A buyer planning to use it as a backup target should confirm with Qumulo whether bucket default retention works and get the Veeam v13 certification record for the Core version they will run.

Open questions and items to re-score

• Release dates for Core 5.3.3 to 7.10.2; the years of the S3 steps are inferred from version order.
• Bucket default retention: a search summary says it is not supported, which conflicts with the existence of PutObjectLockConfiguration; governance mode is not supported per the docs.
• A Veeam.com listing for the v13 claim; no Cohasset or other independent assessment was found.
• Erasure coding, multi-site replication, KMIP, FIPS, SAML and audit logging detail.
• Licence metric, price and support lifecycle.
• GA status of Helios AI Agent, Cloud AI Accelerator, NeuralSearch, NeuralCache and Nexus.
• A Terraform provider and tenant isolation for S3.

Related reading

• Object Storage Ledger 2026 overview
• Everpure FlashBlade scorecard
• VAST Data scorecard
• Veeam immutable backups: how much should you trust them?