VAST Data: Object Storage Ledger 2026 Scorecard

Part of the Object Storage Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product
Owner: VAST Data (private); Series F announced 2026-04-22 at a USD 30 billion valuation with about USD 1 billion of primary and secondary capital, Nvidia among the investors; an IPO is reported as under consideration (press coverage); headquarters and leadership not read
Licence: Capacity-based software subscription in 100 TB increments, transferable across enclosures, with hardware sold at the manufacturer's cost (secondary sources, not a VAST price document); End User Agreement linked from the Data Store page; no list price
Latest release: VAST Cluster 5.5.0 with service packs up to 5.5.0-SP6 (release dates not published; knowledge base pages republished 2026-10-14); 5.4.x and 5.3.x lines documented
Support lifecycle: Upgrade paths published per release (5.5.0 from 5.4.0 through 5.4.4-SP6; 5.4.3 from 5.3.0 through 5.4.1); service packs per minor release; no end-of-support matrix read
Next milestone: PolicyEngine and TuningEngine by the end of 2026; Polaris multi-cluster orchestration in future releases; CNode-X certified configurations without a date (Blocks and Files, 2026-02-26)
Object lock: Governance mode (bypass needs s3:BypassGovernanceRetention and the bypass header) and compliance mode, legal hold and bucket default retention (knowledge base); governance from 4.3, compliance from 4.5 (2022-12); cannot be disabled once enabled and cannot be used on a view that is also open over SMB or NFS. Veeam Ready Object Immutability and the Veeam v12 test suite claimed in a vendor blog (2023-05-22), Veeam.com listing not found; Cohasset assessment for SEC, FINRA and CFTC cited on the product page (vendor claim, report not read)
Tier: File-first platform with S3
Archetype: Real innovator, many items pending
Evidence grade: B. The S3 Object Locking overview and the VAST Cluster 5.4.3 and 5.5.0 release notes were read from kb.vastdata.com, so the S3 and Object Lock scores rest on primary documentation. Performance, durability, pricing and the AI products rest on vendor pages and press coverage (grade B or C). Release dates for 5.x are not published, so steps tied to 5.4 and 5.5 carry approximate years, and the first scored year and every step before 2022 are grade C.

Scope of the scores: VAST is sold as software but delivered and supported as an appliance on certified platforms (VAST enclosures built with Sanmina, Supermicro, HPE, Cisco) or as VAST on Cloud. It is file-first: S3 shares one namespace with NFS, SMB, block and database tables. The scores cover the S3 object side; the hardware coupling shows in deployment freedom and lock-in. The first scored year, 2019, is background knowledge (grade C).

Scorecard

Dimension	Score	Direction
Capability today	68.2 / 100	higher is better
Momentum since end of 2022	+14.8 points (2019 to 2022: +12.9)	higher is better
Credibility	16.0 / 25	higher is better
Commercial risk	14.5 / 25	lower is better
Technical lock-in	14.0 / 25	lower is better
Integrator fit	12.5 / 20	higher is better
AI leverage	8.5 / 20	higher is better
Ledger Index	59.5 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
S3 API fidelity (15)	n/a	2	3	3.5
Immutability and compliance (12)	n/a	0	2.5	3.5
Durability and resilience (12)	n/a	2.5	2.5	4
Performance and scale (12)	n/a	3.5	4	4
Deployment freedom (10)	n/a	1.5	1.5	2.5
Security and multi-tenancy (10)	n/a	2	3	3.5
Operations (10)	n/a	3	3	3.5
Protocols beyond S3 (7)	n/a	3	3.5	4
Lifecycle and tiering (7)	n/a	1	1	2.5
Ecosystem and openness (5)	n/a	1.5	1.5	2
Total / 100	n/a	40.5	53.4	68.2

Year by year: 2019: 40.5 · 2020: 40.5 · 2021: 42.4 · 2022: 53.4 · 2023: 55.8 · 2024: 55.8 · 2025: 66.7 · 2026: 68.2

What moved the score

Year	Domain	Change	Points	Trigger
2021	Performance and scale	3.5 → 4	+1.2	NVIDIA GPUDirect Storage integration (vendor; year approximate, grade C); no S3 over RDMA and no independent benchmark read
2021	Protocols beyond S3	3 → 3.5	+0.7	SMB 2.1 and 3 beside NFS and S3 (year approximate, grade C)
2022	Immutability and compliance	0 → 2.5	+6.0	4.3 governance mode (by 2022-05) and 4.5 compliance mode (2022-12), with legal hold and bucket default retention
2022	S3 API fidelity	2 → 3	+3.0	VAST S3 blog (2022-05-19): versioning, multipart, object lock, bucket and IAM policies, ACLs and HTTPS (the vendor notes the page may be outdated)
2022	Security and multi-tenancy	2 → 3	+2.0	Bucket and IAM policies, ACLs and HTTPS (VAST S3 blog 2022-05-19); tenants (year approximate)
2023	Immutability and compliance	2.5 → 3.5	+2.4	Veeam Ready Object Immutability and Veeam v12 suite (vendor blog 2023-05-22; Veeam listing not found); Cohasset cited (vendor claim); no lock on views open over SMB or NFS
2025	Deployment freedom	1.5 → 2.5	+2.0	Certified platforms from Supermicro, HPE and Cisco and VAST on Cloud in the 5.x release notes and specifications page (year approximate); CNode-X announced 2026-02-26 without a GA date; no commodity software install
2025	Durability and resilience	2.5 → 4	+3.6	Synchronous replication and Global Access namespaces in the 5.4 and 5.5 release notes; 5.5.0 adds async replication for block (years approximate); failure domains and rebuild tests not read
2025	Lifecycle and tiering	1 → 2.5	+2.1	5.4.3: S3 lifecycle rules (15 MB rule size limit); 5.5.0: usable-capacity quotas; no transition to another tier or S3 target; lifecycle rules not supported on Global Access destination buckets
2025	Protocols beyond S3	3.5 → 4	+0.7	NVMe/TCP block, Kafka-compatible Event Broker and VAST Database tables with Trino, Spark and Dremio connectors; 5.5.0 adds NFSv4.2 extended attributes (years approximate); HDFS, Swift and Azure Blob not found
2025	S3 API fidelity	3 → 3.5	+1.5	5.4.3: STS AssumeRole with 15 minute to 36 hour sessions and SSE-C; 5.5.0: per-bucket CORS, If-Match on GetObject and HeadObject (years approximate); no SSE-KMS found, versioning cannot be disabled, no MFA delete
2025	Security and multi-tenancy	3 → 3.5	+1.0	5.4.3 and 5.5.0: STS AssumeRole, SSE-C, mTLS for NFS and the Event Broker, identity policy limit raised to 120 per user; SSE-KMS, KMIP and FIPS not found; CrowdStrike support (2026-09-04) and DataEnclave (2026-09-30) announced without GA labels
2026	Ecosystem and openness	1.5 → 2	+0.5	Cosmos community unified as one partner ecosystem (2026-02-25); open-source connectors and blueprints for Trino, Spark and Dremio (vendor)
2026	Operations	3 → 3.5	+1.0	Polaris control plane included with VAST cloud deployments (2026-02-26); published upgrade paths per release; multi-cluster orchestration still to come; Terraform not found

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-05	Veeam Ready Object Immutability qualification and Veeam v12 test suite passed (vendor blog)	Immutability	M
2026-02	Cosmos partner programme unified at VAST Forward	Ecosystem	P
2026-02	CNode-X: the AI OS on NVIDIA GPU servers, certified configurations to come	AI	V
2026-02	PolicyEngine and TuningEngine announced for the end of 2026	AI	V
2026-02	NVIDIA context memory storage with BlueField-4 announced	Performance	V
2026-02	Polaris control plane, included with VAST cloud deployments; multi-cluster orchestration later	Operations	P
2026-02	CrowdStrike connectors announced	Security	M
2026-09	CrowdStrike Falcon native support across the AI OS	Security	M
2026-09	DataEnclave confidential AI runtime within the VAST AI OS	AI	V

Centre of gravity: AI (3), Security (2), Immutability (1)
Blind spots (no items): S3 API, Durability, Deployment, Protocols, Lifecycle, Packaging, Licensing
Driver mix: Vision 44%, Customer need 0%, Market window 33%, Upstream 0%, Portfolio 22%
Idea-to-need index: 0.57 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 16.0 / 25

Criterion	Score	Basis
Cadence	3.5	Minor releases and service packs (5.5.0 up to SP6) with published upgrade paths; dates not published
Roadmap transparency	2.5	Public knowledge base with detailed release notes; direction only in conference announcements; no roadmap
Say-do	3	Compliance mode and the Veeam qualification shipped; CNode-X, PolicyEngine, TuningEngine and DataEnclave have no confirmed GA, with PolicyEngine and TuningEngine due by the end of 2026
Velocity	4	5.5.0 alone brought S3 CORS, If-Match, NFSv4.2 extended attributes, mTLS, block async replication, vector indexing and capacity quotas
Lifecycle stability	3	Rapid minor and service pack churn, upgrade paths limited to listed source releases, hardware platform names that change

Commercial risk: 14.5 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	2.5	No public prices; no change found
Purchase constraints	3.5	Certified platforms only; capacity subscription in 100 TB increments (secondary sources)
Channel and access	2.5	Public documentation; sold direct and through Cosmos partners (resellers, integrators, distributors, cloud providers)
Owner stability	3	Private and venture-backed at a USD 30 billion valuation (2026-04); an IPO is reported as under consideration
Cost of staying supported	3	Support windows not found; subscriptions transfer across enclosures (secondary sources)

Technical lock-in: 14.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	3	Proprietary layout with similarity-based data reduction; data readable over NFS, SMB and S3
Export path	1.5	NFS, SMB and S3 reads; no replication to an external S3 target found
Stack coupling	3.5	Own stack spanning storage, database and compute
Hardware / cloud coupling	3	Certified platforms from VAST, Supermicro, HPE and Cisco, or VAST on Cloud; no commodity software install
Skills and tooling coupling	3	Vendor tooling and a platform model (views, tenants, DataEngine) specific to VAST

Integrator fit: 12.5 / 20

Criterion	Score	Basis
Partner programme openness	3.5	Cosmos programme unified 2026-02-25 for resellers, integrators, technology alliances, distributors and cloud providers; OEM partners Supermicro, HPE and Cisco
Multi-tenancy and self-service	3.5	Tenants with per-tenant and identity policies, STS and IAM roles; Polaris adds a multi-tenant control plane for cloud deployments
API and infrastructure-as-code	3	REST API, CLI and Kubernetes CSI; Terraform and Ansible not found
Skills and certification	2.5	No public certification found

AI leverage: 8.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI workload support	1.5	3.5	3.5	2021: NVIDIA GPUDirect Storage integration (vendor; year approximate, grade C); BlueField-4 context memory storage and CNode-X announced 2026-02-26 without GA dates; no S3 over RDMA found
AI platform stack	0	0	3	2025: 5.5.0: vector indexing in VAST Database and Compute Clusters in the release notes (year approximate); DataEngine triggers, NIM microservices and the Sirius GPU SQL engine are vendor descriptions
AI-assisted operations	0	0	0	2019: None GA; TuningEngine announced 2026-02-26 for the end of 2026
Agent openness	2	2	2	2019: REST API and CLI; no MCP server found; PolicyEngine for governing agent access is due by the end of 2026

Year by year: 2019: 3.5 · 2020: 3.5 · 2021: 5.5 · 2022: 5.5 · 2023: 5.5 · 2024: 5.5 · 2025: 8.5 · 2026: 8.5

AI say-do, 2023 to 2026: 6 AI items announced; 1 GA, 0 still preview, 5 pending, 0 dropped. Vector indexing shipped in the 5.5.0 release notes; CNode-X, PolicyEngine, TuningEngine, BlueField-4 context memory storage and DataEnclave have no GA date in sources read.

VAST has the deepest AI stack of the file-first platforms here, with vector indexing and compute clusters in its documented release notes. The rest of its 2026 AI programme is dated only as "by the end of 2026" or not at all, and there is no AI in its own operations and no MCP server.

Reading

VAST scores highest of the three file-first platforms on capability because its S3 side is documented in detail: STS, SSE-C, CORS, conditional reads, lifecycle rules and both lock modes, beside NFS, SMB, block and an event broker. Its limits are documented just as clearly: Object Lock cannot be used on a view that is also open over SMB or NFS, versioning cannot be turned off, and nothing tiers off the flash. Most 2026 announcements (CNode-X, PolicyEngine, TuningEngine, DataEnclave) have no GA date, and because the release notes carry no dates the direction list leans toward those announcements more than the shipped work does. A buyer planning to land backups on it should ask VAST for the Cohasset report and a current Veeam listing for the release they will run, and check that the view design allows Object Lock.

Open questions and items to re-score

Release dates for VAST Cluster 5.3, 5.4 and 5.5; the 5.4 and 5.5 steps carry approximate years and their S3 work is missing from the direction list for that reason.
SSE-KMS support.
A Veeam.com listing and the Cohasset report.
Erasure coding geometry, failure domains and rebuild behaviour.
Whether CNode-X, PolicyEngine, TuningEngine and DataEnclave reached GA.
Whether any software-only or commodity deployment exists.
Country, board and leadership.
Site blog posts from 2026-03 discuss a NetApp lawsuit linked to VAST and VAST's purchase of Red Stapler; neither was in the research sources, so neither moves a score.