Xen Orchestra: Open-Source Backup Ledger 2026

Part of the Open-Source Backup Ledger (edition 2026-10-02). How the scores work: methodology.

Snapshot

Kind: Backup platform
Licence: AGPLv3; full feature set buildable from source
Backer: Vates SAS (France), also behind XCP-ng
Paid edition or support: XOA subscriptions (four tiers, published monthly prices) with support
Latest release: Monthly XOA releases; XO 6 under development
Next signal: XO 6 backup workers; instant restore; more VMware and Hyper-V migration tooling
Archetype: Hypervisor-bound platform, fast cadence
Evidence grade: B. Release dates corrected by the reviewer to the release blog posts. The research file states the current version as 5.51+, which is inconsistent with monthly 5.x numbering; capability facts are graded A.

Scope of the scores: Backup features of Xen Orchestra only. It protects XCP-ng and XenServer VMs; it has no physical server agents.

Scorecard

Dimension	Score	Direction
Capability today	70.4 / 100	higher is better
Momentum since end of 2022	+4.8 points	higher is better
Credibility	21.5 / 25	higher is better
Sustainability risk	7.5 / 25	lower is better
Technical lock-in	7.0 / 25	lower is better
Support and ecosystem	16.5 / 20	higher is better
AI leverage	3.0 / 20	higher is better
Ledger Index	67.0 / 100	balanced weights

Capability by domain

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2016	2019	2022	Today
Virtual and physical servers (12)	3	3	3.5	3.5
Databases and applications (12)	1.5	1.5	1.5	1.5
Recovery (14)	2.5	4	4	4
Cyber resilience (14)	1	1	2.5	3.5
Storage efficiency and targets (10)	2	3	3.5	3.5
Long-term retention and tape (6)	2	2	2	3
Replication and DR (10)	4	4	4	4
Security and compliance (8)	3	4	4.5	4.5
New-platform support (VMware exit) (8)	3	3	3	3.5
Management at scale and automation (6)	3.5	4.5	5	5
Total / 100	48.8	57.8	65.6	70.4

Year by year: 2016: 48.8 · 2017: 48.8 · 2018: 48.8 · 2019: 57.8 · 2020: 57.8 · 2021: 57.8 · 2022: 65.6 · 2023: 69.6 · 2024: 70.4 · 2025: 70.4 · 2026: 70.4

What moved the score

Year	Domain	Change	Points	Trigger
2019	Management at scale and automation	3.5 → 4.5	+1.2	REST API and official Terraform provider
2019	Recovery	2.5 → 4	+4.2	Single-file restore from delta backups; automated restore tests
2019	Security and compliance	3 → 4	+1.6	TOTP, SAML and OpenID Connect
2019	Storage efficiency and targets	2 → 3	+2.0	S3 targets, zstd
2022	Cyber resilience	1 → 2.5	+4.2	Encryption of backups on remotes
2022	Management at scale and automation	4.5 → 5	+0.6	OpenMetrics exporter, many pools from one console
2022	Security and compliance	4 → 4.5	+0.8	WebAuthn and audit log
2022	Storage efficiency and targets	3 → 3.5	+1.0	Concurrent writes to several remotes
2022	Virtual and physical servers	3 → 3.5	+1.2	Changed-block backup over NBD
2023	Cyber resilience	2.5 → 3.5	+2.8	5.86: S3 Object Lock immutable backups
2023	Long-term retention and tape	2 → 3	+1.2	5.86: multi-tier GFS retention
2024	New-platform support (VMware exit)	3 → 3.5	+0.8	5.92: VMware-to-XCP-ng warm migration

Direction, 2023 to 2026

Each item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-08	5.86: GFS retention	D8 Retention and tape	C
2023-08	5.86: S3 Object Lock	D4 Cyber resilience	M
2023-11	5.89: automated restore tests with screenshots	D3 Recovery	C
2024-02	5.92: VMware-to-XCP-ng warm migration	D1 Virtual and physical servers	M
2024-05	5.95: NBD streaming stability	D1 Virtual and physical servers	C
2026-02	XO 6.2: MCP package for AI workflows	D7 AI-assisted operations	V

Centre of gravity: Virtual and physical servers (2), Cyber resilience (1), Retention and tape (1)
Driver mix: Vision 17%, Customer need 50%, Market window 33%, Upstream 0%, Portfolio 0%

Credibility: 21.5 / 25

Criterion	Score	Basis
Cadence	5	Monthly releases
Roadmap transparency	4.5	Public GitHub, monthly release blog, public roadmap
Say-do	4	6 of 6 items shipped; XO 6 has been in progress since 2023
Velocity	4.5	Many changes every month; author count rising (25 in 2026)
Lifecycle stability	3.5	Rolling releases; XO 6 transition ahead

Say-do record, 2023 to 2026: 6 forward items since 2023, all shipped within 3 to 6 months except the long-running XO 6 redesign.

Sustainability risk: 7.5 / 25 (lower is better)

Criterion	Score	Basis
Maintainer concentration	2.5	Vates staff write over 60%, but the author base is widening
Backer health	1.5	Bootstrapped company growing with XCP-ng
Licence-change risk	2	AGPLv3, Vates holds most copyright
Abandonment signs	0	Daily commits
Security response	1.5	Active maintenance

Project health: Daily commits; 991 stars, 324 forks; 279 open issues (median 114 days), 198 open PRs (median 3 days). Distinct authors per year rose from 6 to 25.

Technical lock-in: 7 / 25 (lower is better)

Criterion	Score	Basis
Formats	1	Standard XVA and VHD files
Export path	1	VHD converts with qemu-img; OVA/OVF export
Stack coupling	3	Tied to Xen hypervisors
Hardware / cloud coupling	0	Any NFS, SMB or S3 target
Skills and tooling coupling	2	Xen skills are less common

Support and ecosystem: 16.5 / 20

Criterion	Score	Basis
Paid support	4.5	XOA subscriptions with published prices
Consultants and partners	3.5	Reseller and integrator network
Documentation	4.5	Current, detailed documentation
Community and packaging	4	Active forum; Terraform provider with over 1.2 million downloads

AI leverage: 3 / 20

Strand	Today	Latest step
AI for protection / protecting AI	0	none
AI platform stack	0	none
AI-assisted operations	0	none
Agent openness	3	2026: XO 6.2: MCP package for AI workflows (from the VM Ledger source pack, grade B)

No AI in backup itself. Vates shipped an MCP package with XO 6.2 in 2026, recorded in the VM Platform Ledger research; the backup research did not capture it.

Reading

For XCP-ng estates, Xen Orchestra is a complete backup and DR product: changed-block backup, replication, immutable S3 copies, restore testing and strong access controls, released every month. It protects only Xen-based VMs and has no tape or physical agents, so it is a companion to the hypervisor rather than a general backup platform.

Open questions and evidence caveats

Version numbering in the research file is inconsistent (5.51+ today); capability facts are cited to release blogs.
XO 6 replaces the backup engine; check maturity before relying on it.