Virtualization Storage Ledger Methodology: How Every Score Is Built

Part of the Virtualization Storage Ledger (edition 2026-10-16). The results are in the overview and the platform reports. The Ledger uses the same method as the VM Platform Ledger; this page covers what is specific to shared storage for VM clusters.

Who this is for

Teams that need shared storage under a cluster of virtualization hosts: VMware customers pricing a vSAN exit, Proxmox VE and XCP-ng clusters choosing between Ceph, LINSTOR, StarWind and a SAN, OpenShift Virtualization and Harvester users who need storage for both containers and VMs, and the integrators who design and run these clusters. No vendor was briefed on, paid for or reviewed any score.

What is in scope

A platform is included when it shipped a release in the last 12 months, has public documentation or release notes, is available outside one country or one hardware line, and gives several hosts shared access with synchronous replication or erasure coding across nodes and automatic failover. Both hyperconverged storage (on the hypervisor hosts) and disaggregated storage (separate nodes) count, and so does storage that is sold only inside a VM platform (vSAN inside VMware Cloud Foundation, Nutanix AOS, Storage Spaces Direct inside Azure Local), because that is what a buyer compares against.

Out of scope after the tests: hardware arrays whose software cannot be bought separately, Kubernetes-only storage that cannot serve a classic hypervisor, backup products, object-only storage, TrueNAS (its HA is two controllers on shared SAS disks, on Enterprise appliances only), Cisco HyperFlex and Red Hat Gluster Storage (both end of life), Weka and VAST (AI and HPC systems with no hypervisor evidence), and OpenEBS and DataCore Puls8 (Kubernetes only). Longhorn and Portworx are included because they serve virtual machines through Harvester, KubeVirt and OpenShift Virtualization.

Engines, products and packagings

Upstream Ceph is the engine inside IBM Storage Ceph, Red Hat OpenShift Data Foundation, croit and Proxmox VE's hyper-converged Ceph; it carries no commercial risk score, and each of those products is scored on its own packaging, cadence and terms. Proxmox VE Ceph is its own entry because its release cadence, GUI and subscription differ from upstream. LINSTOR and Vates XOSTOR are scored separately for the same reason, as are StarWind Virtual SAN and DataCore SANsymphony after the 2025 acquisition. Longhorn is a community project under the CNCF and carries a sustainability risk score instead of commercial risk.

Capability: ten domains, scored since 2015

Domain	Weight	What a 3 (solid) means	What a 5 (reference) means
Data services core	15	Thin provisioning, snapshots, clones, compression or deduplication, erasure coding or replication, basic QoS	All of these with policy-based control per VM or volume, space-efficient snapshots at scale, inline data reduction and QoS guarantees
Resilience and HA	15	Replica or erasure-coding policies, failure domains, self-healing, a witness for two-node clusters	Stretched or metro clusters with automatic failover, rebuild under load without downtime, documented failure-domain design across racks and sites
Performance and protocols	12	iSCSI or NFS and a native block path, all-flash support, caching	NVMe/TCP or RDMA, FC and SMB where relevant, documented latency and throughput at scale, tiering
Hypervisor integration	12	A supported integration with at least two hypervisors, VM-aware snapshots	Deep integrations (VAAI, ODX, CSI, native plug-ins) across VMware, Hyper-V, Proxmox VE, XCP-ng and KubeVirt, live migration awareness
Scale and topology	10	Three to dozens of nodes, two-node with witness, HCI or disaggregated	Hundreds of nodes, both modes, multi-petabyte clusters, documented limits
Data protection and DR	10	Async replication, snapshot schedules, changed-block tracking, major backup vendors supported	Immutable snapshots, orchestrated failover, broad backup-vendor integration, cross-site replication with RPO in seconds
Security	8	Encryption at rest, RBAC, audit logging	Encryption in flight, external key management, ransomware detection, hardening guides and certifications
Operations and automation	8	A management UI, a REST API, monitoring, rolling upgrades	Terraform and Ansible content, full observability exports, non-disruptive upgrades of everything, fleet management
Hardware and deployment freedom	5	Any x86 server with a compatibility list, mixed drive types	Any x86 and Arm, any drive, no appliance requirement, offline installs
Kubernetes and containers	5	A CSI driver with snapshots	A production CSI driver with RWX, Kubernetes-native management and VM and container workloads on one pool

Each domain is scored 0 to 5 at the end of 2015, 2019 and 2022 and today, against the same anchors every year. Only generally available capability counts; previews count half a step at most. Platform-bound storage scores its hypervisor integration on the one platform it serves and its lock-in accordingly. Buyer lenses on the interactive page re-weight the domains for a vSAN exit, Proxmox VE and XCP-ng clusters, KubeVirt and OpenShift Virtualization, two-node sites, performance-first deployments and regulated multi-site DR.

The other dimensions

Credibility (out of 25): release cadence, roadmap transparency, the say-do record (what was announced in 2023 to 2026 and whether it shipped), velocity and lifecycle stability.
Commercial risk (out of 25, lower is better): price and licence changes since 2023 (vSAN's move to per-core entitlement inside VCF, term-only licences, free editions withdrawn), purchase constraints, channel access, owner stability (the DataCore and StarWind deal, Red Hat Ceph moving to IBM) and the cost of staying supported.
Sustainability risk (out of 25, lower is better): used instead for community projects, as described above.
Technical lock-in (out of 25, lower is better): on-disk and configuration formats, the export path (can the data be read or migrated without the product), coupling to a hypervisor or vendor stack, hardware or cloud coupling, and skills.
Integrator fit (out of 20): partner programme, multi-tenancy and self-service, API and infrastructure-as-code depth, skills and certification.
AI leverage (out of 20): AI workload support (GPUDirect, RDMA, AI data positioning), bundled AI platforms, AI-assisted operations, and official agent interfaces such as MCP servers.

The Ledger Index

A single number out of 100: capability 35, credibility 20, buyer safety 20, AI leverage 10, integrator fit 10 and momentum 5 (capability gained since the end of 2022). Buyer safety is one minus the sum of commercial (or sustainability) risk and lock-in, divided by 50; for the Ceph engine it uses lock-in alone. The Index is shown only from 2023.

Evidence and calibration

Every score comes from the public record: release notes, documentation, compatibility lists, pricing and licence pages, lifecycle pages and press releases for ownership changes. Reports carry an evidence grade (A primary sources, B secondary, C inferred) and end with open questions. Several vendor sites blocked automated reading during research, so the smaller vendors carry lower grades and more open questions than the large ones, and StarWind's own pages were read through a reader proxy and graded B. Corrections are welcome from anyone, vendors included, with a public source, and are logged in the next edition. The Ledger is refreshed twice a year, in March and October.