David Davis

Ask ten IT directors what their RTO is and most will quote a number from a business impact analysis written three budget cycles ago. Ask how long the last full restore actually took, and the room goes quiet. Industry surveys have repeatedly found that a majority of organizations — around 60% in recent studies — need six hours or more to complete a full restore, while only about 5% finish inside an hour. That gap between the declared number and the tested number is where DR programs fail audits, and it is where this brief starts.

Below: a clean tier-by-tier benchmark table for RTO and RPO targets as of mid-2026, an honest mapping of which technology actually delivers each tier — Zerto, Veeam, and Rubrik each earn a place, and each has limits — and the diagnostics to tell whether your declared targets are real or fiction.

The benchmarks: four recovery tiers, as of mid-2026

Most published tier models are either vendor marketing or academic. Here is the version I use when a client asks what “realistic” means. These are targets that well-run enterprises actually hit in tested recoveries — not aspirational numbers for the audit binder.

Two rules make this table useful. First, the tier is defined by the business cost of downtime, not by what the application team wants — everyone believes their app is Tier 1 until they see the invoice. Second, RTO and RPO travel together: a sub-15-minute RTO paired with a 24-hour RPO means you will be back online quickly with yesterday’s data, which for a payments platform is not recovery at all.

The reality gap: declared RTOs are fiction without testing

The survey math deserves a second look. If roughly 60% of organizations need six-plus hours for a full restore and only about 5% finish under an hour, then most of the sub-one-hour RTOs written into DR plans are unfunded promises. The declared number describes the technology the organization wishes it had bought.

The failure modes are consistent. Restore throughput is measured against a single VM, then extrapolated to 400. Dependencies — DNS, identity, load balancers — are not in the runbook, so the application is “restored” but nobody can log in. And the plan has never been exercised end to end, because a full failover test is disruptive and nobody wants to own the outage. The fix is procedural, not technical: a tested tier assignment beats an ambitious untested one every time. I covered how often each tier should be exercised, and what DORA now requires of financial entities, in our brief on DR testing cadence.

The takeaway for the meeting: an RTO that has never been demonstrated in a test is a hypothesis, and the board should hear it described that way.

Matching technology to tier: Zerto, Veeam, Rubrik

Vendors will happily sell you Tier 1 technology for Tier 3 workloads. Mapping honestly saves seven figures at renewal.

Zerto: the Tier 1 specialist

Zerto, now sold as HPE Zerto Software, built its reputation on journal-based continuous data protection: every write is replicated and logged, so you can rewind to a checkpoint seconds before corruption hit. For genuine Tier 1 workloads — where a five-minute RPO is a requirement, not a preference — journaled CDP is the honest answer, and Zerto remains the reference implementation. The 10.9 release (May 2026) added cross-hypervisor replication between VMware and HPE VM Essentials, which matters if Broadcom pricing has you planning a hypervisor exit for part of the estate. The limits are equally clear: per-VM licensing makes it expensive to spread across the whole environment, and it is a replication-first product — most shops still pair it with a separate backup platform for long-term retention. Fit: your top 5–10% of workloads, not your standard.

Veeam: the Tier 2–3 workhorse

Veeam Data Platform v13, shipped in November 2025, is where most of the market lives. Instant VM recovery boots workloads directly from backup storage in minutes — degraded performance until storage migration completes, but running — which is what makes a 1–4 hour Tier 2 RTO achievable from backup infrastructure rather than replication. v13 added instant recovery into Azure with a cleanroom validation step and made backups immutable by default, both of which harden the ransomware case. Veeam’s strengths are breadth of workload coverage and cost per protected VM; its CDP capability exists but is younger and narrower than Zerto’s journaling, and instant-recovery performance depends heavily on the repository hardware underneath it. Fit: the 70–80% of the estate sitting in Tiers 2 and 3.

Rubrik: when the threat model is ransomware, not floods

Rubrik Security Cloud approaches the same problem from the security side: an immutable filesystem, anomaly detection on backup data, and threat hunting inside recovery points so you restore a clean copy instead of reinfecting yourself. Through 2025 it kept widening coverage — Okta recovery, PostgreSQL, Red Hat OpenShift Virtualization, Azure DevOps and GitHub repositories. The trade-offs: RPOs are bounded by snapshot frequency, so it is not a CDP play and will not deliver Tier 1 minute-level RPOs, and its pricing sits at the premium end of the backup market. Fit: security-driven Tier 2 and Tier 3 estates where the recovery scenario you actually rehearse is a cyberattack, and where paying more for forensic confidence is defensible. In a ransomware event, RTO includes the time spent proving the restore point is clean — Rubrik’s bet is that this is where the hours actually go, and the survey data on six-hour restores suggests the bet is reasonable.

Diagnostics: where you actually stand

Run your current plan against these thresholds:

• Declared RTO under 1 hour, recovery method is backup restore: you do not have a Tier 1 plan, you have a Tier 1 label. Either fund CDP replication for those workloads or re-tier them honestly.
• Last tested restore took more than 2x the declared RTO: re-tier or re-platform. The gap will not close by itself, and an auditor will find it before you do.
• Claimed RPO under 15 minutes on nightly backup: arithmetic says no. Your real RPO is up to 24 hours; write that down or change the technology.
• No full-scale restore test in the last 12 months: assume you are in the six-plus-hour majority regardless of what the plan says, and schedule the test before the renewal conversation.
• Recovery copies all live on the same platform or site: your RTO is hostage to a single failure domain — the 3-2-1-1-0 rule exists precisely because restore speed means nothing if the copy you need is encrypted alongside production.

The cost curve: every tier jump costs an order of magnitude

The dirty secret of recovery tiers is the pricing curve. Moving a workload from Tier 3 backup to Tier 2 snapshot replication roughly triples to ten-times the protection cost — replica storage, WAN bandwidth, orchestration licensing. Moving from Tier 2 to Tier 1 CDP does it again: journal storage, per-VM replication licensing, and in many designs a warm second site or reserved cloud capacity that sits idle waiting for a disaster. As of mid-2026, list pricing varies too much to quote responsibly, but the shape holds across vendors: each tier jump is an order of magnitude, which is exactly why “everything is Tier 1” is a budget request, not a strategy.

For organizations that cannot fund a second site, DRaaS has become the middle path — Tier 1-adjacent RTOs at a subscription price, with trade-offs we priced out in our DRaaS pricing brief. The discipline that matters is the ratio: if annual protection cost for a workload exceeds the cost of the outage it prevents, the workload is over-tiered. Most enterprises that run this math for the first time move 20–30% of their “critical” list down a tier and fund proper CDP for the handful that genuinely need it.

Frequently asked questions

What is a realistic RTO for most businesses?

For the bulk of the application estate, 4–24 hours is realistic on standard backup infrastructure with instant-recovery features. Sub-hour RTOs are realistic only for workloads protected by replication or CDP — and only if the failover has been tested end to end, dependencies included.

Can you achieve zero RPO?

Effectively, yes — synchronous replication and journaled CDP can hold data loss to seconds or less. But true zero RPO requires synchronous writes, which imposes distance and latency limits and roughly doubles infrastructure cost. Most Tier 1 programs settle for near-zero RPO via asynchronous CDP and spend the savings on testing.

Is a lower RTO always better?

No. Every hour you shave off an RTO costs progressively more, and past a certain point the spend exceeds the downtime cost it avoids. The right RTO is the one where protection cost and outage cost cross — for many internal workloads that crossover sits comfortably at 12–24 hours.

How often should RTO and RPO targets be tested?

Tier 1 workloads: quarterly failover tests at minimum. Tier 2: twice a year. Everything else: an annual full restore test. Regulated industries increasingly have this dictated for them — DORA in particular has turned testing cadence from best practice into obligation for financial entities operating in the EU.

Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

In December 2024, Cohesity closed its acquisition of Veritas’ enterprise data protection business and became the largest data-protection software vendor in the world — roughly $1.7 billion in combined revenue, as of the companies’ own figures. Then in June 2026 it bought Stone Ram, a small UK firm whose Tranzman tooling exists for one purpose: moving NetBackup estates onto other platforms without the original backup software. That second deal tells you everything about where this market is going. “Cohesity” no longer means a product. It means a portfolio — and if you are comparing it against Rubrik in 2026, you need that decoded before you sign anything.

This brief covers what actually separates the two platforms, where each one earns its keep, where each one will frustrate you, and what NetBackup customers — the people googling this hardest right now — should do at renewal.

The verdict

Pick Rubrik when security leads the purchase. If your CISO co-owns the decision, if you want a single product with a single SaaS control plane, and if a vendor-managed, logically air-gapped vault matters more to you than infrastructure consolidation, Rubrik is the cleaner story. Pick Cohesity when scale and breadth lead. If you are consolidating backup, file services, and dev/test copies onto one platform, if you need to restore hundreds of VMs at once after a wide-blast ransomware event, or if you already run NetBackup, Cohesity’s portfolio fits more of your estate. Neither choice is wrong. The mistake is buying one vendor’s story while your actual requirements match the other’s.

What changed

Two things reshaped this comparison since 2024. First, the Veritas merger made Cohesity a two-flagship company: DataProtect (its original scale-out backup software) and NetBackup (the most widely deployed enterprise backup product of the last two decades) now live under one roof, with Helios positioned as the unified management plane across both. Cohesity has said publicly that NetBackup customers will not be forced to migrate, and that both products remain supported and on active roadmaps.

Second, the June 2026 Stone Ram acquisition put real machinery behind the migration path. Tranzman recovers and moves backup data without needing the original backup application, and Cohesity claims it can cut migration and upgrade time by as much as 75 percent. Read that plainly: the “no forced migration” promise stands, but Cohesity is now investing in making the NetBackup-to-DataProtect move as frictionless as possible. That is a roadmap signal, and buyers should treat it as one.

Rubrik spent the same period sharpening a different blade. It has repositioned entirely as a cyber-resilience company — anomaly detection, threat hunting inside backup data, sensitive-data discovery, and identity recovery for Active Directory and Entra ID, all delivered through Rubrik Security Cloud. Gartner named it a Leader in the 2026 Magic Quadrant for Backup and Data Protection Platforms, positioned furthest in vision. The two vendors are no longer running the same race at different speeds. They are running different races.

Side-by-side comparison

Where Rubrik wins

Rubrik’s advantage is architectural coherence in service of one job: surviving an attack. The Atlas filesystem is append-only, which means ransomware — or a compromised admin credential — has no write path to your snapshots. That is a stronger default posture than immutability bolted on as a feature flag. Rubrik Cloud Vault extends it off-site as a fully managed service, so the isolated copy exists even if your entire on-prem environment is owned. If you are evaluating vault architectures across vendors, our cyber recovery vault comparison breaks down how these isolation models actually differ.

The threat-hunting story is genuinely differentiated. Turbo Threat Hunting scans backup metadata using pre-computed hashes rather than crawling files, and Rubrik claims internal testing found clean recovery points across 75,000 backups in about a minute. Treat vendor benchmarks as vendor benchmarks — but the design approach is sound, and finding a clean restore point fast is the single most underrated variable in real ransomware recovery. Add identity resilience for AD and Entra ID, and Rubrik covers the two things attackers actually target first: your directory and your backups.

Where Cohesity wins

Cohesity’s advantage is scale — in three senses. First, technical scale: SpanFS was built as a general-purpose distributed filesystem, so one cluster consolidates backup, file shares, object storage, and dev/test data copies. If your storage team wants fewer platforms, that consolidation is real money. Second, recovery scale: Instant Mass Restore brings back hundreds of VMs concurrently because SpanFS serves them directly from snapshots. After a wide-blast encryption event, the difference between restoring 40 VMs at a time and 400 is the difference between a bad week and a bad quarter.

Third, market scale. Post-Veritas, Cohesity has the largest install base and the broadest workload coverage in the industry — NetBackup’s workload matrix remains unmatched for legacy and exotic enterprise systems. FortKnox gives it a credible SaaS vault answer to Rubrik Cloud Vault, and the Peer Insights numbers — 4.8 across roughly 1,330 reviews versus Rubrik’s 4.7 across roughly 776, as of mid-2026 — suggest the customer base is not merely large but satisfied. For NetBackup shops, Cohesity is the only vendor offering continuity and modernization in the same contract.

Honest downsides, both sides

Rubrik’s costs run high. List pricing varies by capacity and edition, but Rubrik is rarely the cheap option in a three-way bake-off, and capacity-based subscription costs compound as data grows. It is also not a consolidation play — you are buying a security and recovery platform, not a general-purpose storage layer, so the “fewer platforms” argument goes to the other side. Its review base is smaller, and shops that just want boring, inexpensive backup may find themselves paying for a security posture they never operationalize.

Cohesity’s risk is the merger itself. Running two flagship backup products while unifying management planes and, eventually, filesystems is one of the hardest integration jobs in enterprise software, and roadmap ambiguity is the tax customers pay while it happens. Helios unification across DataProtect and NetBackup is still in progress. And even with Tranzman, a NetBackup migration is a project with real risk, not a button. Buyers should also remember that “no forced migration” is a promise about today’s roadmap, not a contractual term — unless you make it one.

What to do about it

If you run NetBackup: do not panic, but do use the moment. Your renewal is leverage. Ask Cohesity for the Helios unification timeline and the NetBackup support horizon in writing, request a Tranzman-based migration assessment even if you never intend to move, and get a competing Rubrik quote to price-check the renewal. The worst position is renewing for three years without asking any of those questions.

If you are buying fresh: run a recovery bake-off, not a backup bake-off. Measure time-to-clean-recovery for your top 20 applications — including the time to find an uninfected restore point — and make each vendor demonstrate it live. My rule of thumb: if you cannot demonstrate clean recovery of your critical applications inside 24 hours, that gap matters more than any feature on either datasheet. And widen the field before you narrow it — our Veeam vs Rubrik and Commvault vs Veeam briefs cover the adjacent matchups most shortlists should include.

The takeaway for the meeting: Rubrik sells a security platform that does backup; Cohesity sells a data platform that does security. Buy the one that matches who is signing the check.

Frequently asked questions

Is Cohesity better than Rubrik?

Neither is categorically better. Cohesity leads on consolidation, mass-restore scale, and workload breadth, and holds a slight Peer Insights edge — 4.8 versus 4.7 as of mid-2026. Rubrik leads on security architecture, threat hunting, and its managed cloud vault. Match the platform to whether security or infrastructure owns the purchase.

What does the Cohesity-Veritas merger mean for NetBackup customers?

NetBackup remains supported with an active roadmap, and Cohesity says migration to DataProtect is optional. Helios is becoming the common management plane, and the Stone Ram acquisition adds tooling that Cohesity claims cuts migration time by up to 75 percent. Get support horizons in writing at renewal.

Will Cohesity force NetBackup customers to move to DataProtect?

Cohesity has stated publicly that it will not force migrations and will keep selling and supporting both products. The Stone Ram deal signals it wants the move to be easy, not mandatory. Treat the promise as a roadmap statement and negotiate contractual support commitments if NetBackup continuity is critical to you.

What is the main architectural difference between Rubrik and Cohesity?

Rubrik’s Atlas filesystem is append-only and purpose-built so backup data can never be modified in place, prioritizing attack survival. Cohesity’s SpanFS is a general-purpose distributed filesystem that consolidates backup, files, and objects on one scale-out cluster, prioritizing platform consolidation and restore concurrency.

Is Rubrik worth the cost?

For organizations where a ransomware event is a board-level risk and the CISO is involved in data-protection decisions, usually yes — the immutability, threat hunting, and managed vault reduce real recovery risk. For cost-driven shops that only need dependable backup, cheaper options exist and the premium is harder to justify.

Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

Veeam’s ransomware research found that attackers went after backup repositories in 96% of incidents — and got to them roughly three times out of four. Organizations whose backups were compromised faced recovery costs around eight times higher than those whose backups survived. That gap is the entire argument for the 3-2-1-1-0 backup rule. The old 3-2-1 rule assumed your backups fail by accident. The two new digits assume they fail because someone with domain admin credentials wanted them to.

This guide maps each digit to a real 2026 implementation — not the whiteboard version. The short version: the “+1” means an immutable copy an attacker cannot alter even with your credentials, the “0” means recovery you have actually verified, and immutability is not the same thing as an air gap, no matter how many vendor decks conflate the two.

What the digits actually require

The takeaway for the meeting: 3-2-1 protects you from hardware and human error; the +1 protects you from an attacker; the 0 protects you from your own untested assumptions. Most shops I talk to have the first three digits and neither of the last two.

3-2-1: the part you probably already do

Three copies, two media, one offsite has been table stakes since tape libraries were the interesting part of the data center. Two honest checks are still worth running. First, “two media” means two failure domains — a backup repository sitting on the same SAN as production, or in the same vSphere cluster, is one ransomware event away from being zero copies. Second, “offsite” must mean a separate administrative domain, not just separate geography. A DR site joined to the same Active Directory forest with the same admin credentials fails exactly when you need it. If your offsite copy can be deleted from the same console that manages production backups, you have distance, not separation.

The +1: immutable is not air-gapped

Most content ranking for this term treats “immutable” and “air-gapped” as synonyms. They are different controls with different failure modes, and a mature program eventually wants both.

Immutability is a software or firmware guarantee that written data cannot be modified or deleted for a retention window — S3 Object Lock in compliance mode is the reference implementation. It is online, fast to restore from, and cheap to operate. Its weakness is that it is only as strong as the platform enforcing it: governance-mode locks that privileged accounts can lift, retention windows set shorter than attacker dwell time, or a storage admin account that can destroy the whole bucket’s account-level container. Compliance mode, MFA on the storage plane, and retention at least as long as your threat-hunting lookback are the minimum bar.

An air gap is a network or physical separation — offline tape, removable media, or storage that is only reachable during controlled windows. It survives platform compromise entirely, but restores are slow, testing is awkward, and “logical air gaps” that amount to a firewall rule deserve skepticism. Verdict: run immutable object storage as your working +1, and add a true offline copy for the crown-jewel 5–10% of data where a multi-week outage is existential. If you can restore from it in minutes, it is not an air gap — and that is fine, as long as you stop calling it one.

Building the immutable copy: Veeam, Object First, Wasabi, Rubrik

Four approaches dominate the conversations I see in mid-market and enterprise accounts. They are not interchangeable.

Veeam: assemble the stack yourself

Veeam Data Platform gives you three routes to the +1: a hardened Linux repository with immutability flags, direct-to-object backups against any Object Lock-capable S3 target, and Veeam Data Cloud Vault, its managed cloud storage with immutability and egress bundled into a flat per-terabyte price. SureBackup covers the 0 by booting workloads in an isolated lab and running verification tests. Strengths: flexibility and the largest ecosystem of Veeam Ready storage targets. The honest downside is that Veeam sells you the software and the responsibility — a hardened repo is only hardened if your team actually locks down SSH, patches the box, and resists the temptation to join it to the domain. The 96%-of-attacks statistic comes from Veeam’s own incident research; the company is clear-eyed that its customers’ repositories are the target.

Object First: turnkey on-prem immutability for Veeam shops

Object First’s Ootbi appliance exists to remove that operational burden. It is S3 Object Lock storage that ships immutable by default with a zero-access design — no root shell for an attacker to find, no immutability toggle for a rushed admin to disable. As of mid-2026 the appliance line spans roughly 20 TB to 432 TB per node and clusters into the petabyte range, with ingest fast enough to serve as the primary backup target, not just a copy tier. The fit is narrow and deliberate: Ootbi only speaks Veeam. If you run Commvault or Rubrik alongside, it does nothing for those workloads, and you are paying appliance margins over commodity disk. For a Veeam shop that wants on-prem immutability without a hardening project, it is the shortest path.

Wasabi: the cheap immutable offsite tier

Wasabi’s pitch is economic: hot cloud object storage with full Object Lock support, Veeam Ready certification for immutability, flat per-terabyte list pricing, and no egress fees — which matters enormously the day you restore 200 TB in anger. It is an excellent answer for the “1 offsite” and “+1 immutable” digits in a single move. The limits: Wasabi is storage only, so restore speed is bounded by your internet pipe, and minimum-retention billing means churny short-retention jobs cost more than the headline rate suggests. Model your restore-time math before you rely on it as the only immutable copy; our backup storage cost-per-TB analysis runs those numbers across the major targets.

Rubrik: immutability as architecture

Rubrik takes the opposite approach from the assemble-it-yourself model: its append-only filesystem is immutable by design, not by configuration, so there is no setting to get wrong. Rubrik Security Cloud layers on anomaly detection, threat hunting across backup history, and orchestrated recovery validation — effectively bundling the +1 and the 0 into the platform. The trade-offs are real: it is a platform replacement rather than a bolt-on, pricing sits at the premium end, and you are committing to one vendor’s stack for backup, immutability, and security analytics together. For organizations that want the rule enforced by architecture rather than by process discipline, that bundle is exactly the point.

For a deeper side-by-side of these targets — including hardened repos, tape, and the hyperscaler options — see our immutable backup storage comparison.

The 0: verified recovery, not green checkmarks

A successful backup job proves data was written. It proves nothing about whether the application boots, the database mounts, or the restore completes inside your RTO. The 0 digit demands automated, scheduled verification: Veeam SureBackup boots VMs in an isolated network and runs heartbeat, ping, and custom application tests; Rubrik and others offer equivalent recovery validation and clean-room recovery workflows. The benchmark I hold clients to: every tier-1 workload restore-tested at least quarterly, automated verification running weekly, and at least one full DR exercise a year that the infrastructure team does not schedule themselves. If your last full restore test predates your last major hire, you do not have a 0 — you have a hope. Regulated shops should map this cadence to their obligations; our DR testing cadence guide for DORA covers what supervisors now expect in writing.

What to do about it

• This month: inventory which digits you actually have. Check every immutability setting — compliance mode or it does not count. Verify the backup platform has its own identity plane, separate credentials, MFA everywhere.
• This quarter: stand up one genuinely immutable copy — Object Lock bucket, Ootbi node, hardened repo, or a managed vault — and set retention longer than 30 days, since attacker dwell time routinely exceeds short lock windows.
• This half: automate recovery verification for tier-1 workloads and put the results in front of leadership monthly. The 0 is a reporting artifact as much as a technical one.
• Ongoing: add an offline or truly isolated copy for existential data, and rehearse restoring from it once a year.

The rule is cheap insurance against an expensive certainty. Attackers already treat your backups as the primary target; 3-2-1-1-0 is simply the posture that assumes they will.

Frequently asked questions

What is the 3-2-1-1-0 backup rule?

Keep three copies of your data on two different media with one copy offsite, plus one copy that is immutable or air-gapped, and verify recovery with zero errors. The last two digits extend the classic 3-2-1 rule for ransomware, where attackers deliberately destroy backups before encrypting production.

Is an immutable backup the same as an air-gapped backup?

No. Immutability is a software guarantee that data cannot be changed or deleted during a retention window; an air gap is physical or network isolation. Immutable storage is online and fast to restore from but depends on the platform enforcing it. An air gap survives platform compromise but restores slowly. Mature programs use immutable storage as the working copy and reserve a true offline copy for critical data.

Does the 3-2-1 rule still apply in the cloud?

Yes, and SaaS data counts too. A cloud workload backed up to the same cloud account is one compromised credential away from total loss. Cross-account or cross-provider copies with Object Lock — for example, Veeam writing to Wasabi or to Veeam Data Cloud Vault — satisfy the offsite and immutable digits without a second data center.

How often should backups be tested?

Automated verification weekly, restore tests for tier-1 workloads at least quarterly, and a full DR exercise annually. Tools like Veeam SureBackup or Rubrik’s recovery validation make the weekly cadence practical by booting and testing workloads automatically in an isolated environment.

Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

“Does Microsoft back up my data?” is still one of the most-searched questions in enterprise data protection, and for the first time the honest answer is: partially, for a fee, with conditions. For years the answer was a flat no — Microsoft replicated your data for availability, kept recycle bins and retention policies, and told you in the services agreement to use third-party backup. Now Microsoft sells Microsoft 365 Backup as a native, metered service, and every renewal conversation I’ve sat in this year has included some version of “can we just use Microsoft’s?”

Sometimes you can. This brief lays out what the native service actually covers, where it stops, how the third-party platforms — Veeam, Druva, Keepit, AvePoint — genuinely differ, and a decision rule that works better than any feature checklist: choose by threat model.

The short answer

Microsoft 365 Backup is a recovery-speed product that lives inside the Microsoft trust boundary. Third-party backup is a survivability product that lives outside it. That is the entire decision.

If your worst realistic day is a user deleting a SharePoint library or ransomware encrypting OneDrive content, the native service is credible and fast. If your worst realistic day includes tenant-level compromise, a rogue global admin, a licensing or billing lockout, or a regulator asking for four years of mailbox history, native cannot get you there — retention caps at one year and every copy sits with the same vendor, in the same tenant, inside the same failure domain. Backup that can’t survive the failure of the thing it protects isn’t backup. It’s a faster undo button.

What Microsoft’s native backup covers

Microsoft 365 Backup protects three workloads: Exchange Online, SharePoint Online, and OneDrive. Restore points land roughly every ten minutes for the first two weeks, then weekly snapshots carry you out to a maximum of one year. Pricing is consumption-based — as of mid-2026, roughly $0.15 per GB per month of protected data, metered to an Azure subscription, with restores themselves free. Because the data never leaves Microsoft’s platform, bulk restores are dramatically faster than anything pulling content back through public APIs.

What it does not do matters just as much. There is no retention beyond twelve months. There is no export of backup data to storage you control. Teams chat, Planner, Loop, and Entra ID objects are not first-class citizens. And there is no independent restore path — if your tenant is suspended, compromised, or in a billing dispute, the backup is exactly as unreachable as the production data. Microsoft has also opened the same engine to partners as Microsoft 365 Backup Storage, which is why several third-party vendors can now offer native-speed restores under their own control plane — more on that below.

Native vs third-party, side by side

Where the third-party platforms differ

Veeam

Veeam Data Cloud for Microsoft 365 is the SaaS packaging of the most widely deployed M365 backup engine in the enterprise, and Veeam still lets you self-host the software edition if you want to own the storage tier. Strengths: restore granularity, a huge installed base, and the option to consume Microsoft’s Backup Storage APIs for express restore speed while keeping Veeam’s control plane. The trade-off is portfolio complexity — editions, licensing tiers, and a heritage in infrastructure backup that can feel heavy if all you want is a SaaS checkbox. It fits enterprises already running Veeam for the datacenter (we’ve compared that side of the house in Veeam vs Rubrik) that want one data-protection vendor.

Druva

Druva is 100% SaaS on AWS — no software, no storage to size, per-user pricing. Its March 2026 Identity Resilience launch is the most interesting strategic move of the group, extending protection to Entra ID, on-prem Active Directory, and Okta in one platform. Strong for teams that want zero infrastructure and a security-led posture. The flip side: there is no self-hosted option, and data residing in Druva’s AWS environment can complicate strict sovereignty requirements.

Keepit

Keepit runs its own vendor-owned data centers — not AWS, not Azure — which makes it the cleanest answer to “is my backup truly outside Microsoft’s blast radius?” Coverage is broad across SaaS workloads including Entra ID. It’s a strong fit for European buyers with data-residency mandates and for anyone whose auditors ask pointed questions about infrastructure independence. The honest caveat: Keepit is a smaller vendor with a narrower enterprise ecosystem than Veeam, and that matters if you want one platform across SaaS and datacenter.

AvePoint

AvePoint Cloud Backup sits inside a broader Microsoft 365 governance and management platform, and that context is its edge: the deepest Teams and collaboration fidelity of the group, strong Entra ID coverage, and real traction with MSPs. Two caveats. Its backup infrastructure runs largely in Azure, which is operationally separate from your tenant but closer to Microsoft’s cloud than Keepit’s model. And the value case is strongest when you adopt the wider platform — as a standalone backup line item it competes on fidelity, not price.

The honest downsides — both directions

Native’s weaknesses are structural: the one-year ceiling, no export, workload gaps, and shared fate with the tenant. But third-party isn’t a free win. Per-user subscription fees compound quietly as M365 data grows — our backup storage cost-per-TB benchmarks show SaaS backup is routinely the most expensive tier per terabyte an enterprise pays for. Bulk restores through Graph APIs are throttled and slow unless the vendor integrates Microsoft’s Backup Storage. And a second vendor is a second security surface — your backup platform holds a copy of everything and deserves the same access scrutiny as the tenant itself.

The adjacent risk: identity

Here’s the gap most M365 backup RFPs still miss: restoring mailboxes doesn’t restore access. If Entra ID objects, conditional-access policies, or group memberships are deleted or maliciously rewritten, a content-only backup leaves you with perfectly preserved data nobody can sign in to reach. Druva cites incident-response data suggesting the large majority of investigations now trace back to identity compromise — treat the exact figure with caution, but the direction is right.

The market has responded: Druva’s Identity Resilience covers Entra ID, AD, and Okta; Veeam Data Cloud and AvePoint both back up Entra ID; Keepit covers Entra ID within its independent cloud. Microsoft’s native service does not. Takeaway for the meeting: any M365 backup evaluation in 2026 should score identity-object protection as a mandatory line item, not a nice-to-have.

How to decide

• Retention under 12 months, threat model is user error and content ransomware: native is defensible. Budget ~$0.15/GB/month against your protected volume and move on.
• Regulated retention (3–7+ years), legal hold beyond a year, or provable restore independence: third party, full stop. Native cannot satisfy any of these today.
• Apply the 3-2-1-1-0 rule honestly: a native-only copy fails the independent-copy test, because every copy shares one trust boundary. It counts as a recovery tier, not an off-site copy.
• The emerging pattern is both: native (or a vendor consuming Backup Storage) for fast operational restore, plus a third-party copy for long retention and tenant-failure survivability.
• Put identity in the RFP. If the shortlist can’t restore Entra ID state, it’s protecting the library while ignoring the keys.

Frequently asked questions

Does Microsoft automatically back up Office 365 data?

No. Microsoft replicates data for availability and provides recycle bins and retention policies, but none of that is backup. True point-in-time recovery requires either the paid Microsoft 365 Backup service or a third-party platform. The shared responsibility model puts the data itself on your side of the line.

Is Microsoft 365 Backup enough for compliance?

Usually not on its own. Retention is capped at one year, and most regulated industries — finance, healthcare, public sector — carry multi-year retention obligations that only third-party platforms can meet. Native works as an operational recovery layer alongside a compliance-grade copy.

How much does Microsoft 365 Backup cost?

As of mid-2026, roughly $0.15 per GB per month of protected data, billed as Azure consumption, with restores free. Third-party platforms mostly price per user per month, and list pricing varies — the crossover point depends heavily on how much data your average user carries.

What is the shared responsibility model in Microsoft 365?

Microsoft is responsible for infrastructure uptime and service availability. You are responsible for the data — its retention, its recoverability, and its protection against deletion, ransomware, and account compromise. Every backup decision flows from that split.

Can third-party tools restore faster than Microsoft’s native backup?

Generally no for bulk restores — API throttling limits anything pulling data back from outside. The exception is vendors that integrate Microsoft 365 Backup Storage, which combines native-speed restore with an independent control plane. Ask shortlisted vendors specifically whether they use it.

Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

Try to find a published price for disaster recovery as a service and you will mostly find lead-capture forms. The numbers exist — they are just buried in procurement files. Reference-checked ranges put DRaaS at roughly $50–$200 per protected VM per month with replicated storage billed on top. A typical 30-VM managed environment at a provider like Expedient runs $8,000–$30,000 per month depending on recovery tier and immutability options, and full engagements land between $250,000 and $3 million in total contract value over three to five years.

This brief decodes where that money goes, which contract terms actually move the number, and how four structurally different vendors — Expedient, Zerto, 11:11 Systems, and Cohesity — shape what you pay. All ranges are as of mid-2026; list pricing varies by region, deal size, and how hard you negotiate the test schedule.

The benchmark numbers

Treat these as the shape of the market, not a rate card. The spread inside each range is not noise — it is the recovery SLA. A four-hour contractual RTO with annual testing sits at the bottom of the band; a 15-minute RTO with quarterly witnessed tests and immutable replica storage sits at the top. The number itself is less useful than knowing which lever put you where you are.

The anatomy of a DRaaS bill

Every DRaaS quote, whatever the logo, decomposes into a base subscription per protected workload plus three consumption components. The subscription covers replication software, orchestration, and the provider’s support obligation. Consumption covers recovery compute (cheap while idle, full price the moment you declare), replicated storage, and replication bandwidth.

Storage is the line that grows while nobody is watching. Journals, retained snapshots, and immutability copies compound the same way backup storage does — our cost-per-TB benchmark applies almost unchanged here, and the same $/TB discipline should be in your DRaaS renewal file. The takeaway for the meeting: the per-VM rate is the headline, but storage growth is what your year-three bill will actually be about.

The three questions that move the price

Declared vs. contractual recovery SLAs

Many quotes quietly price a declared objective — a target the provider aims for — rather than a contractual SLA with remedies. The gap between the two is often 30–50% of the bill. Decide which workloads genuinely need a contractual 15-minute RTO and which can live with a four-hour target; our RTO/RPO benchmarks give defensible tiers. Paying SLA money for target language is the most common DRaaS procurement mistake I see.

Failover testing frequency

Testing is where DRaaS quotes hide margin in both directions. One included annual test is the default; each additional witnessed test typically bills as a professional-services day plus recovery compute. Quarterly testing can add 10–20% to the annual bill — and it is usually worth it, because an untested runbook is a fiction. Regulated shops should reconcile the test schedule against the cadence argued in our DR testing and DORA brief before signing, not after the first audit finding.

Does failover require IP and DNS changes?

This is the sleeper question. If recovered workloads come up on new addresses, every failover — including tests — drags in DNS cutover, firewall rework, and application re-pointing. That shows up as longer real RTOs and larger services bills. Expedient’s SDN-based approach is the notable counterexample: its push-button failover preserves network identity, so workloads recover without IP or DNS changes. Other providers solve it with stretched networking or scripted re-IP, with varying elegance. Ask the question in every evaluation; the answer predicts your true test cost better than the per-VM rate does.

How four vendors structure the bill

Expedient

Expedient is a full-stack operator: it runs the target cloud, the network, and the service desk, with DRaaS offerings for both VMware and Nutanix estates. Pricing is a managed monthly bill — the $8K–$30K figure for a 30-VM environment is the working planning range, with recovery tier and immutable storage driving the spread. Strengths: the push-button, no-re-IP failover noted above, and witnessed testing handled by the provider rather than your staff. Where it fits less well: shops committed to recovering into their own hyperscaler tenancy, or teams that want software they operate themselves. You are buying an outcome, and the premium over raw software reflects that.

Zerto (HPE)

Zerto is the replication engine, not the service. Its continuous data protection and journal-based recovery deliver the lowest RPOs in this group — seconds, not minutes — and it is licensed per protected VM, run by your team or consumed through an MSP. HPE has owned Zerto since 2021 and, as of late 2025, also distributes it through Commvault, so expect the same engine to appear on several quotes under different letterheads. Strength: best-in-class RPO and hypervisor-level flexibility. The honest downside: buying Zerto directly means you own orchestration, the DR target’s infrastructure bill, and the testing calendar. The software line is only part of your real DRaaS cost.

11:11 Systems

11:11 Systems is the consolidation play — the rollup of iland, Green Cloud, and Sungard AS recovery assets — and it sells managed DRaaS on more than one replication engine, with Zerto- and Veeam-based offerings targeting its own cloud or Azure. That breadth is the strength: one provider can quote continuous replication for tier-0 and cheaper snapshot-based DR for everything else. It is also the caveat: two 11:11 quotes are not automatically comparable, so make the account team state which engine, which target, and which SLA class each line item carries. Fits buyers who want managed service economics with engine choice.

Cohesity

Cohesity — the largest independent data-protection vendor since the Veritas merger closed — comes at DR from the backup side. Recovery is orchestrated from snapshots on its platform, with FortKnox providing an isolated cyber vault, and pricing follows its data-protection licensing plus cloud consumption rather than a per-VM DRaaS subscription. Realistic RPOs are minutes to hours, not seconds. That makes Cohesity the wrong answer for sub-minute tier-0 replication and a genuinely strong answer for the consolidation question: if backup, ransomware recovery, and DR for the long tail of workloads can share one platform, the blended cost often undercuts running a separate DRaaS contract for everything.

Reading your own quote

• Blended cost above ~$250/VM/month: you are paying tier-0 rates across the estate. Re-tier — most environments need contractual aggressive SLAs on fewer than 20% of workloads.
• Blended cost below ~$40/VM/month: check what you actually bought. That price usually means replicated backups with no recovery compute reserved and no orchestrated failover — backup with extra steps, not DR.
• One test per year in the contract: your real RTO is unknown. Budget the extra 10–20% for quarterly tests on tier-0 or accept that the SLA is decorative.
• Storage line growing faster than VM count: journal retention and immutability copies are compounding. Renegotiate retention tiers before renewal, not at it.

What to do about it

Run every DRaaS evaluation against the same four asks. First, contractual SLAs with remedies on tier-0, declared targets everywhere else — and price both tiers separately. Second, the testing schedule in the contract, with per-test pricing fixed for the term. Third, a written answer on failover network identity: no IP or DNS changes, or the exact mechanism and its cost. Fourth, storage growth assumptions in the order form, so year-three pricing is a formula rather than a surprise. Providers that answer all four crisply are the ones worth shortlisting; the ranges in this brief tell you whether their number is honest.

Frequently asked questions

How much does DRaaS cost per VM?

Published and reference-checked ranges run roughly $50–$200 per protected VM per month as of mid-2026, with replicated storage billed on top. Aggressive contractual RTO/RPO, quarterly testing, and immutable replica storage push toward the top of the band.

Why don’t DRaaS providers publish pricing?

Because the bill is mostly configuration: SLA class, storage volume, test frequency, and network design change the number by multiples. Publishing a rate card would anchor every deal at the bottom of the range, so providers price through discovery instead.

Is DRaaS cheaper than running a second data center?

Almost always, below a few hundred workloads. A warm second site carries facilities, hardware refresh, and staffing whether or not you ever fail over; DRaaS converts that to a monthly fee with recovery compute discounted until declaration. At very large scale, or with strict data-sovereignty constraints, owned capacity can win again.

What should a DRaaS contract include for testing?

At minimum: one included full failover test per year, fixed per-test pricing for additional tests, and non-disruptive test capability so exercises do not touch production. Regulated firms should align frequency with their resilience obligations — quarterly on tier-0 is the defensible norm.

Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.

Search “Veeam vs Rubrik” and most of what ranks is the two vendors attacking each other — Veeam’s page on why Rubrik is overpriced, Rubrik’s page on why Veeam is insecure. Neither is a useful basis for a purchase that will sit in your environment for five to seven years. I have run both platforms in production environments and sat through the renewal meetings for each, and the honest answer is that this is not a “which product is better” question. It is a “which trade-off does your organization want” question.

This brief lays out that trade-off as of mid-2026: what changed with Veeam v13, what Rubrik’s architecture actually buys you, where the money goes at 100TB and at 1PB, and a set of decision rules you can defend in front of a CFO.

The verdict up front

Veeam is flexibility plus a lower entry cost. Rubrik is structural security plus operational simplicity. That is the whole comparison in one line.

Veeam remains hardware-agnostic — you bring your own repositories, your own dedupe appliances, your own object storage — and its instance-based Veeam Universal License means costs track workload count, not data growth. With v13, it also closed the security gap Rubrik spent years selling against: the new Veeam Software Appliance is a pre-hardened, DISA STIG-compliant Linux platform with mandatory 2FA and high-availability clustering. Rubrik, by contrast, is immutable by design. Its Atlas filesystem exposes no writable NFS or SMB protocols to the network and refuses non-append-only writes at the API level, so even an attacker holding admin credentials cannot remotely destroy your backups. You pay for that assurance with capacity-based licensing that grows with your data. Neither posture is wrong. But one of them is wrong for you.

Side-by-side comparison

What changed in 2025–26

The most consequential shift is Veeam’s. For years, the credible knock on Veeam was its Windows-based backup server — a large attack surface sitting in the exact blast radius ransomware crews target first. Version 13 addressed that head-on. The Veeam Software Appliance is a prebuilt, Rocky Linux-based, just-enough-OS platform: DISA STIG hardened, SSH disabled by default, mandatory 2FA for admin and Security Officer accounts, and a four-eyes approval model for destructive actions like deleting backup data. Veeam also added active/passive clustering for the backup server itself and a browser-based console that finally breaks the dependence on a Windows management box.

That release changes the sales conversation. Rubrik’s strongest argument — “Veeam’s control plane is your weakest link” — now lands only against organizations still running v12 on Windows, which, to be fair, is most of Veeam’s installed base for the next couple of years. Migration is a project, not a checkbox.

Rubrik’s evolution has been steadier: the company has kept pushing Rubrik Security Cloud beyond backup into data security posture — anomaly detection, sensitive-data discovery, threat hunting inside backup snapshots. Its pitch has moved from “we back up your data” to “we are your last line of cyber resilience,” and boards have been receptive. The same platform logic applies in our Rubrik vs Cohesity comparison, where the two integrated players fight on security depth rather than price.

Pricing and TCO at 100TB and 1PB

Neither vendor publishes meaningful list prices, and street discounts vary widely, so treat any blog quoting exact per-TB figures with suspicion. The shape of the cost curves, though, is consistent and verifiable in any competitive bid.

At 100TB — roughly a few hundred VMs plus file data — Veeam almost always carries the lower entry cost. Instance licensing on a mid-sized estate is modest, and you can land backups on storage you already own or on commodity object storage with immutability enabled. Rubrik at this size means a subscription priced on those 100 front-end terabytes plus either appliance hardware or certified partner hardware. Expect the Rubrik bid to come in meaningfully higher; what you get back is a platform one admin can run in a few hours a week.

At 1PB, the math tightens. Veeam’s license cost stays tied to workload count, but the hidden line items grow: repository hardware refreshes, the staff time to design and patch a sprawling backup fabric, and the engineering discipline to keep immutability correctly configured everywhere. Rubrik’s capacity subscription at a petabyte is a large number — and it keeps growing at your data growth rate, which is the figure to negotiate hardest on. Rule of thumb: if your data is growing above roughly 25 percent a year, model Rubrik’s renewal at year three before you sign, because that is where capacity-based deals bite. If your ops team is understaffed, price that reality too — Veeam’s lower invoice is partly a transfer of cost from the vendor to your payroll.

Where each platform falls short

Veeam’s honest weaknesses

Flexibility is sprawl by another name. A large Veeam estate accumulates proxies, repositories, gateways, and tape servers, and every component is something your team designs, patches, and can misconfigure. Immutability is available and solid — hardened Linux repositories, object lock — but it is opt-in, and audits keep finding shops that never turned it on, a gap we dig into in our immutable backup storage comparison. The v13 appliance is genuinely strong, but it is new; the WebUI still trails the legacy console in places, and the migration off Windows is real work that most of the installed base has not started.

Rubrik’s honest weaknesses

Cost, and the direction of cost. Capacity licensing means your backup bill is indexed to data growth, and nobody’s data shrinks. Lock-in is structural: Atlas is proprietary, so leaving Rubrik means migrating or aging out every snapshot it holds. Repository choice is limited compared with Veeam’s bring-anything model. And for edge cases — unusual applications, legacy platforms, odd hypervisors — Veeam’s twenty years of accumulated workload coverage still runs deeper.

What to do about it

• Choose Veeam if your estate is heterogeneous, your team has real infrastructure skills, and cost per protected workload is the metric your CFO watches. Deploy v13 as the hardened appliance from day one — do not replicate the old Windows design.
• Choose Rubrik if the purchase is security-led — a board ransomware mandate, a cyber-insurance requirement, a lean team that cannot own hardening. You are buying an outcome, not a toolkit, and the premium is the price of that outcome.
• Already on Veeam v12? The cheapest security upgrade available to you is the v13 migration plus hardened repositories — likely a fraction of a platform switch, as the numbers in our Commvault vs Veeam analysis also suggest.
• Negotiating Rubrik? Cap the renewal uplift and model three years of data growth into the quote before signature.

The takeaway for the meeting: Veeam and Rubrik both protect data well — peer scores are effectively tied — so buy the operating model, not the feature list.

Frequently asked questions

Is Rubrik better than Veeam?

Neither is categorically better — both hold roughly 4.6 ratings on Gartner Peer Insights as of mid-2026. Rubrik wins on built-in immutability and operational simplicity; Veeam wins on flexibility, workload coverage, and entry cost. The right answer depends on whether security posture or infrastructure control drives your purchase.

Is Veeam still Windows-based?

Not anymore. Veeam Backup & Replication v13 ships as a pre-hardened, Rocky Linux-based software appliance with DISA STIG compliance, mandatory 2FA, and a web console. Existing v12 deployments remain on Windows until they migrate, and that migration is the key project for current Veeam shops.

How much does Rubrik cost compared to Veeam?

Rubrik typically carries a higher upfront cost because its subscription is priced on front-end capacity and usually includes platform hardware. Veeam’s instance-based licensing is generally cheaper to enter, but you supply and operate the backup storage yourself. List pricing varies; competitive bids are the only reliable comparison.

Can Veeam backups be made immutable?

Yes — via hardened Linux repositories and object storage with object lock. The difference is that Veeam’s immutability is something you configure and verify, while Rubrik’s Atlas filesystem is append-only by design and exposes no writable network protocols at all.

Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.