A competent ransomware crew goes after your backup infrastructure before it detonates anything — encrypt the production data second, delete the ability to recover first. That playbook created a budget line that didn’t exist a few years ago: the cyber recovery vault, an isolated and immutable copy of your most critical data that survives even when the backup platform itself is owned. Search demand for the category is climbing, and nearly every “comparison” you’ll find is a vendor asset in disguise.
I’ve spent twenty-plus years in disaster recovery and data protection, and this is the neutral head-to-head I couldn’t find: what the terms actually mean, how Cohesity FortKnox, Rubrik Cloud Vault, Commvault Cleanroom Recovery, and Veeam Vault genuinely differ, and the three evaluation questions no vendor will volunteer.
Vault, clean room, IRE — get the terms straight
Vendors blur three distinct things, and the blur is where bad purchases happen. A cyber recovery vault is a storage construct: an isolated, immutable copy of data held in a separate security domain, with its own credentials and access controls, so a compromise of your production identity plane doesn’t reach it. A clean room is a compute construct: an isolated environment where you restore systems, scan them for persistence mechanisms, and validate them before reconnecting anything to production. An isolated recovery environment (IRE) is the umbrella — vault plus clean compute plus the forensics tooling to decide what’s safe.
The takeaway a VP can repeat: a vault tells you your data survived; a clean room tells you that you can actually run the business on it. Buying the first without a plan for the second is half a product.
The verdict
Commvault Cleanroom Recovery is the most differentiated offering because it productizes the part everyone else leaves as an exercise for the customer — rehearsing recovery in an isolated environment, on demand. Cohesity FortKnox has the broadest vaulting feature set and the most deployment flexibility, which matters for regulated shops. Rubrik Cloud Vault is the lowest-friction path if Rubrik is already your platform. Veeam Vault wins on pricing transparency — $14–24 per TB per month, flat, egress included — but it is managed immutable storage, not a full IRE. Match the tool to the gap you actually have.
Side-by-side comparison
| Cohesity FortKnox | Rubrik Cloud Vault | Commvault Cleanroom Recovery | Veeam Vault | |
|---|---|---|---|---|
| Isolation model | Virtual air gap, separate SaaS domain, quorum + MFA access | Rubrik-managed cloud tenant, logically air-gapped, immutable | On-demand isolated environment in Azure or air-gapped HyperScale X | Veeam-managed Azure Blob, immutable, separate from your tenancy |
| Deployment | SaaS on AWS, Azure, Google Cloud; new self-managed on-prem option | Managed service on Azure or AWS | Cloud (Azure) or on-prem appliance | Managed service on Azure |
| Recovery rehearsal in the vault | Partial — clean-room analysis and scanning | Limited — recover to your own environment | Core of the product — on-demand cleanroom testing | No — storage only, rehearsal is on you |
| Egress economics | Cloud egress applies; cold tier trades cost for recovery speed | Egress covered for cyber-attack recoveries, per Rubrik | Compute + egress for cleanroom sessions; test costs are bounded | Egress and API fees baked into flat per-TB price |
| Pricing shape (as of mid-2026) | Capacity subscription, warm/cold tiers; list varies | Capacity add-on to Rubrik subscription; list varies | Add-on to Cyber Recovery licensing, roughly double base backup per-TB rates | $14/TB/mo Foundation, $24/TB/mo Advanced, published list |
| Best fit | Cohesity/NetBackup estates, regulated industries | Existing Rubrik shops wanting managed simplicity | Enterprises that must prove recovery works, on a cadence | Veeam shops wanting predictable vault cost fast |
Vendor-by-vendor
Cohesity FortKnox
FortKnox is the most built-out pure vaulting product here. Data lands in a Cohesity-operated cloud domain behind a virtual air gap, with immutability enforced until retention expires and access gated by MFA plus quorum approval — no single admin can act alone. Over the past year Cohesity added a cold storage tier alongside the warm tier on AWS, availability on Google Cloud, support for up to ten vaults per region, and — notably — a self-managed deployment for organizations whose regulators won’t accept SaaS. That last option is rare in this category and it matters for banking and public sector. The honest caveat: a virtual air gap is policy and network isolation, not physics, and the breadth of deployment choices pushes real design work onto your architects.
Rubrik Cloud Vault
Rubrik Cloud Vault is a fully managed, immutable, logically air-gapped copy held in a Rubrik-operated tenant on Azure or AWS — off your security domain, which is the point. Its strength is integration: anomaly detection and threat hunting in Rubrik Security Cloud feed directly into what you choose to vault and what you trust on the way back. Rubrik also states that egress costs are covered when you’re recovering from a cyber attack, which removes one of the nastier line items in this category. The caveats: it only makes sense if Rubrik is already your data protection platform, and the rehearsal story is thinner — you recover into your own environment rather than a turnkey vault-side clean room. If you’re weighing the platforms themselves, see our Rubrik vs Cohesity head-to-head.
Commvault Cleanroom Recovery
Commvault took the opposite approach: instead of selling isolated storage, it sells the isolated recovery. Cleanroom Recovery spins up an on-demand, isolated environment — in Azure, or on an air-gapped HyperScale X appliance — where you restore, scan, and validate systems, then tear it down. Because the environment is on-demand, testing your recovery plan quarterly becomes an operational task rather than a capital project, and that is the most differentiated idea in this comparison. The caveats are cost and complexity: Cleanroom is an add-on riding on Cyber Recovery licensing that runs roughly double the per-TB rate of base backup as of mid-2026 — list pricing varies — and there are more moving parts to own than with a managed vault.
Veeam Vault
Veeam Data Cloud Vault is the pricing-transparency play: pre-built, immutable, Veeam-managed storage on Azure Blob at a published $14/TB/month (Foundation, with fair-use restores around 20% of capacity per year) or $24/TB/month (Advanced, unlimited restores, zone-redundant durability). Egress and API fees are baked into the flat rate, which makes it the only product here you can budget from a public price list in an afternoon. The trade-off is scope. Veeam Vault is excellent immutable off-site capacity for a Veeam estate, but there is no vault-side clean room and no rehearsal tooling — the isolated recovery environment is still yours to build.
The three questions vendors won’t volunteer
1. What is the isolation model, really? “Air-gapped” now describes everything from a separate SaaS security domain with quorum access to an immutability flag inside your own cloud tenancy. Ask whose credentials can touch the vault, and whether a full compromise of your identity provider reaches it. If the answer involves your Active Directory, it is not a vault.
2. Can you rehearse recovery inside the vault? A vault you have never restored from is a hypothesis, not a control. Commvault makes rehearsal the product; Cohesity gives you scanning and clean-room analysis; Rubrik and Veeam largely leave rehearsal to your own environment. Regulated firms should note that supervisors increasingly expect evidence of tested recovery — our breakdown of DR testing cadence under DORA covers what examiners now ask for.
3. What does a real 100 TB recovery cost — and how long does it take? At typical cloud list egress rates, pulling 100 TB back out runs into five figures unless your vendor absorbs it — Veeam bakes egress into the flat rate, Rubrik covers it for attack-driven recoveries, and with the others you should model it explicitly. Then there’s physics: 100 TB over a saturated 10 Gbps link is roughly a day, and real-world restores rarely saturate anything. If your RTO for tier-0 is under 24 hours, a cold cloud tier alone won’t meet it. Demand a recovery-time model in writing before you sign.
Honest downsides, all four
- Cohesity FortKnox — virtual air gap is policy, not physics; deployment breadth means real architecture decisions; you are betting on Cohesity’s control plane.
- Rubrik Cloud Vault — platform lock-in by design; thinner rehearsal story; capacity pricing negotiated, not published.
- Commvault Cleanroom Recovery — the priciest licensing path here; more operational surface area; overkill if all you need is an immutable copy.
- Veeam Vault — storage, not an IRE; fair-use restore caps on the cheaper tier; Azure-only as of mid-2026.
What to do about it
Scope the vault to tier-0 and tier-1 only — for most enterprises that’s 5–15% of the estate, and vaulting everything is how these projects die in procurement. Treat the vault as the second “1” in the 3-2-1-1-0 rule: one copy off-site, one copy offline or isolated, zero errors on verification. If you already run Rubrik or Cohesity, shortlist your incumbent’s vault first and make the others earn a displacement. If you run Veeam and need a defensible isolated copy this quarter, Veeam Vault is the fastest budgetable path — then build the rehearsal muscle separately. And whichever you buy, put a quarterly restore test on the calendar before the ink dries. The vault you tested is the only one that counts.
Frequently asked questions
What is a cyber recovery vault?
A cyber recovery vault is an isolated, immutable copy of critical data kept in a separate security domain with independent credentials, so ransomware that compromises production — including the backup platform — cannot alter or delete it. It exists to guarantee a clean recovery point after an attack.
Is a cyber recovery vault the same as an air gap backup?
Not exactly. A traditional air gap is physical — tape in a vault, a network cable unplugged. Modern cyber vaults use a virtual air gap: network isolation, separate identity, immutability, and controlled connection windows. It’s weaker than physics but far faster to recover from, which is usually the right trade.
How much does a cyber recovery vault cost?
Veeam Vault publishes list pricing at $14–24 per TB per month with egress included. Cohesity, Rubrik, and Commvault price vaulting as negotiated capacity subscriptions or add-ons — Commvault’s Cyber Recovery tier runs roughly double base backup rates per TB as of mid-2026. Budget separately for recovery testing and egress where it isn’t covered.
What is the difference between Cohesity FortKnox and Rubrik Cloud Vault?
FortKnox is a standalone SaaS cyber vault with warm and cold tiers, multi-cloud availability, quorum-based access, and a self-managed option for regulated environments. Rubrik Cloud Vault is a managed, immutable extension of the Rubrik platform — simpler to run, tightly integrated with Rubrik’s threat detection, but only relevant if Rubrik is your backup platform.
Enterprise Techie publishes vendor-honest analysis like this daily — get the brief by email, free.