Executive Summary
For ransomware recovery, compare backup products on four things: copies attackers cannot change, a way to find the last clean recovery point, an isolated place to recover and test, and people on call during an incident.
Backup and disaster recovery software keeps copies of data and systems so they can be restored after a failure, a mistake or a cyberattack. For ransomware, the copies are the target. CISA states that many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid.
The seven vendors in this guide differ in where the software runs and who operates it: software you run on your own infrastructure, a SaaS platform, a fully managed service, or appliances with a separate vault.
Section 3 answers the vendor comparisons buyers search for, one recovery question at a time. Every vendor statement there is quoted from that vendor’s own pages and attributed to it. The guide gives no verdict; the checklist at the end turns each statement into a test for a proof of concept.
What Does Ransomware Recovery Ask of a Backup System?
Recovery targets. NIST defines the recovery time objective as the overall length of time an information system's components can be in the recovery phase before negatively impacting the organization's mission or mission/business processes. NIST defines the recovery point objective as the point in time to which data must be recovered after an outage. This guide abbreviates them RTO and RPO. Set both per application before you compare products, because they decide how often you back up, where copies sit and how fast they must come back.
Offline and tested copies. CISA advises maintaining offline, encrypted backups of critical data and regularly testing the availability and integrity of backups in a disaster recovery scenario. Ask each vendor how its product proves a restore works, and how often.
Immutability has limits. CISA advises using immutable storage with caution, as it does not meet compliance criteria for certain regulations and misconfiguration can impose significant cost. Check retention locks against your legal holds and your deletion obligations before you switch them on.
Clean recovery. CISA warns that care must be taken to identify dropper malware before rebuilding from backups to prevent continuing compromises. CISA advises restoring data from offline, encrypted backups based on a prioritization of critical services, taking care not to re-infect clean systems during recovery.
Admin access is part of the attack surface. An attacker who holds backup administrator credentials can change retention or delete copies. Look for multi-person approval on destructive changes, separate credentials for the backup system, and alerts when settings change.
How Do Backup Vendors Compare for Ransomware Recovery, in Their Own Words?
Each paragraph below takes one recovery question and sets the vendors’ own statements side by side. None of this is a test result; treat each statement as something to verify in your own proof of concept.
Copies attackers cannot change. Rubrik states that its file system was built from scratch to be immutable, so backups can't be encrypted or deleted by a ransomware attack. Cohesity states that immutable backup snapshots and DataLock capability (WORM) help protect backup data from being modified or deleted. Druva states that the Druva Resilience Cloud is a fully managed SaaS solution offering air-gapped and immutable data protection across cloud, on-premises, and edge environments. Veeam states that it keeps recovery data safe with native immutability and air-gapped copies. Commvault states that Commvault AirGap provides an off-site, air-gapped, immutable, indelible copy separate from production. Dell states that PowerProtect Cyber Recovery creates an operational air gap by isolating critical data in a separately governed vault with its own controls, credentials and management plane. Dell states that PowerProtect provides compliance-level hardware immutability and NTP tamper protection.
Controls on administrators and the vault. Cohesity lists Zero Trust principles that use MFA, RBAC, and quorum approval to prevent administrative changes and stop attackers from destroying data. Dell states that it can air gap and isolate critical data with secure physical or logical separation in an on-premises or cloud cyber recovery vault.
Finding the scope of the attack and the last clean point. Rubrik states that after an attack it automatically diagnoses the scope of the ransomware attack, providing a clear view into what data was affected and where it resides. Rubrik states that customers can restore to the most recent clean version of their data, whether in a full, orchestrated recovery or a partial system restore. Cohesity states that customers can hunt and scan for threats using threat intelligence from Google and create custom YARA rules. Druva states that it automatically creates a "golden snapshot" with the latest clean file versions from the attack period. Druva states that it scans data for malware during the restore process and uses an antivirus engine to block malicious hashes/IOCs. Commvault states that Cleanpoint Identification and AI-assisted Synthetic Recovery build a curated composite recovery point from the most recent clean file versions. Dell states that, when attacks occur, Cyber Detect delivers forensic reports showing blast radius, corrupted files, owners, and last known good backups.
Recovering and testing in isolation. Veeam states that it validates backups in isolated, malware-free environments using automated testing and network isolation, powered by Veeam DataLabs, SureBackup, and SecureRestore. Commvault states that Commvault Cleanroom Recovery enables automated, isolated, and repeatable cyber recovery testing.
Identity and security operations. Commvault states that it restores identity with granular and full forest recovery. Rubrik states that it integrates into SIEM, SOAR, Syslog, or security automation frameworks using its APIs.
People during an incident. Druva states that its experts monitor customers' backups 24/7, examining alerts, verifying threats, and working with customers to secure and roll back clean data. Cohesity states that Cohesity CERT immediately steps in to help contain the damage and initiate recovery. Veeam states that Coveware by Veeam delivers expert-led preparation and 24/7 rapid response to cyber extortion.
For small and midsize organizations. Arcserve states that Arcserve Cyber Resilient Storage 2 enables immutable storage to be deployed as a virtual machine on major hypervisors. Arcserve states that one of the suites includes the Arcserve Rapid Ransomware Response service, expert technical help during a ransomware emergency, including a named Arcserve Incident Commander.
A fully managed service runs the backup infrastructure and, in some offers, watches it for you. Software you run yourself leaves the vault design and the isolation to your team. An appliance vault separates the copies physically or logically from production. Ask which of those parts you operate, and who is on call during an incident.
| Recovery question | What to ask the vendor to show | Evidence to keep |
|---|---|---|
| Can attackers change or delete copies? | Delete a backup with a full administrator account, then show what stops it | The retention lock settings and the approval log |
| Is the vault separate? | Where the isolated copy lives, and which credentials reach it | A diagram of networks and accounts that can touch the vault |
| Which copy is clean? | Scan a backup set and pick a recovery point after a simulated infection | The scan report and the chosen point in time |
| Can you recover in isolation? | Restore a multi-tier application into an isolated environment | Time to a working application, measured against your RTO |
| Who helps during an incident? | The incident service, its hours, and what it costs | The contract terms and the escalation path |
What Should Backup and Disaster Recovery Software Do?
Without the security vocabulary, the software does five jobs. It copies data on a schedule that meets each RPO. It keeps those copies where an outage or an attacker cannot reach them all. It restores data, machines and whole applications within each RTO. It proves restores work. It reports what is protected and what is not.
Workload coverage. List every workload you run: virtual machines, physical servers, databases, file shares, Kubernetes, cloud services and SaaS applications such as Microsoft 365 and Salesforce. Ask for each one whether protection is included or sold as a separate product.
Cloud copies. CISA suggests considering a multi-cloud solution to avoid vendor lock-in for cloud-to-cloud backups in case all accounts under the same vendor are impacted. Ask where each vendor stores cloud copies, in which regions, and whether you can choose the account and the provider.
Service providers. CISA advises that, if a third party or MSP is responsible for maintaining and securing an organization's backups, the organization ensure they are following the applicable best practices. Put those practices in the contract.
| Capability | What it covers | How to test it |
|---|---|---|
| Workload coverage | VMs, servers, databases, file shares, containers, cloud and SaaS | Back up one of each workload you run |
| Immutable and isolated copies | Retention locks, separate vaults and separate credentials | Try to delete a locked copy as an administrator |
| Threat detection in backups | Anomaly detection and malware scanning of backup data | Plant a test file pattern and see what is flagged |
| Clean recovery point | Choosing the last clean copy per file or system | Recover from a point after a simulated infection |
| Orchestrated recovery | Runbooks that restore applications in order | Recover a multi-tier application end to end |
| Recovery testing | Scheduled tests in an isolated environment, with reports | Schedule a test and read the report it produces |
| Identity recovery | Active Directory and cloud identity restore | Restore a deleted group and its permissions |
Vendors in Backup & Disaster Recovery Software
Representative vendors include Arcserve, Cohesity, Commvault, Dell PowerProtect, Druva, Rubrik and Veeam. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
The approaches below follow two questions: where the backup software runs, and who operates it.
Backup software licensed per workload, which you run on your own infrastructure or through a service provider. Veeam announced on December 11, 2025 the completion of its acquisition of Securiti AI, which it describes as a Data Security Posture Management (DSPM), privacy, governance and AI trust company.
A cyber resilience platform built on an immutable file system. Rubrik states that it went public on the NYSE under the symbol RBRK.
A scale-out data security platform combined with a second enterprise backup product line. Cohesity announced on December 10, 2024 the completion of its combination with Veritas' enterprise data protection business. Cohesity states that it will continue to invest in all products brought from both companies into the combined portfolio, including Veritas NetBackup, Veritas NetBackup appliances, and Veritas Alta data protection offerings.
A cloud-native resilience platform with cleanroom recovery. Commvault (NASDAQ: CVLT) states that for more than 25 years it has helped organizations protect and recover their data. Commvault states that Commvault Cloud brings together data security, identity resilience, and cyber recovery into one cloud-native platform.
A fully managed SaaS service with no backup infrastructure to run. Druva states that customers can store data on AWS or Azure.
Backup software paired with deduplicating appliances from a storage vendor, and a separate cyber recovery vault. Dell states that PowerProtect Data Manager can be combined with PowerProtect Data Domain. Dell states that PowerProtect protects VMs, Kubernetes, databases, and AI workloads, with native integration with PowerStore, PowerMax, and PowerScale.
Backup and immutable storage for small and midsize organizations. Arcserve states that its solutions are for SMBs and mid-market organizations across cloud, on-premises, and hybrid environments. Arcserve states that it merged with StorageCraft. Arcserve states that Unified Data Protection (UDP) 11 combines orchestrated disaster recovery with DR Runbooks and expanded agentless multi-hypervisor support including Proxmox.
| Vendor | Approach | Where it fits |
|---|---|---|
| Dell PowerProtect | Appliances and a separate cyber recovery vault | Data Manager with Data Domain; Cyber Recovery vault with its own controls; Cyber Detect forensic reports |
| Arcserve | Backup and immutable storage for small and midsize organizations | For SMBs and mid-market; UDP 11 with DR Runbooks; ransomware suites by subscription |
| Veeam | Backup software licensed per workload | Three editions, licensed per workload; isolated backup validation; Coveware by Veeam incident response; acquired Securiti AI in 2025 |
| Commvault | Cloud-native platform with cleanroom recovery | Commvault Cloud; AirGap copies; Cleanroom Recovery; Cleanpoint Identification; identity forest recovery |
| Rubrik | Cyber resilience platform on an immutable file system | Immutable file system; automated scope of an attack; restore to the most recent clean version; NYSE: RBRK |
| Druva | Fully managed SaaS backup | Fully managed SaaS; data on AWS or Azure; golden snapshot of clean files; 24/7 backup monitoring by Druva staff |
| Cohesity | Scale-out platform combined with an enterprise backup suite | Combined with Veritas’ enterprise data protection business in 2024; NetBackup and Alta; DataLock (WORM); Cohesity CERT |
Seven vendors, one per approach. We selected the approaches first; six of the vendors are the ones the previous edition of this guide evaluated, and Arcserve was added to cover small and midsize organizations. No row in this table is for sale, and a vendor cannot buy its way into it. The roster check for this edition also covered HYCU, Acronis, Keepit and N-able, and any of them can present its own case in the Spotlight below.
How Is Backup and Disaster Recovery Software Priced?
The pages quoted in this guide publish no list prices. They do describe how products are licensed. Veeam states that Veeam Data Platform licenses are metered per workload. Veeam states that Veeam Data Platform is available in three editions: Foundation (backup and recovery), Advanced (adds observability and AI-powered threat detection), and Premium (adds recovery orchestration, compliance, and GRC reporting).
Druva states that it offers flexible consumption-based pricing. Arcserve states that its Ransomware Protection and Recovery Suites bring ransomware recovery solutions into one subscription.
For the others, ask for a quote built from your own inventory: the number of workloads or machines, the volume of protected data after reduction, the SaaS users you protect, and the retention you need. Ask which edition or tier includes threat detection, recovery orchestration and incident response, and which sell them separately.
Add storage, the isolated vault, cloud egress for restores, and the staff time to run recovery tests when you compare three-year cost.
| Model | You are charged for | Grows with | Where it goes wrong |
|---|---|---|---|
| Per workload | Each protected machine, VM or instance | Number of workloads | Short-lived cloud instances counted at their peak |
| Per capacity | Protected data, front-end or after reduction | Data growth and retention | Long retention multiplying the bill |
| Per user | SaaS seats protected, such as Microsoft 365 | Headcount | Former employees kept for retention still billed |
| Consumption | Storage and compute the service uses | Data, retention and restores | Restores and egress in an incident costing more than planned |
| Appliance | Hardware capacity plus software and support | Capacity tiers | Refresh cycles and capacity bought ahead of need |
How long does implementation take for Backup & Disaster Recovery Software?
Prove recovery of one important application before you move the rest. Keep the old backups readable until their retention ends.
Set RTO and RPO per application with the business owners. Inventory every workload, where its data lives, and which identity services it depends on.
Decide where primary and isolated copies live, which accounts can reach each, and which changes need more than one approver. Agree the recovery order for your critical services with the security team.
Protect one multi-tier application, simulate an infection, find the clean point and recover it in isolation. Time each step against the RTO.
Move workloads in waves, keep the old system readable for retention, and schedule recovery tests with reports that auditors and insurers can read.
What should you ask vendors about Backup & Disaster Recovery Software?
Ask each finalist to answer in writing and to show each answer on your own data.
-
Do you want to run backup infrastructure yourself?Yes Shortlist software and appliance approaches, and design the isolated copy with your own team.No Shortlist SaaS and managed services, and check where they store data.
-
Is most of your data in SaaS applications and the cloud?Yes Weight SaaS coverage and cloud-native protection over on-premises appliances.No Weight restore speed for VMs, databases and file shares in your data center.
-
Do you have a security team on call?Yes Weight integration with your SIEM and SOAR tools.No Weight vendor incident response services and what they include.
Backup & Disaster Recovery RFP package: 123 questions, 10 demo scenarios and a vendor scorecard
RFP packages are a separate paid product. Vendors do not pay to appear in buyer guides.