Critical Capabilities for Enterprise Backup and Recovery Software Solutions

Published on September 18, 2023, this market report was written by Jason Donham, Jerry Rozeman, Michael Hoeck and Nik Simpson, analysts at Gartner, Inc.

Critical Capabilities for Enterprise Backup and Recovery Software Solutions

Multicloud and hybrid cloud environments, SaaS workloads and ransomware threats require new capabilities from enterprise backup solutions. I&O leaders can use this research to compare 14 vendors’ backup and recovery products based on 15 critical capabilities in seven new use cases.

Overview

Key Findings

• Multiple backup vendors are showing increased focus on security and recovery from cyberattacks by delivering a secure and immutable backup platform, combined with immutable backup data supported by their own or OEM integrated immutable storage. This is complemented with secure managed and air-gapped backup vaults, anomaly and malware scanning of backup data and sensitive data scanning capabilities.
• Multiple leading backup vendors have rapidly expanded on delivery of a unified, hybrid, multicloud and SaaS application data protection solution delivered by leveraging their own or OEM integrated technology to deliver a total solution with single pane of glass management. However, ease of management and workload protection coverage varies.
  Leading backup vendors are pairing on-premises solutions with BaaS solutions to provide the optimal mix of data protection technology while keeping customer experience intact. In addition, most backup vendors have moved away from delivery of a best-of-breed backup application to an integrated solution consisting of backup application, backup storage and security capabilities.
• Backup and recovery for data stored in SaaS applications has matured to the point where vendors are offering support for more applications. Several vendors continue to offer stand-alone products that support multiple SaaS applications, but many of these products are not integrated with the vendor’s primary backup platform.

Recommendations
I&O leaders responsible for data center infrastructure should:

• Improve RFP and PoC outcomes by focusing on features that protect the backup system, backup storage and backup data vs. malware and ransomware, and simplify recovery from large-scale data loss caused by cyberattacks.
• Prioritize broad support for diverse data protection needs by favoring backup applications that support hybrid and multicloud workloads deployed on-premises, in multiple public clouds and for SaaS applications, and align vendor roadmaps for SaaS application support with your own future needs.
• Select the right mix of on-premises data protection solutions combined with BaaS solutions to leverage the best of multiple delivery models to protect the growing amount of data in data center locations, public cloud providers, CSP edge platforms, SaaS offerings, and containerized applications.
• Evaluate best-of-breed backup solutions compared to hardened integrated backup appliances that deliver backup software, immutable backup storage, integrated security, and ransomware detection and remediation to select the solution that best meets business needs.

What You Need to Know
Protecting and recovering application data, regardless of the underlying infrastructure type and location, is critical for I&O leaders. This requirement continues to evolve as new application types, new locations and new threats emerge. To help clients understand the suitability of different backup platforms, this research evaluates vendors based on 7 use cases: on-premises, on-premises with SaaS, hybrid and multicloud, hybrid and multicloud with SaaS, data services, DR, and ransomware recovery.

It assesses the ability of 14 vendor products to address these use cases by evaluating each use case against 15 critical capabilities:

Data Center Integration

• Amazon Web Services (AWS) Integration
• Microsoft Azure Integration
• Google Cloud Platform (GCP) Integration

Other Public Cloud Integration

• Microsoft 365 Integration
• Salesforce Integration
• Other SaaS Integration

Management

• Platform Security
• Disaster Recovery & Orchestration
• Ransomware
• Indexing and Search
• Data Efficiency, Tiering and Life Cycle
• Sensitive Data Scanning
• Analysis

Critical Capabilities Use-Case Graphics

Vendors

Acronis Cyber Protect
It is an agent- or agentless-based backup solution with a focus on security. Acronis offers both private cloud infrastructure and Azure-based hosting where customers can store their backups, host their backup server or use it as disaster recovery location.

Cyber Protect’s differentiator is the integrated delivery of backup and other services, such as email security, endpoint security, server security, malware and ransomware protection, and system and patch management, in a single agent. In addition, the WW availability of firm’s data centers providing backup storage and DR services is a differentiator. The company is a good fit for smaller organizations that either do not have all these capabilities or want to rationalize their portfolio of backup and security products. Acronis is ideally suited for endpoint solutions, remote offices or other edge locations.

Customers evaluating this vendor should be aware of weaknesses, including limitations in its agentless backup for VMware and Hyper-V that does not support any cybersecurity or system management capabilities. The company also lacks advanced NAS integration and only provides agent-based IaaS protection for Microsoft Azure and Amazon Web Services (AWS). In addition, its direct-to-storage architecture complicates management due to its management overhead and lack of support for advanced storage management distribution and/or backup job load-balancing. The firm also lacks support for backup direct-to-public cloud object storage and backup de-dupe unless using Acronis Cloud Storage as a target.

Cyber Protect performs its best in the on-premises and ransomware detection, protection and recovery use cases, but performance is fair in all other use cases.

Arcserve UDP
It is a scale-up backup and recovery platform available as software or on various appliances available from Arcserve. Although the primary focus is a traditional data center, it can be deployed in public clouds, but it has limited support for IaaS and PaaS applications. Backup of Microsoft 365 is available with its BaaS offering, Arcserve SaaS Backup. It also supports additional SaaS applications – including Microsoft Dynamics 365 (CRM), Salesforce and Azure Active Directory (AD).

UDP’s key strengths are broad on-premises workload support. This includes agentless backup of several hypervisor platforms, built-in malware detection from Sophos, and protection of backups vs. ransomware through immutable storage on Arcserve OneXafe or other S3-compliant storage systems with object lock capabilities. SaaS application coverage is comprehensive with Arcserve SaaS Backup.

Customers evaluating UDP should be aware of weaknesses, including poor support for IaaS and PaaS workloads in Google Cloud Platform (GCP) and Azure public cloud. Other weaknesses include a lack of anomaly detection to warn of active cyberattacks and a lack of support for most modern workloads built on container platforms.

UDP performs best in the on-premises and on-premises and SaaS use cases, but performance is fair in all other use cases.

Cohesity DataProtect
It is a scale-out backup and recovery platform available as software deployed on qualified hardware from firm’s partners, company’s own white-box appliances or a virtual appliance. DataProtect can also be deployed using IaaS in cloud environments such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP), and also offers a BaaS solution hosted in AWS. Cohesity Helios provides centralized management of multiple Cohesity deployments in the data center, edge and public cloud.

DataProtect’s strengths include a high-performance scale-out immutable storage platform, near instant recovery of many workloads, comprehensive database coverage, an app store for 3rd-party applications leveraging the backup repository, NAS capabilities, and an API-driven platform with prebuilt integrations to multiple 3rd-party solutions and allowing customizations. DataProtect includes ransomware and ML-based anomaly detection and has improved sensitive data analysis and malware detection capabilities that are integrated with their DataHawk and FortKnox managed data vault solution.

Customers evaluating DataProtect should be aware of weaknesses, including limited support for Salesforce and both on-premises and cloud container backup, and no support for Azure AD.

DataProtect has excellent performance in on-premises, hybrid/multicloud, DR, data services and ransomware detection, protection and recovery use cases, and performance is good in all other use cases.

Commvault Backup & Recovery
It is a scalable enterprise data protection solution based on a 3-tier backup architecture of backup agents, media servers and a management server. The product can be purchased as stand-alone software for installation on the customer’s own infrastructure or as an appliance from Commvault’s HyperScale X family.

Firm’s key differentiators include support for a range of workloads hosted on-premises or in public cloud, including Azure, AWS, GCP and Oracle OCI, plus extensive support for major SaaS applications. In addition, the company complements traditional deployments with a fully integrated BaaS service; Commvault Metallic gives customers the ability to mix and match traditional and BaaS deployments. It also features file and object archiving as well as ThreatWise SaaS-delivered early warning ransomware detection.

Customers evaluating Backup & Recovery should be aware of weaknesses, including complex management, limited automation of recovery from large-scale ransomware attacks, and the need for care in the design of non-appliance deployments to ensure the selected storage system provides satisfactory protection of backup storage and data.

Backup & Recovery has excellent performance in all use cases.

Dell PowerProtect Data Manager
It is an enterprise data center backup and recovery product that addresses a range of use cases, including physical server, VMs, databases and NAS backup. It is available as a stand-alone version packaged as a VM paired with PowerProtect DD physical and virtual storage appliances, or as a fully integrated backup appliance. It also supports snapshot-based backup of public cloud instances in AWS, GCP and Microsoft Azure through PowerProtect Cloud Snapshot Manager. Backup for SaaS applications (Microsoft 365, Google Workspace and Salesforce) is supported through Dell APEX Backup Services.

PowerProtect Data Manager’s key differentiators include its Transparent Snapshot feature that eliminates use of VM proxies and mitigates VM stun, and its tight integration with PowerProtect DD appliances. This includes support for Smart Scale for PowerProtect appliances to simplify administration and scale when integrated with multiple PowerProtect DD appliances. Other strengths include crash- and application-consistent backup of on-premises and cloud-based Kubernetes environments, including OpenShift and VMware Tanzu, as well as public cloud-based distributions, including Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS) and Google Kubernetes Engine (GKE).

Customers evaluating PowerProtect Data Manager should be aware of weaknesses in areas such as its lack of centralized SaaS-based control plane management and support for Microsoft Active Directory and Azure Active Directory. Customers should also consider that the product has limited integrations with snapshot capabilities of 3rd-party storage arrays.

PowerProtect Data Manager has excellent performance in the hybrid/multicloud use case and has good performance in all other use cases.

Druva Data Resiliency Cloud
It is a BaaS platform hosted in AWS that delivers backup and DRaaS for on-premises, SaaS applications and AWS cloud environments. Backup data is globally de-duped across all workloads and storage tiers, thus reducing storage costs.

Firm’s key differentiator is its BaaS delivery model that creates a robust, easy-to-manage and cost-effective backup system. Other highlights include rich metadata indexing to deliver powerful search, analytics, storage optimization and anomaly detection. The product also offers unified management of on-premises, cloud workloads and endpoints, as well as support for Microsoft 365, Salesforce, Google Workspace, SAP HANA and Azure Stack HCI.

Customers evaluating Data Resiliency Cloud should be aware of limitations such as no support for backup of non-x86 workloads, noncloud NoSQL databases and containerized applications. Also, backup of workloads in Microsoft Azure and Google Cloud Platform requires an agent installed in each VM.

Data Resiliency Cloud has good performance in all use cases except hybrid/multicloud where performance is fair.

HYCU Protégé
It is a hybrid, multicloud distributed BaaS control-plane platform supporting virtual, physical, IaaS, SaaS and some PaaS workloads hosted on VMware, Nutanix AHV, AWS, Azure and GCP. It can store backup data on-premises or in AWS, Azure, GCP or other S3-compatible targets where storage is billed directly by the cloud provider as it is not part of the BaaS offering.

Its key differentiator is its ease of use for multicloud distributed data and its control plane BaaS delivery model supporting backup and disaster recovery between clouds for all three public cloud providers. Its architecture allows customers to choose their own backup storage, including on-premises or cloud targets. DBaaS and PaaS support is improved with additions such as GKE, Google BigQuery and Google CloudSQL. The company also offers a distinct backup strategy to support multiple SaaS applications through its R-Cloud initiative. This includes support for Microsoft 365, Amazon RDS, Salesforce, Jira Software, Jira Service Management, Confluence, Okta and Google Workspace.

Customers evaluating Protégé should be aware of limitations such as limited support for on-premises enterprise capabilities. It can improve support for Microsoft HyperV, non-x86 workloads, Oracle RAC and edge appliances like Azure Stack, AWS Outpost or Google Anthos. Support for containerized applications is also lacking for on-premises, Azure and AWS cloud environments. In addition, the company can also expand on supporting more PaaS services as it is lacking support for Azure SQL or Azure AD.

Protégé has good performance for all use cases except ransomware detection, protection and recovery where performance is fair.

IBM Storage Protect Plus (SPP)
It provides data protection for workloads such as VMs, containers, and relational and NoSQL databases. The product is complemented by firm’s Storage Protect for Cloud which includes support for AWS EC2 and VMware Cloud on AWS, Red Hat OpenShift, Microsoft 365, Salesforce, Microsoft Azure AD, and Microsoft Azure VMs, Files, and Blobs. Additionally, it focuses on traditional data center infrastructure, offering agent-based protection of physical and non-x86 systems, filesystems, applications and VMs. SPP implementation includes a centralized backup management server, one or more vSnap servers for backup storage and a vStorage API for Data Protection (VADP) proxy that performs data movement for VMware environments. The SPP servers can be physical or virtual and support IBM, Microsoft Azure and AWS public clouds.

SPP differentiation lies in ease of use, simple deployment and management, and strong support for backup of containerized applications in Red Hat OpenShift and Kubernetes environments. Immutable storage for protection against ransomware is provided via the vSnap storage servers. SPP has also introduced support for SAP HANA and SAP on Oracle.

Customers evaluating the product should be aware of limitations such as limited support for cloud database as a service (DBaaS). Also, recovery of on-premises VMs to and from leading public cloud providers, such as AWS, Microsoft Azure or GCP requires API integrations.

SPP has good performance in the on-premises and SaaS, hybrid/multicloud and SaaS, and ransomware detection, protection and recovery use cases. Performance is fair in all other use cases.

Microsoft Azure Backup
It is a hybrid cloud BaaS solution supporting on-premises and Azure workloads. Hosted on Microsoft Azure, it supports on-premises servers, Azure VMs, SQL in an Azure VM, SAP HANA in an Azure VM, Azure Files, Azure PostgreSQL, Azure Blobs and Azure disks. Backups have different resilient options, as the product supports local redundant storage (LRS), zone redundant storage (ZRS) and geo-redundant storage (GRS). In addition, backups can be made immutable as Azure supports an immutable backup vault and a soft delete function to protect backups against ransomware attacks.

Azure Backup’s main differentiator is its integration with the Microsoft ecosystem. In addition, it provides a cost-effective backup solution that supports customers of all sizes.

Customers evaluating Azure Backup should be aware of limitations in application support, such as no support for Azure Managed Services like Azure SQL or Microsoft 365 solutions. The product does not protect applications or data in AWS, GCP or other public clouds. In addition, the company does not check backups for malware or provide any integrated detection and response capabilities for its backups as it still depends on Microsoft Defender to scan the host. For DR, the firm depends on Azure Site Recovery which is an independent solution from Azure Backup without integration.

Azure Backup performs its best in the DR and ransomware detection, protection and recovery use cases, but performance is fair in the on-premises and on-premises and SaaS use cases, with poor performance in all other use cases.

OpenText Data Protector
Data Protector, acquired in early 2023 as part of OpenText’s acquisition of Micro Focus, is a software-based solution that protects a variety of traditional data center workloads. The product is a part of the firm’s portfolio of products that offer a range of security and data protection offerings.

Its main strength is in its overall coverage of traditional data center environments; ability to integrate with snapshot capabilities of major storage arrays and broad support for a variety of backup targets, including purpose-built de-dupe appliances, tapes and object storage systems.

Customers evaluating Data Protector should be aware of limitations such as the separate Data Protector for Cloud required to protect cloud IaaS, PaaS and SaaS workloads, and the limited integration between it and Data Protector. In addition, lack of support for DR features such as continuous data protection (CDP) replication, run book automation and restore to cloud capabilities should be considered.

Data Protector has good performance in the on-premises and hybrid/multicloud use cases, but performance is fair in all other use cases.

Rubrik Security Cloud
It is a scale-out backup and recovery platform available as software deployed on qualified hardware from firm’s partners or as a white-box appliance. It can also be deployed using IaaS in cloud environments such as AWS, Azure and GCP, and also offers a BaaS solution for Microsoft 365. In addition to Security Cloud, there are several additional components that provide ransomware assessment, recovery, governance and compliance capabilities.

Security Cloud’s key differentiator is its unified platform providing protection of data across on-premises, cloud and SaaS. It includes strong protection of backup data vs. ransomware and malware, isolated recovery and testing, quarantine to prevent reinfection, rapid recovery that comes from an immutable scale-out storage system, and an API-driven platform for easy integration and customization. Partner integrations include Microsoft Sentinel, Splunk and Palo Alto XSOAR.

Customers evaluating Security Cloud should be aware of limited native cloud support within AWS and GCP compared to Azure, and limitations for SaaS application backup. Although most M365 functions are supported, there is still a lack of support for SaaS applications, such as Salesforce, and Azure Active Directory.

Security Cloud has excellent performance in the on-premises and ransomware detection, protection and recovery use cases, and has good performance in all other use cases.

Unitrends Backup Software
This scale-up backup platform can be deployed as software on customer-provided hardware or as an appliance. It is complemented by add-ons such as Unitrends UniView for centralized management of multiple appliances, Unitrends Forever Cloud for long-term retention, and Spanning for SaaS backup and recovery.

Unitrends’ highlights are its global job monitoring and policy management via UniView and its support for DR orchestration. DR orchestration includes support for VMware and Hyper-V recovery operations from the data center to Unitrends Cloud, AWS or Azure environments. Unitrends also supports a wide array of enterprise databases.

Customers evaluating the software should be aware of limitations such as limited support for multicloud workloads, and no support for backup of containerized applications.

The product has good performance in the on-premises and the on-premises and SaaS use cases, but performance is fair in all other use cases.

Veeam Backup & Replication
It provides data protection for hybrid and multicloud environments (IaaS, SaaS and PaaS). Containerized applications are supported via the Kasten product. Additional monitoring and alerting capabilities are supported through the Veeam ONE platform, which is offered as an add-on product.

Firm’s differentiators include support for all 3 major public cloud providers, a range of OSs and hypervisors, integration with an extensive list of primary and secondary storage vendors, and native tape integration. In addition, the company offers comprehensive and flexible any-to-any restore capabilities, whether on or to the public cloud or for on-premises. It also offers comprehensive backup capabilities for Microsoft 365, Salesforce and extensive support deployment in the customer’s infrastructure or as a service from firm’s MSP partners with global availability.

Customers evaluating Backup & Replication should be aware of some limitations. The software-only approach places responsibility on the customer for selection of compute, backup storage and security components and hardening of security across the entire stack. Veeam does not offer BaaS, SaaS, SaaS management, Veeam-native storage or appliances and offers no security solutions such as advanced anomaly detection, malware detection or secure managed storage vaults, as it depends on third-party vendors to offer this.

Backup & Replication has excellent performance for the on-premises and hybrid/multicloud use cases and has good performance for all other use cases.

Veritas NetBackup
It is available as software-only in addition to scale-up and scale-out appliance-based offerings. The platform uses a scalable, 3-tier architecture of agents, media servers and primary server components. Additional backup monitoring, reporting and analytics capabilities are offered through NetBackup IT Analytics. Backup-as-a-service offerings include Veritas Alta Backup-as-a-Service for on-premises and IaaS and PaaS workloads, and Alta SaaS Protection protects multiple SaaS applications. Veritas Alta View adds a SaaS-based control plane to globally administer and orchestrate management of NetBackup installations. Alta Recovery Vault provides securely air-gapped, hosted, off-site backup storage to a customer’s choice from multiple clouds supported by the company, including Azure and AWS.

Key differentiators for NetBackup include support for a range of applications, legacy and modern OSs, hypervisors, containers, cloud IaaS, PaaS and SaaS, cloud and on-premises object storage, tape libraries, 3rd-party de-dupe appliances, and a revamped containerized architecture to ensure scalability and a more efficient cloud-native deployment model. NetBackup is supported across a wide geography, enabling clients to easily manage global deployments.

Customers evaluating NetBackup should be aware of limitations, including limited support for DR of complex Microsoft Active Directory deployments and no support for Microsoft Dynamics 365. Customers should also take care in how they design and implement nonappliance deployments to ensure the selected storage system provides satisfactory protection of backup storage and data.

NetBackup has excellent performance in all use cases.

Vendors added: Microsoft

Vendor dropped: Zerto