Data Protection, Backup & Cyber Resilience
Backup and recovery spent two decades as unglamorous IT infrastructure — an insurance policy purchased reluctantly and priced accordingly. Ransomware changed the category's identity: when the dominant threat encrypts or destroys data, the ability to recover is a security control, and the vendors repositioned from "data protection" to cyber resilience. The rebrand was substantive enough to move valuations toward security multiples and to make the category a structural adjacency of the cybersecurity market.
The market and its players
The 2026 Gartner backup and data protection leaders' quadrant clusters four vendors — Veeam, Rubrik, Cohesity and Commvault — with Veeam slightly ahead (Blocks & Files, Jul 2026). Veeam took a reported ~$15B valuation in its December 2024 TPG-led round and is pushing into AI-era resilience positioning. Rubrik (NYSE: RBRK) is the re-rating case: it IPO'd as a cyber-resilience company rather than a backup company, attached threat monitoring, anomaly detection and data security posture to the backup estate, and is widely credited with making the category shift stick. Cohesity acquired Veritas's data-protection business (closed December 2024), combining the largest legacy installed base with a modern platform and taking the largest market share in the category. Commvault (NASDAQ: CVLT) attached cleanroom recovery and threat scanning to a durable enterprise base. Druva, HYCU, Keepit and Own (acquired by Salesforce) serve SaaS-data and cloud-native niches, while Datto anchors the MSP tier inside Kaseya (42b).
| Player | Status | Resilience positioning |
|---|---|---|
| Veeam | Private, ~$15B (Dec 2024, reported) | Largest modern installed base; AI-resilience push |
| Rubrik | Public (RBRK) | The re-rating proof: backup sold and valued as security |
| Cohesity (+Veritas) | Private, IPO candidate | Scale + legacy modernization; threat detection attach |
| Commvault | Public (CVLT) | Cleanroom recovery; steady enterprise incumbent |
| Druva / HYCU / Keepit | Private | SaaS-data protection specialists |
The convergence mechanics
Three forces pulled backup into security's orbit. The threat model: double-extortion ransomware attacks the backup estate first — deleting snapshots, encrypting repositories — so immutability, air-gapping and recovery-time guarantees became security requirements evaluated by CISOs, not just storage teams (15a). The data position: the backup vendor holds a complete, versioned copy of the enterprise's data — the natural place to scan for indicators of compromise, detect mass-encryption anomalies, and classify sensitive data, which is why resilience platforms now ship threat hunting and DSPM-adjacent features that compete directly with data-security vendors (03g). The budget migration: resilience spend increasingly comes from the security budget, and cyber-insurance underwriting (24) explicitly prices backup posture, closing the loop between the two markets.
The deal record runs both directions: security-relevant capability flowing into backup platforms (Rubrik's Laminar DSPM acquisition; Cohesity's threat-intelligence partnerships), and backup capability flowing into adjacent consolidators (NinjaOne–Dropsuite; Salesforce–Own). An IPO'd Rubrik trading as a security-adjacent growth asset, and a Cohesity IPO candidacy priced against it, keep the category's valuation benchmarks visible (12).
Updated 2026-08-16 18:47 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.