--- title: "7 of 18 backup tools cover servers, VMs and cloud; 3 of those leave the lock to you" summary: "Coverage, isolated copies and the one-console question across the 18 products in TechBag's backup guide and the 14 in its SaaS backup guide, as of September 2026." url: https://www.thetechbag.com/blog/blueprint-secure-cloud-adoption format: Note desk: "Cloud & DevOps" published: 2026-03-26 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["backup","hybrid cloud","immutability","SaaS backup","Veeam","Commvault","Acronis","DPDP"] cover: https://www.thetechbag.com/blog/covers/blueprint-secure-cloud-adoption.png --- # 7 of 18 backup tools cover servers, VMs and cloud; 3 of those leave the lock to you *Coverage, isolated copies and the one-console question across the 18 products in TechBag's backup guide and the 14 in its SaaS backup guide, as of September 2026.* Note · Cloud & DevOps · By TechBag · Published 2026-03-26 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/blueprint-secure-cloud-adoption Of the 18 backup products in TechBag’s Backup & Recovery guide, 7 document protecting physical servers, virtual machines and cloud workloads in one product. Of those 7, three, Veeam Data Platform, Commvault Cloud Backup & Recovery and NetBackup, leave the lock on the isolated copy to storage you configure; two enforce it on the vendor’s own storage and two in their own software.[1] The 2024 version of this piece asked for a cloud data-protection blueprint with broad coverage, isolated copies and a single console, and named no product that delivers it. This is the count behind that wish list, from the guide’s capability tags. ## Coverage: one product for the whole estate is the minority **Figure: Most backup products cover physical servers; only 7 of 18 cover servers, VMs and cloud together** *Backup products documenting protection for each environment, count of 18 products from 11 vendors, as of September 2026* Physical servers 13 products Virtual machines 10 products Cloud workloads 10 products Databases 9 products Endpoints 8 products NAS and file shares 7 products Containers 5 products Physical, virtual and cloud in one product N-able Cove, Veeam, Commvault, Cohesity DataProtect, NetBackup, Rubrik, Acronis Cloud 7 products | | Value (products) | | --- | --- | | Physical servers | 13 | | Virtual machines | 10 | | Cloud workloads | 10 | | Databases | 9 | | Endpoints | 8 | | NAS and file shares | 7 | | Containers | 5 | | Physical, virtual and cloud in one product | 7 | Source: TechBag Backup & Recovery guide, capability tags verified against vendor documentation · as of 30 September 2026 “Broad coverage” also has a SaaS half that none of the 18 carries in the same SKU. Five of the seven vendors with a full-estate product, Veeam, Commvault, Cohesity, Rubrik and Acronis, sell a separate Microsoft 365 or SaaS backup product in our SaaS Backup guide; N-able does not appear there.[2] So the single console is a licensing question: ask whether the SaaS product is managed from the same console as the server product, or merely sold by the same company. ## Isolated copies: who enforces the lock All 18 document immutable copies somewhere, but not in the same place. In 9 the vendor’s own storage enforces it, in 3 the backup software does, and in 6 it is enforced at a storage target you supply and configure, such as object storage with a retention lock or a hardened repository.[1] Our view Our view: “target” immutability is real, but it is your configuration, not the vendor’s promise. If the backup administrator’s credentials can shorten the retention, a ransomware operator holding those credentials can too. Ask who can lift the lock inside the retention period, and get the answer in writing. Where the isolated copy sits is the third question of the blueprint; [our note on DPDP Rule 6](https://www.thetechbag.com/blog/building-impregnable-enterprise-compliance-dlp-backup) counts which of the 18 document an Indian region for it. **Buying in India.** The full-estate products are priced in USD and by different meters, which makes a like-for-like quote hard: Commvault lists its cloud-delivered Backup & Recovery at US$58.50 to US$90 per TB a month, Acronis Cyber Protect Cloud is reported at about US$25 per workload a month through partners, and Veeam Data Platform at about US$250 to US$450 per workload a year, with storage priced apart in every case.[1] Bought through a reseller each arrives as an INR invoice with 18% GST. The regulation that names backups is the DPDP Rules, 2025: Rule 6(1)(d) asks for continued processing after a compromise “such as by way of data-backups”, a duty in force from 13 May 2027.[3] [4] CERT-In’s Directions of 28 April 2022 already require a ransomware incident to be reported within six hours, whatever the state of the restore.[5] How we did this Figures as of 30 September 2026 TechBag count of the product tables in the Backup & Recovery guide (18 products, 11 vendors) and the SaaS Backup guide (14 products, 11 vendors) as they stood on 30 September 2026; the tags were verified against vendor documentation on 22 August 2026. A product counts for an environment only where the vendor documents protecting it, and for an immutability pattern by where the vendor’s documentation says the lock is enforced. Prices are the guide’s published or reported figures, USD before tax; exchange rates and storage are excluded. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [TechBag, Backup & Recovery guide (coverage, immutability and price fields for 18 products)](https://www.thetechbag.com/browse/backup-cyber-resilience/backup-recovery) — verified 22 August 2026; version of 30 September 2026 2. [TechBag, SaaS Backup guide (14 products, 11 vendors)](https://www.thetechbag.com/browse/backup-cyber-resilience/saas-backup) — verified 22 August 2026; version of 30 September 2026 3. [MeitY, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Rule 6](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) — 13 November 2025 4. [DPDP Rules 2025, commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 5. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 Related on TechBag: the [backup and recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/backup-recovery) narrows the 18 by workload, and the [cyber recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) goes deeper on vaults and who can lift a lock. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Backup & recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/backup-recovery) — the 18 products narrowed by workload and immutability - [Cyber recovery guide](https://www.thetechbag.com/browse/backup-cyber-resilience/cyber-recovery) — vaults, clean rooms and who can lift a lock