New
What does your ransomware recovery plan look like after the last round of tests?
Immutable backups, isolated recovery environments, recovery-time testing. What did your last exercise reveal?
Evaluation guide
How to evaluate storage and data protection
This guide is for infrastructure, storage and backup leads refreshing primary storage, replacing a backup platform or strengthening ransomware recovery. It assumes recovery has become a board question and you need evidence that you can get data back, not only that you are keeping copies.
In short
Use this guide to compare storage and data protection vendors on what decides the outcome: proven recovery times, protection of backups from attackers, clean recovery, performance on your workloads, cost per usable terabyte over the contract and the cost of leaving. Then shortlist three to five companies on Techarda and time a real restore with each finalist.
What’s changing in Storage & Data Protection
Before you compare anyone, it helps to know what has shifted in the market, because it changes which questions matter.
Attackers go after backups first
Ransomware operators routinely try to delete or encrypt backups before they encrypt production. Immutable copies, isolated recovery environments and separate admin credentials have become baseline requirements.
Recovery is measured, not assumed
Boards and regulators now ask how long recovery takes, not whether backups exist. In the EU, the Digital Operational Resilience Act requires financial entities to test how they recover, and in Australia APRA's CPS 230 asks regulated entities to set tolerance levels for disruption to critical operations.
Storage is sold as a service
Vendors offer consumption models for on-premises storage, with capacity paid for as used and hardware refreshed by the vendor. Terms vary widely on minimums, growth buffers and exit.
AI workloads need different storage
Training and inference need fast parallel access to large data sets and governed access for the teams using them. That has brought newer file and object platforms into decisions alongside traditional arrays.
What to judge vendors on
Those shifts shape the criteria below. Each one says why it matters and what to ask, so you can take it straight into a vendor call.
| Criterion | Why it matters | What to ask vendors |
|---|---|---|
| 1Proven recovery times | A backup you cannot restore in time is not a recovery plan. Restores at scale are often much slower than backups. | “Can we restore a full production system of our size during the trial and time it from the decision to a running application?” |
| 2Protection of backups from attackers | If an attacker with admin credentials can delete your backups, you do not have backups. | “How are backups made immutable, what stops an admin account from deleting them or shortening retention, and are management credentials separate from production?” |
| 3Clean recovery | Restoring infected data puts you back where you started. You need to know which copy is clean. | “How do you help us find the last clean copy, scan restored data and recover into an isolated environment before we reconnect?” |
| 4Performance on your workloads | Vendor figures use ideal block sizes and data patterns. Databases, virtual machines and AI pipelines behave differently. | “Will you test with our own workload profiles, including during a rebuild after a drive or node failure, and share the results?” |
| 5Cost per usable terabyte over the term | Raw capacity, data reduction assumptions, support and growth pricing make headline prices hard to compare. | “What usable capacity will you guarantee without data reduction assumptions, and what will we pay per usable terabyte in each year of the contract, including support?” |
| 6Data mobility and exit | Proprietary formats and backup catalogues can turn leaving a vendor into a project of its own. | “How would we move our data and backup history to another platform, can old backups be restored without your software, and what would it cost?” |
| 7Cloud and SaaS coverage | Data now lives in cloud services and SaaS applications as well as your data centre. Each needs protection and each has its own limits. | “Which cloud and SaaS services do you protect natively, at what level of detail, and where are those backup copies stored?” |
| 8Help during an incident | During a ransomware event you need experienced help quickly, and you may have lost access to your usual systems. | “What recovery help do you provide during an incident, how fast can it start, and is it included or charged separately?” |
Trade-offs to settle early
No vendor does well on every criterion, and some pull against each other. Decide where you stand on these before the demos start, or the demos will decide for you.
One vendor for storage and backup or two
One vendor for primary storage and backup can mean faster snapshots and recovery. Keeping them separate makes it less likely that one compromise or failure affects both.
Consumption model or owned capacity
Storage as a service moves capital spend to operating spend and puts refreshes on the vendor. Owned capacity is often cheaper at steady growth and leaves you freer at the end of the term.
Local copies or cloud copies
Local copies restore fastest. Cloud copies give distance and isolation, and restoring large amounts of data from them takes time and can incur charges.
Isolation or restore speed
The more isolated a copy is, the safer it is and the slower it is to restore. Most teams keep several tiers and decide which systems get which.
Data reduction or predictable capacity
Compression and deduplication stretch capacity, and results depend on your data. Contract on guaranteed usable capacity, not on the ratio in the brochure.
Red flags
As the answers come back, watch for these. One on its own isn’t a deal breaker, but it deserves a follow-up question in writing.
- Recovery claims based on backup speed or on restoring a single file.
- Immutability that an admin account can switch off or shorten.
- No reference customer who has recovered from a real incident on the platform and will talk about it.
- Backup formats that cannot be read without a current licence.
- Ransomware guarantees with conditions that would be hard to meet in a real incident.
- As-a-service contracts with high minimum commitments or unclear exit terms.
Build your shortlist
Start with your recovery targets, then use Techarda to narrow the field to three to five companies that can show they meet them.
- List your critical systems with the recovery time and recovery point each one needs, and where their data lives.
- Keep companies that protect all of those locations today, including cloud and SaaS services.
- Compare like with like: primary storage against primary storage, backup and recovery against backup and recovery.
- Read recent stories on Techarda for acquisitions, security incidents and product retirements, and plan questions around them.
- Run a timed restore of a real system with each finalist, then check the practitioner questions below and compare side by side.
Companies to consider in Storage & Data Protection
Listed by recent activity on Techarda (what people are reading, following and discussing). The order says nothing about quality, market share or fit for your needs.
Latest Storage & Data Protection stories
Once you have names, recent news is where pricing changes, acquisitions and outages show up first. These are the five newest stories in this category.
What practitioners are asking
News tells you what vendors announced. These open questions show what teams are still trying to work out, with the least-answered first.
Where evidence is thin
A shortlist is only as good as the evidence behind it, and ours is still growing category by category. Here is what’s missing in Storage & Data Protection right now.
20 of 20 companies have no published reviews
If you’ve run one of these in production, a short review helps the next team decide. Reviews are moderated before they appear.
1 question with no answers yet
An answer from someone who has made the same decision is often more useful than any guide. Share what worked, what didn’t and what you’d check next time.
Answer a Storage & Data Protection questionFrequently asked questions
What should I ask Storage & Data Protection vendors about proven recovery times?
A backup you cannot restore in time is not a recovery plan. Restores at scale are often much slower than backups. Ask: Can we restore a full production system of our size during the trial and time it from the decision to a running application?
What should I ask Storage & Data Protection vendors about protection of backups from attackers?
If an attacker with admin credentials can delete your backups, you do not have backups. Ask: How are backups made immutable, what stops an admin account from deleting them or shortening retention, and are management credentials separate from production?
What should I ask Storage & Data Protection vendors about cost per usable terabyte over the term?
Raw capacity, data reduction assumptions, support and growth pricing make headline prices hard to compare. Ask: What usable capacity will you guarantee without data reduction assumptions, and what will we pay per usable terabyte in each year of the contract, including support?
What should I ask Storage & Data Protection vendors about data mobility and exit?
Proprietary formats and backup catalogues can turn leaving a vendor into a project of its own. Ask: How would we move our data and backup history to another platform, can old backups be restored without your software, and what would it cost?
New to some of the terms in this guide? The glossary explains Immutable backup, Isolated recovery environment, Object storage and RPO and RTO.
This guide is written by Techarda editors to our editorial standards. No vendor paid to appear in it or saw it before publication. See our methodology, the trust dashboard or go back to the Storage & Data Protection hub.