Rubrik vs Cohesity when the restore has to be clean

14 hours after the volumes encrypt, production will not mount. The newest snapshot may be the encrypted one, and the restore owner has two consoles that can each name a different point as clean.

That failure is backup and recovery. An endpoint agent that stops the encrypting process is a different purchase, and a detection console is another one. The decision here is which immutable copy you still have, and whether that copy is allowed back into production.

Main buying criteria first: which workloads each platform protects, how a clean point is validated, what orchestration runs on restore day, and how recovery scales. The isolated vault is a separate line after that.

Rubrik Enterprise Edition includes data protection for VMs, databases, and more, plus anomaly detection, turbo threat hunting, orchestrated application recovery, and mass recovery on the Enterprise page checked 3 Oct 2026. Cloud Vault stays a separate unit. Cohesity DataProtect lists virtual, database, cloud, application, NAS, and AI/vector workloads on its product page the same day. FortKnox clean-room recovery is generally available on the 22 September 2026 FortKnox post for SaaS and self-managed, and Cyber Vaulting remains an add-on rather than the DataProtect service price.

	Rubrik	Cohesity
Primary use case	Protect enterprise, cloud, and SaaS workloads on Rubrik Security Cloud Enterprise Edition, validate a clean snapshot, and orchestrate application recovery, with optional Cloud Vault	Protect listed DataProtect workloads, vault with FortKnox, validate in a clean room, then restore to production
Where the isolated copy sits	Rubrik Cloud Vault: a Rubrik-managed, air-gapped copy, bought separately from the Enterprise subscription	FortKnox: a Cohesity-managed vault for DataProtect or NetBackup, or a self-managed vault. Cyber Vaulting is an add-on
Recovery validation and orchestration	Anomaly detection and turbo threat hunting to point at an uninfected snapshot, then orchestrated application recovery and mass recovery on the Enterprise Edition page	FortKnox sequence replicate, scan, lock, recover; clean-room recovery GA for SaaS and self-managed on the 22 September 2026 post, with quorum for critical actions
Day-to-day workflow	SLA policies for backup, retention lock where the warranty requires it, and a separate decision to archive into Cloud Vault	Protection on DataProtect or NetBackup, vaulting into FortKnox, quorum for critical recovery actions, then the clean room
License/pricing	Enterprise Edition subscription with no public per-terabyte software price. Cloud Vault is a separate unit. Warranty caps are separate. See Editions	Core or Enterprise subscription with no public software unit price. Cyber Vaulting is an add-on with no public dollar. A DataProtect as-a-service listing is a different SKU. See Editions
Who operates it	Backup owners run recovery. A Customer Resilience Manager is required only if you want the ransomware recovery warranty	Backup owners run DataProtect or NetBackup. FortKnox recovery actions can require a quorum, so a second approver is part of the restore

We reviewed Rubrik’s Enterprise Edition page, the ransomware recovery warranty agreement updated 15 May 2026, the Cloud Vault on AWS announcement, the AWS Marketplace listing for Rubrik Cloud Vault, Cohesity’s DataProtect product page, Data Cloud packaging page, FortKnox product page, FortKnox clean-room post dated 22 September 2026, Cohesity’s combination announcement, the AWS Marketplace listing for Cohesity DataProtect delivered as a service, and one July 2026 comment that names both products, all on 3 Oct 2026. We did not install either product, so this is not a hands-on benchmark. Cohesity’s edition marks did not come through as text, and Rubrik’s licensing data sheet did not open, so this comparison does not assign Business Edition features or map each Cohesity bullet to Core versus Enterprise.

Rubrik

Cohesity

Rubrik is still sold as Rubrik. It has traded as Rubrik, Inc. (NYSE: RBRK) since the April 2024 IPO, and the Form 10-Q for the quarter ended 31 July 2026 still presents Rubrik as the operating company. No closed acquisition of Rubrik turned up on those sources on 3 Oct 2026. Cohesity remains the purchasable name. On 10 December 2024 it completed its combination with Veritas’ enterprise data protection business. That release names Veritas NetBackup, NetBackup appliances, and Veritas Alta data protection as products the combination covers. NetBackup on a current quote is a Cohesity product, not a second company.

Editions and pricing

Neither vendor posts a per-terabyte software price for the full backup subscription. Use the two Marketplace rows as 12-month signals with the scope limits beside them. Everything else on this table is quote-required.

	Rubrik	Cohesity
How you buy it now	Enterprise Edition is a 3-year subscription that includes software and support, plus new features during the term. The ransomware recovery warranty is not automatic. It has to be approved and written onto the quote, and it requires a concurrent Customer Resilience Manager	Core Edition for data protection and ransomware remediation, or Enterprise Edition for rapid response in a serious incident. Terms are 1, 3, or 5 years and include premium support. Cyber Vaulting, replication, Data Insights, and Platinum Service are add-ons
Public units (3 Oct 2026)	Enterprise Edition software: no public per-terabyte dollar on the pages checked. Isolated-recovery add-on signal: AWS Marketplace, sold by Rubrik Inc., 50,000 USD per 12 months for one unit of Rubrik Cloud Vault on AWS. That unit is Cloud Vault, not the Enterprise backup subscription, and the public row does not define terabytes	Base backup-as-a-service signal: AWS Marketplace, sold by Cohesity, Inc., 29,100 USD per 12 months for 10 back-end TB of Cohesity DataProtect delivered as a service, premium support included, minimum 10 back-end TB, 30-day retention default. A back-end TB is stored backup after dedupe and compression. That listing is not FortKnox and is not the Cyber Vaulting add-on price. Cyber Vaulting had no public dollar on the packaging page
Warranty, not a subscription price	Agreement updated 15 May 2026. Eligible volume is at least 250 TB of a specific Rubrik Security Cloud Enterprise Edition SKU, plus the Customer Resilience Manager. If Rubrik determines the product failed to restore protected data, it reimburses approved third-party recovery expenses up to a cap, not lost revenue. Caps at the time of the incident: 250 TB to under 500 TB, $250,000; 500 TB to under 750 TB, $500,000; 750 TB to under 5 PB, $1,000,000; 5 PB to under 10 PB, $5,000,000; 10 PB and above, $10,000,000. The agreement says this is not insurance	No equivalent public recovery-warranty schedule on the pages checked. Cohesity CERT, the cyber event response team, is named on the packaging page. It is not a published dollar cap
Main buying consideration	Does Enterprise Edition cover the workloads and orchestration you need, with Cloud Vault priced as its own 12-month unit only if the isolated copy is required, and warranty only when written on the quote?	Does DataProtect cover the workloads you need on Core or Enterprise, with FortKnox / Cyber Vaulting as a separate add-on rather than the 29,100 USD DataProtect service block?

Cohesity’s packaging page does list Cyber Vaulting as an add-on, separate from the Core and Enterprise lines. The same page does not show, as text, which recovery bullets sit in Core and which sit in Enterprise. Rubrik’s Enterprise page puts orchestrated application recovery inside that subscription, while Cloud Vault remains its own service. The comment ranks one product as more advanced. Neither product page publishes a shared test of that ranking.

Workload coverage, validation, orchestration, scale

	Rubrik	Cohesity
Workload coverage	Enterprise Edition page checked 3 Oct 2026: data protection for VMs, databases, and more, and a feature list that includes Enterprise, Cloud, and SaaS Data Protection. A single enumerated hypervisor and SaaS inventory was not on that Enterprise page	DataProtect product page checked 3 Oct 2026 lists virtual (VMware vSphere, Nutanix, Microsoft Hyper-V, RHOV), databases (Oracle, Microsoft SQL Server, MongoDB, Cassandra), cloud (AWS, GCP, Azure, OCI), applications (Microsoft 365, Microsoft Exchange, Salesforce), storage/NAS (Pure Storage, NetApp, Hewlett Packard Enterprise, Isilon), and AI/vector (Google Vertex AI, Pinecone)
Recovery validation	Anomaly detection analyzes backup data for ransomware-like change. Turbo threat hunting scans backups to pinpoint clean, uninfected snapshots during recovery. Those are Enterprise Edition features on the page opened	FortKnox product workflow is replicate, scan, lock, then recover. 22 September 2026: clean room recovery is generally available for FortKnox SaaS and self-managed, so vaulted snapshots and Digital Jump Bag assets can be validated in an isolated clean room before production
Orchestration	Orchestrated application recovery restores applications after an attack, failure, or disaster. Mass recovery is named on the Enterprise Edition comparison list. File-level quarantine while restoring the rest of a snapshot was not confirmed on the public pages opened	Clean-room recovery extends FortKnox so investigation and validation happen before production restore. Quorum-based approval stops one user from taking critical recovery actions alone. Self-managed air-gap windows are set from the paired clusters page
Scale	Mass recovery is a named Enterprise Edition capability. No public simultaneous-VM count was on the Enterprise page opened 3 Oct 2026	DataProtect page claims instant mass restore for VMs, files, and application objects, and states recover 1000 VMs instantly as a business outcome. Treat that as a vendor page claim, not a measured bake-off on this comparison
Main buying consideration	Do the workloads you must protect sit on Enterprise Edition, and is clean-point validation plus orchestrated recovery enough before you add Cloud Vault?	Do the workloads you must protect sit on the DataProtect list, and is FortKnox clean-room validation the restore path you will staff?

Workload fit and validation come before the vault SKU. Cloud Vault and Cyber Vaulting stay separate from the base backup subscription prices in Editions.

Where the isolated copy lives

	Rubrik	Cohesity
What stays immutable	Rubrik’s ransomware recovery page says backups cannot be encrypted or deleted by an attack, because the file system was built immutable. Retention Lock on Cloud Vault is the control that stops a policy change from expiring copies early	FortKnox keeps an isolated immutable copy, with retention locks named on the product page. Self-managed vault retention can be set shorter or longer than the primary backup
How it is separated	3 April 2025: Cloud Vault on AWS stores on-premises and AWS backups in an air-gapped tenant, separate from the primary environment, using write-once storage. Rubrik operates the vault	FortKnox copies data into a vault isolated from production networks. The managed service runs on AWS, Azure, or GCP for DataProtect or NetBackup. A self-managed vault is the other deployment. Outside the vaulting window, self-managed recovery or replication on the vault interface group is not permitted
What you should not assume	A primary cluster backup is not the same object as Cloud Vault. The $50,000 unit above is the vault listing, not proof that every Enterprise subscription includes an air-gapped copy	DataProtect delivered as a service is not the vault. FortKnox is the Cyber Vaulting add-on, or the managed and self-managed deployments on the FortKnox page. Buying the 10 TB service block does not put a clean-room copy on the invoice
Main buying consideration	Is the copy that must survive a compromised backup admin in Cloud Vault, on its own unit, with Retention Lock?	Is that copy in FortKnox, managed or self-managed, and is Cyber Vaulting actually on the order?

What restore day is allowed to bring back

	Rubrik	Cohesity
How a clean point is chosen	Enterprise Edition includes anomaly detection and turbo threat hunting so a recovery can point at an uninfected snapshot, then orchestrated application recovery for the applications you bring back	FortKnox’s own sequence is replicate, scan, lock, then recover. Threat scanning is a step on that vault path, not a separate detection product on this comparison
Where the first restore lands	Orchestrated application recovery restores applications after an attack. A generally available clean-room product name was not found on the Rubrik Enterprise Edition page opened 3 Oct 2026	Vaulted snapshots and Digital Jump Bag assets land in the FortKnox clean room for investigation and validation before production, per the 22 September 2026 post already linked under coverage
Who can approve the restore	The warranty agreement requires multi-factor authentication and Retention Lock in compliance mode for covered data. A named quorum control for every restore was not on the public pages opened here	Quorum-based approval so one user cannot take critical recovery actions alone. On self-managed FortKnox, the air-gap window is set from the paired clusters page
What can block a bad object	Not confirmed at file level. Do not assume a quarantined file can be skipped while the rest of the snapshot restores. That behavior was not on the pages used here	The packaging page lists Threat Containment as isolate and block recovery of infected data. The edition that includes it was not readable as text, so treat it as a named capability whose SKU you still have to confirm
Main buying consideration	Is the hard step on restore day pointing Enterprise recovery at a clean snapshot, with Cloud Vault only if that unit was purchased?	Is the hard step getting a FortKnox copy into the clean room, with quorum, before anyone mounts it in production?

Choose Rubrik when Enterprise Edition covers the workloads you protect, validates a clean snapshot, and orchestrates application recovery, with Cloud Vault only as its own unit when the isolated copy is required. Choose Cohesity when DataProtect covers those workloads, FortKnox clean-room recovery is the validation path, and Cyber Vaulting stays an add-on rather than the DataProtect service price. NetBackup on a current Cohesity order stays a Cohesity product.