Backup and Data Protection Platforms (Gartner)

Gartner published the Magic Quadrant for Backup and Data Protection Platforms on 29 June 2026, and the six names on the Leader rung are the same six that were there a year earlier.

Veeam, Commvault, Rubrik, Cohesity, Druva and Dell Technologies. Veeam reports a tenth consecutive year as a Leader and the highest position for Ability to Execute for the seventh time in a row. Commvault reports a fifteenth consecutive year. Rubrik and Cohesity each report a seventh, Druva its second.

A stable roster in a fast-moving market is worth pausing on, because stability at the top is not the same thing as stability inside the box. Almost every placement moved in 2026, and most of the movement was in one direction.

The 2026 Magic Quadrant for Backup and Data Protection Platforms, and six names that did not move

The quadrant is authored by Michael Hoeck, Jason Donham, Rizvan Hussain and Sankalp Rastogi. The 2025 edition was published on 24 June 2025 and carried five of the same names plus Dell, which means the top rung has now held still for two consecutive editions in a market that has been through a decade of consolidation.

Inside that rung the picture is more restless. Veeam made one of the most significant rightward moves in the Leaders quadrant while holding the top position on execution. Druva moved both upward and to the right, which is the strongest combined move of the six. Rubrik continues to sit furthest for Completeness of Vision while shifting slightly down the execution axis. Commvault moved slightly downward despite what the vendors describe as positive business and market results. Dell sits in the Leaders quadrant at some distance from the leading group and also shifted slightly downward.

The honest summary is that two vendors separated from the pack on one axis or the other and four drifted. That happens in a mature evaluation, and it has a specific cause here: the criteria changed under the vendors while the field did not.

The category has been renamed twice in three years, and the second name fits better

Gartner's backup quadrant spent years titled for the data center, as the Magic Quadrant for Data Center Backup and Recovery Software Solutions. The 2025 edition renamed it to Backup and Data Protection Platforms, and the 2026 report keeps that name.

Gartner's own description of the change is the useful part. It calls the market an evolution of the former enterprise backup and recovery software solutions market, and frames the current category around platform-centric, AI-augmented and cyber-resilient architectures that span hybrid, multicloud and SaaS environments rather than around backup and restore.

Read that list again, because each item is a different purchase. Backup and restore is a durability question. Cyber resilience is a security question, and it assumes an adversary who is already inside the environment and knows where the copies are kept. Multicloud and SaaS span is an inventory question, and the inventory is no longer a set of servers in a room. A platform that answers the first question well and the other two badly is a product from the previous category wearing the current name.

The largest acquisition in this market moved the buyer left, not right

Cohesity completed its acquisition of Veritas NetBackup at the end of 2024, which was the largest consolidation event this market had seen in years. The 2026 quadrant moved Cohesity noticeably to the left, and the reported reason is the interesting part: greater portfolio breadth combined with ongoing integration challenges.

That is worth stating plainly because it runs against the assumption most buyers bring to consolidation. Buying a competitor's install base adds customers and code, and both of those are supposed to widen a product's claim on the market. What they also add is a migration path, a second architecture to maintain, two support organizations to merge, and a set of enterprise customers whose renewal decisions now depend on a transition nobody has finished. Cohesity remains a Leader for the seventh consecutive year, so this is a movement within the top rung rather than a fall out of it. But the quadrant's message is that breadth bought at the end of 2024 cost vision through 2026, and the bill arrived in the same evaluation that named the market for resilience.

For a buyer, the practical version is to ask any vendor that has acquired a platform in the last two years which product line is the strategic one, and to get the answer as a date rather than as a commitment.

The tail of the quadrant is where the roster actually changed

Below the Leaders, the 2026 field reads: Huawei as a Challenger; IBM and HYCU as Visionaries; Arcserve and OpenText as Niche Players. Unitrends, which held a place in the 2025 quadrant, is absent, and Arcserve occupies the position it vacated.

Two other absences are worth naming. Microsoft, which appeared as a Niche Player in earlier editions, has not been in the quadrant since 2025. And the number of vendors evaluated at all remains small for a market this large, which is a function of the inclusion thresholds rather than of the number of products on the market. A reader who wants the long tail of backup products will not find it in this document, and should not conclude that the tail is empty.

The tail matters more than it used to, for a structural reason. When the category was defined by data center backup, a midmarket product could be competitive on the strength of one good agent and a reliable repository. When the category is defined by cyber resilience and multicloud span, the same product has to detect an intrusion inside its own data, hold an immutable copy against an adversary with valid credentials, and cover SaaS applications it does not host. That is a research and development budget, and the vendors without one are being sorted out of the evaluation rather than down it.

Thirty-five percent agentic by 2029, from under two percent today

The report's planning assumptions, as reported by the vendors that published them, describe a market that expects to be rebuilt from the inside within four years.

By 2029, Gartner expects 95 percent of products in this category to have embedded cyberthreat detection, 90 percent to integrate generative AI, 80 percent of enterprises to prioritize SaaS backup, and 35 percent to use agentic AI for autonomous backup operations. That last figure is set against a current base of under 2 percent in 2025.

The 35 percent number is the one to hold onto, because it is not a feature forecast. A platform that detects an intrusion is still waiting for a human to decide what to do about it. A platform that runs backup operations autonomously is taking actions nobody requested, on data whose integrity is the entire point of the product. The interesting question in that version of the market is not whether the agent can restore faster than a person. It is who reviews the decision afterward, and what the audit trail looks like when the agent is the only witness.

The 80 percent SaaS figure has a nearer-term edge for buyers. If four out of five enterprises are expected to prioritize backing up their SaaS applications by 2029 and most are not doing it now, then a large share of corporate data currently sits in systems outside the protection of the platform that the same company already licenses.

Forrester dropped the word backup three years before Gartner dropped it

The cross-analyst counterpart on this site is Data Resilience Solutions, which covers Forrester's treatment of the same ground through a Q2 2022 Now Tech report mapping twenty providers, The Forrester Wave: Data Resilience Solution Suites, Q4 2022, scoring nine providers against forty criteria, and The Forrester Wave: Data Resilience Solutions, Q4 2024.

The naming history is the finding. Forrester was already publishing under data resilience in mid-2022, three years before Gartner renamed its quadrant in the 2025 edition. Both firms moved in the same direction and Forrester moved first, which is the normal pattern when a category is redefined by a threat rather than by a technology. The threat was ransomware operators who locate backup infrastructure before they encrypt anything, and the firm that was scoring immutability and recovery testing earliest was the firm that had least reason to keep the old word in the title.

The practical consequence for a buyer is that the two documents are not substitutes. Gartner's quadrant sorts vendors against each other and, since 30 June 2026, has a companion Critical Capabilities report that sorts them by use case instead. Forrester's Wave scores a wider definition of resilience against a longer criteria list. Neither one is a product review, and a shortlist drawn from one of them and checked against the other will disagree in places, which is useful rather than confusing.

What to ask before you buy backup in 2026

Ask what the platform does before it restores, not after. The defining capability of this category is now the ability to find an intrusion inside the backup data, because restoring an infected copy returns the attacker along with the data. Ask for the scan, the quarantine and the clean recovery point as three separate steps in the product rather than three items on a roadmap.

Ask where the immutable copy lives and which identity plane can delete it. Immutability that is administered by the same directory as production is a policy, not a control. The question is not whether the copy is immutable but who has the rights to end that condition.

Ask for a recovery time measured on your largest dataset, not on the vendor's reference environment. Restore benchmarks are produced on clean data with a known size and no adversary in the environment, and the number a buyer actually needs is the one from the last time somebody tried it under pressure.

Ask whether your SaaS applications are in scope, and get the answer as a list of applications rather than as a category. A platform that protects the servers and not the line-of-business SaaS estate protects the smaller half of most modern data.

Ask what the agentic roadmap implies for review. Autonomous backup operations are being sold as labor savings and they function as unlogged decisions until somebody builds the log. Ask what the platform records when it acts on its own.

Ask which document you are reading. The 2026 quadrant places vendors in a market; the Critical Capabilities report published the day after it ranks them per use case, and the vendor that sits mid-pack in the quadrant ranked first in five of six use cases there. Both documents are correct, and a buyer relying on one of them is reading half the evaluation.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

The infrastructure a restore lands on is graded separately at Server Virtualization Platforms. That evaluation decides which hypervisor an enterprise runs; this one decides whether the workloads on it can be rebuilt after an attacker has finished. The two questions meet at the point a recovery plan assumes a clean host pool, which is the assumption cyber recovery exists to test.

The retention policy that sits above all of this is scored at Data Governance Solutions. Governance decides what must be kept, for how long, and who may hold it; a data protection platform is where those decisions become enforceable, because the retention rule that is not implemented in the copy is a policy nobody can prove was followed.