Market Guide for Cloud Backup
7 January 2026 - ID G00841533 - 18 min read
By Michael Hoeck, Sankalp Rastogi
The fragmented use of IaaS and PaaS offerings across multicloud environments has complicated efforts to protect mission-critical data. Heads of I&O can use this research to refine requirements and gain visibility into solutions for more consistent, cost-effective cloud backup and data protection.
Overview
Key Findings
- Unpredictable cloud backup costs are driving many heads of I&O to reevaluate how they’re protecting data stored in cloud infrastructure as a service (IaaS) and platform as a service (PaaS).
- Many organizations lack standardized processes and clear ownership for backup and data protection in cloud infrastructure and platform services (CIPS), increasing risks to effective data protection.
- The proliferation of enterprises’ multicloud operations and expanding number of cloud IaaS and PaaS services leads to the deployment of multiple cloud-native and third-party backup and data protection tools. The use of multiple solutions creates gaps to implementing a common, enterprisewide backup and data protection policy for cloud data.
Recommendations
- Identify opportunities to reduce cloud backup cost and risk by using vendor solutions that transparently provide insights to discover critical and sensitive cloud data and accurately model or include all backup costs such as storage, compute, egress, API and transaction fees.
- Select cloud backup solutions that best optimize the engagement and centralization of backup responsibility across your multiple stakeholders of cloud environments, including IT, cloud, security and development operations.
- Improve multicloud backup operations by auditing and inventorying all existing cloud-native and third-party backup tools to identify opportunities that rationalize solutions, eliminate overlaps, address coverage gaps and standardize recovery objectives across cloud platforms.
Strategic Planning Assumption
By 2029, 70% of enterprises will have shifted cloud backup responsibilities from cloud operations teams to IT operations teams, compared with 25% in 2025.
Market Definition
Gartner defines cloud backup as technologies that capture point-in-time copies of enterprise data in strategic cloud platform services (SCPS) deployments. Its primary purpose is to recover data resulting from multiple data loss scenarios. The use of data copies may also extend to additional data reuse cases, such as test and development, expanded data search, security scanning, data archiving, data analytics, generative AI inference and other API-based access.
Protecting and recovering an organization’s application data within cloud environments is a critical priority. It is well-understood that SCPS vendors have a shared data responsibility model with their customers. Under most circumstances, data stored in the cloud is ultimately the responsibility of the customer organization to protect and not of the cloud service provider.
Cloud backup solutions are vital to an organization’s ability to protect and recover data following events that cause the data to become modified, corrupted or inaccessible. These events may be accidental based on end-user actions or developer updates, or malicious intent, such as ransomware and cyberattacks, or they may be the result of cloud provider error.
Solutions must natively integrate with the SCPS vendor’s offerings of infrastructure as a service (IaaS) and platform as a service (PaaS) and its APIs to perform consistent and routine data backup procedures. They must provide the ability to easily and granularly restore data to the applicable environments. Cloud backup vendors must be adept to the changes that cloud service providers routinely apply to their environments and be responsive to supporting new workloads that are characteristically added quite frequently to these environments.
Cloud backup solutions also extend beyond traditional recovery use cases to drive further business value from the data that is copied to the platform. They incorporate use cases that are focused on data-driven enablement, such as enhanced data protection and expanded data insights and access using backup data.
Enhanced protection capabilities include automated data protection, application discovery and resilience, enhanced cyberrecovery readiness capabilities, orchestration of disaster and cyberrecovery testing and processes, data discovery and access tracking. Data insights and access capabilities enable vendor solutions to present data to new personas beyond the backup administrators. New personas include additional IT personas within security, DevOps, and data and analytics teams, as well as other business users such as compliance and legal.
Mandatory Features
- Backup of enterprise data stored on the SCPS vendor’s infrastructure as a service (IaaS) and platform as a service (PaaS) offerings using its cloud services APIs and integrations.
- Recovery of data from any failure or data loss scenario, such as operational, system or application failure, accidental error, natural disaster, and cyberattack.
- Support for granular file, object and folder recovery of protected cloud-based file and object stores.
- A vendor-hosted backup as a service (BaaS) offering to deliver backup and recovery services for the supported cloud environments.
- A centralized console for the management and monitoring of the cloud backup solution. This includes establishing policies, reporting of success and failure of tasks, troubleshooting and insights to other operational metrics.
- Backup and data management policies to support an enterprise’s business requirements for recovery point objectives (RPOs), recovery time objectives (RTOs), resilience, data life cycle and compliance.
- Cyberrecovery readiness capabilities, such as vendor-developed or third-party integrated, postbackup anomaly and entropy detection.
- Store backup data to an immutable backup storage target. This includes alternatives such as integration with third-party immutable backup storage targets and cloud backup vendor-provided immutable storage.
Common Features
- Automate discovery of SCPS services that are in use and assign policies to protect the data for the enterprise.
- Protect enterprise applications running in a SCPS environment, such as SAP HANA, Microsoft SQL Server, and Oracle Database.
- Support for cloud application discovery capabilities to identify application components, dependencies and data protection status and perform backup and recovery of the application.
- Integration with the organization’s infrastructure as code (IaC) to protect it and orchestrate public cloud application and data recovery.
- Support for cross-account, cross-tenant, cross-region and cross-cloud restore capabilities.
- Generative AI features to simplify administration, improve support services, and accelerate backup and recovery procedures.
- Integration with the vendor’s on-premises backup offering to provide a common enterprisewide backup management experience, and global deduplication and backup storage tiering capabilities.
- Enhanced security capabilities, such as multifactor authentication, role-based access controls and multiperson change validation; integration with privileged access management solutions, security information and event management (SIEM) and security orchestration, automation and response (SOAR) integration; and advanced security reporting and logging.
- Application of zero-trust principles across solution design, architecture and deployment practices to ensure the highest level of security and data integrity.
- Enhanced cyberrecovery readiness capabilities, such as real-time anomaly and entropy detection; postbackup and on-demand malware and signature-based detection; and immutable data vault and isolated recovery environment offerings.
- Orchestration of disaster and cyberrecovery testing and processes.
- Support for expanded platform use cases to assist data protection, copy data management, and test and development requirements.
- Support for expanded backup data insights and access capabilities such as data categorization and classification, sensitive data scanning, search, investigations, business intelligence, retrieval-augmented generation (RAG) and other API retrieval.
- Role-based access controls to provide backup data access to personas outside of the backup administrative teams, such as security, legal, compliance, and data and analytics.
Market Description
Strategic cloud platform services (SCPS), or cloud hyperscalers, deliver multiple public cloud IaaS and PaaS services. While many of the underlying components associated with IaaS and PaaS are a responsibility of the cloud provider, organizations accept a shared responsibility model when utilizing these cloud services. The organization must take responsibility for protecting the business-critical data stored in these services.
Common hyperscaler cloud services containing enterprise-critical data include virtual machines, containers, files and object storage, and database as a service. The following table (Table 1) provides insight into commonly used cloud hyperscaler offerings that require backup and data protection.
Common Cloud Services Requiring Backup and Data Protection
Common data locations | Representative cloud hyperscaler offerings |
Virtual machine | Alibaba Cloud Elastic Compute Service, Amazon Elastic Compute Cloud, Azure Virtual Machines, Azure VMware Solution (AVS), Google Cloud Compute Engine, Oracle Cloud Infrastructure (OCI) Virtual Machines, VMware Cloud on AWS, Tencent Cloud Virtual Machine |
Containers | Alibaba Cloud Container Service for Kubernetes, Amazon Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS), Google Kubernetes Engine (GKE), Oracle Kubernetes Engine, Tencent Kubernetes Engine |
File storage | Amazon Elastic File System (EFS), Azure Files, Amazon FSx, Google Cloud Filestore |
Block storage | Amazon Elastic Block Storage, Azure Disk Storage, Google Cloud Persistent Disk, OCI Block Volume |
Object storage | Alibaba Object Storage Service, Amazon Simple Cloud Storage (S3), Azure Blob Storage, Google Cloud Storage, IBM Cloud Object Storage (COS), OCI Object Storage |
Database as a service | Alibaba Cloud ApsaraDB, Amazon Relational Database Service, Amazon DynamoDB, Azure Cosmos DB, Azure SQL Database, Databricks, Google Cloud Big Query, Google Cloud SQL, Huawei GaussDB, Snowflake, TencentDB for MongoDB |
Source: Gartner (January 2026)
Regardless of where it is stored, enterprise data is subject to environmental, accidental and threat actor incidents and subject to regulatory-based data protection requirements. As a result, organizations must ensure mission-critical cloud data is consistently protected and available for restoration. Using cloud backup solutions enables organizations to establish consistent and enforceable backup and data protection policies. Policy requirements address topics such as expected recovery point objects (RPOs), recovery time objectives (RTOs), and backup storage locations (e.g., the same or different region, availability zone and cloud), including data sovereignty.
The primary use cases for cloud backup include:
- IaaS backup: The ability to protect and recover critical infrastructure and data residing in services, such as virtual machines, files and object storage.
- PaaS backup: The ability to protect and recover data stored to platforms hosted by cloud hyperscalers, such as relational databases and big data offerings.
- Cyber recovery: The ability to orchestrate the identification of cyberattacks and orchestrate the recovery from multiple clouds.
The following diagram (Figure 1) illustrates the primary use cases and features associated with the cloud backup market.
Additional use cases include cloud application infrastructure recovery (CAIR), integration with on-premises backup and recovery, and multiple data services. These services include copy data management, data categorization and classification, sensitive data scanning, search, investigations, business intelligence, retrieval-augmented generation (RAG) and other API retrieval.
Market Direction
Cloud backup solutions are most commonly available in software as a service (SaaS) deployment models, including backup as a service (BaaS) or vendor-hosted deployment models. With limited exceptions, these vendor-hosted solutions are deployed in the vendor’s choice of public cloud infrastructure. Some vendor-hosted solutions will offer flexibility for the customer to choose from more than one supported public cloud infrastructure or the use of bring your own storage (BYOS) as the backup target. Greater choices for backup storage locations are available from vendors that support customer-managed deployments. Customer-managed deployments involve the customer deploying the vendor solution within their own infrastructure. Customers manage the day-to-day responsibilities of operating the solution, including software updates.
Cloud backup vendors most commonly support IaaS backup. Similar to on-premises environments, this would include the protection of data in virtual machines, storage and containers. A significant volume of IaaS data is related to organizations’ movement of workloads using a “lift-and-shift” migration approach. While some vendors utilize agents deployed in the cloud infrastructure to protect data in these systems, most now utilize a cloud-native or agentless integration that leverages cloud service provider APIs, snapshots and other infrastructure.
To best support PaaS backup, cloud backup vendors must tightly align their offerings with the cloud service providers’ available integrations. The extent of integration is limited by the cloud service provider’s available APIs. Where backup and restore APIs are not fully supported, third-party tools may orchestrate cloud service providers’ native capabilities. This may affect the scope of protection and recovery granularity.
The most commonly supported PaaS offerings for backup are relational databases, such as Amazon RDS, Azure SQL or GCP SQL Cloud. Solutions are expanding their integrations to other big data offerings such as Azure Data Lake, Google BigQuery, Snowflake and Databricks.
Feature-rich IaaS and PaaS backup solutions include:
- Application-aware backup and granular recovery
- Cross-hypervisor restore
- Cross-region, -zone and -cloud restore
- Multicloud support
- Dynamic scaling to accelerate the backup and recovery of large workloads
- Optimized cloud infrastructure, including the use of ephemeral and microservices architectures, to reduce cost
- Cyberthreat detection
Across both IaaS and PaaS, cloud backup vendors differentiate their solutions based on the cloud service integration method that is supported. They distinguish snapshot coordination, agent-based and agentless integration architectures. Each offers its own benefits. The following table (Table 2) outlines characteristics of these integrations.
Cloud Backup Integration
Integration type | Description | Pros | Cons |
Snapshot coordination | Involves the management and orchestration of point-in-time snapshots that are supported by the cloud service provider for each of its services. Backup data is primarily stored within the supported infrastructure. | This is appropriate for fast backup and restore. | This may limit backup data separation from production storage and granular recovery capabilities. The use of snapshot capacity may also be cost-prohibitive depending on retention policies. |
Agent-based | Involves the deployment of agents designed for each of the supported IaaS offerings. Depending on the cloud vendor solution, these agents can be ephemeral or persistent in design. These agents interact with the cloud services to back up and restore data. | This approach often provides advantages of granular restore capabilities. | The orchestration of deploying agents to each protected asset may be challenging to manage (e.g., each virtual machine). Agent requirements may impact performance of the protected offering. |
Agentless | Involves the cloud backup vendors’ deployment of services that interact with the cloud service provider APIs. This approach is often built on a microservices-based architecture. | The architecture optimizes the use of microservices-based architecture to optimize performance, scale and cost. | This requires available hyperscaler API and architecture for cloud backup vendors to integrate. The scope of vendor backup capabilities may be limited by APIs. |
Source: Gartner (January 2026)
Further business model and technical innovations that vendors are introducing include:
- Predictable costs: Absorbing egress and transaction fees as part of their subscription fees for BaaS-deployed offerings.
- Expanding cloud coverage: Using a single offering and control plane to orchestrate the protection of workloads across multiple cloud hyperscaler environments.
- Infrastructure and application discovery: Automating the identification and protection of IaaS and PaaS data workloads in a customer account.
- CAIR: Complementing data recovery capabilities, CAIRs are protecting and creating infrastructure as code (IaC) for use in recovery applications. This is applicable to standard restore scenarios and disaster recovery orchestration.
- Expanded data access: Data reuse capabilities are extending beyond instant access and copy data management. New capabilities include the development of presenting data through RAG and transformation of backup data to support direct access from data platforms such as Microsoft Fabric, Snowflake and Databricks.
Market Analysis
Gartner is observing a notable increase in client inquiries for advice on how to protect cloud-based workloads. The vendors in the cloud backup market include the cloud hyperscalers offering native IaaS and PaaS offerings, such as AWS, Azure, and GCP, as well as multiple third-party vendors. Third-party vendors include those that extend their coverage of backup from on-premises to hybrid and multicloud environments. Insights into many of these vendors are found in Gartner’s Magic Quadrant for Backup and Data Protection Platforms. Additional third-party vendors, such as AvePoint, Eon and N2W, focus specifically on protecting cloud hyperscaler IaaS and PaaS. The following table (Table 3) categorically associates a scope of backup capabilities across the three categories of cloud backup vendors. Individual cloud backup vendor offerings will vary in the scope of capabilities.
Cloud Backup Vendor Capabilities
Backup capabilities | Native backup solutions | Third-party backup solutions | |
Cloud hyperscaler | Hybrid-focused | Cloud-focused | |
On-premises coverage |  |  |  |
Multicloud coverage | | | |
SaaS coverage | | | |
Customer-managed deployment option | | | |
BYOS | | | |
Centralized control and policy management | | | |
CloudOps/DevOps-focused admin | | | |
Optimized backup storage target | | | |
Ransomware protection | | | |
| Less common, more common, most common | |||
Source: Gartner (January 2026)
Definitions:
- On-premises coverage: Backup and recovery of on-premises hypervisors, applications and storage.
- Multicloud coverage: Backup and recovery of IaaS and PaaS in multiple hyperscalers.
- SaaS coverage: Backup and recovery of SaaS applications such as Microsoft 365, Google Workspace, Salesforce, Microsoft Entra ID, Okta, and DevOps tools, including GitHub and Azure DevOps.
- Customer-managed deployment option: Customer-managed includes the deployment, management and monitoring of vendor software in the customer’s own infrastructure.
- BYOS: Supports the use of the customer’s own backup storage target, such as alternative cloud and on-premises storage options.
- Centralized control and policy management: Common administration interface of a backup solution for protecting supported IaaS and PaaS.
- CloudOps/DevOps-focused admin: Backup administration and features aligned to specific cloud IaaS and PaaS.
- Optimized backup storage target: Features such as deduplication and compression to efficiently store backup data.
- Ransomware protection: Ransomware and cyber recovery features such as immutable backup storage targets, ransomware detection and orchestration ransomware recovery.
By correlating the continued growth of cloud hyperscaler storage use, which is forecast to be greater than a 30% compound annual growth rate (CAGR) between 2024 and 2029,1 Gartner anticipates double-digit growth for cloud backup solutions over the next several years. Additional growth factors include the clarity of organization understanding, the responsibility of backup and data protection in the shared responsibility model, and the expansion of regulatory mandates and data sovereignty requirements. There are also specific drivers, which relate to the continued growth of IaaS and PaaS workloads:
Key drivers for growth of IaaS
- Cloud migration, including “lift and shift,” and application modernization
- AI and GenAI workloads
Key drivers for growth of PaaS
- Integrated application development
- Database and analytics evolution
- AI integration
Gartner estimates that more than 65% of current cloud backup operations are currently performed using cloud hyperscaler-provided native tooling. Hyperscalers often provide built-in backup capabilities within their own IaaS and PaaS offerings, and they have additional tools to extend policy settings (e.g., retention and storage targets) and orchestrate backup capabilities across these workloads. Access to these tools is simplified through the vendors’ readily accessible service catalog.
Hybrid cloud-focused vendors are rapidly expanding the scope of workload coverage, optimizing performance, and including support to protect IaaS and PaaS workloads across multicloud environments. Newer cloud-focused vendors have emerged over the past three to five years to address the unique nuances of protecting cloud workloads.
The deployment model for many cloud backup solutions is BaaS versus customer-managed architectures. While the implementation of customer-managed deployments for cloud backup is observed, especially in large enterprise environments, using the available deployment architectures of hybrid cloud backup solutions, Gartner anticipates that much of the cloud backup will be serviced through BaaS delivery models.
Representative Vendors
The vendors listed in this Market Guide do not imply an exhaustive list. This section is intended to provide more understanding of the market and its offerings.
Vendor Selection
Representative vendors include those that support both IaaS and PaaS workloads for at least one cloud hyperscaler environment. These vendors are organized into two tables separating those that protect only cloud workloads (Table 4) and those supporting hybrid environments, which includes the protection of on-premises and cloud workloads (Table 5).
Cloud Hyperscaler-Focused Backup Vendors
Vendor | Product(s) | Delivery model | Supported cloud workload platforms |
AvePoint | Confidence Platform | BaaS | AWS, Azure, GCP |
CloudCasa | Kubernetes backup and restore | BaaS | AWS, Azure, GCP |
Eon | Cloud backup platform | BaaS | AWS, Azure, GCP |
Google | Google Cloud backup and DR service | BaaS | GCP |
N2W | AWS backup and recovery, Azure backup and recovery | BaaS | AWS, Azure |
Oracle | Oracle Secure Backup | BaaS | OCI |
Tencent | Tencent Cloud backup service | BaaS | Tencent Cloud |
Source: Gartner (January 2026)
Hybrid-Focused Backup Vendors
Vendor | Product(s) | Delivery model | Supported cloud workload platforms |
Alibaba | Alibaba Cloud backup and recovery | BaaS | Alibaba Cloud |
Amazon | AWS Backup | BaaS | AWS |
Bacula | Bacula Enterprise | Customer-managed | AWS, Azure, GCP, OCI |
Cohesity | Cloud Protection Service | BaaS; Customer-managed | AWS, Azure, GCP |
Commvault | Commvault Cloud | BaaS; Customer-managed | Alibaba, AWS, Azure, GCP, IBM Cloud, OCI |
Dell | PowerProtect Data Manager, PowerProtect Backup Services | BaaS; Customer-managed | AWS, Azure, GCP |
Druva | Data Security Cloud | BaaS | AWS, Azure |
Huawei | OceanProtect | BaaS; Customer-managed | AWS, Huawei Cloud, Alibaba Cloud |
HYCU | R-Cloud | BaaS | AWS, Azure, GCP |
IBM | Storage Defender, IBM Cloud Backup for VPC | BaaS; Customer-managed | AWS, Azure, GCP, IBM Cloud |
Microsoft | Azure Backup | BaaS | Azure |
Rubrik | Rubrik Security Cloud | BaaS; Customer-managed | AWS, Azure, GCP |
Veeam | Veeam Data Platform, Veeam cloud platform | BaaS; Customer-managed | AWS, Azure, GCP |
Source: Gartner (January 2026)
Market Recommendations
Before selecting cloud backup solutions, heads of I&O must clearly scope the requirements of IaaS and PaaS. Such critical requirements include:
- Thoroughly assessing and auditing cloud environments for the use of critical applications and infrastructure that require backup protection.
- Working with the business and data owners to define agreed-upon RPOs and RTOs for each application to ensure alignment with business continuity requirements.
- Conducting tabletop exercises with cloud, application, security and IT team participation to fully scope current backup solutions and identify gaps.
- Defining requirements to align with applicable regulatory compliance demands, such as resiliency performance and data sovereignty.
Heads of I&O must select cloud backup solutions that best align with business and resilience expectations, administrative capabilities and cost expectations. Cloud backup solutions will vary across the following categories and features.
- Cloud workload coverage
- Covering multicloud environments and the related scope of IaaS and PaaS offerings.
- Including discovery capabilities to identify critical data and workloads and automate policy assignments.
- Integrating with cloud workloads using agent-based, agentless and snapshot coordination techniques to effectively perform and optimally administer cloud backup at scale.
- Offering cross-environment recovery capabilities between hypervisors, regions, availability zones and clouds.
- Deployment options
- Availability of cloud backup solutions in multiple delivery models, including BaaS and customer-managed deployment architectures.
- Integrating cloud backup with on-premises backup operations.
- Options for backup storage targets, including multiple hyperscaler targets, BYOS, and on-premises and vendor-hosted cloud data vaults.
- Cyber recovery
- Robust cyber or ransomware detection capabilities to improve resilience from attacks. Detection includes anomaly, malware and threat hunting.
- Immutable data vaults and clean rooms.
- Advanced features
- Implementing CAIRs to effectively scope the application design, configuration and utilization of IaC to orchestrate cloud application recovery with data recovery.
- GenAI and agentic features integrated with the cloud backup solution to optimize and automate backup processes.
- Extending cloud backup data to additional reuse scenarios.
- Cost management
- Pay-per-use and upfront commitment, including multiyear agreements
- Including cloud egress and transaction fees into a single license or predictable cost model.
1 Forecast Analysis: Data Center Storage Capacity by Delivery Type, Worldwide, 2024-2029.
Note 1: Gartner’s Initial Market Coverage
This Market Guide provides Gartner’s initial coverage of the market and focuses on the market definition, rationale for the market and market dynamics.