- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
Rubrik Cloud Vault
The copy the attacker can’t reach — a fully managed, immutable, air-gapped cloud archive that survives the attack that deletes everything else. The last line of defence.
How it’s rated
Full scoreboard ↓Quick answer
Rubrik Cloud Vault is the copy the attacker can't reach: a fully managed, immutable, physically-isolated cloud archive of your backup data — air-gapped from production so it survives the attack that deletes everything else. It's the last line of defence behind Rubrik's zero-trust platform: logically and physically separated, always immutable, with no standing access path from your compromised environment to the vault. When ransomware or a rogue admin wipes production AND your primary backups, Cloud Vault is what's left to recover from. Fully managed by Rubrik means no infrastructure to run and no isolation you have to engineer yourself — the air gap is the product.
The Rubrik platform family
This page covers Cloud Vault — the air-gapped last line. The rest of the platform:
Quick facts
30-second orientation- Product
- Cloud Vault — managed air-gapped recovery
- Vendor
- Rubrik (founded 2014 · NYSE: RBRK · Palo Alto, CA)
- The role
- The last-line copy attackers can't reach
- Air gap
- Physically + logically isolated from production
- Immutable
- Always append-only — can't be encrypted or deleted
- Managed
- Fully managed by Rubrik — no infra to run
- Compliant
- Retention and compliance built in
- Fits
- The last-line defence behind Enterprise Edition
- Licensing
- Capacity-based subscription
- In India via
- TechBag — quotes, PoCs, GST invoicing, Tier-1 support
Understand air-gapped cyber recovery before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is air-gapped cyber recovery?
An isolated, immutable copy of your backups that an attacker can't reach — physically and logically separated from production, so it survives the attack that deletes everything else.
Cloud Vault delivers it as a fully managed service — the air gap without the infrastructure.
Reachable backups vs an air-gapped vault — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Backups on the same network | Air-gapped managed vault (Rubrik) |
|---|---|---|
| The scenario | Backups deleted with production | Air-gapped copy survives |
| Isolation | Same network, reachable | Physically + logically separated |
| Standing access | A path an attacker can traverse | No route from compromised estate |
| Immutability | A setting that can be disabled | The vault's unchangeable nature |
| Who runs it | You build & operate isolation | Fully managed by Rubrik |
| The cost | A capital DR-site project | Managed cloud operating expense |
| Compliance | A separate archive tool | The vault doubles as the record |
| The role | Hope one copy is untouched | A designed last line of defence |
The vault sits behind your primary backups — defence-in-depth, adopted as the last line, not a rip-and-replace.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
The Air Gap
The vault is separated from your production and primary-backup environments — no standing network path an attacker can traverse from a compromised estate.
Immutable Store
Data in the vault is immutable by design — even with vault access, no one can encrypt or delete the copies. The last line stays intact.
Managed Service
Fully managed — no vault infrastructure to provision, patch or isolate yourself. Rubrik operates the air gap you'd otherwise have to engineer.
Compliance Layer
Retention policies and compliance controls built in — the isolated archive doubles as the compliant long-term record.
Recovery Path
When production and primary backups are gone, recovery flows from the vault — the rehearsed path back from catastrophe.
One agent on every machine, one console over all of them — modules attach without a second operational world.
Twelve capabilities. Isolate, protect, recover.
Cloud Vault is the survivor — physically isolated, always immutable, managed for you, so a full compromise still leaves one clean copy.
Physical + Logical Isolation
Separated from production and primary backups — no standing network path an attacker can traverse to the vault.
No Standing Access Route
A compromised admin or estate has no route in — isolation by design, not by policy that can be misconfigured.
Fully Managed Service
Rubrik provisions, isolates and operates the vault — no infrastructure for your team to run.
Always Immutable
Append-only by nature — no one, inside or out, can encrypt or delete the vaulted copies. No off switch.
Compliance Retention
Retention and governance controls built in — the vault doubles as a defensible long-term archive.
Cloud-Scale Capacity
Scales with capacity as a managed cloud archive — no capital cost of an isolated on-prem recovery site.
Last Line of Defence
The copy that survives when production and primary backups are both wiped — the designed survivor.
Break-Glass Recovery
The rehearsed worst-case recovery path — restore from isolation when everything else is gone.
Clean, Intact Copy
Because it's isolated and immutable, the vaulted data is trustworthy for recovery — not silently tampered.
Behind the Platform
Works behind Enterprise Edition — fast primary recovery plus the air-gapped survivor. Layers, not a single copy.
Rehearsed Path
The last-line recovery you've tested, not hoped for — the break-glass drill as standing practice.
Managed Opex Model
The air gap as an operating expense — capacity-based, no data-centre project to fund and build.
Watch the vault explained
The Cloud Vault introduction, the cyber-recovery loop and cloud-data protection.
Introducing Rubrik Cloud Vault
The managed air-gapped vault — what it is and why.
Cyber Recovery with Rubrik Security Cloud
The cyber-recovery loop the vault anchors.
Secure Your Cloud Data with Rubrik
Cloud data protection and isolation, explained.
Want a live, India-context walkthrough on your own fleet?
Book a guided demo →Every vendor keeps a copy. One keeps the one they can’t reach.
Here’s what genuinely sets Cloud Vault apart from the alternatives.
The copy they can't reach
Sophisticated ransomware hunts and deletes backups before encrypting production. Cloud Vault is physically and logically air-gapped from your environment — there's no standing path from a compromised estate to the vault, so it survives when your primary backups don't.
Always immutable, even inside
Even with access to the vault, no one — attacker or rogue admin — can encrypt or delete what's stored. Immutability isn't a setting you can turn off; it's the vault's nature. The last line genuinely stays intact.
Managed — the air gap without the labour
Engineering a real air gap yourself is hard: isolated infrastructure, no reachable paths, immutable storage, someone to run it. Cloud Vault is fully managed by Rubrik — you get the isolation without building or operating it.
The last line, not the only line
Cloud Vault works behind Enterprise Edition — fast day-to-day recovery from primary immutable backups, and the air-gapped vault for the worst-case where those are compromised too. Defence in depth, not a single copy.
Compliant archive, too
The isolated, immutable, retention-governed store doubles as your compliant long-term archive — the same properties that make it a cyber-recovery vault make it a defensible record for audit.
Cloud economics
As a managed cloud archive, the vault scales with capacity and avoids the capital cost of building an isolated on-prem recovery site — the air gap as an operating expense, not a data-centre project.
The numbers behind the platform
What your Cloud Vault journey looks like
Worst-case scoping
The scenario where production AND primary backups are wiped — what must survive, and the retention the compliant archive needs. TechBag scopes it free.
Vault provisioned
Cloud Vault stood up (managed — no infra for you), isolation verified, initial data seeded from the platform.
The break-glass drill
Simulate the catastrophe, recover from the air-gapped vault — the last-line path rehearsed and timed.
Steady-state assurance
Vault as the standing last line + compliant archive, capacity managed. TechBag handles the subscription in INR/GST.
Trusted across regulated industries in 100+ countries
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our tabletop exercise assumed production AND primary backups were gone. Cloud Vault was the only copy left — and the recovery from it worked. That's the scenario nobody wants to fail.”
“We priced building our own isolated recovery site. Cloud Vault gave us the air gap as a managed service for a fraction of the capital and none of the operating burden.”
“The immutability isn't a checkbox we could accidentally disable — it's the vault's nature. Auditors loved that the last line can't be turned off.”
“No standing path from our environment to the vault means a compromised admin account can't reach it. That architectural separation is the whole reason we bought it.”
“It doubles as our compliant long-term archive. One isolated, immutable store serving both cyber recovery and retention was an unexpected win.”
“It's an add-on to the platform, priced by capacity — model it against building isolation yourself. For us the managed route won easily.”
“Recovery from an air-gapped vault is deliberately not instant — it's the break-glass copy. Set expectations: fast recovery is Enterprise Edition, the vault is the survivor.”
“Fully managed meant zero vault infrastructure for my team. We got defence-in-depth without a new operational world to run.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the air-gapped cyber recovery market — tap any vendor to see why it sits where it does.
TechBag Cyber-Recovery Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Managed air-gapped cyber recovery — this page's subject.
Isolation Strength × Managed Simplicity
The grid nobody publishes — how real the air gap is vs how much you have to build and run yourself.
Managed isolation depth — the corner it owns.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Cloud Vault vs the cyber-recovery field
Managed vaults, DIY isolation and the hardware options — honest lanes; the platform hubs are live for context.
| Dimension | Rubrik Cloud Vault | AWS air-gapped DIY | Dell CyberVault | Cohesity FortKnox | Tape / offline |
|---|---|---|---|---|---|
| What it is | Managed air-gapped cloud vault | Self-built isolation | Dell's cyber recovery vault | Cohesity's managed vault | The old air gap |
| Managed vs DIY | Fully managed | Fully DIY | Appliance + service | Managed SaaS | Manual |
| Immutability guarantee | Always immutable | Object-lock | Hardware-immutable | Immutable | Physically offline |
| Platform integration | Native to Rubrik | None | Dell-estate | Cohesity-estate | None |
| Recovery speed | Break-glass | Varies | Vault recovery | Vault recovery | Slow |
| Economics | Managed opex | Cloud cost + labour | Hardware capex | SaaS opex | Media + labour |
| Best fit | Rubrik customers wanting a managed last line | Cloud teams who'll build it themselves | Dell-standardised estates | Cohesity estates | True-offline purists |
Which last-line approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Cloud Vault if…
- ✓You want the last-line copy attackers can't reach
- ✓Managed air gap beats building isolation yourself
- ✓Always-on immutability with no off switch matters
- ✓You're on Rubrik and want native defence-in-depth
Build it in AWS if…
- ✓You have the team to engineer and run true isolation
Choose Dell CyberVault if…
- ✓You're Dell-standardised with PowerProtect
Choose Cohesity FortKnox if…
- ✓Cohesity is your backup platform
Keep tape if…
- ✓True physical-offline is your compliance requirement
What does a total backup wipe cost you?
Drag the sliders (count critical workloads; IT-hour cost as loaded recovery rate). Estimates assume ~5 hours per workload of catastrophe-recovery readiness where no surviving copy exists, with ~70% removed by a managed air-gapped vault — the true value (surviving the wipe at all) is effectively unbounded. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models actual device counts and modules.
Three ways to consume it
Cloud Vault prices by capacity as a managed subscription. TechBag models it against building isolation yourself, in one GST quote.
Cloud Vault
Best for the managed last line
- Capacity-based managed subscription
- Air-gapped, always-immutable archive
- No vault infrastructure to run
+ Compliance retention
Best for regulated archives
- The vault doubles as the record
- Governed long-term retention
- One store, two jobs
Platform bundle
Best for defence-in-depth
- Behind Enterprise Edition
- Fast primary + air-gapped survivor
- TechBag scopes the whole posture
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your device counts and current tools — we’ll model it against what you spend today.
The 8 questions to ask every cyber-recovery vault
Take this into your next vendor call — including ours.
Confirm there's no standing network path from your production/primary-backup environment to the vault — the air gap must be real.
Verify immutability can't be disabled from inside the vault — it should be the store's nature, not a toggle.
Confirm exactly what Rubrik operates vs what you touch — the point is no vault infrastructure to run.
Run the worst-case recovery (production + primary backups gone) FROM the vault — rehearse the last-line path.
Set that vault recovery is the break-glass copy, deliberately not instant — fast recovery is Enterprise Edition.
Map the retention/compliance value — the isolated store doubles as your defensible long-term record.
Size the vault capacity and model the managed opex vs building isolation yourself — the DIY labour is the hidden cost.
Confirm it sits behind Enterprise Edition as defence-in-depth — the last line, not the only line.
Questions buyers ask
Ready to evaluate Cloud Vault?
Scope a break-glass drill (recover from the vault when all else is gone), or bring your worst-case scenario and let a TechBag advisor design the last line with you.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.