Veeam Expands into Data Security
Veeam
Backup is becoming the low margin entry point, not the whole product. Once a vendor is already copying and indexing a company’s data, it can sell higher value tools that help security teams detect ransomware damage, investigate what changed, and find sensitive files sitting in the wrong place. That is why Rubrik and Cohesity are moving up the stack from recovery into security and compliance, where budgets are larger and differentiation is clearer.
-
Ransomware protection is a natural extension of backup because the backup system already has the two things incident responders need most, clean copies of data and a time stamped history of what changed. Rubrik built products like Radar on top of its immutable file system and timeline view for exactly this reason.
-
Data governance is the same pattern applied to privacy and compliance. A vendor that already scans data across VMs, cloud buckets, SaaS apps, and databases can classify files containing PII, show who accessed them, and generate audit reports. That puts backup vendors into partial competition with specialists like BigID, while still solving a different workflow from access control platforms like Immuta.
-
The money logic is important. Backup software is increasingly commoditized and often discounted, while adjacent security and governance modules carry subscription pricing, better gross margins, and more room for upsell. Rubrik’s business mix shows the model, with subscription becoming 86% of revenue in 2023 and gross margin rising from 69% to 77%, while Veeam remains valued at a lower revenue multiple despite larger scale.
The category is heading toward bundled data security platforms. Veeam’s later move to buy Securiti shows the same end state, where backup vendors try to own not just restore, but also what data exists, whether it is exposed, and how it is governed. The winners will be the vendors that turn backup metadata into everyday security and compliance workflows, not just emergency recovery.