split
true
white-70
RUBRIK SECURE VAULT
The cyber recovery vault that's immutable from the very first backup
Attackers went after backup data in 96% of attacks. Secure Vault takes the target off the table: an append-only filesystem, backups invisible over NFS and SMB, MFA on by default. No separate bunker to build or run.
button
primary
lg
true
_self
full
button
secondary
lg
true
_self
full
link
primary
lg
true
full
false
tickerSpeed
20
button
primary
lg
true
_self
full
variant
center
eyebrow
WHAT IS A CYBER RECOVERY VAULT
heading
A vault you configure is a vault an attacker can reconfigure.
subheading
A cyber recovery vault is backup storage that’s immutable, isolated and access-controlled by default, so a compromised production environment can’t reach, alter or delete your recovery data. Secure Vault is built that way from the first block written.
backgroundColor
bg-white
stat
TARGETED
96%
Share of attacks that went after backup data. Your recovery tier is not collateral damage. It is the objective.
stat
EXPOSED
74%
Of those attacks, the share at least partially successful. Partial success is enough to make every remaining copy suspect.
stat
COMPROMISED
35%
Of organizations had their backup and recovery systems fully compromised. Partial access became total.
IMMUTABLE
Immutability isn’t a setting. It is the filesystem.
Secure Vault writes to a proprietary append-only filesystem. No changes, no modifications, from the very first backup. No window between deployment and protection, and no setting an admin can skip or an attacker can reverse.
- Append-only from first write, not first configuration
- AES-256 encryption, FIPS 140-2 compliant (verify)
- Key management via internal TPM or external KMIP
false
false
link
primary
md
true
content
ISOLATED
An attacker who owns production still can’t see the vault.
Backups are undiscoverable because Rubrik Secure Vault does not expose them over NFS or SMB, so ordinary network reconnaissance turns up nothing to encrypt. Access is governed by RBAC with mandatory, natively enforced MFA, and changing retention takes two people.
- No NFS or SMB exposure, so backups never appear on the network
- Mandatory MFA and TOTP, on by default
- Intelligent Data Lock preserves data when anomalies appear
false
false
link
primary
md
true
content
RECOVERABLE
Find the last clean point, then recover where you choose.
Rubrik runs threat hunting, anomaly detection and sensitive data monitoring against your backups. Finding the clean point is an investigation you finish, not a restore-scan-fail loop. Then recover into an isolated recovery environment, the built-in clean room, or straight to production.
- Last clean point surfaced from backup history
- Surgical, file-level ransomware recovery
- Live Mount for non-disruptive DR rehearsal
false
false
link
primary
md
true
content
BUILT IN VS. BOLTED ON.
Rubrik Secure Vault vs. legacy vaulting
Legacy vaults are a second copy: another site, another tier, immutability switched on afterward. Secure Vault is the vault, immutable from the first write.
| Criteria | Legacy vaulting | |
| When immutability begins | After an administrator configures it | From the very first backup, enforced by the filesystem |
| Network visibility of backups | Reachable over NFS or SMB | Not exposed over standard file protocols |
| Who can delete a copy | A single admin with valid credentials | Two-person rule, MFA on by default |
| Finding a clean recovery point | Mount, scan, fail, repeat | Threat hunting surfaces the last clean point |
| Infrastructure required | A separate vault to build and operate | The backup storage platform is the vault |
Rubrik Secure Vault Use Cases
Real-world cyber recovery vault use cases, powered by Rubrik
Recovering from ransomware without reinfecting production
The encryption is contained, but nobody can say which snapshot is clean. Every candidate restore risks putting the payload back.
- Threat hunt backup history for indicators of compromise
- Restore the verified clean point into a clean room or IRE
- Recover surgically at file or application level
Evidence-backed
clean point identified before the first restore
Surviving credential compromise of your backup admin
Stolen credentials are the opening move in most breaches. If they reach the recovery tier, it is not a recovery tier.
- Granular RBAC with mandatory, natively enforced MFA
- Retention Lock applies a two-person rule
- Intelligent Data Lock preserves data on anomaly
Two-person
rule required to shorten retention or delete
Meeting regulatory retention without a separate archive tier
Regulated industries need provable, unalterable retention. A bolted-on compliance archive adds a second thing to audit.
- Define WORM-compliant retention in policy
- Aligns to SEC 17a-4(f) and FINRA 4511(c)
- DoDIN APL listed, Common Criteria EAL2+
One platform
for retention and recovery, not two
Proving recovery works before you have to prove it
Most organizations find their recovery gaps during the incident. Boards and insurers now want a tested answer.
- Live Mount spins up recovery copies non-disruptively
- Rehearse into an isolated recovery environment on a schedule
- Report tested recovery points, not policy coverage
Defensible
recovery ETA for an auditor, insurer or board
variant
center
eyebrow
BEYOND THE VAULT
heading
Part of the platform — how it all connects
subheading
Rubrik Secure Vault is the data plane. It sits inside a platform that brings together data, identity and AI, so recovery is not a separate discipline from security.
backgroundColor
bg-white
NEW
Rubrik Virtual Vault
Software-only vault on your own hypervisor with object-locked storage.
Identity Resilience
Recover Active Directory, Entra ID and Okta without attacker persistence.
RESOURCES & EXPERTISE
Learn more from our experts
White Paper
38 pages
The Definitive Guide to Rubrik Secure Vault
How append-only storage, logical air gap and access control combine into a recovery tier that survives a compromised production environment.
Datasheet
2 pages
Specifications and deployment options
Appliance, Cloud Cluster Elastic Storage and Rubrik Virtual Cluster deployments, encryption standards and certifications.
_self
Insights
7 min Read
What is an air gap, and why does it matter?
How logical air gapping differs from tape, and why network invisibility does more for recovery than physical separation alone.
FAQ
Everything you need to know
bg-surface-muted
What is a cyber recovery vault?
A cyber recovery vault is backup storage that is immutable, network-isolated and access-controlled by default, so a compromised production environment cannot alter or delete the data you need to recover. It differs from an ordinary backup repository in that isolation and immutability are properties of the storage itself rather than policies applied on top. Rubrik Secure Vault implements this with a proprietary append-only filesystem that does not allow changes or modifications from the very first backup.
How does a cyber recovery vault work?
In four stages. Data lands in an append-only filesystem that refuses modification from the first block, so nothing is mutable while it waits. The copy sits outside production's blast radius, unexposed over standard file protocols and reachable only through role-based access control plus natively enforced MFA. Anomaly detection and threat hunting run continuously against the backups, so the last known-clean recovery point is identified from evidence. You then restore into an isolated recovery environment, a clean room, or surgically back to production.
Is Rubrik Secure Vault the same as Rubrik Cloud Vault?
No. Rubrik Secure Vault is the backup storage platform you operate, deployed as a Rubrik appliance, as Cloud Cluster Elastic Storage, or as a Rubrik Virtual Cluster on your own hypervisor. Rubrik Cloud Vault is a separate, Rubrik-managed service that holds an offsite copy in a Rubrik-owned cloud tenant, outside your account and identity domain. Many organizations run both, with Rubrik Secure Vault as the primary recovery tier and Rubrik Cloud Vault as the offsite layer.
How is an air gapped vault different from tape?
Both create separation, but they separate different things. Tape separates physically and pays for it in recovery time, often days or weeks to locate and rehydrate. A logical air gap keeps backups off standard file protocols so they cannot be discovered or encrypted from a compromised host, while remaining online for immediate recovery. With Rubrik Secure Vault you get the isolation without the retrieval penalty.
Can an attacker with admin credentials delete my backups?
Not with a single set of credentials. Access to Rubrik Secure Vault requires granular role-based access control plus multi-factor authentication that is mandatory and natively enforced, enabled by default for every customer. Retention Lock adds a two-person rule to retention changes, and Intelligent Data Lock preserves data when anomalies are detected. Deleting protected data becomes a multi-party action rather than something one compromised account can do alone.
Does Rubrik Secure Vault meet regulatory retention requirements?
Yes. You can define WORM-compliant retention periods in policy, aligned to regulations including SEC Rule 17a-4(f) and FINRA Rule 4511(c). Encryption is FIPS 140-2 compliant AES-256, with FIPS 140-2 Level 2 drives available in hardware, and key management can run through an internal TPM or an external KMIP service. Rubrik Secure Vault is DoDIN APL listed and has been evaluated at Common Criteria EAL2+.