In an office editor, autosave is a single toggle. For the past six months, almost every conversation about switching virtualization platforms has ended with the same question: “So where’s the same toggle for our whole data center?” There isn’t one. There is a ladder of mechanisms, and each step covers its own class of problems.
The confusion starts with the words. People call a snapshot a backup, call replication ransomware protection, and call a second site backup. Each of these words is half right. And each half surfaces at the worst possible moment: during an audit, after a failed update, or in an attack.
This issue is an attempt to lay out the whole ladder: from a virtual machine clone before a risky operation to a copy in S3 with a local data center operator. Separately, we look at what of this is included in the platform license and what you buy on top, using Nutanix as the example — based on the NCI 7.5–7.6 versions current as of early October 2026.
Threat map
Each step answers its own question
A “mechanism × threat” matrix quickly shows where protection exists and where it only seems to.
The first thing to do before choosing a product is to write down the threats you need protection from. There aren’t many: an administrator error or a failed update, the failure of a node or an entire cluster, the loss of a site, ransomware with administrator rights, and an auditor’s or regulator’s requirement to keep copies for a long time and provably.
Then every mechanism is checked against this matrix. The conclusion is usually unpleasant: no single step covers all the threats, and the most expensive ones cover precisely not the one people fear most.
Synchronous replication to a second site is the most expensive mechanism on the ladder. It offers no protection against ransomware whatsoever: it conscientiously and without delay sends already-encrypted blocks to the standby site. Nor against administrator error: a deleted table is deleted on both sites at once.
So the right question isn’t “which DR should we pick” but “which two or three steps cover each row of the matrix.” One step for everything isn’t architecture, it’s hope.
First line
A clone before an operation and a local snapshot
Rollback in minutes instead of hours, but only as long as the cluster itself is alive.
The cheapest step and the most underrated one. Before updating application software, migrating a database or changing a driver version, you take a clone or a snapshot, and rollback takes minutes rather than hours.
This step is part of the base license. With Nutanix, VM snapshots and clones, including application-consistent ones, are available in every edition starting with Starter, and Pro adds self-service file restore for users.
This step has one limitation, but it’s a fundamental one: the snapshot lives on the same cluster as the machine itself. A cluster failure takes out both the data and all of its restore points. That’s why a snapshot is not a backup, no matter how often you take it.
The second pitfall is operational. A snapshot someone forgot to delete after an update turns, six months later, into a chain that eats capacity and drags down performance. The rule is simple: every manual snapshot has a lifetime, and it’s written into the maintenance procedure.
Second site
An equivalent site: Async, NearSync, Metro
Scheduled copies, a short interval, or synchronous writes: each mode has its own price in bandwidth and in budget.
The next step is a copy on a second cluster that can take over the workload. There are three modes here, and they differ not only in RPO but also in what they demand from the link and from the budget.
Asynchronous replication sends snapshots on a schedule. In the base Nutanix edition, the interval starts at 1 hour. The link has to handle the volume of changes per interval; latency between sites barely matters. This is the workhorse for most systems.
NearSync cuts the interval to 1–15 minutes using lightweight snapshots. For systems where an hour of lost transactions is unacceptable but a synchronous setup doesn’t work over the distance, it’s usually the right compromise.
Metro means synchronous writes to both sites, with an RPO of zero. The price of that zero: every write operation waits for acknowledgment from the remote side, so the setup only works with low latency, meaning over short distances. We wrote in detail about the “50 km versus 600” fork in the issue on renting versus owning infrastructure. Automatic failover in Metro is only possible with a witness at a third site; otherwise, when the connection drops, the system can’t tell a site failure from a link failure.
And a general caveat for this whole step: a second site is a second infrastructure. Nodes, licenses for their cores, rack space, power. It costs almost as much as the first one, yet it spends most of its time on standby.
Nutanix editions
What’s in the license and what you buy extra
Pro, Advanced Replication and Ultimate: what each step unlocks and which cores it’s counted on.
There’s a ladder not only in mechanisms but also in licenses. A mistake we see regularly is choosing an edition by its name rather than by the scenario.
There are three steps. NCI Pro includes asynchronous replication with RPO from 1 hour, multi-site DR, basic recovery plans and snapshots to object storage. The Advanced Replication add-on (Advanced Disaster Recovery on the price list) on top of Pro unlocks Metro, synchronous replication, NearSync, advanced orchestration and live migration between clusters. NCI Ultimate already includes all of this, plus microsegmentation. Below Pro there’s also Starter, with asynchronous replication to a single site, but that’s an edition for small hybrid clusters.
What follows in practice. If a system needs an RPO under an hour or zero, that’s an add-on right away; you can’t build such a setup on Pro. Test failover and staged startup with scripts and address changes belong to advanced orchestration, and that’s worth remembering when the audit comes around. Snapshots to object storage and a clean room built on them, however, are already available in Pro.
A mistake we see regularly is choosing an edition by its name rather than by the scenario.
A separate word on the metric. The NCI license and the add-on are counted on all the cores of the cluster: if three machines need NearSync, the add-on is still bought for all the cores of the cluster they live on. DR sites are licensed separately, by the cores of their own clusters. That’s why it pays to keep critical systems in a separate cluster rather than spread them across a shared one. We wrote about how the license perimeter quietly creeps outward in the issue on backup systems.
The edition contents are given per official Nutanix materials as of early October 2026. They change more often than the procurement cycle, so it’s worth rechecking them as of the tender date.
DR for the audit
What you see at the standby site
Normal platform behavior that looks like a problem during an audit.
One of the most common questions about DR comes not from engineers but from auditors. And it sounds simple: “Show me.”
A recent case. A customer has two Nutanix sites with asynchronous replication via Recovery Plans. The customer’s architect opened the VM list at the standby site, didn’t find the protected machines there, and got seriously worried: how do we explain this to the audit? Our role here was advisory — to explain the platform’s behavior and prepare the supporting evidence; the configuration was done by the customer’s team.
The behavior is, in fact, normal. What sits at the standby site isn’t machines but restore points. A machine appears in the list only during a failover or a test failover. This isn’t a defect but a principle: while the site is on standby, there’s nothing in its inventory to consume resources.
But that doesn’t make things any easier for the auditor. They need artifacts, not principles. What makes sense to show: a list of restore points for each protected system with their age, an RPO compliance report for the period, a recovery plan with the startup order and, most importantly, a record of regular test failovers with the actual recovery time.
One more detail worth checking on your own version and license: in the description of the Advanced Replication add-on, test failover is listed as part of advanced orchestration. If the audit requires regular tests, that’s an argument for a tier above the base one.
Retention and verification
An archive cluster that isn’t started
Copies outside the primary cluster without permanent compute nodes: cheap, but with caveats.
Not every system needs a second site ready to take over the workload. For many, it’s enough that copies sit outside the primary cluster, can be verified and, if necessary, brought up — even if not within minutes.
Nutanix has Multicloud Snapshot Technology for this, and it’s included in Pro and Ultimate at no extra cost. Snapshots are stored in S3-compatible storage, including Nutanix Objects, and can be restored to any cluster on the platform. In the zero compute setup, a permanent second cluster isn’t needed: the target cluster is brought up on demand, including in the cloud.
For a long time the weak spot was recovery: data was first pulled from object storage onto the cluster, and for large machines that took hours. NCI 7.5.1 introduced Instant Restore: the machine powers on as soon as the snapshot metadata has been loaded onto the cluster, and the data is pulled in the background.
But this step has a caveat that’s easy to miss: immutability. Nutanix has no official confirmation that MST works with object lock on the bucket, and one of the certified storage providers explicitly prohibits enabling it. Until proven otherwise, this is a cheap and convenient tier, but not an immutable one. Nutanix builds its clean room on the same technology — an isolated recovery environment that’s brought up on demand.
The second option is an inexpensive hybrid cluster, even on NCI Starter with NVMe or SSD plus HDD. It can serve both as a target for asynchronous replication and as storage that a Commvault-type product writes to. That’s enough for the role of a recovery point, but we wouldn’t run the entire production workload on it after a disaster. And for any option: retention without regular restore testing isn’t protection, it’s hope.
Backup
Hot and warm tiers: NVMe and HDD
Backup storage is judged by how fast you can restore from it, not by how much it holds.
This is where virtualization platform territory ends and backup in the usual sense begins: separate software, separate storage, separate accounts. The logic is the same for any mature backup product; we use Commvault for our examples.
The key parameter of backup storage isn’t capacity but restore speed. Everyone calculates capacity; almost no one calculates restore speed. Yet on the day of an incident, management doesn’t ask “how many copies do we have” but “when will it be back up.”
Yet on the day of an incident, management doesn’t ask “how many copies do we have” but “when will it be back up.”
A hot NVMe tier is needed where you have to restore a lot and fast. Recently we sized a backup target with several petabytes of physical capacity per site and a restore requirement of hundreds of terabytes per hour. At that scale deduplication no longer helps: data arrives from Commvault already compressed, and storage has to be sized by physical capacity. We wrote in detail about how the reduction ratio melts away on compressed and encrypted data in the issue on backup systems.
A warm HDD tier is cheaper per terabyte and works well for restore points older than a few days that are rarely restored. A sound design isn’t a choice between tiers but a combination: fresh copies on the fast tier, older ones moved to the slow tier by policy.
Air gap
Tape: the cold tier
An anachronism that still delivers what online media can’t.
Tape looks like an anachronism until you calculate the cost of storing a petabyte for ten years and remember that a cartridge on a shelf is physically unreachable over the network. No online medium provides that kind of isolation.
The price of that isolation is time. Restoring from tape takes hours and days, not minutes, and it’s limited by the number of drives. That’s why tape is a tier for long-term retention and for the “everything else is already compromised” scenario, not for fast recovery.
Right now we have a task going the other way: a large library with a couple dozen drives and several hundred cartridges, and the customer wants to move entirely to flash. The arguments are clear: speed, density, getting rid of mechanics. But the first question we ask is: what will replace the air gap in the new design? If there’s no answer, tape is worth keeping at least for the longest-term retention.
Ransomware protection
Immutable storage and appliances
A copy that an administrator can delete can also be deleted by whoever stole that administrator’s account.
Modern ransomware first looks for backups and only then encrypts the primary data. That’s why backup immutability is no longer an option but a baseline requirement.
There are three mechanisms. A hardened Linux repository where the backup service has no delete rights. S3 object lock, which prohibits deletion until the retention period expires. Storage lock on the Commvault side. They all share one principle: the retention period is set at write time, and until it expires no one can delete the copy, including the backup administrator.
Immutability doesn’t replace account separation. If the backup storage, the backup console and the primary infrastructure sit in one domain with the same administrators, an attacker needs just one account.
On ready-made solutions. Commvault’s HyperScale X is good because it ships already hardened and doesn’t require you to build and harden a repository by hand.
S3 in Uzbekistan
Backup to a local cloud
The localization law as amended in 2026, the hosting model and the link arithmetic.
The cherry on top is a copy outside your own infrastructure. For Central Asia, that’s almost always a local cloud, and the reason isn’t only technical.
Since 2021, Article 27-1 of the Law on Personal Data required citizens’ personal data to be stored on technical means inside the country. In March 2026 the law was relaxed: localization remained mandatory for biometric and genetic data and for telecom operators’ subscriber data. The rest can be stored abroad subject to adequate protection in the country of storage, approved contractual terms or international standards. For banks, the requirements of the sector regulator come on top of this, and they should be checked separately. So a foreign cloud is no longer prohibited by default, but for telecom and biometrics the question is still closed.
For a local copy, two options remain. The first is your own object storage in a rented rack at a data center operator: your own hardware and software, someone else’s site. The second is S3 as a service from the operator itself. The second is faster to launch; the first gives more control.
What to check in both cases: whether object lock is supported, where the data physically resides and who has administrative access to it, and on what terms you can take your data back when you exit the contract.
And the link arithmetic, which for some reason gets done last. The first full copy of 100 TB over a 1 Gbit/s link at full utilization takes more than 9 days; at a realistic 70%, about two weeks. At 10 Gbit/s, from 22 hours to a day and a half. Restoring from the cloud follows the same arithmetic, except that on the day of an incident no one is going to wait two weeks. That’s why a cloud copy is the last step of the ladder, not the first line of recovery.
Checklist
What to check before choosing a design
Twelve questions worth asking before choosing products and editions.
Bottom line
In place of a conclusion
There’s no “Autosave mode=ON” toggle for a data center. There’s a ladder from a clone to the cloud, and each step covers its share of the risks at its own price.
The mistake we see most often is buying the most expensive step and considering the matter closed. A metro cluster without an immutable copy alongside it protects against fire, but not against ransomware and not against your own administrator.
If you’re choosing a platform or revisiting your data protection, let’s lay out the ladder for your systems: which threats are real, which steps you already have, and what the license covers.