In the first post of this series, we made the case that hypervisor modernization is a security event and laid out five rules for getting through it with your data protection intact.
Two of those five rules include policy consistency can't be a manual process and immutability alone won't save you.
Every workload has to be protected and that protection has to be hard to break. Investments in automated policy consistency and layered security are foundational to hypervisor modernization. All other efforts, from threat detection to recovery, depend on these two conditions.
Policy Consistency Can't Be a Manual Process
Protection must follow the workload.
Modernization rarely happens in one move. A team may stand up Nutanix AHV or Proxmox in one data center, keep VMware in another, and run another virtualization platform at the edge. Each platform brings its own management layer, its own APIs, and its own way of creating and moving VMs.
Each new VM is a protection decision someone has to remember to make.
In most environments, that decision is manual. Someone enrolls the VM, picks a policy, and confirms that the first backup ran. At the pace of a modernization project, these enrollments slip—and the VM that never gets enrolled is the one that matters on the day of an attack.
Rubrik removes the manual step. Rubrik Security Cloud integrates with each hypervisor's management layer to discover VMs automatically as they appear. You define an SLA policy once (covering backup frequency, retention, archival, and replication) and it applies the same way regardless of the platform underneath. When a VM moves to a different hypervisor, you apply the same policy without recreating the SLA for the new environment.
The integrations follow how each platform organizes its workloads. In Nutanix AHV environments, for example, Rubrik integrates with Prism Central for auto-discovery and category-based SLA assignment. When a VM is reassigned to a new category, it inherits that category's associated SLA. For Hyper-V, integration with System Center Virtual Machine Manager provides the same centralized discovery and policy enforcement. SLA inheritance gives every discovered VM default protection, so no workload waits for someone to find it.
Your team manages one set of policies from one control plane, regardless of the mix of platforms the roadmap produces.
On-Demand Session:
Hypervisor Freedom: Unified Protection for Modern Infrastructure
Immutability Alone Won't Save You
Consistent coverage gives you something to protect. The next concern is how well that protection holds up against someone with valid credentials.
Almost every backup vendor claims immutability. But modern ransomware operators work around these claims. They compromise admin credentials, then delete repositories, shorten retention windows, or disable protection before encryption begins. A single control, however well built, gives a compromised credential too much room.
Rubrik applies Zero Trust Data Security™ in layers, so defeating one control does not open the rest. Key controls include:
Immutability by Design: An append-only file system prevents modifications at the storage layer.
Logical Air Gap: Backup data stays off standard network file protocols such as SMB and NFS, closing the paths ransomware typically uses to reach backup repositories.
Retention Lock: Additional security prevents backups from being deleted or modified before their retention period ends, regardless of user permissions.
Quorum Authorization: Multiple independent approvals are required before anyone can shorten retention or delete data.
Intelligent Data Lock: An intelligent recycle bin retains deleted data in a manner customers cannot access when anomalous activity is detected.
Role-Based Access Control with Multi-Factor Authentication: Mandatory MFA covers every session.
Encryption at Rest and in Flight: Backup data stays unreadable even if an attacker reaches the storage media.
5 Data Protection Rules for the Modern Hypervisor Era
Get the Guide
Why These Two Rules Come First
Policy consistency decides what gets protected. Layered security decides whether that protection survives an attack. Together they give a modernization project a foundation that stays put when the hypervisor changes. Whatever mix of VMware, Nutanix AHV, Microsoft Hyper-V, or other platforms your roadmap produces, your team works from one set of policies and one security architecture.
Protected workloads raise the next question: what is hiding inside them? That is the subject of the next post in this series.
If you want all five rules in one place, including the capabilities to evaluate and the questions to ask your vendor, download the guide.
Safe Harbor Statement: Any unreleased services or features referenced in this document are not currently available and may not be made generally available on time or at all, as may be determined in our sole discretion. Any such referenced services or features do not represent promises to deliver, commitments, or obligations of Rubrik, Inc. and may not be incorporated into any contract. Customers should make their purchase decisions based upon services and features that are currently generally available.