Cohesity Revolutionizes Data Security: Introducing Quantum-Proof NetBackup 11

At a glance

• Post-quantum encryption arrives: Cohesity says NetBackup 11, announced March 24, 2025, protects data in transit against “harvest now, decrypt later” attacks.
• Kyber in TLS 1.3: The release adds a hybrid key exchange that pairs classic X25519 with the Kyber768 algorithm (Kyber became NIST’s ML-KEM standard).
• Veritas roots: NetBackup came to Cohesity with its purchase of Veritas’s data protection business, completed in December 2024.
• Beyond encryption: The release also widens user-behavior monitoring, tightens risk scoring and adds cloud workload support.

Cohesity puts post-quantum crypto into NetBackup 11

Cohesity announced NetBackup 11 on March 24, 2025, and its headline feature is encryption meant to hold up against future quantum computers. Chief product officer Vasu Murthy called it the most powerful NetBackup release to date. The worry it answers is real: data stolen today could be decrypted years from now once quantum machines can break RSA and elliptic-curve keys.

Why backup traffic is a quantum target

A large enough quantum computer could break the public-key math that protects most traffic today. Backup data is a tempting target because it is kept for years. Cohesity’s answer covers data in transit and deduplication traffic inside NetBackup, using a hybrid TLS 1.3 key exchange that combines X25519 with Kyber768. Kyber is the lattice-based scheme NIST standardized as ML-KEM in 2024.

Adopting Kyber-1024 for Enhanced Security

Admins have to switch the feature on. Cohesity’s documentation says post-quantum mode is off by default, works only on RHEL and Windows hosts in version 11, and cannot be used with FIPS mode enabled. It relies on the Open Quantum Safe provider, which the company itself says is still mostly used in research settings, so teams should test before turning it on everywhere.

Where Veritas fits in

NetBackup is a Veritas product line. Cohesity bought Veritas’s data protection business in a deal that closed in December 2024, so NetBackup 11 is the first major release under the Cohesity name.

The Role of Veritas

Veritas documentation and support pages still carry the NetBackup material, and existing Veritas customers are the main audience for the upgrade.

What changes for backup teams

For most shops, nothing changes until they upgrade and enable the setting. Rival backup vendors will likely face questions from customers about their own post-quantum plans.

Behavior monitoring and risk scoring

The release also watches for more kinds of unusual admin activity, which can slow an attacker who has stolen administrator credentials and wants to wipe backups. Risk scoring now suggests safer settings automatically, and suspicious configuration changes can be held for multi-factor approval. Cloud coverage grows too, with support for workloads such as Amazon DocumentDB and Azure Cosmos DB.

What to check before upgrading

Teams that run NetBackup should confirm their primary and media servers run RHEL or Windows before planning a post-quantum rollout, and check whether FIPS mode is required by policy, since the two can’t be used together. Older NetBackup hosts will keep talking the traditional way. Encryption that resists quantum attacks is only useful once it is on.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.