Cohesity

1.1 Corporate Identity, Operating Model, and Foundation

Cohesity was founded in 2013 by computer scientist Mohit Aron, who previously engineered the Google File System and co-founded Nutanix before pioneering hyperconverged secondary data architecture. Headquartered in San Jose, California, the company operates as a privately held software provider delivering AI-powered data security, backup, disaster recovery, and unstructured data management across hybrid cloud, multicloud, and on-premises environments. In August 2022, Sanjay Poonen took over executive leadership as Chief Executive Officer and President, bringing executive experience from VMware and SAP, while Aron transitioned to Founder Emeritus. Cohesity monetizes through software licenses, appliance bundles, and managed Software-as-a-Service subscriptions via its Cohesity Data Cloud platform, serving over 12,000 customers globally, including more than 85 of the Fortune 100.[CO001, CO002, CO004, CO009]

1.2 Financing History, Veritas Combination, and Capital Structure

Before its landmark combination with Veritas' enterprise data protection business, Cohesity raised over $650 million in equity across multiple venture rounds, anchored by early backing from Sequoia Capital, Wing Venture Capital, and SoftBank Vision Fund's $250 million Series D in 2018. Following a confidential IPO filing in December 2021 that was subsequently shelved, Cohesity executed a transformative transaction announced in February 2024 and completed in December 2024, acquiring Veritas' core data protection segment for approximately $2.5 billion in cash and an estimated 20.9% equity stake in the combined entity. The transaction valued the combined business at approximately $7 billion, funded via a Series H equity round led by Haveli Investments and substantial term loan B debt arranged by J.P. Morgan, which also served to facilitate a debt paydown for Veritas Technologies. The carve-out separated Veritas' enterprise data protection assets—including NetBackup and Alta—from its remaining InfoScale, Compliance, and Backup Exec operations, which were spun into an autonomous company named DataCo under Carlyle.[CO003, CO005, CO006, CO007, CO010, CO013]

1.3 Governance Structure, Enterprise Scale, and Strategic Risks

Post-merger governance reflects a balanced syndicate of venture pioneers, private equity control sponsors, and independent cyber experts. Board oversight is led by Chairman Gaurav Garg of Wing Venture Capital, alongside Haveli Investments' Brian Sheth, Carlyle's Patrick McCarter, former Veritas CEO Greg Hughes, and independent director Kevin Mandia, with Premji Invest's Sandesh Patnam serving as observer. While the combined business reached pro forma revenues exceeding $1.6 billion to $1.7 billion and approximately $1.5 billion in ARR, integration risks and elevated financial leverage remain critical diligence considerations. Debt market analysts noted concerns regarding the heavy debt package utilized to finance the transaction, while broader research indicates that catastrophic cyber disruptions impose severe financial penalties—with peer executive surveys attributing revenue losses of up to 15% following major incidents—placing heightened operational scrutiny on data security custodians like Cohesity.[CO008, CO011, CO012, CO014, CO015]

1.4 Exhibits

2.1 Market Boundary, Category Scope, and Status-Quo Substitutes

Enterprise data protection has evolved from isolated secondary backup appliances into unified data security, cyber resilience, and cloud data management platforms. The market boundary includes software, managed SaaS platforms, and orchestrated vaulting that protect hybrid enterprise workloads across on-premises infrastructure, multi-cloud architectures, and SaaS applications. Historically, enterprises addressed these workflows by piecing together multiple point tools across fragmented silos, spending tens of billions annually on separate backup, archiving, disaster recovery, and test/dev environments [CM001, CM006]. The modern category encompasses immutable snapshot protection, anomaly detection, automated clean-room recovery, and AI-enabled secondary data querying [CM002, CM004]. Excluded from this boundary are primary production storage hardware arrays, general-purpose enterprise databases, operational Security Information and Event Management (SIEM) systems, and endpoint security agents, which interface with data protection systems via APIs but represent separate IT budget centers. Traditional status-quo substitutes encompass script-driven tape archiving, native hypervisor snapshotting, and legacy on-premises media servers, which carry substantial administrative overhead and lack automated clean recovery against modern ransomware threats [CM004, CM009].[CM001, CM002, CM004, CM006, CM009]

2.2 Addressable Market Sizing, Sizing Lenses, and Analytical Divergence

Evaluating Cohesity's market potential requires examining multiple sizing lenses across third-party research, company disclosures, and analyst projections. Official post-merger disclosures target an aggregate total addressable market (TAM) of $40+ billion, which includes IDC's enterprise data replication and protection software category [CM002]. Within this broader aggregate, IDC's Semiannual Software Tracker pegged 2024 projected vendor sales in data replication and protection software at $12.3 billion, representing the core serviceable addressable software envelope [CM002]. Broader market assessments by Grand View Research and Research and Markets estimate the worldwide enterprise data management sector expanding to $265.68 billion by 2030, reflecting a 14% compound annual growth rate driven by data proliferation and hybrid work patterns [CM007]. Sizing models diverge based on whether hardware appliances, managed backup infrastructure, and cyber recovery services are bundled into software-only figures. Post-Veritas combination disclosures position Cohesity with over $1.7 billion in pro forma revenue and $1.5 billion in annual recurring revenue across more than 12,000 enterprise accounts, establishing a top market share footprint of approximately 19% within fragmented software replication and protection spending [CM002, CM003]. Sizing diligence requires distinguishing core recurring software subscription revenue from hardware appliance passthrough, maintenance renewals, and multi-year legacy contract backlogs [CM014].

2.3 Enterprise Buyer Profiles, Procurement Centers, and Adoption Pathways

Purchasing authority for enterprise cyber resilience platforms is governed primarily by the Chief Information Security Officer (CISO) and the Chief Information Officer (CIO) or Vice President of Infrastructure, reflecting the operational convergence of cybersecurity and disaster recovery. Historically, secondary backup was treated as an operational infrastructure expense evaluated on storage density, recovery point objectives (RPO), and recovery time objectives (RTO). In the current threat landscape, enterprise procurement requires executive cyber-risk sign-off, multi-workload validation, immutable storage guarantees, and integration with incident response workflows [CM004, CM008]. Adoption pathways follow hybrid deployment models: enterprise accounts deploy scale-out software fabrics or appliances to consolidate data center and private cloud silos, while expanding into managed Backup-as-a-Service (BaaS) and Data Management-as-a-Service (DMaaS) models hosted on public clouds such as AWS [CM001, CM005, CM011]. Procurement cycles for multi-workload enterprise platform migrations typically range from 6 to 18 months due to stringent security reviews, proof-of-concept testing against live backup targets, and extensive channel partner staging [CM004, CM010].[CM001, CM004, CM005, CM008, CM010, CM011]

2.4 Growth Catalysts, Operational Headwinds, and Migration Constraints

The adoption of modernized cyber resilience architectures is propelled by compounding operational drivers alongside severe technical constraints. The primary market driver is the surge in enterprise ransomware attacks and cyber threats, which necessitates rapid immutable recovery, early threat hunting, and automated anomaly detection to prevent catastrophic operational disruption [CM002, CM004, CM010]. Cloud data tiering and as-a-service adoption further accelerate demand, with Enterprise Strategy Group research showing that over two-thirds of organizations utilize cloud backup-as-a-service while seeking to eliminate fragmented public cloud copies [CM008, CM011]. Additionally, generative AI platforms like Cohesity Gaia create monetization potential by indexing secondary data repositories for secure enterprise retrieval-augmented generation [CM003, CM010]. Conversely, adoption velocity is constrained by major structural hurdles: merging extensive enterprise customer bases like Veritas creates multi-year technology harmonization and sales cycle complexities, while agile competitors such as Rubrik, Veeam, and Commvault actively compete for accounts in transition [CM003, CM004, CM010, CM012]. Macroeconomic budget scrutiny, switching friction from entrenched tape or appliance infrastructure, and unverified private firmographic metrics represent persistent diligence risks [CM010, CM013, CM014].[CM002, CM003, CM004, CM008, CM010, CM011, CM012, CM013, CM014]

2.5 Exhibits

3.1 Competitive Landscape: Direct Peers, Incumbents, and Architecture Models

The enterprise data protection and cyber resilience landscape is split across three distinct competitive vectors: legacy enterprise incumbents defending heterogeneous mainframe and database footprints, modern scale-out cyber resilience platforms, and software-first volume specialists. Following Cohesity's merger with Veritas' enterprise data protection business in December 2024, the combined entity vaulted to the number one market share position with approximately 19% of an otherwise fragmented industry, protecting over 100 exabytes of data across 13,600 enterprise accounts. In doing so, Cohesity combined its high-growth cloud-native architecture with Veritas' established enterprise accounts, including NetBackup installations across the Global 500. However, this scale puts Cohesity into direct confrontation with Rubrik, which completed an initial public offering in April 2024 at a $17 billion public market valuation. While Rubrik built its posture around zero-trust cyber recovery and cloud-native security, Veeam continues to lead volume adoption via hardware-agnostic, instance-based licensing across mid-market and hybrid enterprise estates. Simultaneously, legacy infrastructure players such as IBM (with IBM Storage Protect) and hybrid incumbent Commvault contest complex hybrid data center environments, while cloud providers offer native snapshotting that serves as an entry-level substitute. Cohesity's strategic response centers on positioning backup repositories as active corporate intelligence assets through AI engines like Gaia, though customer adoption requires navigating significant platform migration overhead.[CP001, CP002, CP003, CP004, CP005, CP006]

3.2 Capability Comparisons, Architectural Friction, and Commercial Models

Evaluating enterprise backup platforms exposes stark divergence in cyber-recovery mechanics, architecture packaging, and total cost of ownership. Direct competitor comparisons highlight that while Cohesity emphasizes scale-out file systems and post-ingest threat scanning across its Data Cloud, rival Veeam attacks Cohesity's operational constraints. Veeam criticizes Cohesity for lacking continuous inline threat scanning during initial data ingest, relying instead on scheduled post-ingest scans or external incident response partners like Mandiant. Furthermore, architectural friction emerges in cloud recovery: whereas Veeam offers cross-platform hypervisor recovery directly to public cloud infrastructure without proprietary hypervisor dependencies, Cohesity deployments historically require standing up cluster appliances or VMware compute within cloud targets. Commercially, pricing structures introduce major evaluation friction. Cohesity packages software via backend-terabyte (BETB) subscription capacity licensing, typically running between $150 and $400 per TB annually before accounting for cyber-resilience add-ons like FortKnox or DataHawk, which can inflate deployment spend by 15% to 40%. Conversely, Veeam promotes predictable instance-based pricing without capacity penalties, while Commvault publishes baseline SaaS prices for endpoint and Microsoft 365 workloads while keeping enterprise front-end terabyte (FETB) contracts heavily negotiated. In secondary platforms like IBM Storage Protect, heavy initial setup costs and complex administration contrast with Cohesity's unified single-pane interface, although PeerSpot buyer engagement data reveals IBM maintaining 1.7% category mindshare against Cohesity's 1.1%.[CP007, CP008, CP009, CP010, CP011, CP012, CP013]

3.3 Moat Durability, Intellectual Property, and Platform Assembly Vulnerabilities

Cohesity's competitive moat rests on three pillars: scale-out file system defensibility, deep ecosystem partnerships, and newly patented AI retrieval intellectual property. On June 3, 2026, Cohesity was granted U.S. Patent No. 12,619,501 for Cohesity Gaia, establishing a protected legal perimeter around running generative AI retrieval-augmented generation (RAG) directly against secondary backup and archive stores in-place without data replication or external pipeline exposure. Backed by strategic equity investments and technical alliances from Nvidia, HPE, and Cisco, Cohesity integrates directly with enterprise hardware ecosystems and modern AI acceleration stacks, while incorporating OEM modules like Cyera for DSPM. Nevertheless, significant adverse vulnerabilities threaten long-term moat durability. Competitor intelligence notes that Cohesity's broader cyber-resilience platform is increasingly assembled from acquired and OEM components: DSPM capabilities rely on resold technology from Cyera (anchored in a US-AWS control plane), identity threat detection and response is OEM'd from Semperis, and the core NetBackup foundation was acquired from Veritas. This multi-roadmap structure creates engineering integration friction. Furthermore, post-merger integration risks surfaced following workforce reductions in mid-2024 and executive turnover, creating potential renewal churn as legacy Veritas accounts face migration decisions amid aggressive takeout campaigns from Rubrik and Commvault.[CP014, CP015, CP016]

3.4 Exhibits

4.1 Revenue Architecture and Delivery Mix

Public evidence supports a capacity-led enterprise model rather than a transparent seat-priced SaaS model. RFP.wiki describes quote-based subscriptions measured in backend terabytes, covering DataProtect, replica and retention entitlements, SmartFiles, archive, and DataProtect-as-a-Service. It also describes software-only, integrated-appliance, and managed-service deployment choices. Cohesity itself says the platform protects more than 1,000 hybrid-cloud and SaaS workloads, while UpMarket describes coverage across cloud, on-premises, and SaaS environments. Together, these sources indicate several monetization surfaces: protected capacity, deployment form, contract duration, and module attachment. They do not disclose revenue mix, recognition policy, renewal behavior, or the gross-profit contribution of each surface, so the bridge below is structural rather than numerical. [CI001, CI003, CI004, CI005]

4.2 Pricing Opacity and Go-to-Market Economics

Cohesity does not publish an enterprise list price in the retained evidence. RFP.wiki reports customary one-, three-, and five-year terms and gives a directional software-only market range of roughly $150 to $400 per backend terabyte annually, while warning that appliances, managed delivery, retention, replication, implementation, and optional cyber-resilience modules can raise total cost. Those figures are third-party estimates, not Cohesity quotes or realized-price evidence. Historical company releases show that capital was directed toward worldwide sales and marketing, research and development, and strategic routes through HPE and Cisco. That history supports an enterprise and partner-assisted motion, but current sales cycle, channel take rate, quota productivity, CAC, payback, and discount dispersion remain private. [CI002, CI006, CI007, CI010, CI016]

4.3 Historical Traction and Financing Signals

The strongest operating disclosures in the assigned evidence are old. Cohesity reported that annual revenue increased 600 percent from 2016 to 2017 and that more than 200 enterprise customers selected the company during two quarters reported in 2018. These are useful evidence of early commercial acceleration, not current revenue or ARR. Financing references are more recent but use different scopes: Tracxn reports $810 million of total funding, UpMarket reports a $950 million Series H in December 2024 at a $7 billion post-money valuation, and Forge reports a derived secondary-market price of $15.67 and $4.69 billion valuation as of June 13, 2026. Funding raised is not cash available, and a modeled secondary value is not an operating-performance measure. [CI008, CI009, CI011, CI012, CI013, CI014]

4.4 Unit Economics, Capital Adequacy, and Verdict

The financial verdict is therefore evidence-constrained. Cohesity addresses a costly buyer problem: Tech Insider reports a Cohesity-linked survey in which CEOs estimated an average 15.17 percent revenue impact from a cyberattack. That supports willingness-to-pay logic, but it does not establish Cohesity's own growth, retention, pricing realization, or profitability. RFP.wiki also records complaints about high cost and difficult-to-predict packaging, creating a plausible pricing-pressure and implementation-friction risk. With no current audited income statement, balance sheet, cash-flow statement, debt schedule, cohort retention, or channel economics in the assigned pool, revenue quality and margin path cannot be underwritten. The immediate diligence priority is a post-Veritas financial package that separates legacy cohorts and reconciles cash, debt, burn, and recurring revenue definitions. [CI015, CI016, CI004]

4.5 Exhibits

5.1 Product Scope and Customer Workflow

Cohesity's current product surface is organized around a single Data Cloud spanning data protection, data security, data insights, and a common platform. The homepage says the platform protects more than 1,000 hybrid-cloud and SaaS workloads, but that breadth is a company claim rather than an independently tested compatibility count. In workflow terms, an enterprise can apply policy-based protection to heterogeneous data, retain recoverable copies, investigate threats, and restore workloads through one product family instead of assembling separate backup and storage tools. DataProtect is the clearest delivery unit: Cisco and an independent catalog both describe self-managed deployment and Backup-as-a-Service options. The practical diligence issue is not whether a broad platform exists, but which capabilities, workload connectors, and management functions are included in each contract and release.[CE001, CE002, CE003, CE004]

5.2 Architecture and Technical Differentiation

The strongest technical evidence is historical but internally consistent. Cohesity's 2016 white paper and Tech Field Day's account describe a scale-out distributed platform using global deduplication, adaptive tiering, workload isolation, and a SnapTree-based snapshot model. Those mechanisms support the product's consolidation thesis: backup, recovery, files, test and development, and analytics can share a common data layer rather than generate additional copies across point products. SnapTree is presented as enabling frequent snapshots and fully hydrated recovery images, while distributed ingest and indexing are intended to spread work across cluster nodes. This establishes a specific architectural lineage, not proof that every current cloud service uses the same implementation. A current component/version map, current scale limits, and independently reproduced throughput or recovery tests remain unavailable in the assigned evidence.[CE005, CE006, CE011]

5.3 Deployment, Integration, and Operations

Deployment flexibility is a material strength and a source of implementation risk. Cisco's validated design documents an on-premises all-flash configuration on UCS X-Series with infrastructure automation and cluster expansion procedures, while the independent catalog describes self-managed, service, and hybrid-cloud models. XenTegra, a Cohesity partner, lists VMware, Oracle, SQL, Microsoft 365, and NAS among supported environments; that is useful integration evidence but remains supplier-channel testimony rather than an independent interoperability benchmark. Historical practitioner coverage also shows node discovery, software-version matching, cluster expansion, and a responsive management interface. Together these sources indicate a mature enterprise operating model, but they also imply dependencies on validated hardware, networking, ports, identity systems, connector compatibility, and disciplined sequential maintenance.[CE002, CE008, CE010, CE011]

5.4 Security Maturity and Open Technical Risks

Cisco's 2023 validated design identifies immutable snapshots, WORM controls, encryption, multifactor authentication, and granular role-based access control as part of the integrated solution. These controls are relevant because backup infrastructure is itself a privileged recovery dependency, but their presence does not establish operational efficacy under attack. InvGate's catalog lists historical Cohesity vulnerabilities, including CVE-2023-33295 for missing TLS certificate validation in older DataProtect versions; this is a secondary compilation, not a substitute for current vendor advisories or an authoritative vulnerability database. The assigned PeerSpot page asks for product weaknesses and reports eight responses, yet its prefetched text does not expose the substantive answers. The resulting risk posture is therefore evidence-limited: controls are documented, while current patch status, certification scope, incident history, recovery-test results, and practitioner criticism require primary follow-up.[CE007, CE011, CE012]

5.5 Exhibits

6.1 Customer Base Segmentation and Enterprise Footprint

Following the completion of its transaction with Veritas' enterprise data protection business in December 2024, Cohesity expanded its installed base from an emerging high-growth challenger into the world's largest data protection software provider by market share. The combined company protects hundreds of exabytes of data across more than 12,000 customers globally. Its penetration into top-tier enterprise accounts is substantial, counting over 85 of the Fortune 100 and nearly 70% of the Global 500 organizations as active clients. Sectoral adoption is anchored in large-scale, highly regulated verticals with demanding cyber-resilience and availability mandates: Cohesity serves all ten of the top ten global financial institutions, all ten of the top ten global manufacturers, eight of the top ten healthcare providers, and eight of the top ten global retail leaders. Historically, legacy Cohesity expanded across diverse enterprise commercial accounts and public-sector agencies including AutoNation, Hyatt, Bungie, LendingClub, Piedmont Healthcare, and the U.S. Department of Energy, but the Veritas transaction concentrated strategic revenue in the global enterprise tier.[CU001, CU002, CU003, CU004]

6.2 Adoption Trajectory, Channel Scale, and Channel Alliances

Cohesity's go-to-market scale and customer deployment velocity rely on a massive joint ecosystem comprising major systems integrators, value-added resellers, and infrastructure hardware OEMs. Value-added technology partners such as World Wide Technology (WWT) and SHI International play central roles in customer architecture, deployment, and operationalization. Partner environments implement Cohesity Data Cloud and DataProtect across diverse production workloads—including VMware, Hyper-V, SQL Server, Network Attached Storage (NAS), and Active Directory—while configuring cyber-vaulting options such as FortKnox and identity threat detection. Additionally, strategic channel integrations with Cisco, Hewlett Packard Enterprise (HPE), and Nvidia provide validated turnkey appliances and accelerated compute platforms that facilitate enterprise rollouts. However, customer research indicates that modern enterprise buyers increasingly face operational pressure from accelerating attack speeds and ransomware extortion, compelling organizations to prioritize business recovery validation and data immutability over basic point-solution backups.[CU005, CU006, CU007, CU008]

6.3 Customer Durability, Dual-Portfolio Risks, and Mindshare Competition

Customer retention and durability represent both Cohesity's greatest opportunity and its primary operational vulnerability. To reassure enterprise NetBackup and Alta customers against forced deprecation, Cohesity instituted a public 'No Customer Left Behind' pledge, committing to multi-year support, pricing lock-ins, and unified management across both legacy platforms via Cohesity Helios. Despite these commitments, independent industry tracking on platforms like PeerSpot indicates that Cohesity Data Cloud held only a 1.1% category mindshare in Backup and Recovery in late 2026, trailing IBM Storage Protect (1.7%) and market leaders. Furthermore, candidate and industry intelligence compiled by Built In emphasizes that the combination created a dual-portfolio reality with overlapping products, where near-term customer retention and expansion depend heavily on clear roadmap convergence, licensing alignment, and predictable migration paths. In the broader market, peer leaders such as Rubrik and Commvault aggressively target enterprise accounts undergoing vendor integration transitions.[CU009, CU010, CU011, CU012, CU013]

6.4 Exhibits

7.1 Regulatory and Legal Compliance Vulnerabilities

Enterprise data protection infrastructure sits directly at the epicenter of expanding global cybersecurity compliance and privacy regulations. According to Cohesity research, 92% of organizations experiencing a material cyberattack suffer formal legal, regulatory, or compliance fallout, including government fines, mandatory breach disclosures, and civil litigation. In heavily regulated verticals such as financial services, 93% of institutions report regulatory or legal repercussions following cyber incidents, while only 5% demonstrate mature cyber resilience postures. For Cohesity, which operates as an enterprise custodian across more than 1,000 workloads including hybrid cloud and SaaS environments, any compromise of backup immutability or secondary metadata catalogs exposes the firm and its enterprise clientele to severe statutory liabilities under global frameworks. Because cyberattacks routinely trigger public earnings guidance revisions and executive accountability, Cohesity's legal risk profile is inextricably tied to customer incident outcomes and verifiable compliance integrity.[CR001, CR002, CR003, CR004]

7.2 Operational Recovery Hurdles and Secondary Storage Security

Operational resilience in enterprise backup environments is increasingly threatened by sophisticated ransomware threat actors who intentionally target and attempt to destroy secondary backup systems to compel ransom payments. While enterprise defenders prioritize threat detection, Cohesity documentation warns that backup system hardening is critical to prevent adversaries from disabling recovery mechanisms. Across enterprise deployments, technical recovery workflows remain a major bottleneck: 97% of surveyed organizations require more than 24 hours to restore operational data from backups following an attack, with 12% requiring at least a full week. Compounding operational friction, 42% of affected enterprises suffer reinfection during recovery procedures due to incomplete threat eradication from historical backup snapshots. Additionally, independent user evaluations from PeerSpot note that while Cohesity Data Cloud provides straightforward administrative interfaces, it must continue refining advanced enterprise recovery features to rival legacy platforms like IBM Storage Protect in complex failover scenarios.[CR005, CR006, CR007, CR008]

7.3 Partner Dependency, Debt Overhang, and Valuation Execution Risks

Cohesity's aggressive expansion strategy combines strategic ecosystem partnerships with large-scale corporate consolidation, introducing substantial execution and financial dependencies. The company relies extensively on strategic technology partners and investors including Nvidia for AI-powered data search initiatives such as Gaia, alongside Cisco and Hewlett Packard Enterprise for joint data center go-to-market integration. However, the closing of Cohesity's complex merger with Veritas data protection unit in December 2024 represents its most significant operational undertaking, uniting Cohesity's rapid revenue trajectory with Veritas's legacy footprint to achieve a 19% market share. While leadership targets a 2026 initial public offering at a valuation rivaling Rubrik's $17 billion market capitalization, public markets will scrutinize combined net revenue retention, post-merger integration friction, and unamortized debt obligations. Private equity capital structures and high valuation multiples create downside exposure if macroeconomic volatility or delayed customer migration hampers profitable execution.[CR009, CR010, CR011, CR012, CR013, CR014]

7.4 Exhibits

8.1 Investment Thesis and Anti-Thesis

Cohesity's primary investment thesis centers on its newly acquired position as the largest data protection software vendor globally following its combination with Veritas's enterprise data protection unit, commanding an industry-leading 19% market share in enterprise backup and data security [CV001, CV002]. The combined entity entered 2025-2026 with an annualized recurring revenue base exceeding $1.5 billion and an adjusted profit margin of 28%, creating an enterprise platform that pairs Cohesity's modern high-growth cyber resilience and AI capabilities with Veritas's vast Fortune 500 installed base [CV003, CV004]. Strategic backing from major technology and ecosystem anchors including Nvidia, IBM, SoftBank, and Cisco further solidifies its position as an enterprise standard in cyber resilience and generative AI data management through products like Cohesity Gaia [CV005, CV006]. However, the counter-thesis is substantial: executive aspirations to achieve an IPO valuation rivaling or exceeding Rubrik's $17 billion public capitalization demand a forward multiple expansion that is difficult to justify without audited disclosure of organic versus legacy growth rates [CV001, CV003]. Furthermore, corporate survey research highlights that 70% of public firms suffer earnings guidance cuts and 68% experience stock declines post-breach, underscoring systemic execution risks across cybersecurity customers [CV007]. Integrating Veritas's slower-growth legacy software assets while managing post-merger debt overhang presents a formidable execution risk, leaving private secondary valuation marks of $7B to $8B as a realistic ceiling rather than a floor [CV008, CV009].

8.2 Recommendation Stance and Entry Discipline

We assign Cohesity a recommendation of track with medium confidence, a high risk rating, and a fair valuation stance relative to its last institutional and secondary marks [CV001, CV008]. While the company's operating scale of $1.5 billion ARR and 12,000 to 13,000 customers provides a durable downside buffer, private market transactions—including an estimated secondary price of $19.80 per share and transaction marks between $7.0 billion and $8.0 billion—fully price in the baseline merger combination [CV003, CV008, CV010, CV011]. Institutional entry discipline requires avoiding secondary markups until the enterprise provides audited financial transparency regarding debt debt quantum, covenant obligations, and net revenue retention across legacy Veritas accounts [CV001, CV009]. If Cohesity attempts an initial public offering in late 2026 seeking Rubrik's 12.75x EV/sales multiple, public equity markets are likely to enforce a steep conglomerate discount due to Veritas's low-single-digit pre-merger growth profile [CV001, CV003]. Therefore, institutional investors should track the asset through its initial post-merger audited reporting periods rather than pursuing private secondary liquidity at current tender marks [CV008, CV011].[CV001, CV003, CV008, CV009, CV010, CV011]

8.3 Scenario Analysis, Peer Multiples, and Exit Readiness

Valuation underwriting requires evaluating Bull, Base, and Bear scenarios against public comps Rubrik and Commvault [CV001]. Rubrik trades at approximately 12.75x price-to-sales on a pure-play cloud security growth profile, while Commvault trades at roughly 7.16x price-to-sales on mature, cash-generative operations [CV001]. In our Base Case (50% probability), Cohesity achieves modest post-merger organic growth in the low teens, commanding a 5.0x to 6.0x multiple on an estimated $1.8B forward ARR base, yielding an enterprise valuation of $9.0B to $10.8B at a late 2026 IPO [CV001, CV003]. In the Bull Case (25% probability), successful cross-selling of Cohesity Gaia AI search and cloud data resilience into Veritas's accounts accelerates blended ARR expansion toward 20%, unlocking a peer-comparable 8.5x multiple and a $16.0B to $17.0B valuation [CV001, CV006]. Conversely, in the Bear Case (25% probability), integration frictions, debt service pressures, and customer churn among legacy Veritas cohorts compress growth into the mid-single digits, resulting in a Commvault-like or discounted private equity multiple of 3.5x to 4.5x, valuing equity at $5.5B to $7.0B [CV001, CV003, CV009]. Downside protection is established by Cohesity's historical equity capitalization, including $810M raised across 7 venture rounds through Series F and institutional support from Carlyle, SoftBank, and Sequoia [CV009, CV012].

8.4 Exhibits