Are QNAP products unsafe to deploy?

That's too strong. Properly configured QNAP devices (not exposed to the internet, strong admin passwords, firmware updated, no unused services running) are generally safe. The DeadBolt and Qlocker incidents disproportionately affected devices exposed to the internet with weaker configurations. For enterprise deployments behind firewalls with proper hardening, QNAP's enterprise models are defensible. For internet-accessible storage, QSAN has a better track record.

What about feature parity at the enterprise tier?

At spec level, QNAP's ES-series and QSAN's XCubeSAN/XcubeNXT are comparable (dual-active controllers, enterprise IOPS, standard protocols, VMware/Citrix/Hyper-V certifications). The decision typically comes down to track record, support preference, and app ecosystem requirements rather than pure feature availability.

Does QSAN have a surveillance recording solution?

QSAN doesn't have an equivalent to QNAP's QVR Pro. For surveillance workloads specifically, QNAP is the better fit. For separation-of-concerns architectures where surveillance runs on dedicated NVR hardware and QSAN handles production storage, that's often the cleaner design.

What does CRS typically recommend?

For production storage workloads where security track record and enterprise SLA support matter, QSAN. For mixed-use NAS deployments where the QTS app ecosystem is part of the requirement, QNAP. We distribute QSAN not QNAP, but we're honest about where QNAP's advantages apply.

Comparison Guide

QSAN vs QNAP Enterprise: The Security Track Record Difference (2026)

Two Taiwanese storage vendors, one with a clean security record. Why the difference matters for production workloads.

Option A

QSAN

Enterprise-only storage, clean security record.

Option B

QNAP (Enterprise)

QNAP

Mass-market NAS with enterprise line.

Quick Summary

Both are Taiwanese storage manufacturers, both offer enterprise-class models, and on feature-parity the two can look similar on spec sheets. The structural difference is security track record. QNAP has had multiple major ransomware incidents (DeadBolt, Qlocker) affecting tens of thousands of devices. QSAN has no comparable incident in its history. For partners deploying production storage to customers and being accountable for the consequences if ransomware hits, that track record is a genuine differentiator. QNAP's broader product range and app ecosystem are real advantages; QSAN's enterprise-only focus is also a real advantage.

QSAN

QSAN's product family focuses exclusively on enterprise storage: XN2 SMB NAS, XCubeSAN dual-active SAN, XcubeNXT unified storage, XF5 all-NVMe. No consumer products. No DeadBolt or Qlocker equivalent security incidents in the company's history.

QNAP

QNAP (Enterprise)

QNAP makes NAS products across the consumer, SMB, and enterprise tiers. The enterprise range (TS-h, ES-series) targets production workloads. QNAP has had multiple major ransomware incidents (DeadBolt 2022, Qlocker 2021) that encrypted thousands of internet-facing QNAP devices.

Head-to-head comparison

Feature	QQSAN	QNQNAP (Enterprise)
Product range focus	Enterprise only	Consumer + SMB + Enterprise
Security incident track record	No major ransomware incidents on record	DeadBolt (2022), Qlocker (2021), multiple CVEs
Dual-active controller options	XCubeSAN, XcubeNXT, XF5	TES / ES series (Enterprise only)
Third-party drive support	Yes	QNAP compatibility list
Maximum IOPS	1.8M (XCubeSAN), higher on XF5	Comparable on enterprise models
Operating system	QSM / SANOS / XEVO	QuTS Hero / QTS
App ecosystem	Focused (storage-centric)	Large (app store, surveillance, etc.)
Enterprise certifications	VMware, Citrix, Hyper-V certified	VMware, Citrix, Hyper-V certified
AU distribution + support	CRS direct, AUD, local SLA	QNAP AU + channel
Entry cost	Enterprise-tier	Lower entry (SMB models bring average down)
Positioning	Professional-only	Consumer through enterprise

Highlighted cells show where one product has a clear advantage for the majority of Australian mid-market and MSP use cases. Ties are unhighlighted.

The security track record

This is the key differentiator and the reason many Australian partners prefer QSAN. QNAP has had two major ransomware incidents that affected large numbers of customers:

Qlocker (April 2021). Tens of thousands of internet-facing QNAP devices were encrypted by the Qlocker ransomware over a short window. Attackers exploited QNAP vulnerabilities to deploy 7-Zip encryption across user data. Many victims paid ransom in bitcoin to recover data.

DeadBolt (January 2022 onwards). DeadBolt specifically targeted QNAP devices exposed to the internet, encrypting data and demanding ransom. QNAP pushed firmware updates, but DeadBolt resurfaced multiple times across 2022 with different variants. Some victims lost data despite paying.

QNAP's response to both incidents has improved security posture, but the incidents happened, they affected real customers, and the pattern of internet-facing QNAP devices being high-value targets for ransomware is established.

QSAN has no comparable incident in the company's history. Part of that is the product-range positioning, QSAN doesn't sell to the mass consumer market, so there isn't the same density of internet-facing devices to target. But partners who've dealt with QNAP ransomware events take the track-record difference seriously.

Enterprise focus vs consumer-to-enterprise spread

QNAP spans from consumer (single-bay TS-x for home use) through SMB (TS-h53x for small offices) to enterprise (ES-series dual-controller). That product range is genuinely useful for partners who want one vendor across every customer size, but it does mean enterprise engineering resources are shared across consumer work.

QSAN is enterprise-only. Every engineering cycle, every firmware release, and every support investment is targeted at enterprise customers. The product range is narrower but the focus is tighter.

Which shape fits better depends on the partner's business. For a partner serving customers across the full spectrum (home-office to mid-market to enterprise), QNAP's range is a real operational advantage. For a partner focused on mid-market and enterprise customers where production uptime matters, QSAN's focus pays off.

Where QNAP still wins

Two genuine QNAP advantages worth naming.

App ecosystem. QNAP's QTS app store has hundreds of applications covering surveillance (QVR Pro), productivity, backup, virtualisation, container runtime, and more. QSAN doesn't have an equivalent. For customers who want a storage device that also runs surveillance recording and hosts application workloads, QNAP's app ecosystem is a meaningful feature.

Price at the low end. QNAP's SMB models bring average pricing down and serve workloads where QSAN is over-engineered. For a 4-bay SMB NAS for file shares, QNAP and Synology both sit at price points QSAN doesn't target.

For pure enterprise-storage workloads, these advantages don't usually apply. For broader deployments where apps or low-end price matter, they do.

Feature parity on enterprise models

QNAP's enterprise ES-series offers dual-active controllers, SAS connectivity, enterprise IOPS, and VMware/Citrix/Hyper-V certifications. QSAN's XCubeSAN and XcubeNXT offer the same. On raw enterprise feature parity, the products are broadly comparable.

The decision usually comes down to three factors: security track record (QSAN preferred), app ecosystem (QNAP preferred if needed), and AU support experience. CRS distributes QSAN with AUD billing, local SLA support, and engineering escalation. QNAP has AU channel presence but the partner's experience depends heavily on which distributor and which reseller chain the product goes through.

When to choose each

Choose QNAP when:

Customer needs QTS's app ecosystem (surveillance, productivity apps, container runtime).
Deployment is across a range of sizes from SMB to enterprise and single-vendor consistency matters.
The customer is not internet-facing (reducing ransomware attack surface).
Price at the SMB tier matters and QSAN is over-engineered for the workload.

Choose QSAN when:

Security track record is a decision factor (especially for internet-accessible storage).
Enterprise workloads (production VMs, databases, VDI) are the use case.
Third-party drive flexibility matters for TCO.
AU SLA-backed support is required.
Partner prefers a vendor focused exclusively on enterprise storage.

Frequently asked questions

Not that we're aware of. No major ransomware event comparable to QNAP's DeadBolt or Qlocker has been reported against QSAN devices. The smaller consumer-device footprint is part of why, but QSAN's security track record across the enterprise product range is clean.

Evaluating enterprise NAS with a clean security record?

CRS distributes QSAN enterprise storage across ANZ and the Pacific with AUD billing and local SLA support. We will scope the right product against your workload and compare against QNAP ES-series pricing.