Object First (Ootbi): Ransomware Proof Immutable Backup Storage for Veeam
Object First makes Ootbi, an appliance that gives your Veeam backups true immutability out of the box, so a ransomware attack cannot encrypt or delete them. We supply and stand behind it because, after years assessing backup storage from the vendor side, it is the cleanest immutable target for Veeam we have seen. Here is what it is, who it suits, and how we help you deploy it.
Object First Ootbi is a backup storage appliance built specifically for Veeam that makes your backups immutable, meaning they cannot be altered or deleted for a set period, even by an attacker with admin credentials. It uses S3 Object Lock immutability on a hardened Linux appliance with no root access, racks in about fifteen minutes, and scales from a small desktop unit for branch sites up to petabyte clusters. We supply Ootbi and help you size and deploy it. It only works with Veeam, which is the point, not a limitation.
If your backups can be reached and encrypted, they are not a recovery plan, they are another target. That is exactly what modern ransomware goes after first. It finds the backup repository, deletes or encrypts it, and then holds the live data to ransom knowing you have nothing clean to restore from. Immutable backup storage closes that door. Object First was built to do one job extremely well: be the immutable landing zone for Veeam, with none of the complexity that usually comes with hardening a repository yourself.
C4C is an independent UK technology consultancy. We spent years on the vendor side of storage and data protection, building the quotes and making the claims, so we do not recommend a platform lightly. We supply Object First because it is, in our assessment, the simplest and most robust way to give Veeam backups genuine immutability, not because we are obliged to. Object First was founded by Veeam's own founders and, as of early 2026, is owned by Veeam, so the integration is as close as it gets. We will always tell you honestly where it fits and where it does not.
What is Object First Ootbi?
Ootbi, which stands for Out of the Box Immutability, is a purpose built backup storage appliance. You point Veeam at it as an object storage repository and every backup written to it is immutable for a retention window you set. During that window nothing can change or delete those backups, not a rogue admin, not stolen credentials, not ransomware that has spread across your network. The immutability is enforced by S3 Object Lock and the appliance runs a hardened Linux operating system with, in the vendor's words, zero access to root, so there is no login an attacker can abuse to turn protection off. Communication between Veeam and the appliance uses Object First's Smart Object Storage API (SOSAPI) over HTTPS, so the traffic between them is encrypted.
The design goal is that it is boring to run. It racks, stacks and powers on in around fifteen minutes, there is no storage tuning to do, and capacity and performance grow simply by adding nodes. That matters, because the security value of an immutable repository collapses the moment it is misconfigured, and most self built hardened repositories drift over time. Ootbi removes the chance to get it wrong.
Why immutability matters
The widely used backup rule is 3-2-1, three copies of your data, on two types of media, with one copy off site. Against ransomware that is no longer enough, because an online copy can be found and destroyed. The rule has moved on to 3-2-1-1-0: the extra 1 is a copy that is immutable or offline, and the 0 means zero recovery errors, a backup you have verified you can actually restore from. Object First is built on the same thinking, a model Veeam calls Zero Trust Data Resilience, which assumes a breach will happen and keeps the backup separated and locked so it survives one. Ootbi is that immutable copy, kept online for fast recovery but locked so it cannot be touched. If you want the honest, vendor neutral picture of what storage immutability really buys you and what it does not, we have written that up separately in our storage immutability guide.
It also watches for the attacker
Immutability is the guarantee that a backup survives. Ootbi adds a second, quieter layer: an early detection feature that stands up a decoy Veeam backup server on a segmented part of the cluster, as a tripwire. Nothing legitimate ever touches it, so any probing or attempt to reach it is a strong signal that something is wrong, and it is reported straight to your team by email or into your SIEM. It will not stop an attack on its own, but it can tell you an intruder is moving towards your backups before they get there, which is often the earliest warning you will get.
The range: from branch office to enterprise
There are two form factors, which is what lets us recommend it across quite different organisations.
Ootbi
The enterprise appliance
A 2U rack mounted node with capacities up to 432TB, clustering to 1.7PB across a four node Veeam scale out backup repository and beyond 7PB across multiple clusters, with backup speeds of up to 8 GB/s. This is the fit for a data centre estate protecting a serious volume of Veeam backups.
Ootbi Mini
For branch, edge and smaller sites
A compact desktop unit in 8TB, 16TB and 24TB sizes with the same immutability and the same Veeam integration, aimed at remote offices, edge locations and smaller organisations that run their own Veeam but do not have a data centre. It is how immutable backup becomes realistic below the enterprise tier.
Both give you the same core protection. The Mini is the reason we can help organisations that are not enterprise scale but do run their own IT and their own Veeam. If you want the detail on the smaller end, see our guide to immutable backup for branch, edge and smaller sites.
How you buy it: CapEx or Consumption
Ootbi now comes two ways, and the choice is about cash flow rather than capability. Both give you the same appliance, the same immutability and the same support. The traditional route is a straight purchase. The newer route is a consumption subscription, where you pay monthly for what you use rather than buying the hardware up front. Both are available in the UK.
CapEx
Buy it up front
You own the appliance for a fixed term of up to five years, with software, updates, technical support and on site service included. It is the simpler answer when your backup volume is steady and not expected to grow much over that period, because you pay once and the cost per terabyte is fixed.
Consumption
Pay per use, from 10TB
A subscription that runs a year at a time, with no upfront payment and predictable monthly billing. Capacity runs from 10TB up to 7PB, and hardware refreshes, updates, technical support and on site service are all included. You are billed for a base capacity each month, and if you go over it the overage is charged the following month by the terabyte. As you consume more, the price per terabyte falls.
The honest steer, and the one we can give from the vendor side, is this: consumption suits an estate that is growing, or one that would rather not tie up capital in storage, because there is no hardware refresh to manage and no large cheque at the start. CapEx suits a static estate viewed over five years. It is a sizing conversation more than a pricing one, and it starts with how much you are protecting now and where that is heading. We run that with you, using Object First's own sizing tool, so you are not over or under buying.
How we help
We are not a box shifter. We supply Object First as part of getting your Veeam recovery genuinely ransomware resilient, which means sizing it to your real backup volume and retention, making sure it sits correctly in your Veeam design, and being straight with you if a different approach fits better. Because we came from the vendor side, we know how this kit is priced and positioned, so you are not paying for guesswork. The conversation starts with what you are protecting and what you need to be able to recover, not with a part number.
Want immutable backups that survive an attack?
Tell us what you run and roughly how much Veeam backup you are protecting, and we will give you a straight read on whether Object First is the right fit and how to size it. No obligation, and if it is not right for you we will say so. Ootbi works with Veeam only, so a quick word about your setup saves everyone time.
Prefer email? Reach us directly at hello@c4cgroup.co.uk.
Frequently asked questions
What is Object First Ootbi?
Ootbi, which stands for Out of the Box Immutability, is a backup storage appliance built specifically for Veeam by Object First. You use it as a Veeam object storage repository, and every backup written to it becomes immutable for a period you set, so it cannot be altered or deleted, even by someone with admin credentials or by ransomware. It uses S3 Object Lock and runs a hardened Linux appliance with no root access.
Does Object First work with anything other than Veeam?
No. Ootbi is purpose built for Veeam and works with Veeam only. That is deliberate. By targeting one backup platform it can be tuned, hardened and kept simple in a way a general purpose storage box cannot. Object First was founded by the founders of Veeam and is now owned by Veeam, so the two are designed to work as one.
What makes the backups immutable?
Immutability is enforced using S3 Object Lock, and the appliance runs a hardened Linux operating system with zero access to root. Once a backup is written it is locked for the retention period you choose and there is no administrative login an attacker could use to unlock or delete it early. That is what makes it survive an attack that has already compromised your network.
Does Ootbi only resist an attack, or can it detect one?
Both. The immutability means an attacker cannot alter or delete your backups. On top of that, Ootbi has an early detection feature that places a decoy backup server on a segmented part of the cluster as a tripwire. Because nothing legitimate should ever touch it, any activity against it is reported to your team by email or SIEM as an early warning that someone is probing your backup environment.
Is there a version for smaller sites?
Yes. Alongside the enterprise 2U appliance there is Ootbi Mini, a compact desktop unit in 8TB, 16TB and 24TB sizes with the same immutability and Veeam integration. It suits remote offices, edge locations and smaller organisations that run their own Veeam but have no data centre, which is what makes immutable backup practical below the enterprise tier.
Can I buy Ootbi as a subscription instead of paying up front?
Yes. Alongside the traditional upfront purchase, Ootbi is available on a consumption model: a pay per use subscription that runs a year at a time, with no capital outlay and simple monthly billing. Capacity runs from 10TB to 7PB, and hardware refreshes, software updates, technical support and on site service are all included. It is available in the UK. Which model works out cheaper over five years depends on how much your backups grow, so we size it with you before recommending either.
Does the consumption model change the immutability or the support?
No. You get exactly the same appliance, the same S3 Object Lock immutability and the same hardened Linux with no root access, whichever way you pay. The consumption model changes the commercial terms, not the protection. It also folds in the hardware refresh, so you are not managing an appliance lifecycle on top of the subscription.
Do you resell Object First, and does that make you biased?
We do supply Object First. We are also independent advisers, and we recommend it because after years assessing backup storage from the vendor side we think it is the cleanest immutable target for Veeam available. If it is not the right fit for your situation we will tell you, because our reputation depends on the advice being honest, not on shifting a box.
We do not run Veeam yet. Can you still help?
Yes. Ootbi needs Veeam to work, so if you are not on Veeam we will talk you through what that involves as part of the wider picture, rather than pretend the appliance stands alone. The best first step is a short conversation about what you are protecting today and what you need to be able to recover.