Object First (Ootbi): Ransomware Proof Immutable Backup Storage for Veeam
Object First makes Ootbi, an appliance that gives your Veeam backups true immutability out of the box, so a ransomware attack cannot encrypt or delete them. We supply and stand behind it because, after years assessing backup storage from the vendor side, it is the cleanest immutable target for Veeam we have seen. Here is what it is, who it suits, and how we help you deploy it.
Object First Ootbi is a backup storage appliance built specifically for Veeam that makes your backups immutable, meaning they cannot be altered or deleted for a set period, even by an attacker with admin credentials. It uses S3 Object Lock immutability on a hardened Linux appliance with no root access, racks in about fifteen minutes, and scales from a small desktop unit for branch sites up to petabyte clusters. We supply Ootbi and help you size and deploy it. It only works with Veeam, which is the point, not a limitation.
If your backups can be reached and encrypted, they are not a recovery plan, they are another target. That is exactly what modern ransomware goes after first. It finds the backup repository, deletes or encrypts it, and then holds the live data to ransom knowing you have nothing clean to restore from. Immutable backup storage closes that door. Object First was built to do one job extremely well: be the immutable landing zone for Veeam, with none of the complexity that usually comes with hardening a repository yourself.
C4C is an independent UK technology consultancy. We spent years on the vendor side of storage and data protection, building the quotes and making the claims, so we do not recommend a platform lightly. We supply Object First because it is, in our assessment, the simplest and most robust way to give Veeam backups genuine immutability, not because we are obliged to. Object First was founded by Veeam's own founders and, as of early 2026, is owned by Veeam, so the integration is as close as it gets. We will always tell you honestly where it fits and where it does not.
What is Object First Ootbi?
Ootbi, which stands for Out of the Box Immutability, is a purpose built backup storage appliance. You point Veeam at it as an object storage repository and every backup written to it is immutable for a retention window you set. During that window nothing can change or delete those backups, not a rogue admin, not stolen credentials, not ransomware that has spread across your network. The immutability is enforced by S3 Object Lock and the appliance runs a hardened Linux operating system with, in the vendor's words, zero access to root, so there is no login an attacker can abuse to turn protection off.
The design goal is that it is boring to run. It racks, stacks and powers on in around fifteen minutes, there is no storage tuning to do, and capacity and performance grow simply by adding nodes. That matters, because the security value of an immutable repository collapses the moment it is misconfigured, and most self built hardened repositories drift over time. Ootbi removes the chance to get it wrong.
Why immutability matters
The widely used backup rule is 3-2-1, three copies of your data, on two types of media, with one copy off site. Against ransomware that is no longer enough, because an online copy can be found and destroyed. The rule has become 3-2-1-1, where the extra one is a copy that is immutable or offline. Ootbi is that copy, kept online for fast recovery but locked so it cannot be touched. If you want the honest, vendor neutral picture of what storage immutability really buys you and what it does not, we have written that up separately in our storage immutability guide.
The range: from branch office to enterprise
There are two form factors, which is what lets us recommend it across quite different organisations.
Ootbi
The enterprise appliance
A 2U rack mounted node in 64TB, 128TB and 192TB sizes, clustering into the petabytes across a Veeam scale out backup repository, with backup speeds measured in gigabytes per second. This is the fit for a data centre estate protecting a serious volume of Veeam backups.
Ootbi Mini
For branch, edge and smaller sites
A compact desktop unit in 8TB, 16TB and 24TB sizes with the same immutability and the same Veeam integration, aimed at remote offices, edge locations and smaller organisations that run their own Veeam but do not have a data centre. It is how immutable backup becomes realistic below the enterprise tier.
Both give you the same core protection. The Mini is the reason we can help organisations that are not enterprise scale but do run their own IT and their own Veeam. If you want the detail on the smaller end, see our guide to immutable backup for branch, edge and smaller sites.
How we help
We are not a box shifter. We supply Object First as part of getting your Veeam recovery genuinely ransomware resilient, which means sizing it to your real backup volume and retention, making sure it sits correctly in your Veeam design, and being straight with you if a different approach fits better. Because we came from the vendor side, we know how this kit is priced and positioned, so you are not paying for guesswork. The conversation starts with what you are protecting and what you need to be able to recover, not with a part number.
Want immutable backups that survive an attack?
Tell us what you run and roughly how much Veeam backup you are protecting, and we will give you a straight read on whether Object First is the right fit and how to size it. No obligation, and if it is not right for you we will say so. Ootbi works with Veeam only, so a quick word about your setup saves everyone time.
Prefer email? Reach us directly at hello@c4cgroup.co.uk.
Frequently asked questions
What is Object First Ootbi?
Ootbi, which stands for Out of the Box Immutability, is a backup storage appliance built specifically for Veeam by Object First. You use it as a Veeam object storage repository, and every backup written to it becomes immutable for a period you set, so it cannot be altered or deleted, even by someone with admin credentials or by ransomware. It uses S3 Object Lock and runs a hardened Linux appliance with no root access.
Does Object First work with anything other than Veeam?
No. Ootbi is purpose built for Veeam and works with Veeam only. That is deliberate. By targeting one backup platform it can be tuned, hardened and kept simple in a way a general purpose storage box cannot. Object First was founded by the founders of Veeam and is now owned by Veeam, so the two are designed to work as one.
What makes the backups immutable?
Immutability is enforced using S3 Object Lock, and the appliance runs a hardened Linux operating system with zero access to root. Once a backup is written it is locked for the retention period you choose and there is no administrative login an attacker could use to unlock or delete it early. That is what makes it survive an attack that has already compromised your network.
Is there a version for smaller sites?
Yes. Alongside the enterprise 2U appliance there is Ootbi Mini, a compact desktop unit in 8TB, 16TB and 24TB sizes with the same immutability and Veeam integration. It suits remote offices, edge locations and smaller organisations that run their own Veeam but have no data centre, which is what makes immutable backup practical below the enterprise tier.
Do you resell Object First, and does that make you biased?
We do supply Object First. We are also independent advisers, and we recommend it because after years assessing backup storage from the vendor side we think it is the cleanest immutable target for Veeam available. If it is not the right fit for your situation we will tell you, because our reputation depends on the advice being honest, not on shifting a box.
We do not run Veeam yet. Can you still help?
Yes. Ootbi needs Veeam to work, so if you are not on Veeam we will talk you through what that involves as part of the wider picture, rather than pretend the appliance stands alone. The best first step is a short conversation about what you are protecting today and what you need to be able to recover.