Object First built a box that says no

At North Country Healthcare, the nuisance was ordinary. Aging Windows servers needed replacing. Monthly patches briefly took backup storage offline. Health checks delayed jobs. Vendors needed chasing for firmware updates. For a nonprofit consortium of three hospitals and a home health agency in northern New Hampshire, the machinery of keeping a safety net working had become a job of its own.

Then came a more consequential question: could someone with the right credentials destroy the backups? In Object First’s published account, the healthcare group wanted stronger immutability, availability, scalability and Veeam integration. It chose Ootbi. Its reported backup window shrank by 35%. The appeal was partly speed, partly the disappearance of chores.

A safety net with fewer scissors

A backup is useful because it preserves an earlier state of the world. Ransomware makes that proposition awkward: an attacker who can encrypt production data may also hunt down its escape routes. A second copy offers little comfort if the same compromised authority can remove it.

Object First sells an on-premises destination for Veeam backup software. Its appliance, Ootbi, takes its cheerfully awkward name from “Out-of-the-Box Immutability.” Data arrives through the S3 object-storage protocol. Object Lock protects retained backups against alteration or deletion during their immutability period. The company’s Zero Access design removes destructive administrative powers from the storage environment.

The distinction matters. Security often asks people to remember another rule. This product tries to make a dangerous action unavailable. That is the promise behind the company’s phrase “Absolute Immutability.” It is a claim about protected storage, rather than a guarantee that an entire business cannot be attacked.

The founders already knew the neighborhood

Ratmir Timashev and Andrei Baronov had already built Veeam. In June 2022, they publicly launched Object First, with David Bennett leading the company. Ootbi’s official product launch followed in February 2023. The founders were returning to a familiar customer with a smaller assignment: improve the place where Veeam puts its backups.

That focus shaped the engineering. Rather than support every backup application, Object First optimized around one ecosystem. Rather than hand customers software and a hardware shopping list, it combined the two. Rather than build another deduplication stack, Bennett explained in a 2024 interview, it would use Veeam’s capabilities.

There is expertise in choosing what to leave out. Veeam resellers already understood the buyers; Object First gave them another component to sell. Distribution and integration reinforced each other. A narrow technical decision became a practical route to market.

Eight hours becomes four

Centerbase, a legal practice-management software provider, supplies a useful test of the pitch. It already used Veeam and Backblaze B2 for immutable offsite storage. The missing piece was a faster local repository. Centerbase chose Ootbi for local immutability, installation simplicity and Veeam integration.

According to Object First’s customer case study, Centerbase reduced its recovery point objective from eight hours to four. That means narrowing the potential window of lost work. It does not mean every recovery suddenly takes half as long. The case study described a lower recovery time objective as a future opportunity.

North Country Healthcare illustrates the staffing side. Its administrator, Ryan J. Taylor, put it plainly: “We don't have a dedicated team of storage engineers, and now, we don't need them.” These are vendor-published customer accounts, not controlled comparisons. Still, they identify something concrete: less time tending the backup target, more usable time to protect the organization.

The security report has a second act

The interesting part of Object First’s October 2024 security summary is the repair work. NCC Group examined source code and production-ready appliances over 54 days and two testing rounds. The first round identified 20 issues, including a critical command-injection vulnerability. By the second round, 19 were fixed; one low-risk issue remained.

The summary said the remaining issue was not a security threat in the current functional environment. Physical-access attacks were outside the assessment’s scope. Those boundaries matter. The useful lesson is to ask for the findings, their severity and their resolution, then read the test’s limits. A security badge tells a shorter story.

What can a stolen administrator account actually destroy?

A smaller box, a wider footprint

The range has expanded beyond the original rack. Ootbi Mini, announced in October 2025, packages the same approach into a desktop tower for branch offices, small businesses and edge sites, with 8, 16 and 24 TB options. Larger Ootbi systems cluster up to four nodes; multiple clusters extend capacity beyond 7 PB. Advertised performance reaches 8 GB/s, depending on configuration.

Honeypot adds a decoy Veeam environment to flag suspicious activity. Fleet Manager, launched in 2026, supplies centralized cloud-based monitoring for distributed appliances. Neither changes the central job: Veeam manages backup and recovery; Object First provides the storage underneath.

The invoice has conditions

At launch in 2023, Object First advertised pricing from $11 per TB per month. Treat that as historical positioning. Today’s choices are an upfront appliance purchase or a consumption subscription through partners. Consumption includes hardware refreshes, updates, support and onsite service, with a one-year agreement and a 10 TB minimum commitment.

The subscription has operational strings: telemetry needs outbound internet access, and reducing committed consumption waits until renewal. A fully disconnected environment therefore needs a different purchasing assessment. Buyers should also compare a Veeam hardened repository and targets from ExaGrid, Dell or HPE against their own retention, capacity and recovery requirements. A dedicated Veeam appliance makes less sense when multiple backup platforms must share one target.

The ecosystem became the owner

Veeam confirmed its acquisition of Object First in January 2026. By August, Object First was reporting 148% year-over-year bookings growth for the second quarter and customers active in 45 countries. Bookings measure orders, not recognized revenue. The figures describe a growing business built around an unusually specific refusal.

The idea readers can copy costs no appliance budget: examine the recovery path as if privileged credentials are already stolen. Separate the backup system’s authority from its storage, keep another copy offsite, and rehearse a restore. Object First’s argument begins with that uncomfortable question about the administrator. Its product gives one part of the answer a physical shape.