TL;DR

• We’ve added Object First to our partner stack. Its Ootbi (out of the box immutability) appliance is a purpose-built backup target with what it calls Absolute Immutability, a Zero Access architecture where nobody, including an admin with valid credentials, can alter or delete backup data.
• The only prerequisite is a Veeam agent sitting between whatever you’re protecting and the appliance. ITogether rents that Veeam agent to you as part of the service, so it doesn’t matter what you’re backing up, cloud workloads, Microsoft 365, on-prem servers, virtual machines, if a Veeam agent can talk to it, Ootbi can protect it. You don’t need to already own or run Veeam yourself.
• Worth knowing upfront: Veeam confirmed in January 2026 that it has acquired Object First outright. The company was originally founded in 2022 by Veeam’s own founders, Ratmir Timashev and Andrei Baronov, after they’d left the business, so this closes an unusual loop rather than opening a new one.
• For organisations still backing up to generic NAS or disk targets, Ootbi closes a specific, well-documented gap: ransomware that reaches the backup repository itself, not just production data.

Why we’ve added Object First to our partner stack

Ransomware that goes after the backup repository first, not just production systems, is now the default playbook, not the exception. A generic NAS or disk target with an admin account attached is exactly the kind of single point of failure that playbook relies on. Object First’s Ootbi appliance is built specifically to remove that single point of failure, and that’s a gap we see in client environments often enough to want a dedicated answer for it. The only prerequisite is a Veeam agent sitting between whatever’s being protected and the appliance, and we rent that agent to you as part of the service, so this isn’t limited to organisations already running Veeam.

That’s the detail worth sitting with. It genuinely doesn’t matter what you’re backing up, cloud workloads, Microsoft 365, on-premises servers, virtual machines, as long as a Veeam agent can sit between that content and the appliance, Ootbi can protect it. The Veeam agent is doing the talking to the orange box; what’s on the other side of that agent is largely irrelevant to the architecture.

What Ootbi actually does

The core claim is Absolute Immutability: a Zero Trust, S3-native object storage architecture where nobody, not even an administrator with valid credentials, can alter the firmware, operating system, storage layer or backup data itself. That’s a materially different promise from “immutability” settings that a compromised admin account can still switch off.

Object First’s Zero Access architecture has been third-party penetration tested by NCC Group, and the company is a signatory to CISA’s Secure by Design pledge, worth checking the actual report rather than taking the marketing claim at face value, which is exactly what we did before adding them.

On the hardware side, the flagship Ootbi appliance is a 2U rack unit that Object First says can be racked, stacked and ingesting backup data within 15 minutes, with up to four nodes clustering together and multiple clusters scaling beyond 7PB. Object First Honeypot deploys a decoy Veeam environment inside the appliance as a tripwire for suspicious activity, and Fleet Manager gives centralised visibility across distributed deployments.

For smaller sites, Object First launched Ootbi Mini in October 2025, a compact desktop tower aimed at remote and branch offices, edge sites and smaller businesses without a dedicated storage team, in 8, 16 and 24TB capacities, with deliveries beginning January 2026. Same Zero Access architecture, same Veeam integration, smaller footprint.

The Veeam acquisition, and why it matters for buyers

In January 2026, Veeam confirmed it has acquired Object First outright. It’s a smaller story than it looks at first glance: Object First was started in 2022 by Ratmir Timashev and Andrei Baronov, Veeam’s own founders, after they’d left the company, and Veeam has now brought that product back in-house rather than continuing to compete alongside it.

Veeam had already been shipping its own hardware-agnostic Veeam Software Appliance since September 2025, which put it in the odd position of competing with its founders’ own follow-on venture. Acquiring Object First tidies that up, and a Veeam spokesperson described the move as offering “the simplicity of a single supplier for an out-of-the-box, immutable backup target appliance that combines hardware and software”, while stating Veeam’s partner ecosystem strategy remains otherwise unchanged.

The genuinely open question, and the one we’d ask on any active deal, is what happens to the existing Ootbi product line as Veeam works through combining it with its own Software Appliance. Neither company has published a roadmap for that yet. That’s not a reason to avoid Object First, the underlying architecture and independent testing stand on their own, but it’s a fair question to put to any vendor or reseller before committing to a multi-year hardware refresh.

What we’re seeing in practice

Two things are driving demand here. First, ransomware groups have got better at going straight for backup infrastructure, so “we have backups” stopped being a sufficient answer some time ago, it matters whether those backups can actually be altered or deleted by whoever just compromised your domain admin account. Second, immutability requirements are creeping into compliance obligations, not just best practice guidance, which is turning this into a checkbox conversation as much as a technical one.

Smaller IT teams without dedicated storage engineers are exactly who benefits most from an appliance model like this. Object First’s own positioning, no security expertise required, is a fair description of what we’ve seen: this isn’t a platform you tune, it’s one you rack and point Veeam at.

UK & New Zealand perspective

UK organisations working towards NIS2-adjacent expectations and NCSC ransomware guidance are increasingly being asked to evidence that backup data can’t be altered post-compromise, not just that backups exist. New Zealand organisations under All-of-Government cyber resilience expectations face a similar direction of travel. In both markets, being able to point to independent penetration testing, rather than a vendor’s own claims, is what actually satisfies an auditor or a board.

Object First Ootbi at a glance

	Ootbi (2U appliance)	Ootbi Mini (desktop tower)
Best suited to	Data centre, mid to large enterprise	ROBO, edge and small business sites
Capacity range	Scales linearly beyond 7PB across clusters	8, 16 or 24TB per node
Deployment time	Rack, stack and ingesting in ~15 minutes	Same architecture, desktop form factor
Immutability model	Absolute Immutability, Zero Access, even admin credentials can’t alter data	Same
Prerequisite	A Veeam agent, rented by ITogether as part of the service	A Veeam agent, rented by ITogether as part of the service
Independent testing	Penetration tested by NCC Group	Penetration tested by NCC Group
Ownership	Acquired by Veeam, confirmed January 2026	Acquired by Veeam, confirmed January 2026

Quick decision checklist

• Consider Object First if: you want a purpose-built, Zero Access backup target rather than a general-purpose NAS or disk array. You don’t need to already run Veeam, ITogether rents you the Veeam agent as part of the service.
• Look at Ootbi Mini if: you’re protecting a remote office, edge site or smaller estate without a dedicated storage team.
• Ask before you commit: how Veeam’s acquisition will affect the Ootbi product roadmap and support model over the life of the hardware.

What we predict

Looking 12 to 36 months out, expect immutable, Zero Access backup storage to move from a differentiator to a baseline expectation on any Veeam deal, in much the same way MFA went from optional to assumed.

We also expect Veeam to fold Ootbi’s architecture into its own Software Appliance over that window rather than run them as permanently separate product lines, worth watching for buyers weighing up long-term hardware investment.

ITogether’s Independent Verdict

Object First earns its place on our partner stack on the strength of the architecture, Zero Access immutability that’s been independently penetration tested, not on the marketing around it. The Veeam acquisition is a reasonable thing to factor into a buying decision, but it’s not a reason to discount the product itself.

The point we’d want any buyer to leave with is the simplicity of the prerequisite: a Veeam agent, which we rent to you as part of the service, is the only thing standing between whatever you’re protecting and Object First’s appliance. It doesn’t matter whether that’s cloud workloads, Microsoft 365, on-premises servers or virtual machines, and it doesn’t matter whether you run Veeam today. If your current backup target trusts an admin account to keep ransomware out, that’s the gap worth closing first.

👉 Want to know if Object First’s Ootbi is the right fit for your Veeam environment, get in touch.

📞 UK +44 (0) 113 341 0123

📞 NZ +64 (0)9 802 2444

📧 hello@itogether.com

FAQs

What does “Absolute Immutability” actually mean?

A Zero Access architecture in which nobody, including an administrator with valid credentials, can alter or delete backup data, the firmware, operating system or storage layer once it’s written.

Do we need to already run Veeam to use Object First?

No. The only prerequisite is a Veeam agent sitting between what you’re protecting and the appliance, and ITogether rents you that agent as part of the service. What you’re backing up, cloud, Microsoft 365, on-premises or virtual machines, doesn’t matter.

Has Veeam really acquired Object First?

Yes, confirmed by Veeam in January 2026. Object First was originally founded in 2022 by Veeam’s own founders after they’d left the company.

What’s the difference between Ootbi and Ootbi Mini?

The same Zero Access architecture in two form factors: Ootbi is a 2U rack appliance scaling to 7PB+ for data centre use, Ootbi Mini is a desktop tower in 8-24TB capacities for remote, edge and smaller sites.