Object First Ootbi: A Laser-Focused Opportunity for the Channel

Indulge me for a moment. Before I can explain why Object First, a company I’d never heard of at the time, grabbed my attention in a crowded expo hall at Veeam’s 2023 VeeamOn partner conference, I need to run through a few key facts:

• Two-thirds of global businesses polled by Sophos early in 2023 say they were victims of ransomware in the prior year.

• About 93% of companies struck by ransomware in the last year say the attacker tried to delete or modify their backups, and 75% say those efforts successfully impacted at least some of their files, according to Veeam.

• Storing immutable backups is the best, and arguably only, way to protect data completely from ransomware.

With that context in mind, you can begin to understand why I wanted to learn more about a still young company dedicated exclusively to one product that helps one community (Veeam’s more than 35,000 partners) do one extremely important thing: Store utterly immutable copies of Veeam backups, and make them readily available for safe recovery when needed.

“It’s purpose-designed for Veeam,” says Tony Liau, Object First’s vice president of product marketing. “That’s our only use case.”

That laser-sharp focus has allowed the company to create an appliance-based solution that delivers a combination of immutability, security, simplicity, scalability, and flexibility I don’t run into a lot. Let’s break that out item by item.

Immutability: Fully 98% of businesses surveyed by Veeam earlier this year said they use immutability or air-gapping to protect some or all of their backups from tampering. Danny Allan, Veeam’s CTO, suspects a lot of them are at least partially deluding themselves.

“There are shades of immutability,” he told me at VeeamON, “and when you ask a customer, ‘do you have immutability’ they don’t always understand the nuances of what that means.”

Object First does, and has gone to what some might call fanatical lengths to ensure that their immutable storage really is immutable. Based on an Amazon S3-compatible protocol, Object First’s solution uses S3’s Object Lock feature in compliance mode, the most restrictive setting, to make meddling with stored backups extremely difficult for would-be attackers—or anyone else.

“Not even the most privileged admin, no root account, no anything can go in and delete that data,” explains Anthony Cusimano, Object First’s chief evangelist and director of technical marketing.

Even that wasn’t quite enough for the company though, he continues, so it supplemented Object Lock and compliance mode with additional proprietary safeguards. “We took some of the best parts and then we also took some of the things that we saw as limitations and rolled our own,” Cusimano says. “Only the absolute .0001% of the cyber hacker elite would be able to get into this thing, and they’d probably need to be in the building to do it.”

Security: Zero-trust security is a model in which no person, process, application, or endpoint is considered implicitly trustworthy, and nothing gets permissions or access to anything else by default. The concept dates all the way back to 2009, when it was regarded as an interesting idea. In an age when mobile and cloud computing have made perimeters irrelevant and attackers have grown frighteningly proficient at penetrating even the most layered defenses, however, zero trust has rapidly gained acceptance as a must-have rather than nice-to-have security strategy.

Object First’s immutability, not coincidentally, is inherently zero trust by design. No one, including an end user’s CEO, the IT provider who sold them the Object First solution, or Object First itself can change backups, delete them, or modify their retention window once they’re written into storage.

“We’re actually pioneering a brand-new space, which is zero trust specifically for backup,” says Vitaly Sukhovsky, Object First’s vice president of channel.

Simplicity: One of the benefits of designing a system to do one thing and one thing only—securely store Veeam backups—is the simplicity it makes possible relative to products with multiple uses, and Object First has taken full advantage of that opportunity. In fact, they’ve named their one and only solution Ootbi, as in “out of the box immutability,” because they’ve setup immutability, zero trust, and almost everything else in advance.

“You don’t need to configure anything because we’ve already done that in the background,” Liau says. “Even a stupid marketing guy like me can get this thing up and running in 15 minutes.”

Scalability: IDC expects the global “DataSphere” to grow 21% this year to a little over 122.8 million petabytes. A lot of that will be business data, which means that both production storage and backup storage will need to expand at comparable rates, and do so in a way that adds space without compromising performance.

Ootbi’s engineering reflects that fact. The “object” part of Object First’s name refers to the company’s use of object storage, an efficient, high-capacity technology the company has specially customized to eliminate performance issues that would otherwise make it a bad fit for backup workloads. The solution’s “stackable” architecture is designed to scale linearly from a performance standpoint as well.

“As you keep stacking boxes, it just keeps getting faster and faster and faster,” Liau says.

You can stack up to four nodes, moreover, each of which provides 128 TB of capacity for a total of 0.5 PB of capacity per cluster. As Cusimano notes, that’s room enough for backups of your Active Directory, your dev team’s latest efforts, and more, instead of just business-critical data alone.

“The truth of the matter is when ransomware hits, it hits everything,” Cusimano says. “Whatever you’re using, it’s all gone.”

Flexible: Ootbi is intentionally inflexible in a lot of areas, like immutability and security, but accommodating by design in a lot of others. The system integrates with any S3-compatible storage service Veeam supports, and you can also split data into separate buckets with customized retention policies.

Commitment to the Channel

The other distinctive quality about Ootbi is that it’s custom-built not just for Veeam storage but for the Veeam channel as well. Here’s where it helps to know that Object First was co-founded by Ratmir Timashev and Andrei Baronov, the same two people who co-founded Veeam. Unwavering, long-term commitment to the channel is a big part of what turned their earlier company into the powerhouse it is today, and is a deeply embedded part of their new company too.

“We are constantly evolving our partnership model and our partner program to better fit the opportunities and needs of our partners,” Sukhovsky says, “whether they’re resellers, integrators, or MSPs.”

For starters, Object First is 100% channel only. “We do not sell our product in any way, shape, or form on our own,” Cusimano says. “We sell only through our partners.”

Veeam partners will find the live 24x7x365 support they receive from Object First familiar too, he adds. “If you love Veeam’s support, you’re going to love ours too, because it’s the same level of support from people who are deeply knowledgeable about Veeam.”

Plus, adding Ootbi to their current offerings is easy for Veeam partners, Object First emphasizes, because the only skills they need to administer the essentially self-managing system are Veeam skills they have now. “Everything they need to know, they already know,” Sukhovsky says.

Which makes Ootbi an interesting business opportunity for anyone in Veeam’s channel. The solution requires very little investment in training and almost no time to deploy and maintain, yet answers a need pretty much every Veeam end user faces. Bundling it into Veeam sales is an easy way to add customer value and dollar value to those deals.

“This is truly a new revenue stream for them,” observes Object First CEO David Bennett. “And a profitable one too, thanks to the high margins we give partners, which can reach 30%.”

Explaining why they deploy Ootbi alongside Veeam to customers can also help partners position themselves as strategic, security-conscious trusted advisors instead of mere resellers, Liau notes. “It elevates the partner from just a VAR to someone who can advise them on best practices,” he says.

All of that, understandably, has the Object First team bullish about the future. “We know that we have the best story to tell on how to complement a zero-trust paradigm, and we know that we can be even better taking feedback from partners into consideration continuously as we do today,” Sukhovsky says. “The rest is just execution and focus.”

From where I sit, they’ve got the focus part down already.