Interviews > ExtraMile Video series

My mind just doesn't work that way. Good problem solver, but not a good builder of instructions and flows. So, I love the technology and I loved understanding it and then teaching other people about it.

And that passion ended up getting honed into the Greenfield product I was working on at the time. No one knew how to demo it. So the sales team started just calling on me saying, Hey, you want to come join our sales calls and demo this product?

I said, absolutely. And I found out shortly thereafter that you can actually do that as a job. And I thought, well, this is so much more fun than coding.

I love explaining how things work. And if I just have to explain to potential buyers, I'd love to do that full time. And shortly thereafter, I found out you could actually do this at a macro scale.

And that was the sort of marketing aspect of this, being able to take the sort of passion I have for storytelling and learning and explaining and building content that other people could then deliver or just see or read and be able to sort of get that quick download of what's going on in my mind. That's really what I'm passionate about. And it's been a really fun journey because every step of the way, I gained an invaluable skill and each next step I take, I take all of those previous things with me and it really helps me integrate and do the best I can because I've got this background working for me.

Host: Moving from coding to customer conversations takes real curiosity, I must say. So heading to the second question for the day. As Chief Evangelist and Senior Director of Solutions Marketing at Object First, you joined as the company's third full time employee.

What were some of the biggest setbacks you faced in building the company's messaging and brand visibility from the start?

Anthony: Well, the hardest thing about being employee number three at a brand new company is you just don't know what you don't know, right? When I joined the company, my boss at the time basically pitched me on my interview on what the product was and what it was doing. And I thought, this is brilliant.

Why is no one else doing this? This seems like a really good idea that should exist already. The product was easy to demo, it was very easy for me to just comprehend and get excited about storytelling.

But I quickly realized the things that I was good at in my past were not the things that I was getting hired for. It's how do you actually sell a hardware appliance? You know, hardware is very different than software.

And then having this appliance that was specifically built for one other company, which is Veeam, being able to think about like, well, okay, this is not just something I can market to everybody. I have to market to a very specific sector of people. It created a lot of interesting and unique challenges.

Also, just the realization that when you're employee number three, there's not a lot of other employees who do their jobs. So I got to learn how to do a lot of people's work, which was fun. But it also meant that I got to really expand my domain knowledge, what I'm good at and what I used to know into lots of new horizons and categories.

So there's a lot of learning early days. And as we brought in more employees and the company began to grow and it grew very quickly, it was also an opportunity for me to help and foster the growth of others, taking all of the stuff that we had built and getting them to sort of, hey, I own this now. This is my passion project as well.

And giving up those things while getting to focus on sort of the next generation of problems we were building and solving for is great. It was a lot of work. It was a lot of fun.

Host: Yeah. Building a brand from the ground up is never easy. And your experience as an early team member is a great lesson for a startup.

So on that note, let's look at how the story grew. You have played a key role in Object First evolving through its emergence from stealth to becoming a part of you. So how did your marketing and evangelism responsibilities change as the brand grew and what lessons did you learn from that?

Anthony: It was, it was really funny because early days we were in stealth, but we were still going to events, right? I went to the VeeamON, we went to VMworld and then VMware Explorer, right? So I was at these events with a stealth product, basically just talking to potential prospects, Veeam customers and getting an understanding and an idea of what their challenges were, what they were running into at the time and how they were dealing with the problem we were solving.

And that really helped me tune in and craft the message of the product that we built. So when we exited stealth, we were able to really hit the ground running and start selling and have a story that was pre-baked. So, you know, I will say anyone's going through this themselves, if you're in stealth, don't feel like it needs to be a secret, right?

Like it's, it's not some closely guarded thing. This is your time to really ask questions and get answers because once you're out of stealth, you know, once we launched our product and we were selling actively, it becomes a lot harder to turn that boat, right? But in stealth days, you can change your messaging, you can change your white papers, you can change your data sheets, you can change whatever you want because no one's really looking at it yet.

And it's opportunity to be agile and really find the thing that works. Coming out of stealth into actually selling, that was a totally different tone shift because then it was, we want to capture this section of the market. Our product early days was very limited in terms of capacity.

So we had a very specific slice of customer we were going after. We had a completely unique solution. No one else in the market was selling or building what we were selling and building at the time.

And I think that's still true to this day for the most part. So it then became a game of, okay, how do we ensure that every Veeam customer is able to ransomware proof their backup data and get them on our solution? And when they don't buy us, let's understand why they don't buy us and keep that feedback for future roadmap items or future conversations to really understand like how we compared against the other offerings in the market.

Host: Yeah, that's a valuable perspective, Anthony. Thank you for that. So let's go ahead now.

What's your take on the importance of security measures such as MFA, least privilege access, recovery testing and immutable backups in building a resilient ransomware defense system?

Anthony: So obviously immutable backup, very important. It was in our product name. Our product was originally, well, it's still called Ootbi to this day, but originally the name Ootbi stood for out of the box immutability.

We wanted to make sure that immutability was front and center. We've since sort of decommissioned using that longer form explanation, but immutability is so crucial and critical for cybersecurity because when you think about all of the components of cybersecurity, you have prevention, you have detection, you have analytics, you know, backup and recovery. Most of the things we do, it's kind of like the human body, right?

Like we exercise, we try and eat healthy. We take vitamins, we take, you know, medicine when we're feeling sick. They're all preventative measures to stop the body from getting sick.

But the difference between the human body and a data center is when we get sick, we have to deal with it and recover. When a data center is infected by ransomware or there is some kind of cybersecurity breach, you have an out, which is recovery. If you have a good clean copy of that environment, you are able to quickly get it back and start recovering back in the environment as if it was never infected at all.

Now obviously that there's a lot of components that work to make that a seamless and easy process. But the most important part is the fact that that backup doesn't change when it's in storage, right? Because if the ransomware gets access to the backup, it doesn't matter.

It's going to delete it. It's going to mutate it and alter it and turn it into something unusable. Immutability is the only way to ensure that you can recover when something goes tragically wrong.

I also want to hit on, you said another thing that just I'm incredibly passionate about is least privilege access. And while, you know, we're not selling a product that is going to help you implement this yourself, I am a huge advocate for least privilege access in general because, you know, our product Ootbi, you could know every secret, you could have the admin username and password, and it wouldn't matter because everything's segmented underneath to prevent data threats and deletions from occurring when all secrets are known.

But so many folks today, I hate to say it, it's not just like backup and IT admins, it's cybersecurity as well. There's this old mentality, and I see this from my dev days, right? When I was a developer, there's this mentality that administrative rights and what I own is part of my job description and functionality.

So the more I own, the more important I am. And I think that is a complete miss on how we build and think about environments. One, the less you have access to and the less you own means there's less chance of your credentials being used to spread an infectious activity.

But also it means you really get to focus in on your specific slice of ownership and functionality when you apply least privilege access correctly. And you have each individual own their slice and have to jump through incredible hoops to get access to other slices. That's the same path of resistance that any bad actor or ransomware attack has to go through.

And it is a great way to stop the spread and ensure that when it comes time to recover, you're only recovering one or two things that got hit versus your entire environment, which is a much more laborious operation.

Host: Yeah, totally agreed. Strong defense depends on incorporating the right security measures, including least privilege access, immutability, and backup. So moving on to the next, Object First was shortlisted for ransomware protection and recovery company of the year in the Computer Security Magazine Awards 2026.

So what key developments or progress do you think contributed to this recognition of the company?

Anthony: The biggest thing we do that I don't see other, and like I said before, there aren't many other vendors that do exactly what we do. We are a backup storage target and that's it. You can't buy an Object First Ootbi and use it to host your video files or anything like that.

That's not what it's designed for. It's designed specifically to ingest Veeam backup data and to be able to recover Veeam backup data either through file or instant recovery quickly and efficiently and keep that data immutable. No one else is doing that specific thing, which I think is one key part of this, right?

We built something that is single purpose in its goal. And when you do that, just like least privilege access, when you really focus in on the problem you're looking to solve, it makes it very easy to secure it, to ensure it does exactly what you want it to do every time. And also it really helps you focus on the optimization angle because you can build a storage box that does everything for everyone, but that means it's not going to do anything well when you have one problem you're looking to solve, ingest, make immutable and make quick recovery for Veeam backup data.

You're basically doing the minimal amount of operations and optimizing that becomes much easier. That's point one. But I think the other thing to consider, and I would like to see other storage vendors do this, is to consider the approach not only of least privilege access, but zero access, right?

Again, getting into that developer mentality, IT and developers in security love to have administrative access. They love to be able to say, hey, if I needed to, I'd go factory reset this box. But that is a critical point in the security chain, right?

If I can go in with admin access and I can factory reset the box, that data is not immutable. If I can go in and get root access or get operating system access and chmod the access permissions for whatever the files are, it's not immutable, right? You can say your storage is immutable all day and every day at the storage layer, that's fine.

But if it's not immutable from all the underlying layers, storage layer, operating system, firmware, hardware, you've missed the mark because ransomware, and now that ransomware is powered by AI, it's not looking for the traditional path of, I'm just going to use admin and disable it. It's like, okay, that probably won't work. It's going to go under.

If it's hosted on a hypervisor, it's going to go into that hypervisor layer and it's going to delete the underlying infrastructure. If it's hosted on physical hardware, but you have access to the operating system, it's going to go through that layer. You have to consider locking out access to the underlying layers that support your backup immutability.

And when you do that, you can always ensure recoverability because if you can't access it and if the vendor can't access it, then ransomware certainly can't access it.

Host: Totally agreed. And the recognition truly reflects how Object First's efforts to make backup storage and simple and secure is advancing. So on that note, absolute immutability is designed to prevent privileged administrators or attackers with administrative credentials from updating or deleting backup data.

How does this approach boost an organization's ability to recover from a ransomware attack?

Anthony: So, we talked a little bit about zero access in the last question. And that's step one, right? As long as the data is immutable, you can always get it back.

So that's first point of help is we're actually allowing you to get your data back and it should be unaltered. But point two, I think this is something a lot of people miss. When we talk about absolute immutability, one of the things that we're putting out there is the fact that data has to be immutable the moment it's written.

People forget that if you are not using encryption, if you're not using a secured API to capture and send that data, you could have man-in-the-middle attacks. If you're sending your data to, if you're using like snapshots and there's snapshot orchestration and it's residing on some kind of cache or buffer. If you're smart, if it's a smart powered ransomware, most ransomware is smart today.

Most cyber attack utilities are smart because they're AI powered. It's going to look for where are those points where the data isn't immutable. So absolute immutability dictates the data must be immutable from the moment it is written to the device.

Now you can further embolden this by using something like what we offer, which is a hardened target appliance. And the great thing about appliances are this, especially when they're purpose-built like ours is, you know, we enforce Eight Eyes Support Protocol. So let's say you messed up and you absolutely filled up your box with a whole bunch of junk data and you didn't mean to, you backed up way too much stuff and you now can't run new backups.

So you want to factory reset the box and get it set to, you know, clean slate so you can actually rebuild your backup strategy. You can't just go and factory reset the box. Obviously with zero access, we've disabled that.

You also can't just call into support and ask them to factory reset the box. What we do is we use something called eight eyes protocol, which means that you have two different individuals on the customer side and two different individuals on the vendor side or the Object First side that have to validate. We all are who we say we are.

And before we do any kind of action to your box, this validation has to occur across all four parties. This way we know you're not being, you know, fished or compromised or puppeted by some deep fake AI that looks and sounds just like you. It's like, no, you are who you say you are.

We do validation of identification. And the same thing happens on our end because you can't trust your vendor. Right.

And that's something I want to get the point across. We don't even trust ourselves. And that is truly the most zero trust thing you can do is to basically say, hey, when you're calling into support, we want you to validate you are talking to Object First support team.

And this way, no matter what the action that's being committed that occurs, there is four different people that validate this action that is occurring is legitimate. It is not being perpetuated by a cyber attack or a cyber threat. And you will never find yourself in a situation where the data is able to be unrecoverable.

Host: Totally. Recovering ransomware attack is a big task and Object First is totally advocating absolute immutability on that note. So let's take this conversation further.

Object First is mainly focused on making data backup, storage, secure, simple and powerful. What are the biggest challenges organizations face in balancing strong ransomware protection with storage and operational simplicity?

Anthony: Well, today, I think one of the big issues is storage has become needlessly complicated for no good reason, really. It's storage. Right.

We think about what storage used to be. It's like, hey, you plug in a hard drive, you write data to it and, you know, hopefully it doesn't the mechanics don't break. Storage has become something that you require a storage admin for.

Right. There's an IT position for storage admins and companies and backup admins that might be managing storage themselves. What got lost along the way is it's still storage and it is a vendor's responsibility to secure that storage and make it zero access.

Make it absolutely immutable. That should not fall to the admin needs to be managing the requests of their peers saying, hey, I accidentally deleted his email. Can I get it back?

And you're like, yeah, sure. Let me get you that email back. They shouldn't have to go and then fuss with their storage to ensure that happens.

So one of the pleasant byproducts of building a very secure product is when you lock down everything, you really limit the number of operations your end users can do. In an Object First case, our storage appliance takes less than 15 minutes to set up. The hardest part of the setup is actually lifting the box because it's quite heavy and getting it in the rack.

But you can create S3 keys, you can create S3 buckets, you can enable MFA, you can set up email notifications, and that's really it. There's nothing else you can do inside our product. Once you create that S3 key and bucket, you plug that information into Veeam, Veeam starts writing your existing backups into our device, everything else is optimized, automated, and managed by us.

You want to update the thing, you pull it directly from our repository, and we do a firmware update that is completely automated by us. Storage should not be complicated, and secure storage should be even less so because when you're securing something, you're basically taking away permissions and access from your end users. So in the case of a backup storage target appliance like ours, we made it so simple by product of, the more access we gave, the more complicated it got, so we removed all of that.

And there's no way to break into it, there's no way to hack it. We actually send our box off once a year to a third-party penetration testing firm. We give them access to our source code and the hardware, have them run a gamut of tests, and they give us a bill of health.

We respond to anything they find. Last time we did it, they didn't find anything beyond deemed informational because there's just no access, right? It's quick and easy because it's a very simple and secure box.

So I think that's a lot of what it comes down to is security can lend to simplicity and we shouldn't be expecting backup and storage admins to have to become experts in Linux or security or anything else to be able to do their job. That should be handled and optimized by the vendor themselves.

Host: Surely, you identified the major pain points organizations face today and it's clearly, you know, interesting to know how Object First is addressing them. So moving on to the last one for the day, you have worked a lot with technology-spanning software development and CI/CD to data protection, cybersecurity, and solutions marketing. What emerging technology trends do you think are booming right now and what makes them interesting to you?

Anthony: So, I mean, everyone's probably gonna respond to this question with AI and it's super cool and it does all these things. And I'm of the mind that AI is a tool at the end of the day. And it's a tool that I think we've put a lot of over-reliance on to do a lot of things that we're experts at, right?

So, I'm gonna come back to something I talked about earlier, which is the importance of information. You know, when we did our rapid-fire questions, I mentioned that I really like Confluence as a utility. And the reason why I like it is because I think, especially coming from a startup world, right, where I was employee number three and have, you know, we are companies now, but acquired by Veeam, I'm part of an 8,000-person company.

Being able to find the answer to your question inside an organization is a Herculean task at many places of business. But when you have a good repository of information available, I can go find the answer I'm looking for exactly when I need it and I know how. AI can aid in that absolutely, right?

Because it's all about pattern matching and large learning models and data management. You can ask that AI to find that thing. But what's even better than that is knowing where to find something because you have a well-organized, well-maintained information repository.

And when you're able to, as a human, not as an artificial intelligence, but as a human intelligence, say, I have a question. I know where I can find that question and you don't have to ask anybody else. You've optimized not only your mental workflow, but your company's mental workflow because you're not bothering the AI.

You're not bothering your coworkers. You know where it is. You know how to get it.

And I think it's a tool, a technology that we rely on less and less. The ability to know and find and understand and optimize how information is both recorded and gathered. But I truly see that as something of the future that we're going to come back to and be thinking a lot about.

Just because you have a flat file, sort of object storage, everything's tagged, metadata category that an AI can go through and understand, if you can't maintain that well yourself, you're going to get junk data in there. And eventually the AI is going to feed you junk data. And human information, like custodialship, very important.

And I think that's something that's going to come back in the future and we're going to be thinking a lot about is what is the human impact on data, both in the ingestion as well as the recall of it.

Host: Yeah, that's a strong point to wrap up, Anthony. And thank you for being here with us. It was indeed a great conversation and it was an absolute pleasure to have you here with us.

And your journey was quite inspiring, I must say. And your perspectives on the ransomware defense, absolute immutability and least privileged access were unmatched. So thank you for being here.

Anthony: Thank you for having me. It's great talking with you.

Host: So here we come to the end of today's discussion of ExtraMile by SecureITWorld. We thank everyone who tuned in. Join us for upcoming episodes as we feature another trailblazer making a mark in the tech era.

Until then, stay curious. See you soon.