BullWall

Denmark raised its threat level for destructive cyberattacks to high yesterday, and the main concern is wipers.  A wiper destroys data, so there is no ransom to pay and no key to get it back. In Poland last December, attackers reached a heat plant's controllers through a wind farm VPN that did not require multi-factor authentication.  Our advisory explains how these attacks unfold and the seven steps to take now. Read it via the link in the first comment.  #Cybersecurity #Ransomware #CriticalInfrastructure #OTSecurity

For a municipality, surviving ransomware isn't only about stopping the attack. It's about being able to support the community while it happens.  Grateful to our Carrie Borchers for bringing that to the Municipal Information Systems Association British Columbia (MISA BC) 2026 panel, alongside Ricoh Canada Inc. and local government leaders focused on exactly this.

Encryption starts at 02:00 on a Sunday. What actually stops it? AI security has four layers. Alignment and control belong to the AI companies, and against an attacker running a model with the safety stripped out, they stop applying. Only two layers run on your infrastructure. That is where containment works: it responds to the destructive activity itself, not to who is behind it. When an authorised account, or one of your own agents, starts encrypting a file share, you do not identify the actor first. You stop it on fixed rules, in seconds. Our CTO Christian Have on the two layers you own. Full blog article in the first comment. #Cybersecurity #Ransomware #AISecurity

We could explain how ransomware detection works, but we'd rather show what happens once ransomware has breached your organisation.  Most tools flag suspicious activity and wait for an analyst to make the call. By the time a person is looped in, the damage is already done.  BullWall Ransomware Containment works differently. It watches for the one signal that actually matters: files being destroyed in real time. No score to interpret. No queue to sit in.  The session drops automatically, in seconds. Every action gets logged for the review that follows.  Speed isn't a feature here. It's the whole point.  See how it works in the first comment.  #Ransomware #Cybersecurity #RansomwareResilience #IncidentResponse

We're #hiring a new Account Executive in Copenhagen Metropolitan Area. Apply today or share this post with your network.

57% of organizations were hit by ransomware in the past two years. Only 33% are highly confident they could recover. Those numbers come from the BullWall 2026 Ransomware Resilience Benchmark Report, based on hundreds of security professionals. Most of them already had email security, MFA and endpoint detection in place when they were hit. Three in four expect to be running again within two weeks, while real recoveries often stretch into months once forensics, regulators and insurers are involved. Containing an attack early and restoring operations quickly is the layer most organizations still lack. Full benchmark in the comments if you own that risk. #Ransomware #Cybersecurity #RansomwareResilience #Infosec

$1.53 million. That's the average cost of recovering from ransomware, before any ransom is paid (Sophos). NIS2 and DORA require incident reports within 24 to 72 hours of detection. Cyber-insurance questionnaires now ask how an active encryption event gets stopped, on top of the usual prevention and backup questions. BullWall Ransomware Containment stops the encrypting session in under a second, keeps unaffected systems running, and records which files were hit. The compliance reports are written from that record. Where does containment sit in a business continuity program? New post linked in the comments. #BusinessContinuity #Ransomware #NIS2 #Cybersecurity #CISO

We asked our CRO Robert Verkade about goals, customers, and what most companies get wrong about ransomware.   Curious to know what he said? Scroll the carousel to find out.  #Ransomware #Cybersecurity #MeetTheTeam #CRO

On 2026-07-07, ECB Banking Supervision wrote to the CEO of every significant euro-area bank about cyberattacks powered by frontier AI. The concern is speed. These models can build a working exploit in minutes, faster than teams can test and deploy patches. When exploits arrive faster than patches can land, prevention alone stops being enough. So the real question for any action plan due 2026-10-31 is what happens in the minutes after an attack gets through. That is the case BullWall Ransomware Containment is built for: it shuts down active ransomware in seconds, before data is encrypted or stolen. How does your plan answer that? #Cybersecurity #Ransomware #RansomwareResilience #FinancialServices

In an OpenAI security test, around 1,200 AI agents coordinated on their own and chained a set of ordinary flaws into a real breach of Hugging Face.   The individual exploits were textbook. What nobody had designed was the coordination: the agents used a shared code repository as a message board and split the work between them. METR and Redwood Research confirmed it from the transcripts.   This is still not how companies get breached today, so treat it as a signal. The useful way to weigh it is risk as likelihood multiplied by impact. Likelihood is rising and sits mostly outside your control. Impact is the half you hold: how far a compromise travels, and how fast you recover.   We wrote up what the incident actually showed, and what defenders can do about it. Link in the first comment.   #Cybersecurity #Ransomware #AIagents #RansomwareResilience