Bullpen.News From Edwin Dorsey
Get Daily Recap Feedback

Monday, October 19, 2026

Back to today

From X

@StableBread

Fajasy on X

The ransomware software of Nubeva Technologies $NBVAF (TSXV: $NBVA) passed every test in a month-long third-party lab evaluation in 2023, and its biggest customer, Kroll, walked away anyway. In January 2022, Nubeva launched Ransomware Reversal, or NuRR, the product the company is now built around. It’s a lightweight agent installed on servers, desktops, and laptops that watches for the file encryption a ransomware attack produces, captures copies of the encryption keys as the malware generates them, and stores those keys on the customer’s own network. After the attack, Nubeva uses the captured keys to build a decryptor (a program that reverses the encryption) and hands the customer its data back, without the ransom. The only outside test of NuRR I found was a month-long evaluation in 2023 at DreamPort, a lab in Maryland (the test doesn’t appear to have been commissioned by Nubeva). DreamPort is run by the Maryland Innovation and Security Institute (MISI), a nonprofit that partners with U.S. Cyber Command to connect the military with outside cybersecurity products. Per Nubeva’s July 20, 2023 release, NuRR passed all 17 tests in MISI’s test plan and captured the encryption keys in every attack, including ones using the LockBit, Ragnar Locker, and BlackBasta ransomware strains. But less than two months after the MISI results, Nubeva lost its biggest customer: → January 2023: Nubeva named Kroll, the risk advisory firm that runs more than 3,000 incident-response investigations a year, as a strategic partner using the product in its ransomware cases. → September 2023: Kroll ended the relationship and paid $180,000 to walk away. It had been 86% of FY2023 revenue (~$1.78M of $2.07M). Neither company gave a reason in a filing or press release. But in a July 2024 video on Nubeva’s YouTube channel, CEO Randy Chou said Kroll sometimes brought in 10 ransomware cases on the same weekend, and “neither the partner or us as a complete solution could handle the emergency services.” In an October 2025 video, he explained the constraint further. Each new ransomware variant needs its own decryptor, which Nubeva’s engineers built by hand. With 10 to 30 attacks running at once, “you don’t have enough engineers to go figure out the new decryptor.” Chou added that Nubeva “simply cannot afford to scale” its support, “and that’s still the reality,” so it’s waiting on automation before it grows again. A longtime investor I spoke with, who has followed Nubeva for years and has spoken with people who’ve used NuRR in the field, described the same constraint. He also says Kroll’s exit is why Nubeva stopped trying to grow on its own and bet on AI to write the decryptors.

Investor Letters

All letters

LXS.DE: a 2028 sale it can force

Lanxess can force Advent to buy at least half its Envalior stake in April 2028, potentially raising about €745 million to reduce net debt.

LPTH $525M
Trade Ideas Flow 21 clicks

Build-A-Bear: A Narrower Path

Build-A-Bear's push into prestuffed toys and broader retail distribution tests brand stretchability, but recent results warrant caution.

BBW $303M
TSOH Investment Research 17 clicks
SKIN · long

Skinhealth Systems INC

SkinHealth Systems owns a dominant professional skincare consumables franchise but trades at roughly $115 million market cap and $255…

SKIN $73M
Value Investors Club 2 clicks

Semtech Analyst Day Review

Semtech raised Q3 guidance and targets $3.2 billion of fiscal 2030 revenue, excluding upside from its AI data-center optical and copper…

SMTC $13B
CV's Substack 13 clicks

Publications we follow

Every publication on this site, hand-picked.

128 publications

Newsletters 108

YouTube 4

Blogs 15

Seeking Alpha 54 of 245

Nominate a publication

X accounts we follow

Every account on this site, hand-picked.

90 accounts
Nominate an account

Investor letters we follow

189 firms

Sectors

Ordered by how often our editor reaches for them.