Bullpen.News From Edwin Dorsey
Get Daily Recap Feedback

Wednesday, October 21, 2026

Back to today

From X

@StableBread

Fajasy on X

The ransomware software of Nubeva Technologies $NBVAF (TSXV: $NBVA) passed every test in a month-long third-party lab evaluation in 2023, and its biggest customer, Kroll, walked away anyway. In January 2022, Nubeva launched Ransomware Reversal, or NuRR, the product the company is now built around. It’s a lightweight agent installed on servers, desktops, and laptops that watches for the file encryption a ransomware attack produces, captures copies of the encryption keys as the malware generates them, and stores those keys on the customer’s own network. After the attack, Nubeva uses the captured keys to build a decryptor (a program that reverses the encryption) and hands the customer its data back, without the ransom. The only outside test of NuRR I found was a month-long evaluation in 2023 at DreamPort, a lab in Maryland (the test doesn’t appear to have been commissioned by Nubeva). DreamPort is run by the Maryland Innovation and Security Institute (MISI), a nonprofit that partners with U.S. Cyber Command to connect the military with outside cybersecurity products. Per Nubeva’s July 20, 2023 release, NuRR passed all 17 tests in MISI’s test plan and captured the encryption keys in every attack, including ones using the LockBit, Ragnar Locker, and BlackBasta ransomware strains. But less than two months after the MISI results, Nubeva lost its biggest customer: → January 2023: Nubeva named Kroll, the risk advisory firm that runs more than 3,000 incident-response investigations a year, as a strategic partner using the product in its ransomware cases. → September 2023: Kroll ended the relationship and paid $180,000 to walk away. It had been 86% of FY2023 revenue (~$1.78M of $2.07M). Neither company gave a reason in a filing or press release. But in a July 2024 video on Nubeva’s YouTube channel, CEO Randy Chou said Kroll sometimes brought in 10 ransomware cases on the same weekend, and “neither the partner or us as a complete solution could handle the emergency services.” In an October 2025 video, he explained the constraint further. Each new ransomware variant needs its own decryptor, which Nubeva’s engineers built by hand. With 10 to 30 attacks running at once, “you don’t have enough engineers to go figure out the new decryptor.” Chou added that Nubeva “simply cannot afford to scale” its support, “and that’s still the reality,” so it’s waiting on automation before it grows again. A longtime investor I spoke with, who has followed Nubeva for years and has spoken with people who’ve used NuRR in the field, described the same constraint. He also says Kroll’s exit is why Nubeva stopped trying to grow on its own and bet on AI to write the decryptors.

Investor Letters

All letters

Eli Lilly And Co. (LLY)

Eli Lilly's Mounjaro and Zepbound drove 2025 revenue to $65.2 billion as the drugmaker expands AI partnerships with Nvidia, Isomorphic…

LLY $1.2T
SixSigmaCapital: Navigating the Financial Markets 25 clicks

Why I sold OB pick for 26 SVM

Silvercorp’s falling Ying grades, prolonged GC suspension, El Domo execution risk and Chaarat funding needs weaken its valuation despite…

SVM $2B
The Oak Bloke 27 clicks

Vicor Update, Part Three

Vicor’s $66.6 million in AI power-delivery royalties generated about $50 million of operating profit, eclipsing its module business as…

VICR $9.7B
CV's Substack 28 clicks
DOMO · long

Domo INC

Domo is valued as an NOL shell, with the long case tied to the timing and value of its NOL realization.

DOMO
Value Investors Club 11 clicks

Carecloud News

CareCloud may attract a private-equity buyer after its Q3 call, with acquiring enough shares the main obstacle to a take-private deal.

CCLD $74M
Calvin Blissett 10 clicks

Heico Corporation

HEICO sells FAA-approved aircraft replacement parts at 30% to 50% discounts to OEMs, gaining customers as restrictive aftermarket contracts…

HEI $42B
D Invests 13 clicks

Publications we follow

Every publication on this site, hand-picked.

129 publications

Newsletters 109

YouTube 4

Blogs 15

Seeking Alpha 54 of 247

Nominate a publication

X accounts we follow

Every account on this site, hand-picked.

90 accounts
Nominate an account

Investor letters we follow

190 firms

Sectors

Ordered by how often our editor reaches for them.