BULLWALL
BullWall is a Danish cybersecurity vendor providing agentless, ML-driven ransomware containment and server intrusion protection for mid-market and enterprise organizations in Financial Services, Manufacturing, Pharma, and Public Sector across 20+ countries, sold through channel partners and direct enterprise sales.
- Company typePrivate
- Founded2016
- HeadquartersVejle, Denmark
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What BULLWALL does
BullWall is a privately-held Danish cybersecurity company, headquartered in Copenhagen with regional offices in Bourne End (UK) and Wilmington, Delaware (US). Founded in 2016, the company operates as BullWall Group A/S with wholly-owned operating subsidiaries in Denmark and the US. The company builds an agentless ransomware containment platform deployed on a single virtual machine, using 28 sensors and machine learning to monitor file systems, servers, SAN/NAS storage, Active Directory, SharePoint Online, and OneDrive continuously. When active encryption is detected at the data layer — a layer where endpoint detection-and-response (EDR) tools are reportedly blind to 99% of attacks during BullWall pentests — the platform executes automated containment in under one second, isolates the threat across file systems, identities, and endpoints, runs an IOC sweep, verifies backup integrity, and only authorizes recovery once the environment is confirmed clean. The platform connects to existing SIEM, EDR, NAC, and SOC tools via RESTful APIs as a complementary containment execution layer rather than a rip-and-replace replacement.
The product portfolio comprises three core offerings: Ransomware Containment (the flagship sub-second detection and response product), Server Intrusion Protection (which traps intruders using stolen credentials and hijacked RDP sessions before they reach critical infrastructure), and Virtual Server Protection for VMware vSphere and ESXi environments (which enforces MFA on hypervisor access and monitors datastores for encryption). All three products share a unified compliance reporting engine that auto-generates forensic evidence bundles mapped to GDPR, NIS2, DORA, SOX, HIPAA, CAF 4.0, NIST, CIS18, and cyber insurance requirements.
BullWall serves mid-market and enterprise organizations in four primary verticals: Financial Services, Manufacturing, Pharma, and Public Sector. The company protects more than 1,000 organizations across 20+ countries, with named customers including Newport City Council, Sir Roger Manwood's School, Town of North Andover, Ricoh, The Coombe Hospital, Winchester College, Texas School District, Limonta, and Star Pipe Products. Revenue mechanics are subscription-based with quote-driven enterprise, advanced, and freelancer tiers, annual or multi-year contract billing. Go-to-market is channel-first: a global distributor and reseller network of more than 30 partners (including Fujitsu, GuidePoint Security, Optiv, Ricoh, SHI, and Softcat) complemented by direct enterprise field sales featuring 60-minute live ransomware demonstrations and G-Cloud procurement for UK public sector.
BULLWALL firmographics
Firmographics- Name
- BULLWALL
- Legal name
- BullWall Group A/S
- Website
- https://bullwall.com
- Company type
- Private
- Founded year
- 2016
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- BullWall is a Danish cybersecurity vendor providing agentless, ML-driven ransomware containment and server intrusion protection for mid-market and enterprise organizations in Financial Services, Manufacturing, Pharma, and Public Sector across 20+ countries, sold through channel partners and direct enterprise sales.
- Ownership category
- akta.pro rank
BULLWALL industry classification
Industry- Product category
- Ransomware Containment Software
- NAICS
- Security Systems Services (except Locksmiths) (561621)
- akta.pro primary industry
- Confidential Computing & Hardware-backed Protection (TEE/HSM) (HDADAFAJ)
- akta.pro secondary industry
- Credential Stuffing & Password Attack Protection (HDADALAC)
Keywords
Where BULLWALL is headquartered
LocationHeadquarters
- HQ city
- Vejle
- HQ country
- Denmark
- HQ region
- Europe
Offices3 records
Markets served
BULLWALL business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Marketing or Sales, Operations
Revenue model
- Subscription Licensing: BullWall operates on a subscription licensing model with product tiers (Advanced, Enterprise, Freelancer) as indicated in the sitemap. Products include Ransomware Containment, Server Intrusion Protection, and Virtual Server Protection. The platform is sold through channel partners and direct sales with annual or multi-year contract billing.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Enterprise, Advanced, and Freelancer product tiers available |
Go-to-market motion2 records
Distribution channels4 records
Marketing channels7 records
BULLWALL product offering
Product offeringCore offering
BullWall provides agentless ransomware containment, server intrusion protection, and virtual server protection software deployed on a single virtual machine. The platform uses 28 sensors and machine learning to continuously monitor file systems, servers, SAN/NAS storage, Active Directory, SharePoint Online, and OneDrive, detecting active encryption at the data layer and executing automated containment across file systems, identities, and endpoints in under one second. It then verifies recovery before authorizing restoration, generating audit-ready compliance evidence bundles mapped to GDPR, NIS2, DORA, SOX, HIPAA, and other regulatory frameworks.
Product overview
BullWall is a ransomware operating layer that takes a signal and executes the full response: containment, investigation, verified recovery, and automated reporting to regulators and insurers, on the infrastructure organizations already run. The company offers three distinct core products: Ransomware Containment (detects active encryption at the data layer and executes automated containment across file systems, identity, and endpoints in under a second), Server Intrusion Protection (traps intruders attempting server access via stolen credentials or hijacked RDP sessions before they can launch an attack or disable defenses), and Virtual Server Protection (protects VMware vSphere and ESXi environments from unauthorized access and encryption targeting the virtual layer). All three products work together as a complete ransomware operating layer, sharing automated containment capabilities, compliance reporting mapped to GDPR, NIS2, DORA, and cyber insurance requirements, and agentless deployment on a single VM.
Differentiator
Problem solved
Functional benefit
Products and services
- Ransomware Containment Detects active encryption the moment it begins across file systems, identities, and endpoints, initiates automated containment, generates incident reports, and only authorizes recovery once evidence confirms safety. Includes compliance reporting mapped to GDPR, NIS2, DORA, SOX, HIPAA, and cyber insurance requirements. Targeted at regulated enterprises and public sector organizations.
- Server Intrusion Protection Detects intruders using stolen credentials and hijacked remote access sessions, traps them before they reach critical servers, and prevents attackers from disabling existing security defenses. Identifies credential abuse, hijacked RDP sessions, unauthorized remote access attempts, malicious scheduled task modifications, and lateral movement across critical server infrastructure.
- Virtual Server Protection Protects VMware vSphere and ESXi environments when attackers target the virtual layer. Enforces MFA on every ESXi SSH login, monitors datastores, virtual disks, and running processes continuously for encryption and unauthorized access, integrating with the broader BullWall containment platform.
Quantifiable outcome
- Sub-second containment from detection to response
- +6 more outcomes
Companies that use BULLWALL
Customer profileNamed customers13 records
Segments4 records
Ideal customer profiles5 records
BULLWALL technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration22 records
AI capability2 records
Feature7 records
BULLWALL partnerships and signals
Strategic signalPartnerships
26 partnerships are on record, tiered core and minor.
- Northamber PLCcoreParent company of Renaissance distributor. Part of BullWall's UK distribution network enabling local market expertise and partner support.
- Renaissance (Northamber PLC Group)coreUK-based distributor and Northamber PLC group company providing local distribution expertise for BullWall products.
- Solid8 TechnologiescorePart of BullWall's distribution network providing technology distribution services.
- InnovisionminorDistribution partner in BullWall's partner ecosystem.
- CETA Cyber DefenceminorCyber defence focused distributor in BullWall's network.
- CyberFusionminorCyberFusion with PSM Services branding, part of distribution network.
- DatastoreminorDistribution partner in BullWall ecosystem.
- Froggy NetworkminorCloud and cybersecurity as service provider, designer and distributor.
- Microsoft SentinelcoreCloud-native SIEM and SOAR platform integration. Receives OCSF Security Findings, enables KQL-based threat hunting, automated playbook execution, and compliance retention.
- CrowdStrikecoreEDR and endpoint protection integration partner. BullWall works alongside CrowdStrike to provide the containment layer that EDR alone cannot provide.
- SentinelOnecoreEndpoint protection platform integration partner.
- FujitsucoreMajor technology reseller and systems integrator offering BullWall through their security portfolio.
- GuidePoint SecuritycoreCybersecurity-focused VAR and consultant helping customers select and implement security solutions.
- OptivcoreSecurity solutions integrator and MSSP, providing advisory, implementation and managed services.
- RicohcoreOffice equipment and managed services provider reselling BullWall as part of their cybersecurity offerings. Ricoh is both a partner and customer.
- SHIcoreLarge IT solutions provider offering BullWall through their extensive security portfolio.
- SoftcatcoreUK-based technology partner and VAR offering BullWall solutions.
- AvoiraminorTechnology reseller with security focus.
- AxiansminorICT solutions provider and VINCI Energies brand.
- BluumminorTechnology solutions reseller.
- CBE Office SolutionsminorOffice solutions provider with technology offerings.
- ConnectionminorIT solutions provider and VAR.
- HalodataminorSecurity-focused VAR specializing in data defence.
- ITsavvyminorTechnology solutions VAR.
- Trace3minorEnterprise security solutions provider.
- ViatelminorTechnology and connectivity solutions provider.
Scale indicators14 records
Recent moves6 records
Expansion highlights5 records
BULLWALL competitors and assessment
Company assessmentDirect peers
- Halcyon: Halcyon is a ransomware-specific protection platform that combines prevention, detection, and automated response. Like BullWall, it focuses narrowly on ransomware rather than broad XDR, and sells to mid-market and enterprise in regulated verticals — making it the closest direct competitor.
- Rubrik: Rubrik delivers data security with cyber recovery and ransomware investigation capabilities, including automated recovery verification. It competes with BullWall on the recovery side of the ransomware response chain and on regulatory/audit-grade evidence generation for large enterprises.
- Cohesity: Cohesity provides data management and cyber resilience with ransomware detection, immutable backups, and rapid recovery at enterprise scale. It overlaps with BullWall's verified-recovery and compliance-reporting value proposition for large organizations with significant data estate risk.
- Commvault: Commvault offers data protection and cyber recovery with Cleanroom Recovery and threat detection capabilities. It targets the same enterprise and regulated buyers as BullWall with a broader data-management platform positioned around ransomware resilience.
Broad incumbents
- Darktrace: Darktrace is an AI-driven cybersecurity platform offering detection, response, and autonomous containment across endpoint, network, cloud, and identity. It is one of BullWall's listed integration partners but also competes in behavioral detection and automated response that overlaps with BullWall's containment layer.
- CrowdStrike: CrowdStrike Falcon is a leading endpoint security platform with EDR, XDR, identity protection, and increasingly automated response. BullWall explicitly positions itself as the containment layer that EDR alone cannot provide, while CrowdStrike continues to expand response capabilities that could compress BullWall's gap.
- SentinelOne: SentinelOne Singularity is an AI-powered endpoint and XDR platform with autonomous response and rollback features. It is a BullWall integration partner and the type of platform that, by adding stronger rollback and containment, could narrow the use case BullWall serves.
- Palo Alto Networks (Cortex): Palo Alto Cortex XSIAM/XDR is an integrated detection, response, and SIEM platform with extensive automation. Cortex is a BullWall integration partner, but Palo Alto's roadmap toward autonomous SOC capabilities is the type of platform play that could subsume standalone containment tools.
Emerging players
- Akamai Guardicore (Segmentation): Akamai Guardicore provides micro-segmentation and ransomware containment by limiting lateral movement at the network level. It overlaps with BullWall's lateral movement and credential-abuse protection, but uses a network-centric rather than file-system-centric approach.
- Todyl: Todyl is an emerging single-platform security provider combining SASE, EDR, SIEM, and incident response for MSPs and mid-market organizations. It represents the type of integrated platform that could offer BullWall-like containment as part of a broader security suite to budget-constrained buyers.
Market position
Strengths5 records
Weaknesses4 records
Competitive moat5 records
Key risks6 records
Key highlights6 records
Customer concentration
BULLWALL social profiles
Digital presenceBULLWALL compliance and trust
Trust signalCompliance8 records
BULLWALL financial estimates
Financial estimateRevenue estimate
Valuation estimate
BULLWALL leadership team
Management profileNumber of profiles
Profiles4 records
BULLWALL subsidiaries and ownership
Company hierarchySubsidiaries2 records
BULLWALL funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
BULLWALL M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about BULLWALL
What does BULLWALL do?
BullWall provides agentless ransomware containment, server intrusion protection, and virtual server protection software deployed on a single virtual machine. The platform uses 28 sensors and machine learning to continuously monitor file systems, servers, SAN/NAS storage, Active Directory, SharePoint Online, and OneDrive, detecting active encryption at the data layer and executing automated containment across file systems, identities, and endpoints in under one second. It then verifies recovery before authorizing restoration, generating audit-ready compliance evidence bundles mapped to GDPR, NIS2, DORA, SOX, HIPAA, and other regulatory frameworks.
Is BULLWALL a public or private company?
BULLWALL is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was BULLWALL founded?
BULLWALL was founded in 2016. It employs 11 to 50 people.
Where is BULLWALL based?
BULLWALL is headquartered in Vejle, Denmark, in the Europe region.
How does BULLWALL make money?
One revenue line is on record: subscription Licensing.
Who are BULLWALL's main competitors?
Direct peers on record are Halcyon, Rubrik, Cohesity and Commvault. Broad incumbents are Darktrace, CrowdStrike, SentinelOne and Palo Alto Networks (Cortex). Emerging players are Akamai Guardicore (Segmentation) and Todyl.
Does BULLWALL have an API?
Yes. BullWall connects to existing SIEM, EDR, NAC, and SOC platforms via RESTful APIs. No rip and replace. No endpoint software rollout. Fully operational in days.
What industry is BULLWALL in?
BULLWALL's product category is Ransomware Containment Software. Its primary akta.pro industry code is HDADAFAJ, Confidential Computing & Hardware-backed Protection (TEE/HSM), with a secondary code of HDADALAC, Credential Stuffing & Password Attack Protection. Its NAICS code is 561621.