A ransomware note is an invoice designed by someone who has already broken into the office. It arrives with a deadline, a cryptocurrency address and the theatrical confidence of a waiter presenting the bill. Bill Siegel's first instruction is less cinematic: take a deep breath. Disconnect the affected machine. Leave it switched on. Raise a hand and ask for help.
That sequence contains his operating philosophy in miniature. A cyber-extortion event rewards haste, embarrassment and private improvisation. Siegel tries to replace all three with evidence. Before anyone discusses a payment, Coveware identifies the ransomware strain, checks whether a free decryptor exists, examines backups, reviews what the attacker has done in earlier cases and maps the probable outcomes. The goal, he has said, is to find a route to recovery without paying at all.
It is a practical creed from a founder whose route into cybersecurity began in finance. Siegel studied business administration and finance at the University of Michigan's Ross School, then worked in equity research and distressed debt. He moved through SAC Capital and The Receivables Exchange before joining SecondMarket, the private-securities platform. He began running operations there in 2011, became CEO, led it through a reinvention and stayed at the wheel when Nasdaq Private Market acquired the company in 2015.
SecondMarket had already lived through one frenzy. Before Facebook went public, trading in shares of private technology companies had become a loud, loosely controlled market. By 2014, the platform had pivoted toward company-controlled liquidity: tender offers, equity management and transactions in which an issuer could decide who sold, who bought and when. Siegel spoke then about giving private companies tools to manage ownership while offering employees and early investors a path to liquidity. The product changed because the old market's incentives had stopped serving the companies at its center. That experience feels relevant to Coveware. In both businesses, the visible transaction gets the attention, while the useful work lies in creating rules around it.
01 / The strange continuityA price, a clock and imperfect information
Private markets and ransomware do not share a dress code, but they do share a difficult anatomy. An asset is hard to value. Liquidity is constrained. Time changes the bargaining position. The parties possess different information, and one side may behave badly. In a ransomware case, add damaged servers, frightened employees, privacy lawyers, forensic investigators, insurers, law enforcement and a criminal counterparty whose promises are not exactly covered by a warranty.
Siegel's finance experience did not make him a malware reverse engineer. It made him comfortable with transactions that sit at the intersection of valuation, risk, compliance and human behavior. His co-founder, Alex Holdtman, brought the technical background, including experience at backup provider Datto. Their pairing gave Coveware two useful instincts: understand the machinery, and account for every choice around it.
After Nasdaq, Siegel joined SecurityScorecard as chief financial officer in 2016, responsible for finance, operations and customer-success teams. The move put him inside cybersecurity, but his next company began with a question rather than a product brochure. Ransomware was hitting organizations at a remarkable rate, yet reliable information about what happened inside actual incidents was scarce. Surveys looked backward. Victims often stayed quiet. Individual vendors saw only one piece of the disaster.
Siegel and Holdtman founded Coveware in 2018 to collect primary incident data and discover what it could make possible. The service became the sensor. Every engagement could add structured knowledge about entry points, threat actors, ransom demands, bargaining behavior, decryptor reliability, downtime and recovery. A miserable Tuesday for one client could make the following Thursday slightly less miserable for another.
02 / The data flywheelKeeping receipts on people who send ransom notes
Cybercriminal groups have habits. Some negotiate. Some vanish for odd stretches. Some supply decryptors that work poorly. Some make claims about stolen data that cannot be verified. Their names and alliances change, but a case history can still narrow the range of surprises. Coveware built detailed profiles using prior demands, negotiation patterns and recovery outcomes, then used that memory to frame the next client's decision.
Siegel likes a crash-test analogy: you cannot build safer cars without studying car crashes. It is an unusually cheerful image for ransomware, though still more pleasant than the real subject. The point is that case volume compounds. A database does not make a criminal trustworthy. It helps a victim distinguish evidence from an extortionist's sales pitch.
Early on, this approach also produced an awkward public position. General advice said never pay. Siegel called Coveware pragmatic: some companies without usable backups faced closure, while paying could preserve the business. Yet pragmatism cut both ways. He described cases where a company wanted to pay and Coveware advised waiting, imaging the encrypted data or pushing harder on backup review. Payment was never a moral souvenir or a default service. It was one possible decision after the alternatives had been priced honestly.
Even a successful transaction does not produce a neat ending. A decryptor can be slow, temperamental or destructive. A large environment may require days merely to decrypt, followed by wiping machines, rebuilding systems and changing procedures. Siegel once described the tools as beasts with nuances. Coveware kept care sheets on them. In this corner of technology, the fine print sometimes arrives after the criminal has been paid.
03 / From cases to policyThe quiet argument for structured truth
In June 2022, Siegel took Coveware's experience to the U.S. Senate Committee on Homeland Security and Governmental Affairs. The testimony ranged from cryptocurrency settlements to mandatory incident reporting, but its spine was the same principle that shaped the company: a problem cannot be solved until it is understood.
He told lawmakers that Coveware had voluntarily shared subsets of data with law enforcement from every attack it had worked since inception. He supported broader reporting, while warning that an avalanche of unstructured submissions could bury the very agencies meant to analyze them. Collecting information was only the first job. Deciding what to collect, how to organize it and how quickly it could inform action mattered just as much.
This is where Siegel's operator temperament shows most clearly. He does not treat transparency as a mood. It needs fields, definitions, workflows and people responsible for the handoff. His public self-description - dad, husband, “technology operator / masochist” - supplies the dry joke. The operator part is visible in his insistence that good intentions must survive contact with a spreadsheet.
04 / The next scalePractice travels farther than panic
Veeam acquired Coveware in April 2024 and kept the business operating as Coveware by Veeam. The fit joined incident response and threat intelligence with a large data-protection platform. Coveware's firsthand view of attacks could inform preparation and recovery; Veeam's reach could put those capabilities in front of more organizations. Siegel stayed on as CEO.
The deal also widened what Coveware's case history could influence. Its services included forensic triage, identifying the strain and entry point, negotiation and remediation, cryptocurrency settlement and decryption support. Elements of that work could now connect with Veeam's data platform and cyber-resilience programs. The acquisition did not make ransomware response simple. It placed the people who see attacks at close range beside the systems intended to keep data recoverable. For Siegel, the stated objective remained minimizing disruption rather than celebrating a payment negotiated downward.
On stage after the deal, his advice sounded almost athletic: practice, and do it regularly. Organizations, he argued, fall to the level of their preparation during an incident. The phrase is useful because it removes fantasy from resilience. Nobody discovers a hidden talent for coordinating executives, lawyers, technical teams and law enforcement at three in the morning. They discover whether the phone numbers work.
The research continues to move with the attackers. In 2025, Coveware tracked the rise of targeted social engineering and data-exfiltration pressure. In 2026, Siegel published on agentic AI and faster patching, failing ransomware code, mass extortion campaigns and the gap between promised and actual outcomes. The brands rotate. The method remains: inspect the evidence, validate the technical reality and resist advice that depends on a criminal honoring a promise.
Siegel's career reads like a collection of uncomfortable markets: distressed securities, private-company shares, security ratings and cyber extortion. The connecting skill is not prediction. It is arranging uncertain facts so a decision can be made without pretending the uncertainty has vanished. Ransomware happens to make the value of that discipline painfully obvious.
The criminal's leverage is urgency. Coveware's counterweight is accumulated memory. And the tiny, almost comic act that begins the whole process is still a breath - a moment long enough to stop panic from becoming the most expensive participant in the room.