# Coveware

> Coveware is a specialist cyber-extortion incident-response company that helps organizations assess ransomware attacks, negotiate with threat actors when necessary, move cryptocurrency compliantly, validate decryption prospects, and recover operations. Its unusual advantage is a feedback loop: each case adds anonymized evidence about attacker behavior, payment outcomes, recovery rates, and timelines, which informs the next case and Coveware's public quarterly reports. Veeam acquired the roughly 30-person company in 2024 for an undisclosed price, linking Coveware's first-response expertise with Veeam's backup and recovery platform.

- **Founded:** 2018
- **Headquarters:** Norwalk, United States
- **Founders:** Bill Siegel (CEO and Co-Founder), Alex Holdtman (CTO and Co-Founder)
- **Team size:** Approximately 30 employees at the 2024 acquisition; the supplied company data lists 26 employees
- **Products:** Cyber Extortion Incident Response, Recon Forensic Triage, Unidecrypt, Ransomware Analytics, Incident Response Retainer
- **Notable:** Handled more than 2,000 cyber-extortion incidents by 2021 and now says it handles more than 2,000 cases per year., Built Recon and Unidecrypt to convert repeated forensic and recovery work into a faster, more consistent response process., Published a long-running quarterly dataset tracking ransom payments, attack vectors, variants, company size, downtime, and attacker tactics.

## Products & services

- **Cyber Extortion Incident Response** — An end-to-end response service covering assessment, evidence-based threat-actor negotiation, sanctions and compliance checks, cryptocurrency settlement when authorized, decryption support, and post-incident documentation.
- **Recon Forensic Triage** — A non-persistent collection tool and SaaS analysis layer that maps incident evidence to MITRE ATT&CK, visualizes an attack timeline, and is designed to answer recovery questions in hours rather than weeks.
- **Unidecrypt** — A recovery tool available to response and retained-service clients to make ransomware decryption safer and faster.
- **Ransomware Analytics** — Benchmarks drawn from current cases to estimate negotiation outcomes, re-extortion risk, decryption success, recovery duration, and likely data loss for a specific incident.
- **Incident Response Retainer** — A prepaid, SLA-backed 24/7/365 response package with an assigned success manager, readiness sessions, research access, and optional tabletop or hands-on exercises.

## Achievements

- Handled more than 2,000 cyber-extortion incidents by 2021 and now says it handles more than 2,000 cases per year.
- Built Recon and Unidecrypt to convert repeated forensic and recovery work into a faster, more consistent response process.
- Published a long-running quarterly dataset tracking ransom payments, attack vectors, variants, company size, downtime, and attacker tactics.
- CEO Bill Siegel testified before the U.S. Senate Committee on Homeland Security and Governmental Affairs in June 2022.
- Acquired by Veeam in 2024 and continued operating as Coveware by Veeam.
- Reported that the share of victims paying in Coveware-managed cases reached a record low of 23% in Q3 2025.

## Latest updates

- **2026-07** — Coveware's latest quarterly report said cyber-extortion outcomes were becoming more volatile as the attacker profile changed.
- **2026-04** — Its Q1 2026 report warned that agentic vulnerability discovery is compressing patch windows; Coveware-managed payment rates were 23%, with an average payment of $680,081 and a median of $300,750.
- **2026-02** — Coveware documented a Nitrogen ESXi malware bug that could corrupt files so completely that even the attacker could not decrypt them, making payment useless.
- **2025-10** — The company reported a record-low 23% payment rate across its Q3 2025 cases, while data exfiltration appeared in 76% of cases.
- **2024-10** — Veeam Data Platform 12.3 introduced Recon Scanner technology developed by Coveware.
- **2024-04** — Veeam announced its acquisition of Coveware; the deal closed March 29 and financial terms were not disclosed.

## Links

- Website: https://coveware.com
- LinkedIn: https://www.linkedin.com/company/coveware
- Twitter/X: https://twitter.com/coveware
- Facebook: https://facebook.com/Coveware

---

Profile page: https://yespress.io/coveware
Published by YesPress — https://yespress.io
Last updated: 2026-08-20