The company relaunches in an age where AI can destroy data in seconds.
READ
4 MIN.
PUBLISHED
28.10.2026
The Danish ransomware containment company takes a new name, a new direction and an enhanced containment platform that stops an attack as it starts and keeps the business running.
COPENHAGEN, Denmark, 2 November 2026.
From today, BullWall is Helm. The Danish ransomware containment company relaunches under a new name and brand, a refounding of the company around one ambition, to transform security into a force for progress.
The launch comes as AI changes the speed and scale of cyber-attacks. The fastest recorded breakout, from first foothold to moving across an organisation’s network, now takes less than 30 seconds. The threat is not only external. Organisations’ own AI agents hold valid credentials and can rewrite and delete data at machine speed. The result is the same whether the cause is an attacker or a mistake. Data is destroyed faster than people can respond.
According to Verizon’s latest Data Breach Investigations Report, nearly half of all breaches involve ransomware, and according to IBM the average breach costs around EUR 4.5 million or USD 5 million before downtime or production loss is counted. Under ever tighter oversight, organisations must report a serious incident within hours, not weeks, and show they stayed in control of their data while it happened.
“Ransomware is no longer an IT problem. It is one of the largest financial risks a business carries, and the cost of being unprepared now reaches the balance sheet and the boardroom,”
says Frank Stensballe Vium, Chairman of Helm.
“Boards are no longer asking whether they will be attacked. They are asking how much it will cost, how long they will be down and whether they can show regulators they stayed in control. That is the market Helm is building for, and with the continued backing of our owners we will keep investing in the platform, our partners and our people.”
“No organisation can count on keeping every attacker out,”
Frederik Braun, CEO of Helm, continues.
“In an age of AI, what matters is what happens in the first seconds after an attacker gets inside. Does the business have the readiness to stay in control of its data, get back on its feet and answer its regulators? We give organisations that decisive control before, during and after an attack, so an attack becomes something they handle, not something that defines them. Helm is more than a new name. It is the company we are becoming.”
Helm acts in the window most security tools leave open, the moment data starts to be destroyed. Rather than looking for known malware or suspicious behaviour, it watches the data itself. Helm detects and stops encryption within seconds, isolating the account and the device doing the writing while the rest of the business keeps running. Because it triggers on how data changes rather than on who or what changed it, the same control applies to attackers and to AI agents alike.
Containment is the start, not the end. An impact list shows exactly which accounts, hosts and files were hit. Helm verifies that backups, endpoints and monitoring are clean before recovery begins, and the incident report is written while the attack is being contained, ready for regulators whose first-notice deadlines run from a few hours to days.
Helm protects company data where it lives, and integrates with the major storage and collaboration platforms, on-premises and in the cloud. The latest version of Helm’s containment platform is available to customers and partners from today.
“Prevention tools make a judgement about who or what is acting. We make a judgement about what is happening to the data, and that is a much harder signal to hide,”
says Christian Have, CTO of Helm.
“An attacker with stolen credentials, or an AI agent doing exactly what it was told, looks legitimate right up to the moment it starts destroying files. That is the moment we are built for.”
For customers and partners, the people they work with and the protection they rely on stay the same, now under the Helm name. Helm remains backed by Axcel, the leading Nordic private equity firm.
Helm’s new website, helmsecurity.ai, went live today. Visitors to bullwall.com are redirected to the new site.
Cybersecurity powering progress.
Helm, formerly BullWall, is state-of-the-art ransomware containment, enabling organisations to move forward by taking control before, during and after an attack.
Using behavioural sensors, Helm detects active encryption across file systems, protecting company data wherever it lives, with integrations across all major storage and collaboration platforms, on-premise and in the cloud. It contains the threat at the speed of the attack, isolates compromised identities, verifies that backups, endpoints and monitoring are clean before recovery, and generates forensic evidence and reporting that shows the board and regulators exactly what happened.
Running on the infrastructure organisations already use, Helm turns an attack signal into coordinated action. Partner-led and headquartered in Copenhagen, Denmark, Helm protects more than one million users in 20+ countries, helping them contain threats, recover with confidence and keep business moving forward.
We call it Cybersecurity Powering Progress.
Learn more at helmsecurity.ai.
