The next time you find yourself on EDGAR, consider using my SECSift reader instead!
It turns SEC filings into clean, readable documents. You can search every word, export anything, merge tables, highlight what matters and gray out the rest, and compare against previous filings.
Not familiar with the reader? Here’s a 3-minute interactive demo (viewable on your computer) and another video I made walking through the entire tool.
🌾 Welcome to StableBread’s Newsletter!
Ransomware’s been around since the ’80s. It’s a type of malicious software (aka malware) that locks you out of your files, systems, or networks until you pay a ransom to get them back. Victims either restore from backups, if they have clean ones, or pay.
In 2026, ransomware’s still extracting six-figure payments. The victims who paid in Q2 handed over a median of $150,000, and ransomware showed up in 48% of the breaches in Verizon’s latest breach report, up from 44% a year earlier.
Early ransomware took real coding skill to build. Today, attackers with little technical knowledge can buy it ready-made through ransomware-as-a-service (RaaS), where developers sell or rent their ransomware to other criminals.
AI has lowered the bar even further, since the latest models can write malicious code and scan company networks for vulnerabilities.
But defenders can use the same models to find and patch security holes before attackers do, and to spot attacks as they happen.
Top AI labs are now handing their best cyber models to defenders:
OpenAI: On September 3, 2026, it committed $1B of subsidized access to its Daybreak cyber models for water utilities, local governments, community banks, and other defenders.
Anthropic: Since April 2026, its Project Glasswing has given ~200 vetted organizations, mostly in critical infrastructure, access to its Claude Mythos Preview model to find and patch vulnerabilities.
The company in this write-up goes after ransomware’s weak spot. To lock files quickly, ransomware has to create its encryption keys on the victim’s own computer, and the company’s software, installed on a customer’s servers, desktops, and laptops, copies the keys mid-attack.
After the attack, the company uses the captured keys to build a custom decryptor (a program that reverses the encryption), so the victim gets their files back without paying the ransom.
Right now, its own engineers build each decryptor by hand, so the team can’t keep up when many attacks hit at once. That’s why, since 2023, it’s been working on having AI write the decryptors instead.
The market values the entire business at just under $10M. Revenue has fallen 76% since its largest customer walked away in 2023, and two customers now bring in 80%+ of all revenue. That sounds like a terrible business, but a stock screen misses the point.
From here, there are two routes management intends to take:
AI automation: It’ll have AI, including the new frontier model it got access to in September 2026 (likely OpenAI’s), write its decryptors. Then, the company plans on growing again through partners like incident-response firms and cyber insurers.
Partnership or sale: If the AI work falls short, it’ll finish its patent portfolio and position itself for a partnership or sale. All three companies its CEO helped build before this one ended in a sale, and the company has already sold part of its business, including five patents, to a much larger cybersecurity company.
It also helps that the company:
Passed a month-long evaluation at a third-party lab, capturing the encryption keys in every attack the testers ran.
Owns two new U.S. patents on using captured keys to recover files, with two more applications pending.
Signed a deal to deploy its software at one of the world’s 10 biggest financial institutions.
Holds cash worth more than a quarter of its market value, enough for ~4 years at the current burn, with no warrants and no debt beyond a small SBA loan.
Below, I cover why its biggest customer left, the cash runway, the CEO’s record, the 12% holder who keeps buying, the AI plan, the patents it sold and kept, and the bank deal.
I also share why a longtime investor I spoke with (we'll call him "Investor X") expects a sale. Then I conclude with what a buyer might pay and how I'd size a position.
I almost never paywall the idea itself, only the deep dive. But this is an illiquid nanocap that I plan to buy, and with a sizeable list, the name and deep dive only go to paid subscribers.
Subscribe to StableBread's Research!
Full access to this write-up and every future one. Cancel anytime.
View PlansSubscribe to unlock:
- 50+ write-ups every year
- Buy/sell/hold decisions
- Periodic industry, market, and thematic research
- Deeper analysis and valuation models
- Full archive of all past research
