Ransomware Response,

Done Right.

Downtime is Our Enemy

When businesses fall victim to ransomware, they can’t do business. Gillware is the only incident response firm to prioritize restoration to get businesses back to where they were before the attack.

Gillware approaches ransomware restoration and investigations simultaneously so you return to normal at the same time you are getting answers.

We speed up the process with our proprietary remote collection process and central case management tools to keep you in the loop and continuously moving forward.

Have you fallen victim to a
ransomware attack?

We will help get you back on your feet.

We focus on what matters most: Your business.

We get you back up and running.

Most incident response firms place their focus on the investigation, and solely the investigation. While important, that does nothing to get your employees back to work or your operation back on its feet. We eliminate the threat and restore your systems while simultaneously conducting the investigation.

We save you time and money.

In 99% of the ransomware incidents we respond to, it is completely unnecessary to spend time and money traveling to you. That’s because we built a suite of remote collection tools, reducing the overall response time and cost.

We are your One-Stop Ransomware Shop

Dealing with a ransomware attack is stressful enough, let alone dealing with multiple vendors throughout the response process. To keep things simple, we handle everything from eradication, ransom negotiation, restoration, investigation, and reporting.

A closer look at our Ransomware Response process

Initial Assessment

Ransomware response can take many different paths. We work with you to determine the type of attack, the best course of action, and whether restoration from backups or paying the ransom is the best next step.

Ransom Negotiation & Payment Facilitation

If there is no other option, we attempt to negotiate the ransom to a lower amount on your behalf. Once we’ve arrived to an amount, we process the payment to retrieve your encrypted files.

Eradication & Evidence Collection

We remove the threat from your system, conduct malware scans and network threat hunting. We also preserve evidence from the ransomware attack to inform our investigation of root cause.

System Decryption & Restoration

Once the decryption keys are obtained, we decrypt the data and get systems restored to full functionality as quickly as possible.

Investigation & Final Report

We provide the details and results of our activities in a final report, including suggested corrective actions and cybersecurity safeguards necessary to avoid future incidents.

Our Ransomware Incident Response Team

Nathan Little

Vice President, Incident Response and Digital Forensics


Cindy Murphy

President, Forensics


Jonathan Cunningham

Director, Incident Response and Digital Forensics


Seth Hopwood

Digital Forensics and Incident Response Analyst


Michael Sullivent

Director, Incident Response and Digital Forensics


Cody Dorn

Digital Forensics and Incident Response Analyst