Meta Description: Compare the top incident response companies for 2027, from Mandiant and Unit 42 to Arete and S-RM, with retainers, ransomware response and forensics checked.
The first hours of a breach decide most of what it will cost. A help desk ticket about locked files turns into a ransom note on every server, the backups turn out to be encrypted too, and the insurer wants to know which firm is handling the investigation before it will approve anything. Legal counsel needs findings that will hold up later, the board wants to know whether data left the building, and IT needs someone who has seen this exact attacker before. That is the moment incident response companies are built for, and it is the worst possible moment to start comparing them for the first time.
The market splits into a few clear groups. Platform vendors such as CrowdStrike and Palo Alto Networks run large consulting arms that bring their own detection tooling into an engagement. Risk and investigations firms such as Kroll and S-RM pair digital forensics and incident response with breach notification, litigation support and crisis management. Then there are ransomware specialists that live on cyber insurance panels and handle negotiation, decryption and recovery at volume. Incident response is a different purchase from round-the-clock monitoring, so if you mainly need a team watching alerts every night, start with our list of managed detection and response providers, and if you want broader outsourced security operations, our guide to managed security service providers covers that ground.
Every firm here was checked against its own website for the incident response services it offers today, its headquarters, whether it sells an incident response retainer, and each specific figure we quote, such as response time commitments, engagement volumes, insurer panel coverage and accreditations. Where a firm has been acquired or renamed, we use its current brand. Vendor statistics are reported as the firms publish them, and claims we could not confirm on a firm’s own pages were left out.
Incident Response Companies At A Glance
Company
Headquarters
Best For
Core Services
Mandiant
Reston, USA
Large enterprises facing nation-state or complex intrusions
The list runs from the largest global response teams, which take on nation-state intrusions and Fortune 500 crises, through investigations firms that combine forensics with legal and notification work, to ransomware specialists that handle a high volume of insured extortion cases. Each entry notes where the firm is strongest and where a different choice may serve you better.
1. Mandiant — Google Cloud Response Team Offering A 2-Hour Retainer Response Time
Mandiant is the incident response and threat intelligence business inside Google Cloud, and it remains the name many security leaders call first for serious intrusions. Its incident response practice covers preparedness, technical response and crisis management, and the company describes more than two decades of frontline experience behind it. Mandiant reports engagements in more than 65 countries in a single year, which gives its responders a wide view of how specific threat groups operate.
The Mandiant Retainer is the clearest part of the offer. It provides pre-negotiated terms, access to responders with a stated 2-hour response time, and proactive services that can be redirected as priorities change without rewriting the contract. Around the core response work, Mandiant sells compromise assessments, cyber defense assessments, red teaming, cloud architecture reviews across AWS, Azure and Google Cloud, tabletop exercises and crisis communications support. It also maintains a partner network of law firms, insurers, brokers and ransomware negotiators. Mandiant cites Leader placements in the IDC MarketScape for Worldwide Incident Response 2025 and the Forrester Wave for Cybersecurity Incident Response Services, Q2 2024.
Mandiant fits large enterprises, regulated firms and public bodies that expect advanced or state-backed attackers and want threat intelligence feeding directly into the investigation. The trade-off is cost and scale: smaller organizations with a single ransomware event may find a specialist firm faster to engage and easier to budget for.
2. CrowdStrike — Platform-Backed Responders Logging 100,000+ Hours Of IR Casework A Year
CrowdStrike’s incident response services sit alongside its Falcon platform and are pitched around three outcomes: stop the breach, evict the adversary and restore control. The company says its responders deploy globally within hours and cover endpoints, identities and cloud systems, with 24/7/365 availability. Forensic work focuses on root cause, hidden persistence and lateral movement, followed by remediation guidance and help restoring systems and verifying data integrity.
The scale behind the practice is the main draw. CrowdStrike reports more than 100,000 hours of incident response casework a year and tracks more than 281 adversary groups, and its responders use the platform’s forensic and timeline tooling during engagements. The company states it has pre-established relationships with law firms and cyber insurers, which matters when coverage and privilege need to be in place from the first call. A Services Retainer gives priority access to responders who already know your systems and workflows. CrowdStrike cites a Leader placement in the 2025 IDC MarketScape for Worldwide Incident Response and the Forrester Wave for Cybersecurity Incident Response Services, Q2 2024.
CrowdStrike suits organizations that already run Falcon or are open to deploying it during a response, since tooling and responders come from the same house. Buyers who want a fully vendor-neutral investigator, or who run a competing endpoint stack they do not plan to change, may prefer an independent firm.
Unit 42 is the threat intelligence and incident response team at Palo Alto Networks. Its response practice covers incident response, forensically sound digital investigations with defensible reporting, ransomware negotiation assistance and managed threat hunting, with MDR and managed XSIAM available for after the crisis. Unit 42 says it handles more than 750 incident response engagements a year and has investigated and contained more than 5,000 security incidents.
Two details stand out for buyers who carry cyber insurance. Unit 42 states it is listed as a preferred vendor on more than 50 cyber insurance panels, which can remove friction when a carrier has to approve the firm. Its retainer comes with pre-defined SLAs that range from 24 hours down to two hours depending on the tier you buy, and the service runs 24/7/365. Retainer customers manage their engagement through the Unit 42 Arcade portal. The firm also publishes case outcomes on its site, including a 73% reduction in ransom payment through negotiation for one manufacturer, though those are single-customer results rather than averages.
Unit 42 is a strong pick for insured mid-market and enterprise organizations that want a well-known name already approved by their carrier, and for Palo Alto Networks customers who want response and tooling joined up. As with CrowdStrike, buyers committed to another security stack should confirm how the team works with their existing tools.
4. Kroll — Investigations Firm Handling Over 3,000 Incidents A Year
Kroll, headquartered at One World Trade Center in New York, combines cyber incident response with the investigations, legal support and notification work it has built up over decades. The firm says it handles more than 3,000 incidents a year, and its 24×7 team of certified security and forensic experts can work remotely or deploy onsite within hours. Its service list covers digital and computer forensics across every evidence source, malware analysis, advanced persistent threat detection, Office 365 forensics and business email compromise investigations.
What separates Kroll is how far it goes past the technical fix. Its recovery team handles device and server reimaging, Active Directory rebuilds, network segmentation, patch management and hardening. On the other side of the breach, Kroll offers multijurisdictional breach notification support, including call center and credit or identity monitoring services for affected individuals. Its forensic engineers provide expert testimony, and some have served as court-appointed special masters, which is valuable when a breach is likely to end up in litigation or regulatory review. Kroll also runs tabletop exercises using a seven-step process.
Kroll fits organizations where the breach response will involve regulators, class action risk or large numbers of notified individuals, since one firm can carry the work from containment through to notification. Teams that only need fast technical containment may find a narrower specialist simpler.
5. Arete — Extortion Specialist Restoring Without Payment In Nearly 70% Of Cases
Arete is a cyber risk firm built around ransomware response and extortion events, and it is a familiar name to cyber insurers and breach coaches. Its services cover incident response, data breach response, compliance and sanctions analysis, and managed security services, and it serves cyber insurers, cyber law firms, financial institutions, other incident response firms and MSSPs, and government agencies. Its process runs from the pay or no-pay decision through response, remediation and restoration.
Arete publishes outcome figures that are unusually specific for this market. It says it remediates and restores systems without a ransom payment in nearly 70% of extortion engagements, and that when payment is made, its Threat Actor Negotiations team reduces the amount by up to 82%. Its intelligence comes from what it calls the Arete Data Lake, fed by thousands of incident responses, threat actor attribution data and reverse-engineered malware samples. SentinelOne named Arete its Incident Response Partner of the Year for 2026, the second year in a row.
Arete fits mid-market companies facing ransomware or data extortion, especially when an insurer or outside counsel is directing the response and wants a firm that can run negotiation, sanctions checks and recovery together. Organizations dealing with a long-running espionage campaign may be better served by a larger intelligence-led team.
6. Sygnia — IT And OT Response Firm With Engagements In 60 Countries
Sygnia is a cybersecurity consultancy with hubs in Tel Aviv, New York, Singapore and London and teams across North America, Europe, Mexico, Australia and Japan. It focuses on containing and removing advanced attackers, and its incident response work explicitly coordinates across IT, OT and business teams. The company reports more than 250 team members, more than 500 clients including Fortune 500 and Global 2000 companies, and engagements in 60 countries.
Sygnia sells an incident response retainer alongside threat hunting, MDR, and incident response and SOC training services, and its site advertises 24/7 responder availability under a rapid response SLA. Its Velocity TDIR platform is described as vendor agnostic, which helps when the victim runs a mix of security tools and the response team needs to work with what is already deployed rather than force a rip and replace in the middle of a crisis. The firm points to over a decade of frontline experience.
Sygnia suits large enterprises, financial institutions and industrial operators that face sophisticated attackers and need a team comfortable in operational technology as well as corporate IT. Smaller companies with a straightforward ransomware event may find it more than they need.
S-RM is a London-headquartered intelligence and cyber security consultancy that works across nine international offices. Its cyber incident response team is global and multilingual and responds 24/7/365, with technical triage within hours, onsite consultants where needed, and full investigation, containment and restoration. The wider firm also covers digital forensics, managed security, offensive security, corporate investigations and crisis response, which gives it a deep bench for extortion cases.
S-RM holds NCSC Cyber Incident Response Level 2 Assured Service Provider status and CREST CSIR accreditation, both announced in December 2023, along with ISO 27001, ISO 9001 and ISO 14001 certification. Its negotiation capability draws on decades of kidnap, ransom and extortion crisis work, an unusual pedigree among incident response companies. The firm cites one ransomware case where it recovered more than 30,000 encrypted endpoints and 300+ servers for a public organization in under a week. It also works directly with insurers and legal representatives, and has been named incident response team of the year in Zywave’s Cyber Risk Awards several years running.
S-RM fits UK and European organizations that want an NCSC assured responder, and multinationals that value its blend of intelligence, negotiation and technical response. Buyers looking for published retainer terms will need to ask, as the firm does not list them on its site.
8. NCC Group — Tiered IT And OT Response Retainer With A Guaranteed SLA
NCC Group is a cyber security company headquartered in Manchester, UK, with more than 2,000 colleagues and over 25 years in business. Its incident response line covers incident readiness, cyber incident response management, incident response recovery and a cyber incident response retainer, backed by a 24/7 incident response hotline. The firm takes part in the NCSC Industry 100 programme and displays a long list of accreditations, including CREST incident management and NCSC CIR.
The retainer is well defined. NCC Group offers tiered packages matched to your SLA needs, with guaranteed response times, 24/7/365 access to IT and OT incident responders, and remote or onsite deployment. Onboarding is part of the package so the team has your environment details before an incident, and optional readiness services include first responder training, tabletop exercises, compromise assessments and external attack surface management. OT incidents are supported with partner Dragos, which matters for manufacturers and utilities.
NCC Group fits UK and international organizations that want a retainer with clear tiers and a single supplier that can also handle testing and assurance work between incidents. Buyers focused purely on ransomware negotiation may want to pair it with a specialist.
9. CYPFER — In-House Ransomware Recovery Team Across Six Office Locations
CYPFER is a cyber attack response and ransomware recovery firm with offices in Miami, London, Utrecht, Toronto, the Cayman Islands and Mexico City. Its services cover incident response, ransomware recovery, digital forensics and cyber risk, and its ransomware practice includes advisory work and CYCOMMS, its threat actor communications service. The firm offers 24/7 global support and cites more than 25 years of experience and 2,500 customers.
The firm’s defining claim is that it never outsources: the people who investigate are the same people who rebuild, rather than handing restoration to a subcontractor. That continuity matters during ransomware recovery, where decryption, data validation and system rebuilds have to happen in the right order to avoid reinfection. CYPFER also offers a zero-dollar retainer for critical infrastructure clients, which lowers the barrier for hospitals, utilities and municipalities that cannot easily fund a paid retainer.
CYPFER suits mid-market companies and critical infrastructure operators that need a hands-on team to take them from ransom note to running systems. Large enterprises dealing with complex espionage cases may want a firm with a bigger threat intelligence operation behind it.
10. Quorum Cyber — Microsoft-First DFIR Team That Absorbed Kivu Consulting In 2025
Quorum Cyber is an Edinburgh-headquartered security firm with a US office in Tampa, and since November 1, 2025 it has also been the home of Kivu Consulting, the incident response firm that had worked with insurers and breach counsel for 16 years. Kivu now operates as Quorum Cyber with the same engagement leads in place. The combined digital forensics and incident response team handles ransomware, cloud compromise, business email compromise, insider threats and complex enterprise intrusions.
Its services include incident response, forensics, threat containment and recovery, and ransomware negotiation built on intelligence-led assessments and controlled communication with attackers. What sets Quorum Cyber apart is depth in the Microsoft stack: it takes a Microsoft-first approach across Sentinel, Defender XDR, Entra ID, Microsoft 365 and Azure, holds Microsoft Solutions Partner for Security status, and offers enhanced monitoring through Microsoft telemetry during an incident. It sells an incident response retainer, works alongside cyber insurers and legal counsel during engagements, and says it is one of only two firms globally trusted by Microsoft’s DART team.
Quorum Cyber fits organizations that run heavily on Microsoft 365 and Azure, where most investigations start with identity and email. Buyers outside the Microsoft ecosystem should confirm how much of the team’s tooling depends on it.
How To Choose An Incident Response Company
The right firm depends on what you are most likely to face, who pays the bill and how quickly you need people working. These five questions cover the decisions that matter most before you sign anything, ideally well before the incident.
Do You Need An Incident Response Retainer Or Can You Call When Something Happens?
An incident response retainer moves the paperwork out of the crisis. The contract, rates and scope are agreed in advance, the firm collects details about your environment during onboarding, and you get a committed response time, which on this list ranges from a 24-hour SLA on entry tiers to two hours on premium ones. Many retainers also let unused hours roll into proactive work such as tabletop exercises, compromise assessments or playbook reviews, so the money is not wasted in a quiet year. Calling a firm cold during a breach is possible, but you will negotiate terms while systems are down, and some firms prioritize retained clients when demand spikes. If you are regulated, handle sensitive data or have been targeted before, a retainer is usually worth it. Ask how hours are counted, whether proactive services draw from the same pool, and what happens to unused balance at renewal.
Is The Firm On Your Cyber Insurance Panel?
If you carry cyber insurance, read the policy before you choose a responder. Most carriers keep a cyber insurance panel of pre-approved breach coaches, forensic firms and negotiators, and using an off-panel firm can mean reduced reimbursement or a fight over rates. Panel firms already know the carrier’s billing rules and reporting expectations, which speeds approvals in the first hours. Check which firms are on your carrier’s panel, then shortlist from that group, and ask your broker whether a firm you prefer can be added by endorsement. In many insured breaches, outside counsel engages the forensic firm so findings stay under privilege, so make sure your preferred firm is used to working that way. Finally, note the carrier’s notice requirements: late notice can affect coverage regardless of which firm you pick.
Can They Handle Ransomware Negotiation And Payment Compliance?
Ransomware response is more than restoring servers. Someone has to decide whether payment is even on the table, communicate with the threat actor without making things worse, check the group against sanctions lists, and validate any decryptor before it touches production systems. Some firms on this list run in-house negotiation teams, while others bring in a partner. Ask who will actually talk to the attacker, what intelligence they hold on the specific group, how they verify claims of stolen data, and how they handle sanctions screening and payment documentation. A firm with good data on a ransomware group can often tell you whether the group reliably delivers working decryptors or deletes data as promised, which shapes the pay or no-pay decision. Treat published negotiation outcomes as directional, since each case differs.
Do You Need Forensics, Remediation Or Both?
Digital forensics and incident response are related but different jobs. Forensics answers what happened: how the attacker got in, what they touched, whether data left and what evidence will stand up to a regulator or a court. Remediation is the hands-on work of evicting the attacker, rebuilding Active Directory, reimaging machines and restoring data. Some firms do excellent forensics and hand remediation back to your IT team or a partner, while others carry the work all the way to recovery. Decide which you need before you sign. If litigation, notification or regulatory reporting is likely, prioritize defensible forensic reporting and expert testimony experience. If your IT team is small, prioritize a firm that will rebuild alongside you. After the incident, follow-up testing from one of the penetration testing companies we have reviewed can confirm the gaps were actually closed.
How Fast Can They Actually Engage?
Time to engage is the gap between your first call and a responder working on your systems, and it is where firms differ most in practice. Ask for the contractual response time and what it measures: a call back, a scoping session or hands-on investigation. Ask how quickly they can deploy collection tooling remotely, whether they can use the endpoint agents you already run, and how long onsite deployment takes in your locations and time zones. Confirm language coverage if you operate in several countries. A firm with a 2-hour SLA that then needs days to agree a statement of work is slower than one with a 4-hour SLA and a pre-signed retainer. Test the hotline once during onboarding, and keep the number and retainer details somewhere that will still be reachable if email and your corporate network are down.
Conclusion
For large enterprises facing advanced attackers, Mandiant, CrowdStrike, Unit 42 and Sygnia bring the deepest threat intelligence and the largest response teams, with Unit 42 especially convenient for insured buyers given its panel coverage. Kroll is the natural fit when a breach response will run into notification, regulators or litigation. Arete, CYPFER and Quorum Cyber are built for the ransomware and extortion cases that make up most insured claims, while S-RM and NCC Group give UK and European buyers NCSC assured response and clearly structured retainers.
Whichever firm you choose, set it up before you need it: sign the retainer, confirm it with your insurer, run a tabletop exercise and keep the hotline number offline. Incident response is one part of a wider security program, and our roundup of cybersecurity companies covers the prevention and monitoring side that keeps that hotline call from happening in the first place.
