You're Breached Right Now: Choosing a Responder in Hours, Not Weeks

Key takeaways

• The claim hotline comes first if you carry cyber insurance. Your carrier's panel rules decide who gets paid and how much. A two-hour delay checking this can cost you more than any wrong firm choice.
• Mid-incident you run three gates, not six checks. Mobilization with named people, environment fit, and documentation discipline. The rest of the evaluation waits.
• Wrong specialty costs more than wrong firm. A brilliant enterprise-Windows team on an OT/ICS network or a cloud-native platform wastes the hours that matter most. Environment fit is gate one.
• Do not touch the machines. Powering off, restoring from backup, or reimaging before forensics destroys the evidence your insurer and regulator will both want. Contain, preserve, then call.
• Everything you skip mid-incident, you schedule for the day after. The full evaluation turns the emergency engagement into a deliberate retainer with known costs before the next incident.

The first thirty minutes, before you choose anyone

The responder choice matters, but three things come before it, and all three are faster than a vendor call:

1. Contain without destroying. Isolate affected systems at the network level if you can. Do not power off encrypted machines if you can avoid it: volatile data on those systems is evidence, and "we reimaged it" is the one answer that damages the investigation, the insurance claim, and the regulator report at the same time.
2. Call the hotline on your policy. If you carry cyber insurance, the carrier's breach hotline is your fastest path to funded response. Most policies route you to their panel firms with costs billed to the claim. Engaging off-panel without the pre-approval conversation is how buyers pay twice.
3. Wake counsel. The panel breach lawyer runs privilege and, on most panels, is the person who formally engages the responders. Response work under counsel direction keeps the investigation inside privilege, which matters for what must later be disclosed. Notification clocks like GDPR's 72 hours and the HIPAA breach rule start running whether or not a responder is on site.

If someone is already doing incident command, that person should run this list, not you. The incident commander role exists precisely so the person choosing responders is not also fighting fires.

The three gates, in order

Gate 1: Can they actually mobilize, with named people

Mid-incident, everything else is theoretical if the team cannot start. On the first call, get:

• A named engagement lead. A real person who will be on your incident, not a salesperson and not "our team."
• Hours to first action, in writing, today. Hours to acknowledge, hours to remote start, hours to on-site if you need boots. A firm that answers "immediately" without numbers does not have an SLA, it has enthusiasm.
• The concurrency answer. "What happens if you're working three other incidents when I invoke?" The only honest answers involve surge bench, priority terms, or a retainer queue. Silence on this question is a red flag at 2 a.m. and a disqualifier by morning.

Retainer firms pre-agree exactly these terms, which is a large part of what a retainer is actually for. If you have one, invoke it now, this is the moment it exists for.

Gate 2: Do they know your environment

A responder who has never worked in your environment type will spend the first billable day learning it. The failure modes are not subtle:

• OT/ICS: containment means production trade-offs. A firm without ICS-specific experience may isolate a segment that stops a production line, or miss the engineering workstation that matters. The documented OT/ICS response firms exist for exactly this environment.
• Cloud and cloud-native: the evidence lives in API logs, audit trails, and cluster state that evaporate. Standard endpoint forensics on a Kubernetes incident is archaeology in the wrong ruin. Match the firm to the platform: cloud IR and cloud-native/Kubernetes responders document platform-specific experience.
• Regulated sectors: in MedTech and automotive environments, the response has to anticipate the regulator's questions, not just the attacker's. Sector fluency is not a luxury there, it is the engagement.

Ask one question: "What incidents like ours, in environments like ours, have your actual responders worked?" Then ask which ones they can describe. Firms with documented engagements answer fast. How the directory documents them shows what that looks like at the evidence level.

Gate 3: Will the work survive the claim and the regulator

The audience for the response is larger than you: the carrier's adjusters, possibly a regulator, possibly a court. Two checks, asked fast:

• Documentation discipline. "Can you show us a sanitized report structure now?" You are listening for a timeline with evidence citations, scope separated from speculation, and prose a non-technical executive can read. The forensic evidence requirements your claim and any 8-K disclosure will lean on are decided in these first hours.
• Chain of custody and privilege. Confirm they work under counsel's direction and preserve evidence to a defensible standard. Firms that shrug at this mid-incident will shrug at it in the deposition too.

What to skip on purpose

You are allowed to skip mid-incident, and you should:

• The full RFP. Structured procurement is for peacetime, that is what the planning evaluation is for. Emergency engagements need three gates, not six checks and a scoring matrix.
• Reference calls. No one you can reach at 3 a.m. is a useful reference. The evidence substitutes: named responders, documented engagements, panel presence on the carrier's own page.
• Rate negotiation to the third decimal. Mid-incident rates are what they are, and haggling burns engagement hours. Get the rate structure in writing, flag anything you dispute, and negotiate the delta after containment. The exception: get the minimums and out-of-scope definitions stated before work starts, because those, not the hourly rate, are where emergency invoices surprise buyers.
• Security questionnaires and certifications paperwork. Registry checks you can do yourself in minutes where evidence exists. Vendor risk reviews are a procurement artifact, not a response tool.

Two things you must NOT skip, ever, even mid-incident: the panel pre-approval call if you are going off your carrier's panel, and the preservation of evidence before remediation. Both mistakes are unrecoverable and both are common.

The first-call script

Five questions, every firm, same order. Takes twenty minutes across three calls and makes the choice comparable when you are least able to compare:

1. "Who is the named lead on our incident, and which responders are with them?"
2. "How many hours from a signed engagement to your first action, and what does first action mean?"
3. "What other incidents are you working right now, and what happens to our priority if they escalate?"
4. "What incidents in environments like ours can you describe without an NDA?"
5. "What do you need from us in the first four hours, and what will you absolutely not do without our approval?"

The last question is the tell. Strong firms answer it with evidence handling, isolation approvals, and communication protocol. Weak firms answer it with "we'll take it from here," which is exactly wrong: it is your incident, your evidence, and your regulator.

Red flags at 2 a.m.

• "Just restore from backup and we'll check it after." Remediating before forensics destroys the record of what happened and what left.
• No named humans by the end of the first call. Teams that cannot produce a lead before engagement will not produce one during.
• SLA by adjective. "We'll be right there" is not a response commitment. Neither is a number with an asterisk about concurrent incidents.
• Panel discouragement. Any firm that talks you out of calling your carrier's hotline or confirming panel rules is volunteering you for the bill. The panel checker and the panel data study exist so you don't have to take anyone's word for it.
• The retainer ambush. Being told your emergency is a great time to buy a retainer, as a condition of mobilization. Buy the retainer later, deliberately, with both eyes open on cost.

The day after: converting panic into practice

Once containment is stable and the responders are working, schedule the real evaluation. The emergency taught you things no RFP could: whether the firm's bench was real, whether their documentation discipline held under pressure, whether their terms matched what you were told. Run the full six-check evaluation against the firm that just saved you and against two alternatives, then decide the retainer question with evidence. The post-incident review is where the response itself gets audited, and the responder comparison belongs in it.

And if the incident ends without a responder engaged, because it was small or the panel handled it, you just received the cheapest drill money can buy. Run it as one: the IR plan template and a tabletop exercise are how you make the next 2 a.m. a checklist instead of a decision.

Frequently asked questions

Do I have to use my insurer's panel firm during an active incident? Usually no, but the panel firms are the ones the carrier has pre-agreed rates and billing with, so the practical answer is: call the hotline, ask the pre-approval question for any firm you prefer, and get the answer in writing before work starts. The overlap between panels and IR firms explains the economics.

Can I engage a response firm before counsel is involved? You can, but you shouldn't. Response work runs under privilege when counsel directs it, and evidence gathered without privilege protections can end up in the regulator's hands in full. The call order that protects you is carrier, counsel, responders.

How fast can a retainer firm actually start? It depends on the retainer tier, but pre-agreed SLAs exist precisely for this moment, and firms with published response commitments are the ones that honor them. The retainer cost guide covers the structures and what response terms each one buys.

What if the firm I want is not on my carrier's panel? You can still engage them, but call the carrier first, because reimbursement rules differ per policy and the conversation takes minutes. What you cannot do is assume. The most expensive sentence in incident response is "we thought it would be covered."

If you're reading this during an active incident: documented emergency response firms, right now →