All Ten Carriers' Incident Response Panels, Compared
Ten major cyber insurers publish the names of the firms they trust for breach response. We read all ten panels and hold 308 documented firm-carrier relationships in our data, re-read quarterly. Here is the market side by side: panel sizes, the firms that appear most, what the lists do and don't tell you, and what changed in the first quarterly re-read.
Key takeaways
- Published panel sizes vary enormously. From AXA XL's 54 named firms and Coalition's 48 down to Beazley's four and Liberty Mutual's one on the pages we read. A short published list is not the same as a short panel, it may simply be a carrier that publishes less.
- Seven firms appear on six of the ten published panels. The most-named names are not all forensics shops: two are law firms and one is legal services, which says quietly that panels are built around counsel as much as around DFIR.
- Panels are a funding and approval mechanism, not a quality award. Panel-firm costs are typically covered and engagement needs no pre-approval. What the lists never tell you is price, response time, or availability.
- Panels move. Our first quarterly re-read caught five firms dropping off three carriers' panels within twelve days of the baseline read.
The ten panels, side by side
| Carrier | Firms named | Relationships | Notes from our read |
|---|---|---|---|
| AXA XL | 54 | 62 | Published as a PDF, re-read manually |
| Coalition | 48 | 57 | Widest range of job types; page dated April 2026 |
| AIG | 43 | 46 | Published as a PDF, re-read manually |
| QBE | 38 | 45 | Read through its page's protections |
| Chubb | 36 | 40 | Deep on core breach steps across five job types |
| CNA | 39 | 34 | Page re-read after the October drops below |
| Travelers | 7 | 7 | Short published list on the page we read |
| AXIS | 7 | 7 | Short published list on the page we read |
| Beazley | 4 | 4 | Short published list on the page we read |
| Liberty Mutual | 1 | 1 | One named firm on the page we read |
Counts are from our documented reads of each carrier's own published pages in October 2026, with every relationship sourced and dated in our panel data study. Where a carrier publishes little, we record exactly what the page shows, no more.
The firms that appear most
Seven firms appear on six of the ten published panels we track:
| Firm | Carriers | Trade |
|---|---|---|
| Arete | 6 | Incident response and forensics |
| Booz Allen Hamilton | 6 | Consulting and DFIR (the Tracepoint practice) |
| Charles River Associates | 6 | Financial economics with an IR practice |
| CrowdStrike Services | 6 | Incident response and forensics |
| Epiq | 6 | Legal services and administration |
| Mullen Coughlin | 6 | Breach counsel |
| Norton Rose Fulbright | 6 | Breach counsel |
One tier down, at five of ten: Ankura, Mandiant / Google Cloud, Kroll, Experian, and TransUnion. The shape of that list is the real finding: the panel system rotates around a small set of firms spanning forensics, counsel, notification, and credit services. If you want to understand who the claims ecosystem keeps re-hiring, the directory lists all of it, filterable by panel.
What the panels do and don't tell you
What they do tell you: which firms the claims organization has already vetted, which means engagement usually needs no pre-approval and costs are typically covered under the policy. In an incident, that is the difference between a funded response starting tonight and an approval conversation.
What they never tell you: quality, price, response time, or availability. A named firm is not the "best" firm, and our Verification Standard is the independent evidence layer the panels don't provide: certifications checked against issuing registries, documented response times, and sourced claims, panel presence being one signal among several.
What changed in the first quarterly re-read
Twelve days after the baseline study, our first re-read caught five firms dropping off three carriers' published panels, including a firm that had been on five of ten panels at the baseline. The record is rendered-verified and public in Panel Moves. The lesson for buyers is simple: the panel page you read when you bound the policy is not the panel page that exists when you have an incident. That is why we re-read quarterly.
If you carry a cyber policy, check your carrier's panel before you need it.
Check a panel or a firm against the ten we track →Panel counts come from carrier-published pages, read October 6-20, 2026, and re-read quarterly; every relationship is sourced and dated in our panel data study. AIG and AXA XL publish PDF lists, which are re-read manually. Absence from a published page is a statement about our sources, not about a carrier relationship. No firm paid to appear. Last verified: October 2026. Have a correction or addition? Request inclusion or a correction →
Continue reading
Best Cloud Incident Response Firms 2026: Ranked by Documented Evidence
Search for the best cloud incident response firms and you get vendor blogs ranking themselves, a review site selling placement, and forum threads asking for a firm people can afford. Nobody answers the question with evidence. This page does. It ranks the firms in our cloud [DFIR](/glossary#dfir) directory by what is actually documented: carrier [panel](/glossary#panel) presence, published response pages, and rates where firms publish them. Where the evidence is thin, it says so.
Best Incident Response Companies 2026: Ranked by What's Documented, Not What's Claimed
Search for the best incident response companies and you get two things. Vendor blogs that rank themselves first. And listicles that rank by adjectives. Neither survives contact with a real incident. What survives is evidence: which firms carriers' claims teams keep re-hiring, what the firms document about their own capability, and how their claims check out. This page ranks the market's most-documented IR firms. It tells you exactly what the ranking can and cannot say.