How IR Firms Get on Cyber Insurance Panels: What Carriers Document Before They Panel You

Key takeaways

• A panel is a claims supply chain, not an award. Carriers panel firms to control response quality, speed, and cost on covered events. Everything on the panel exists to serve the claim.
• Repeat presence is the signal. In our documented dataset, seven firms appear on six of ten published carrier panels. They share three traits: multi-category coverage, global or wide geography, and a named 24/7 response capability.
• The long tail is real. 108 of the 158 unique firms in our documented dataset appear on exactly one carrier's published panel. Single-panel presence is the normal state, not a failure.
• Carriers document categories, not criteria. Published pages slot firms into roles: DFIR, breach counsel, notification, crisis communications. To get on, you need to be unambiguously one of those.
• The relationship usually starts through claims or counsel. Panels refresh in cycles, and the firms that get added are typically ones the claims team or panel breach counsel has already worked with.

What a carrier panel actually is

When a policyholder calls a breach hotline, someone has to answer with a firm that can start work in hours, bill against the claim, and document the response well enough for a regulator. The panel is that answer, pre-negotiated. Panel firms typically work under agreed terms, which is also why panel membership matters for buyers: many policies cover panel-firm costs fully and treat off-panel work as a pre-approval conversation.

That framing explains what carriers document. A panel page is a roster of roles. DFIR firms contain and investigate. Breach counsel manages privilege and notification duties. Notification vendors run call centers. Crisis communications firms manage the outside world. Restoration firms get data back. If your firm does not clearly occupy a role, it does not clearly belong on the page.

What the published panels show

We read the published panel pages of ten carriers and MGAs and documented every relationship, 308 in total, with access dates (October 2026). Every one is a publicly stated relationship. Three patterns stand out.

The repeat names. Seven firms appear on six of the ten published panels: Arete, Booz Allen Hamilton, Charles River Associates, CrowdStrike, Epiq, Mullen Coughlin, and Norton Rose Fulbright. They are not interchangeable, but they share traits. Each covers its category across geographies. Each names a real response capability, not just a service description. Several span more than one category, which makes them easy to panel: one relationship, many claims.

The long tail. 108 of 158 documented firms appear on exactly one carrier's panel. This is the normal shape of the market. Most panel firms got there through a specific claims relationship or a regional need, and most never try to repeat it. If you are on one panel, you are not behind. You are typical.

The evidence depth varies. Some carriers publish full rosters with names, roles, and hotlines (AXA XL's documented page carries 54 firms; Coalition's 48). Others publish a statement that a panel exists and a process to access it. A carrier with no public roster is not a carrier without firms. It is a carrier whose panel you document through a different channel.

We put the full numbers, including the firms-by-panel-count distribution and what panel data cannot tell you, in Inside Cyber Insurance Panels: Which IR Firms Carriers Actually Panel.

The evidence a firm needs to be panel-able

Carriers do not publish criteria, so treat this as what the published pages reward, plus what firms report after going through it.

• A category you fit without explanation. DFIR, breach counsel, notification, crisis communications, restoration, forensic accounting. The panel page needs a slot for you.
• A named, reachable response capability. A 24/7 hotline that reaches a responder, not voicemail. Panel pages that publish hotlines are telling you the claims team uses them.
• Geographic coverage that matches the book. If the carrier writes policies where you cannot deploy, the relationship is a liability. US-only coverage panels to US books.
• Documentation discipline. Panel work flows into claims, sometimes into litigation. Evidence preservation, chain of custody, and reports that serve adjusters and counsel, not just the client.
• Insurance and standing. Professional liability coverage appropriate to response work. Carriers are extending their claims reputation to you.
• Capacity honesty. A firm that accepts every panel invitation but cannot staff concurrent incidents damages the claims process. Carriers notice.

Certifications help but are not the gate. What the published pages document is the role and the reach, not the acronym list.

How the relationship usually starts

Panel additions are rarely won by cold outreach alone. The common paths:

1. Claims referrals. A claims handler uses your firm on an off-panel basis, the work goes well, and the firm enters the next panel refresh with internal support.
2. Breach counsel recommendations. Panel breach counsel bring their own trusted DFIR firms. Carrier counsel asking claims to add a firm is a strong signal.
3. Panel refresh cycles. Carriers revisit panels after claims experience shifts, after acquisitions, or after a program change. Firms with documented, current capability are the easy additions.
4. New program builds. MGAs launching cyber programs need a panel on day one. Building for a new program is the cleanest entry, because there is no incumbent.

What all four share: the carrier can already see evidence of what you do. A firm with a documented, source-cited profile is easier to add than a firm whose capability is described in adjectives.

What the data cannot tell you, and we will not guess

Published panels do not disclose rates, exclusivity terms, how often firms are used, or why a firm came off a panel. Panels change, and a public page is a snapshot with an access date. Check the live panel before you plan a business around it, and treat every count in this piece as dated evidence, not a permanent state.

Frequently asked questions

Do you have to be on a panel to get carrier-referred work? No. Claims teams use off-panel firms regularly, usually with an approval step. Panel membership makes the path routine; it does not gate the work entirely.

How long does getting panelled take? There is no published standard, and firms report timelines from weeks to more than a year. The variable is usually the carrier's refresh cycle, not the vetting itself.

Do panel firms get paid less? Panel terms are negotiated and confidential, so we cannot answer this honestly. What the structure implies: carriers trade volume and predictability for terms, which is the same trade the panel makes for policyholders.

Does being on one carrier's panel help with others? It helps as evidence: documented panel presence on a carrier-published page is a verifiable claim. The firms we see on six of ten panels are the exception, not the result of a formula.