Panel Moves, October 2026: Five Firms Off Three Published Panels
Twelve days after we read ten carriers' published breach-response panels for our panel data study, we re-read every page. Five firms were gone. One of them had been on five of ten panels at the baseline read. This is the first edition of Panel Moves, the quarterly record of who carriers add, drop, and keep, from their own published pages, confirmed in a rendered browser so a missing name is missing on the page a buyer sees, not just in our fetch.
The drops, confirmed
| Firm | Panel | Was | Now | How we know |
|---|---|---|---|---|
| Ankura | CNA | Listed at the October 6-7 read | Absent from the rendered vendor page; ten other panel firms render normally | Rendered-browser check, October 2026 |
| Ankura | QBE | Listed at the October 6-7 read | Absent after all seven specialist accordions expanded; 27 other provider names render | Rendered-browser check, October 2026 |
| Cypfer | Coalition | Listed at the October 6-7 read | Absent from both published panel pages | Rendered-browser check, October 2026 |
| CyberSteward | Coalition | Listed at the October 6-7 read | Absent from both published panel pages | Rendered-browser check, October 2026 |
| Aceris | QBE | Listed at the October 6-7 read | Absent from the rendered page | Rendered-browser check, October 2026 |
Ankura is the headline. At the baseline read it sat on five of the ten published panels we track, tied for the most. Twelve days later, two of the five are gone. We do not know why, and we will not guess: carriers change panels for their own reasons, and a drop is a fact about the page, not a judgment about the firm. What the fact is worth to a buyer is real: if your policy steers you toward panel firms, the panel you were shown at binding may not be the panel that answers at 2 a.m.
What did not change
Most of the market held still in the window. Across the seven carriers we could fully verify automatically, 135 named provider appearances confirmed present, the same as at the baseline read. CNA's page still renders its core panel. Coalition's DFIR section still carries Arete, Booz Allen, CRA, CrowdStrike, Irongate, and Level Blue. QBE, which blocks automated fetches, resolved under a rendered browser: its nine panel advisors and its specialist lists across all seven categories render, with the names above the only absences found.
No confirmed additions in this window. Adds are harder to catch than drops, a new name on a page is a needle our automated pass does not claim to find, so adds stay a manual review the page hashes flag for. The next edition carries the add-side ledger.
The three carriers the automated pass could not read
The automated re-read could not verify three carriers: AIG publishes its panel as a PDF, AXA XL keeps vendor lists inside PDFs, and QBE sits behind a Cloudflare challenge that blocks fetches. The rendered-browser check resolved QBE this edition. AIG and AXA XL stay on the manual-check list, and their absence from the automated column is a statement about their publishing format, not their panels.
What this means if you are buying insurance
Panel pages change between your binding date and your incident date. The practical checks:
- Look up your carrier's currently published panel, not the list your broker showed you at renewal.
- If a firm you retained is no longer on it, ask your carrier what that means for cost coverage before your next incident, not after.
- If you are evaluating a firm, check its documented panel presence here, with sources and dates.
What this means if you are a firm
A drop from a published panel is visible to every buyer who reads it. If your firm was dropped and you believe the record is wrong, send a correction, we publish corrections. If the record is right, the panel checker shows you which carriers' published pages name you today.
Panel Moves runs quarterly, from the carriers' own published pages, re-read and rendered-verified. [Subscribe for the next edition → /api/subscribe] The full dataset behind it: our panel data study, with sources and access dates.
Baseline read October 6-7, 2026; automated re-read October 18, 2026; rendered-browser confirmation October 19-20, 2026. Every drop was verified in a rendered browser, not assumed from a fetch. Carriers change their pages without notice; if a carrier reading this disagrees with our record, the corrections flow is open. Last verified: October 2026. Request inclusion → or a correction →
Continue reading
Best Cloud Incident Response Firms 2026: Ranked by Documented Evidence
Search for the best cloud incident response firms and you get vendor blogs ranking themselves, a review site selling placement, and forum threads asking for a firm people can afford. Nobody answers the question with evidence. This page does. It ranks the firms in our cloud [DFIR](/glossary#dfir) directory by what is actually documented: carrier [panel](/glossary#panel) presence, published response pages, and rates where firms publish them. Where the evidence is thin, it says so.
Best Incident Response Companies 2026: Ranked by What's Documented, Not What's Claimed
Search for the best incident response companies and you get two things. Vendor blogs that rank themselves first. And listicles that rank by adjectives. Neither survives contact with a real incident. What survives is evidence: which firms carriers' claims teams keep re-hiring, what the firms document about their own capability, and how their claims check out. This page ranks the market's most-documented IR firms. It tells you exactly what the ranking can and cannot say.