# 5 Security Vendor RFP Myths, and What the Public Record Says Instead > Every security team writing an incident response RFP inherits five beliefs that feel like wisdom: the panel list is current, we already know the best firms, a claimed certification is a held certification, the RFP you wrote at kickoff still describes the market, and the shortlist finishing the RFP is the end of the work. We maintain a dated, sourced record of ten cyber insurance carriers' published breach-response panels -- 335 documented relationships, re-read quarterly -- and every one of those beliefs fails against it. Here are the five myths, the documented facts that break each one, and what a myth-proof RFP asks instead. - **Published**: 2026-10-26 - **URL**: https://vendorquals.com/blog/security-vendor-rfp-myths --- # 5 Security Vendor RFP Myths, and What the Public Record Says Instead *Every security team writing an incident response RFP inherits five beliefs that feel like wisdom: the panel list is current, we already know the best firms, a claimed certification is a held certification, the RFP you wrote at kickoff still describes the market, and the shortlist finishing the RFP is the end of the work. We maintain a dated, sourced record of ten cyber insurance carriers' published breach-response panels -- 335 documented relationships, re-read quarterly -- and every one of those beliefs fails against it. Here are the five myths, the documented facts that break each one, and what a myth-proof RFP asks instead.* ## Key takeaways - **Panel lists decay silently.** In October 2026, six firms dropped off four carriers' published panels within twenty days of our baseline read -- one of them had been on its carrier's page continuously since at least April 2025. The list you were handed at binding is not the list that answers at 2 a.m. - **Familiarity is not verification.** The market concentrates: seven firms appear on six of the ten published panels we track. The names everyone knows are the names on every list -- which is exactly why a famous name tells you nothing about fit for your environment. - **Claims need an issuer, not a checkbox.** A GIAC certification can be checked against the issuer's own registry. A government assurance like the UK NCSC's incident response scheme is a published list of 62 providers. Most RFPs collect the claim and never run the check. - **The market moves faster than your document.** A year of third-party archive snapshots shows every panel we could observe changed: one carrier added eight listings in a single quarterly cycle; another turned over a fifth of its bench in twenty-two months; a firm changed its name on a panel page mid-quarter and the paperwork quietly stopped matching. - **Selection is the start of the work, not the end.** The firms that survive your RFP are the ones you will actually call. Exercise the shortlist, date every document, and re-verify on a cadence -- the record is the deliverable. ## Myth 1: The panel list your carrier gave you is current The panel page is the one document everyone trusts and nobody date-checks. Our first quarterly re-read of ten carriers' published panels, twelve days after the baseline, found five firms already gone; an October 26 follow-up found a sixth, off Chubb's panel, dropped in the eight days after the re-read. Ankura had been documented on CNA's published panel continuously from April 2025 through the October 2026 baseline -- then it was silently gone within twelve days. Two firms on Coalition's published page, Cypfer and CyberSteward, appeared and vanished inside a single quarter without ever showing up in a third-party archive snapshot. Carriers publish these pages as living documents, overwrite them in place, and attach no change log. The panel you saw at binding may not be the panel that exists at incident time, and nothing on the page will tell you it changed. **What to do instead:** Ask every panel document for its date of capture, not the "last updated" label on the page. Re-verify the panel when you bind the policy and again when you have an incident. Paste any panel list into a [panel checker](/tools/panel-checker) that shows what is documented in a dated record -- or build the re-verification into your own vendor management cadence. The full picture of which carriers' panels we track and how the lists compare: [cyber insurance panels compared](/blog/cyber-insurance-panels-compared). ## Myth 2: We already know the best firms This myth survives because it is half true: the famous names are genuinely on most lists. Seven firms -- Arete, Booz Allen Hamilton, Charles River Associates, CrowdStrike, Epiq, Mullen Coughlin, and Norton Rose Fulbright -- appear on six of the ten published panels we track. That concentration is a fact about the market's claims benches, not a verdict on quality, and it cuts both ways: if your shortlist is the same seven names every competitor shortlists, you have optimized for consensus, not fit. There is a second, newer version of this myth: the AI answer. When we asked AI assistants in October 2026 to name top incident response firms, they recommended the same familiar names -- sourced from vendor marketing pages and listicle content farms. In our testing, not one answer cited a carrier panel, a government registry, or any document a buyer could verify. An AI answer that recommends a firm you already knew has not added information; it has added confidence you did not pay for. **What to do instead:** Treat the RFP as a market intelligence exercise, not a confirmation exercise. Ask what distinguishes a firm for *your* environment -- OT and ICS networks, cloud-native infrastructure, a regulated industry's notification clocks -- and document the firms that specialize there, not the ones with the most recognition. The six-check framework for matching responders to your environment: [how to choose an incident response firm](/blog/how-to-choose-an-incident-response-firm). ## Myth 3: A claimed certification is a held certification Most RFPs and security questionnaires ask vendors to self-report certifications, and most buying processes file the answer without ever checking it. The uncomfortable fact is that self-reported claims are the cheapest thing in the document to get wrong -- or to inflate -- and the whole point of a certification is that someone other than the firm's sales team says it is true. Verification is usually one step, and the step is public. A named team member's GIAC certification can be checked against the issuer's own verification service with the certificate ID. The UK NCSC's Cyber Incident Response scheme is a published government list of 62 assured providers you can match a firm against by name. A FedRAMP authorization is a marketplace entry with a status and a date. A carrier panel membership is a page the carrier publishes. These checks take minutes; our entire evidence model is built on running them and labeling what we could not verify. **What to do instead:** Replace the fifty self-report questions with five verifiable ones: which named people hold which certifications (with IDs), which government assurance lists the firm appears on (with dates), which carrier panels publish the firm's name, which engagements the firm has written up publicly, and what response-time commitments the firm will put in writing by severity tier. A firm that hesitates on a verifiable question has answered it. How we grade every claim on this site, and what each grade means: [our evidence tiers](/blog/how-to-choose-an-incident-response-firm). ## Myth 4: The RFP you wrote at kickoff still describes the market today An RFP names firms, and firms move. We reconstructed a year of panel history from third-party archive snapshots, and every panel we could observe changed: AXA XL's published panel added eight listings -- five of them new DFIR firms -- between its March 2025 and June 2025 editions, one quarterly cycle. AIG's panel turned over roughly a fifth of its bench across its July 2024 and May 2026 editions, gaining a service category that did not exist in the old document. Chubb's page dropped Kroll and BakerHostetler between January and May 2025 with no announcement. And the churn is not only exits: names change mid-stream -- Cybereason became LevelBlue on Chubb's panel page, which means incident paperwork naming one firm no longer matches the panel page naming the other. The buyers who feel this least are the ones who wrote the RFP six months ago and filed it. The failure mode is quiet: a runbook that names a firm that left the panel, a contact who left the firm, a retainer that quietly expired. **What to do instead:** Date every line of the vendor section of your RFP, and re-read the market on a cadence -- quarterly is what the churn rate actually supports. Two questions do most of the work: *who does your claims bench share with every competitor?* and *what changed on your own panel since you last looked?* The first edition of our own quarterly moves record, including the correction we published when our follow-up read caught changes our first pass missed: [Panel Moves, October 2026](/blog/panel-moves-2026-10). ## Myth 5: Once the shortlist is chosen, the work is done The shortlist is a bench, and a bench nobody exercises is a list of assumptions. The expensive version of this myth is specific: a policyholder whose runbook names a panel firm the carrier dropped months ago, calling at 2 a.m. and discovering the engagement path no longer matches the claim. Every drop in our October record happened silently, on pages the carriers themselves publish, within twenty days. The cheap insurance against it is governance scaled to the risk: exercise the shortlist once a year -- a tabletop that actually calls the firms, not a slide deck; re-verify the panel and the claims each quarter; keep the retainer terms and the response-time commitments current; and write down, for each firm, the date you last verified anything about them. An unverified, undated shortlist is not a decision; it is a memory. **What to do instead:** Treat the RFP as the first leg. The full structure -- responders, counsel, and the insurance layer, and how the three legs hold each other up -- is in [the three legs of incident response](/blog/three-legs-of-incident-response), and the emergency version of the evaluation you should never have to run is in [choosing a responder when you are breached right now](/blog/breached-right-now-choosing-a-responder). ## What a myth-proof RFP looks like Strip the five myths out and the RFP gets shorter, not longer. Ask fewer questions, make every answer checkable, date everything, and re-run the checks on a cadence instead of trusting the kickoff document. If you want a starting structure with the verification fields built in, the [incident response RFP builder](/rfp/cloud-ir) drafts one in minutes -- and the [panel checker](/tools/panel-checker) tells you what is documented about any firm or panel list against our dated record. ## Frequently asked questions **Is an RFP even worth it for incident response, since you never know when the incident comes?** Yes, with one correction: it is a readiness document, not a procurement event. Its job is to have named, verified firms, dated claims, and current engagement paths ready before the incident -- and to be re-verified often enough that "ready" stays true. **How often do incident response panels actually change?** Our documented record: six firms off four carriers' published panels within twenty days of the October 2026 baseline; over the year we could reconstruct from archives, every observable panel changed at least once, and adds outnumbered drops everywhere we looked. Quarterly re-verification matches the observed churn rate. **What is the single most valuable check?** The issuer check. Whatever the claim -- certification, government assurance, panel membership -- verify it against the body that issued it. It is the difference between a vendor's marketing and a fact, and it is almost always public. **How do I check a firm's insurance panel memberships?** Read the carrier's own published panel page, note the date you read it, and re-read it before you rely on it. Our cross-carrier record of who is documented where: [the state of cyber insurance IR panels](/blog/state-of-cyber-insurance-ir-panels). --- *The facts in this post come from our own dated, sourced panel record: 335 documented relationships across ten cyber insurance carriers, read October 6-7, 2026, re-read October 18-20, with a full-structure follow-up read on October 26; historical editions verified against Internet Archive captures from January 2025 through May 2026; government assurance lists (the UK NCSC Cyber Incident Response scheme, 62 providers) and the FedRAMP Marketplace as published. We document what pages and registries say, with dates; we do not rank firms, and absence from our record means absence from the pages we read, not a judgment. Last verified: October 26, 2026. Have a correction or addition? [Request inclusion or a correction ->](/corrections)* Source: https://vendorquals.com/blog/security-vendor-rfp-myths. This page is also served as HTML at https://vendorquals.com/blog/security-vendor-rfp-myths. --- - [All articles](https://vendorquals.com/blog)