Inside Cyber Insurance Panels: Which IR Firms Carriers Actually Panel, and Where the Gaps Are

Key takeaways

• 308 publicly stated relationships, 158 unique firms, ten carriers. Every relationship below is documented from a carrier-published page with an access date in October 2026.
• Seven firms appear on six of the ten published panels. Arete, Booz Allen Hamilton, Charles River Associates, CrowdStrike, Epiq, Mullen Coughlin, and Norton Rose Fulbright. No firm appears on all ten.
• The market is a long tail. 108 of the 158 firms appear on exactly one carrier's published panel. Single-panel presence is the normal state for a panel firm.
• Panel pages differ wildly in depth. The deepest documented page carries 54 firms. The thinnest is a single statement that a panel exists. Both are honest descriptions of what the carrier chose to publish.
• Breach counsel outranks forensics on the pages. Normalized, DFIR work holds 98 relationships, but breach counsel and advisory roles hold 75 more across three label variants. Carriers panel the legal side as heavily as the technical side.

What we collected and how

We read the published cyber panel and vendor-partner pages of ten carriers and MGAs: AIG, AXA XL, AXIS, Beazley, Chubb, CNA, Coalition, Liberty Mutual, QBE, and Travelers. Pages were read October 6-7, 2026. Every relationship we record is publicly stated on the carrier's own page or in its published program materials; we note the source and access date per relationship.

Two cleanups make the counts honest. Provider names vary across pages (23 variants, such as "CrowdStrike Services" versus "CrowdStrike"), and we canonicalize them before counting, the same mapping our platform applies. Categories are normalized through the dataset's own capability sheet for 296 of the 308 rows; 12 rows keep the carrier's original label. When a firm appears twice with one carrier in two roles, that is two relationships and one firm, and we count both facts separately.

The headline numbers

That last row is the quiet headline. Even the most panelled firms in the market sit on six of ten published pages. Carrier panels overlap, but no firm has become the universal default, and the panel you face depends on the carrier you bought from.

Panel sizes differ more than the firms do

Read the bottom half of that table carefully. Travelers and AXIS document seven relationships each, and Liberty Mutual's documented page is a panel-existence statement, not a roster. That is a fact about what each page publishes, not about which carrier has a better panel. Some carriers publish full rosters with hotlines; others keep the list behind the claims process. When you compare panels, compare what is published, and note the access date.

The firms on the most published panels

Seven firms sit on six of the ten published pages. What they document tells you what repeat panel presence looks like.

Six firms sit on five of ten: Ankura, Experian, Kroll, Mandiant, MOXFIVE, and TransUnion. Kroll is the breadth outlier, documented in six different role categories from forensics to notification to identity monitoring. The pattern in the top tier is not one thing done everywhere, it is a clear category plus the geography and capacity to serve it on every panel.

What carriers actually panel

With categories normalized, the 296 mappable relationships distribute like this:

The legal side is bigger than it looks. Add breach counsel, media liability counsel, and technology E&O counsel and the counsel cluster approaches the DFIR cluster in size. The niche roles are real too: four relationships name DDoS mitigation, four name MDR, three name ransom negotiation. Those roles are rare enough that, on a panel page, a firm occupying one is memorable.

Where the coverage is thin

Geography first: 189 of the 308 relationships (61%) are documented as US coverage. 45 are global, 39 US and Canada, 17 APAC or Europe, and the rest regional. A buyer with an international footprint is depending on the global-coverage slice of any panel, and that slice is a minority of what the pages document.

Depth second: the long tail is where single-carrier panel firms live. 108 firms appear once. Some are regional specialists, some are role specialists, some are relationships the carrier published once and never refreshed. The pages do not say which, and we will not guess. What the shape implies for buyers: panel choice is real choice on the big carriers' pages, and a much shorter list on the thin ones.

What this data cannot tell you, and we will not pretend

Published panels do not disclose rates, response-time commitments, exclusivity terms, usage frequency, or outcomes. Our provider-level evidence for SLAs is exactly what the carriers publish, which for most relationships is nothing, so we record it as not established rather than inventing it. Panels change between our access dates and after them. Treat every number here as dated evidence with its source attached, check the live panel before you rely on any firm, and read our panel comparison of two of these carriers for what page-level differences mean during a claim.

Frequently asked questions

Which firms appear on the most cyber insurance panels? On the published pages we document: Arete, Booz Allen Hamilton, Charles River Associates, CrowdStrike, Epiq, Mullen Coughlin, and Norton Rose Fulbright, each on six of ten published panels as of October 2026.

Is a firm on many panels better than a firm on one? Not automatically. Repeat panel presence shows sustained trust from claims teams. Fit for your environment, response time, and policy terms decides the rest, and the long tail contains excellent specialists.

Why do some carriers publish almost no panel details? Publishing is a choice, not an obligation. Some carriers route all panel access through the claims process. The honest reading of a thin page is that the data is behind the claim, not that the panel is thin.

How current is this data? Every relationship carries an access date, October 6-7, 2026. Panels change. The live pages and the panel checker are the current state; this article is the documented snapshot.