The Three Legs of Incident Response: Responders, Counsel, and Insurance

Key takeaways

• The responder leg is documented. 203 specialist firms across five specializations, including 93 cloud incident response responders, evidence-graded against certification registries, carrier-published panels, and sourced claims, under a published rubric.
• The counsel leg just became visible. Mandiant's own published risk-partner page names 35 law firms, with a link to each, from global firms to cyber boutiques across the US, UK, and Canada. It is a platform-published roster: citable, single-source, self-curated.
• The insurance leg changes under your feet. Ten carriers' published breach-response panels hold 308 documented relationships in our data, re-read quarterly. The first re-read caught five firms dropping off three panels within twelve days of the baseline study.
• One leg of three has independent verification. The other two are self-published. That gap is where buyer diligence is heading next.

The responder leg: who evicts the attacker

The responder is the firm you call when containment is measured in hours. Its work is the technical core of the incident: forensics to learn what happened, containment and eradication to stop it, recovery to bring operations back. The buyer problem is not finding responders, it is telling them apart. Every firm markets the same sentences.

The documented answer is evidence. The documented directory carries 93 cloud incident response responders, each graded across evidence tiers: certifications checked against the issuing registry holder by holder, panel memberships read from carriers' own published pages, and every claim on a profile carrying its source and date. The rubric is public: the Verification Standard states what "verified" means, criterion by criterion, including what the platform does not do. The choosing guide turns the same evidence into six checks for any shortlist.

The counsel leg: who runs privilege and notification

The second hire is a law firm. Breach counsel directs the response under privilege, owns the notification analysis across the jurisdictions involved, manages the regulator relationship, and holds the decisions that become findings if the incident ends in a claim or a filing. For public companies, counsel is also the interface to the SEC's disclosure clock. Our breach counsel explainer covers the role in depth; the short version is that privilege, once broken, cannot be rebuilt retroactively.

Until recently, the counsel bench had no public roster at all. Firms engaged counsel privately, and insurers' counsel networks were terms in policy documents. That changed when the market's largest IR firm published its own: Mandiant's cybersecurity risk partners page, at cloud.google.com/security/partners/cybersecurity-risk-partners, names 35 law firms with a link to each. The list spans global firms such as Kirkland & Ellis, Debevoise & Plimpton, Hogan Lovells, Freshfields, Norton Rose Fulbright, Wilson Sonsini, and Cooley, dedicated cyber boutiques such as the Beckage Firm, Shook, and Wiley, and Canadian firms including Blakes, Osler, and Torys.

Read with clear eyes: this is a platform-published roster, curated by the publisher, citable as "named on Mandiant's published risk-partner page" and nothing more. It is not an assessment of any firm's capability, and it is one vendor's network, not the market's. But it is public, dated, and linkable, which no counsel directory was before. We now document that roster ourselves, with each firm's own practice language kept separate from the citation: the breach counsel bench, informational only, no ranking and no referral.

The insurance leg: who pays, and who they trust

The third leg decides the economics. Cyber policies typically cover breach response costs when the insured uses firms on the carrier's published breach-response panel, which makes panel membership a cost fact, not a vanity badge: the panel firm is often the cheapest path to a funded response, because the claims team has already vetted it.

We read all ten carriers' published panels and hold 308 documented firm-carrier relationships in our data, re-read quarterly with changes published. The cadence matters more than the count. Our first re-read, twelve days after the baseline study, caught five firms dropping off three panels, including a firm that had been on five of ten panels at the baseline. That record is public in Panel Moves. Panel pages change between a policy's binding date and its incident date, and most buyers have no way to know.

The braid: three public sources, one map

Read together, the three sources expose a market structure no single one shows. Seven of the ten carriers whose panels we track (Chubb, CNA, QBE, Beazley, Coalition, AXA XL, and Liberty Mutual) are also named on that same Mandiant risk-partner page, alongside reinsurers like Munich Re and Swiss Re and brokers like Marsh and Lockton. The insurer that publishes a panel partners with the IR firm that publishes a counsel roster; the responders those panels name carry the relationships the counsel bench directs.

None of this is hidden. It is simply unconnected. Each participant publishes its own slice, aimed at its own audience. The buyer assembling an incident bench has to read all three slices at once, usually during the worst week of their year.

One leg of three has a verification layer

Here is the asymmetry that motivated this page:

• Responders have an independent, evidence-graded directory with a published verification rubric, registry checks by named credential, and quarterly re-reads of panel claims.
• Counsel have a single platform-published roster. Useful, citable, and self-curated by one vendor. No independent standard exists for what makes a breach-ready law firm.
• Insurance panels are carrier-published and carriers' own quality bar is real, but the only independent check on what the panels say today is the quarterly re-read, ours.

For buyers, the practical guidance is the same for all three legs: document your bench before the incident. Verify your responder's credentials against the issuing registries, not the firm's website. Confirm your counsel is engaged or on your carrier's counsel network, in writing. Check your shortlisted responders against your own carrier's published panel, because chain of custody and funding both run through it. The bench you assemble in advance is the one you keep at 2 a.m.