Documented Firms Directory

Browse Verified DFIR & Cloud Incident Response Firms

Breach response and DFIR firms, panel-vetted and research-sourced across AIG's CyberEdge panel, Coalition's panel, and the Chubb ecosystem, with the full verification pass pending.

MITRE ATT&CK Cloud • CIS • SOC 2 • FedRAMP

Showing 68 of 68 firms

Start an RFP
Partially verifiedPanel-Confirmed

Breach response planning and cyber risk services, Chubb panel breach coach.

Services: Breach coaching and incident coordination · Incident response planning and tabletop exercises · Cyber risk assessments · Post-incident reporting support

Panels: Chubb, CNA

Coverage: North America, national · HQ Philadelphia, PA

Visit websitenetdiligence.com
Partially verifiedPanel-Confirmed

24/7 incident response and breach services, Chubb panel responder.

Services: Incident response and breach forensics · Ransomware containment and recovery · Carrier-grade reporting and claims support · Preparedness assessments

Panels: Chubb

Coverage: North America, national · HQ Mount Laurel, NJ

Visit websitesurefirecyber.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, CISM, GCFA credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

CISSPCISMGCFAGCFEGCIHEnCE

Panels: AIG, CNA, Coalition, QBE, AXA XL

Engagements: 1 documented, latest in Multiple sectors

Visit websitekroll.com
Partially verifiedPanel-Confirmed

DFIR firm, GIAC/SANS, CISSP, OSCP credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

GIAC/SANSCISSPOSCP

Panels: AIG, Chubb

Visit websitepaloaltonetworks.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, GCFA, GCFE credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

CISSPGCFAGCFEGCIHEnCE

Panels: AIG, Chubb, Beazley, Coalition, Zurich, AXIS, CNA, Allianz, QBE, AXA XL

Engagements: 1 documented, latest in Multiple sectors

Visit websitecrowdstrike.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, GCFA, GCIH credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

CISSPGCFAGCIHEnCE

Panels: AIG, Chubb, CNA, Coalition, AXA XL

Engagements: 1 documented, latest in Multiple sectors

Visit websitecloud.google.com
Partially verifiedPanel-Confirmed

DFIR firm, CREST, CISSP, GSEC credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

CRESTCISSPGSECGCIHGPENGCTIOSCPCFE

Panels: AIG, Coalition, QBE

Visit websitelevelblue.com
Partially verifiedPanel-Confirmed

DFIR firm, GIAC/SANS, CISSP credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

GIAC/SANSCISSP

Panels: AIG, Beazley, AXIS, Chubb, QBE

Visit websitearcticwolf.com
Partially verifiedPanel-Confirmed

DFIR firm, GIAC/SANS, CISSP, CISA credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

GIAC/SANSCISSPCISA

Panels: AIG, CNA, QBE, Beazley, AXA XL

Visit websitemoxfive.com
Partially verifiedResearch-Sourced

DFIR firm, GCFA, GCFE, GCIH credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

GCFAGCFEGCIHGREMCISSPGSEOSCP
Visit websiteguidepointsecurity.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, CISA, CISM credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

CISSPCISACISM

Panels: AIG, CNA, QBE

Visit websitefticonsulting.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, CISA, CISM credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

CISSPCISACISMGIAC

Panels: CNA, AIG, Chubb, QBE, AXA XL

Visit websiteankura.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, CISA, EnCE credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

CISSPCISAEnCEGCFA

Panels: AIG, Chubb, CNA, AXIS, AXA XL

Visit websitestrozfriedberg.com
Partially verifiedResearch-Sourced

DFIR firm, CISSP, EnCE, GIAC credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

CISSPEnCEGIAC
Visit websiteprudentialassociates.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, GCFA, GCFE credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

CISSPGCFAGCFEGCIHEnCE

Panels: CNA, AIG, Chubb, Coalition, AXIS, AXA XL

Engagements: 1 documented, latest in Ransomware

Visit websiteareteir.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, GIAC, OSCP credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

CISSPGIACOSCP

Panels: AIG

Visit websitebluevoyant.com
Partially verifiedPanel-Confirmed

DFIR firm, EnCE, CISSP credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

EnCECISSP

Panels: AIG, Chubb, CNA, Coalition, QBE, AXA XL

Partially verifiedResearch-Sourced

DFIR firm, CISSP, CISM, CISA credentialed, federal and government response.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response +1 more

CISSPCISMCISACRISCGCIHGPENGXPNGWAPT
Visit websitecoalfire.com
Partially verifiedResearch-Sourced

DFIR firm, CISSP, GIAC, GCFA credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPGIACGCFAGCIH
Visit websiterapid7.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, GIAC, CISA credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPGIACCISACISM

Panels: AXA XL

Visit websitesecureworks.com
Pending reviewResearch-Sourced

DFIR firm, Forensics-focused credentials credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Forensics-focused credentials
Partially verifiedResearch-Sourced

DFIR firm, CISSP, GIAC credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPGIAC
Partially verifiedResearch-Sourced

DFIR firm, CISSP, GIAC, CISM credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPGIACCISMCISA
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, GCFA, GCFE credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPGCFAGCFEGCIHEnCE

Panels: AIG, Chubb

Visit websitekivuconsulting.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, CISA, CISM credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPCISACISM

Panels: CNA, AIG, Chubb, Coalition, AXIS, AXA XL

Partially verifiedResearch-Sourced

DFIR firm, CISSP, CISA, CISM credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPCISACISMGIAC
Visit websitedeloitte.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, CISA, CISM credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPCISACISMGIAC

Panels: AIG, Chubb, CNA

Partially verifiedResearch-Sourced

DFIR firm, GIAC/SANS, CISSP, OSCP credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

GIAC/SANSCISSPOSCP
Visit websitesygnia.io
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, CISA, CISM credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPCISACISM

Panels: AIG, Chubb, CNA

Visit websiteverizon.com
Partially verifiedResearch-Sourced

DFIR firm, CISSP, CISA, CISM credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPCISACISM
Visit websitecybersecop.com
Partially verifiedResearch-Sourced

DFIR firm, Cisco/CCNP, Splunk, OWASP credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Cisco/CCNPSplunkOWASP
Visit websiteunderdefense.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, CISA, CISM credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPCISACISMGIAC

Panels: Chubb, CNA

Coverage: US, nationwide

Visit websitersmus.com
Partially verifiedResearch-Sourced

DFIR firm, GIAC, CISSP credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

GIACCISSP

Coverage: US, nationwide

Visit websitetracepoint.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, GIAC credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPGIAC

Panels: AXA XL

Coverage: US, nationwide

Visit websiteredpointcyber.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, CISA, CISM credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPCISACISM

Panels: AIG, Chubb

Coverage: US, nationwide

Visit websitewww.alvarezandmarsal.com
Partially verifiedPanel-Confirmed

DFIR firm.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Panels: AIG

Coverage: US, nationwide

Visit websitenardello.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, GIAC credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPGIAC

Panels: AIG

Coverage: US, nationwide

Partially verifiedPanel-Confirmed

DFIR firm, CISSP, GIAC credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPGIAC

Panels: Chubb, AXA XL

Coverage: US, nationwide

Visit websitecybereason.com
Partially verifiedResearch-Sourced

DFIR firm, CISSP, GIAC credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPGIAC

Coverage: US, nationwide

Visit websitetetradefense.com
Partially verifiedPanel-Confirmed

DFIR firm.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Panels: QBE

Coverage: US, nationwide

Visit websitecoveware.com
Partially verifiedPanel-Confirmed

DFIR firm.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Panels: AIG, QBE, Beazley, AXA XL

Coverage: US, nationwide

Visit websitefenix24.com
Partially verifiedPanel-Confirmed

DFIR firm.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Panels: Chubb, Coalition, CNA, AXA XL

Coverage: US, nationwide

Visit websiteirongatesecurity.com
Partially verifiedResearch-Sourced

DFIR firm, GIAC, CISSP credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

GIACCISSP

Coverage: US, nationwide

Visit websiteredcanary.com
Partially verifiedResearch-Sourced

DFIR firm, GIAC, CISSP credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

GIACCISSP

Coverage: US, nationwide

Visit websiteexpel.com
Partially verifiedPanel-Confirmed

DFIR firm, CISSP, GIAC, CISA credentialed.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

CISSPGIACCISACISM

Panels: CNA

Coverage: US, nationwide

Visit websitepondurance.com
Partially verifiedResearch-Sourced

DFIR firm.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Coverage: US, nationwide

Visit websiten1discovery.com
Pending reviewResearch-Sourced

DFIR firm.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Coverage: US, nationwide

Visit websitevestigeltd.com
Pending reviewResearch-Sourced

DFIR firm.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Coverage: US, nationwide

Visit websiteglobaldatarisk.com
Pending reviewResearch-Sourced

DFIR firm.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Coverage: US, nationwide

Visit websitenorthforensics.com
Pending reviewResearch-Sourced

DFIR firm.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Coverage: US, nationwide

Visit websitelitigationforensics.com
Pending reviewResearch-Sourced

DFIR firm.

Services: Incident response and digital forensics · Ransomware and BEC response · Cloud and M365 investigations · Identity and Active Directory response

Coverage: US, nationwide

Visit websitedefensible.tech
Partially verifiedPanel-Confirmed

AIG CyberEdge panel member, forensics, data-restoration.

Services: Incident response and forensics · Data restoration and recovery

Panels: AIG, CNA, Coalition, AXA XL

Coverage: US, AIG CyberEdge panel coverage · HQ Not stated in panel listing

Visit websitecypfer.com
Partially verifiedPanel-Confirmed

Coalition panel member, dfir, deepfake-forensics.

Services: Incident response and forensics

Panels: Coalition

Coverage: US, Coalition panel coverage · HQ Not stated in panel listing

Visit websitecoalitioninc.com
Partially verifiedPanel-Confirmed

DFIR retainer services firm, documented from public research (Gartner Peer Insights listing). The firm carries 1 client reviews on Gartner Peer Insights (5/5, October 2026).

Services: Digital forensics and incident response · Incident response retainer

Panels: Beazley

Partially verifiedPanel-Confirmed

DFIR retainer services firm, documented from public research (Gartner Peer Insights listing).

Services: Digital forensics and incident response · Incident response retainer

Panels: QBE

Partially verifiedPanel-Confirmed

DFIR retainer services firm, documented from public research (Gartner Peer Insights listing).

Services: Digital forensics and incident response · Incident response retainer

Panels: AIG, Coalition

Partially verifiedResearch-Sourced

DFIR retainer services firm, documented from public research (Gartner Peer Insights listing). The firm carries 79 client reviews on Gartner Peer Insights (4.6/5, October 2026).

Services: Digital forensics and incident response · Incident response retainer

Partially verifiedResearch-Sourced

DFIR retainer services firm, documented from public research (Gartner Peer Insights listing). The firm carries 16 client reviews on Gartner Peer Insights (4.4/5, October 2026).

Services: Digital forensics and incident response · Incident response retainer

Partially verifiedResearch-Sourced

DFIR retainer services firm, documented from public research (Gartner Peer Insights listing). The firm carries 4 client reviews on Gartner Peer Insights (4.8/5, October 2026).

Services: Digital forensics and incident response · Incident response retainer

Partially verifiedResearch-Sourced

DFIR retainer services firm, documented from public research (Gartner Peer Insights listing).

Services: Digital forensics and incident response · Incident response retainer

Partially verifiedResearch-Sourced

DFIR retainer services firm, documented from public research (Gartner Peer Insights listing).

Services: Digital forensics and incident response · Incident response retainer

Partially verifiedResearch-Sourced

DFIR retainer services firm, documented from public research (Gartner Peer Insights listing).

Services: Digital forensics and incident response · Incident response retainer

Partially verifiedResearch-Sourced

MDR and DFIR services firm, documented from public research (firm website, October 2026).

Services: Digital forensics and incident response · Managed detection and response · Incident response retainer

Visit websiteesentire.com
Partially verifiedResearch-Sourced

Incident response and forensics service from the Varonis data security company: investigation, containment, eradication and recovery, with a forensics team for APT investigations.

Services: Incident response · Digital forensics and malware analysis · Containment, eradication, and recovery

Coverage: US-based, global response · HQ New York, NY

Visit websitevaronis.com
Partially verifiedResearch-Sourced

Security solutions provider with an IR Retainer Program, documented from public research.

Services: Incident response retainer · DFIR · Compromise assessment · Threat hunting

Visit websiteoptiv.com
Partially verifiedResearch-Sourced

Offensive security firm with incident response plan validation, documented from public research.

Services: Red teaming · Continuous penetration testing · IR plan validation · AI/LLM security assessment

Visit websitebishopfox.com
Partially verifiedResearch-Sourced

Global consulting firm with cyber defense and resilience teams, documented from public research.

Services: Incident response · Microsoft Sentinel SIEM/SOAR · Cloud security · On-call response

Visit websiteprotiviti.com
Partially verifiedResearch-Sourced

Veteran-owned cybersecurity firm with Gulf Coast energy and maritime focus, documented from public research.

Services: 4-hour emergency IR engagement · vCISO · CMMC/HIPAA/SOC 2 compliance · Energy OT security

Coverage: Gulf Coast

Visit websiteblueradius.io

VendorQuals, Specialist Vendor Intelligence

Panel membership included where publicly documented; full verification pass pending.

directory source: live database

Other Service Providers in this category

Not response firms

These companies provide platforms, tools, and managed services for this specialization. A responder investigating an incident here may rely on their tooling. A buyer building a platform may hire them. They do not send responders to your incident.

Magnet Forensicsmagnetforensics.comTooling

Digital investigation platform (Magnet AXIOM) for forensic artifact collection and analysis.

Cellebritecellebrite.comTooling

Digital forensics and intelligence platform, strongest in device data extraction and analysis.

OpenText (EnCase Forensic)opentext.comTooling

EnCase Forensic, the long-standing disk forensics and investigation suite, plus Tableau write blockers.

Exterroexterro.comTooling

Forensic and ediscovery platform whose portfolio includes the FTK (Forensic Toolkit) product line.

Volatility Foundationvolatilityfoundation.orgTooling

The open-source memory forensics framework (Volatility), maintained by a nonprofit foundation.

SUMURIsumuri.comTooling

Digital forensics hardware and software, including write blockers and the PALADIN forensic suite.

Digital Intelligencedigitalintelligence.comTooling

Forensic workstations, write blockers, and lab equipment for digital investigations.

SANS Institutesans.orgTraining

Cybersecurity training and GIAC certifications; its DFIR curriculum (FOR500, FOR508) is the standard credential path for forensic analysts.

See the full ecosystem across all specializations, or request inclusion.