Best Incident Response Companies in 2026

The best incident response company for you depends on the incident you are most likely to face and who has to sign off on the response. For a nation-state intrusion or a breach across a global estate, Mandiant, CrowdStrike, and Palo Alto Networks Unit 42, all Leaders in Forrester's Q2 2024 incident response Wave, bring large benches and their own threat intelligence. For an environment that runs on Microsoft identity, Microsoft Incident Response knows the stack from the inside. For insured mid-market incidents, Kroll, Arctic Wolf, and Sophos pair investigation with notification, restoration, or ongoing monitoring. For investigations that may end in litigation, Stroz Friedberg, now part of LevelBlue, brings decades of digital forensics work. Focused firms, including ours, fit companies that want the responders who investigate to also fix what failed. One disclosure up front: BD Emerson appears on this list, this is our site, and our entry is marked.

How we ranked them

Four criteria, weighted toward the first 48 hours. Speed to a responder: how fast a named investigator is working in your environment, and whether a retainer makes that a contractual commitment. Forensic depth: whether the firm can reconstruct the intrusion from endpoint, identity, cloud, and network evidence, or mostly reads the alerts its own tools produce. Fit with your stack and your insurer: whether the firm works on the security tools you already run, and whether your cyber policy will pay for it. And what happens after containment: whether the firm stays to close the access path and rebuild, or hands over a report and leaves. Every firm below is credible. The differences are in scale, price, and what each one is built to do.

The stakes justify choosing in advance. Mandiant's M-Trends 2026 report, built on more than 500,000 hours of investigations in 2025, put the global median dwell time at 14 days, up from 11, and found that the median time between initial access and handoff to a second threat group fell to 22 seconds, from more than eight hours in 2022. The 2026 Unit 42 Global Incident Response Report, drawn from more than 750 incidents, found that in the fastest cases attackers moved from initial access to data exfiltration in 72 minutes, and that identity weaknesses played a material role in nearly 90 percent of investigations. A firm you are still vetting on day one is working behind the attacker.

Analysts see the top tier the same way. Forrester's Q2 2024 Wave for cybersecurity incident response services evaluated 14 providers and named five Leaders: Accenture, Aon, CrowdStrike, Google (Mandiant), and Palo Alto Networks. Aon's investigations group is now Stroz Friedberg, a LevelBlue company.

1. Mandiant (Google Cloud)

Mandiant, part of Google Cloud since 2022, draws its annual M-Trends report from its own investigations, and its strength is the hardest intrusions: espionage, long-dwell compromises, and attackers who come back after eviction. The Mandiant Retainer offers a two-hour response time with prenegotiated terms and prepaid funds. The trade-offs are premium rates and a model built around large enterprises. Best for enterprises and public bodies facing a capable or state-linked intruder.

2. CrowdStrike

CrowdStrike's responders work with the company's own platform for forensic data, and CrowdStrike says its experts deploy globally within hours. That works best where CrowdStrike's tools are already in place, which is also the question to ask: teams running another endpoint tool should confirm how the engagement works with it. CrowdStrike was a Leader in the Q2 2024 Forrester Wave, and a Services Retainer buys priority access. Best for organizations that want endpoint visibility across the estate during the response and may keep the platform afterward.

3. Palo Alto Networks Unit 42

Unit 42 combines incident response, threat research, and the Palo Alto Networks product line, and the company cites more than 5,000 incidents investigated and contained. The Unit 42 Retainer comes with 24/7 availability across its managed and incident response services, and Unit 42 was a Leader in the Q2 2024 Forrester Wave. Like CrowdStrike, it works fastest on its own stack. Best for enterprises with Palo Alto Networks firewalls or Cortex in place, and for organizations that want one retainer covering readiness work and response.

4. Microsoft Incident Response

Microsoft's incident response team, previously known as DART, investigates compromises of Microsoft environments from the inside: Active Directory, Entra ID, Exchange, and Azure. When an attacker has taken over identity, that knowledge shortens the rebuild, and Microsoft publishes its ransomware approach openly. The limits follow from the same focus. Evidence and remediation outside the Microsoft estate, such as network appliances, Linux servers, or another cloud, usually need a second firm. Best for organizations where Microsoft identity was the attacker's main path.

5. Kroll

Kroll pairs forensic investigation with the work that follows a breach of personal data, and says its experts respond to more than 2,000 cyber incidents a year. Its cyber risk practice offers breach notification with multilingual call center support, and retainers that cover both incident response and proactive services. That end-to-end model suits breaches where data theft triggers notification duties. Best for insured breaches with personal data at stake, where one firm can run the work from forensics through notification.

6. LevelBlue (Stroz Friedberg)

LevelBlue completed its acquisition of Aon's cybersecurity and IP litigation consulting groups, including Stroz Friedberg, in August 2025, and now presents its incident response practice as combining Stroz Friedberg, Trustwave, and Cybereason. The litigation consulting heritage is the reason to call: forensic work built to hold up in disputes and regulatory proceedings. Ask how the combined firm staffs cases while it integrates three companies. Best for investigations likely to end in litigation, arbitration, or a regulator's inquiry.

7. Accenture

Accenture was also a Leader in the Q2 2024 Forrester Wave, and its incident response work sits inside its security business. The reason to choose it is scale beyond the response itself: a breach that turns into a multi-year rebuild across many countries, run by the firm that may already run your transformation programs. The trade-off is cost. Name the responders in the retainer so the team you meet is the team that responds. Best for global enterprises already working with Accenture on large programs.

8. Arctic Wolf

Arctic Wolf added incident response when it acquired Tetra Defense in 2022, which the announcement described as one of the first incident response firms to offer restoration and recovery, and as a go-to partner for cyber insurers. The model fits the mid-market: response, restoration, and a path into Arctic Wolf's managed detection service afterward. Best for mid-market companies with cyber insurance that want response and recovery from one firm.

9. Sophos (Secureworks)

Sophos completed its $859 million acquisition of Secureworks in February 2025, bringing Secureworks' incident response practice together with its own. Both businesses are built around managed detection and response, so expect the conversation to turn to a managed service once the incident closes. Ask which team and which tooling will run your case while the two businesses integrate. Best for mid-sized organizations that want response and ongoing monitoring from one provider.

10. BD Emerson, an Andersen Consulting company (disclosure: this is us)

BD Emerson's incident response team handles containment, forensics, and the remediation that closes what the attacker used. We work with your counsel and your insurer from the first call, and under Kovel arrangements when counsel directs the investigation. Every action is logged with a time and a reason, and every finding comes with the specific fix that closes it. The same team carries the work into post-breach remediation, and an incident response retainer sets terms, service levels, named responders, and environment pre-work before anything happens. BD Emerson became part of Andersen Consulting when Andersen Group's acquisition closed in October 2026, and larger rebuilds draw on Andersen Consulting colleagues. Best for mid-market and enterprise companies, regulated ones in particular, that want the team that investigates to fix what failed. We are the wrong call for a global espionage case that needs hundreds of responders in a dozen countries at once.

What incident response costs

Pricing follows the engagement structure more than the brand. Emergency engagements with no contract in place are billed by the hour, typically at higher rates than a retainer locks in. Retainers prepay hours or fees in exchange for response-time commitments, prenegotiated terms, and onboarding done in advance, and many let unused value go to readiness work such as plan reviews and tabletop exercises. If you carry cyber insurance, the carrier may require a firm from its panel and will often have negotiated the rates, so read the policy before you sign anything. The response fee is a small share of what an incident costs: IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99 million, a 12 percent increase and a record. The comparison that matters is which firm gets you to containment, and to a report that holds up, fastest.

How to choose before you need one

Pick the firm before the incident, because the first hours are the expensive ones. Five questions separate finalists. Who will be on our call at hour one, by name or role, and is that response time in the contract? Does the team work on the security tools we already run, or does it need to deploy its own? Will our cyber insurer pay for this firm, and does the firm already work within our carrier's claims process? Can the firm work under counsel's direction to protect privilege, as our Kovel agreement guide explains? And who closes the access path and rebuilds after containment, the same team or a second firm?

If ransomware is the scenario that worries you most, our guide to the best ransomware recovery companies covers the restoration side, where negotiators, restoration specialists, and backup vendors' response teams often do as much of the work as the investigating firm.