CrowdStrike Incident Response
Incident response services, available on retainer.
Incident Response
Incident response retainer
Experts are on call before the worst day, not searched for during it.
Addresses 103 stories in our coverage in the last 90 days 4 products that provide it
What it is
A pre-agreed contract with an incident response firm, with guaranteed response times, so investigators can start within hours of a serious incident.
How to value it
In a major incident the first hours decide how much is lost, and NIS2 asks for an early warning to the authorities within 24 hours. Negotiating contracts during an attack wastes that time. A retainer usually also covers preparation such as plan reviews and tabletop exercises.
Questions to ask a vendor
- 1What response time is guaranteed, and in which countries and languages?
- 2Can unused hours go to preparation such as tabletop exercises?
- 3Do you meet our cyber insurer's requirements for response firms?
- 4Can you support regulatory reporting under NIS2, DORA and GDPR?
For your risk register
- Risk
- A slow, uncoordinated response to a major incident increases damage and misses reporting deadlines.
- Control
- Incident response retainer with a tested escalation path.
- Owner
- CISO.
- Measure
- Time from declaring an incident to responders engaged.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Mandiant Incident Response
Incident response services from Mandiant, available on retainer.
Unit 42 Retainer
Incident response retainer with Unit 42, including preparation services.
Truesec Incident Response
Incident response team with a retainer option.
Recent stories it addresses
571 stories in total- 16 Oct 2026Cybersecurity incident at BAE Systems disrupts US bankruptcy court system
Cybersecurity incident at BAE Systems disrupts US bankruptcy court system operations.
- 16 Oct 2026When Your Ransomware Negotiator Works for the Other Side
Ransomware negotiator arrested for allegedly working with attackers.
- 16 Oct 2026BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts
BAE Systems cyber incident halts US bankruptcy court notices nationwide.
- 15 Oct 2026UK Legal Aid Agency Hack Scope Widens After Forensic Review
UK Legal Aid Agency hack impacts records dating back to 1978.
- 15 Oct 2026UK Legal Aid Agency: Hackers stole records dating back to 1978
UK Legal Aid Agency confirms hackers stole records dating back to 1978 in April 2025 breach.
- 13 Oct 2026TFG London cyberattack disrupts systems at Hobbs and Whistles retailers
TFG London cyberattack disrupts IT systems at Phase Eight, Hobbs, and Whistles.
- 13 Oct 2026Legacy refrigeration controllers exploited in OT attack on hundreds of French supermarkets
OT attack on refrigeration systems impacts hundreds of French supermarkets.
- 13 Oct 2026Cyberattack Prompts Ahold Delhaize to Disconnect Systems
Ahold Delhaize disconnects systems due to a cyberattack, impacting deliveries and online orders.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.