Incident response vendors: who they are and how CISOs compare them

On CISO Tribune's record as of 12 November 2026, 36 vendors file under incident response and forensics, the taxonomy category for breach investigation services, digital forensics tools and platforms that coordinate an incident response. Five file it as their primary category; the other 31 file it alongside a managed detection and response contract, a threat intelligence feed or a security consulting practice. Chief information security officers (CISOs) compare these vendors on what they actually sell: hours from a team of investigators, software that runs the coordination, or both.

Key facts

• Our record files 36 vendors under incident response and forensics: 5 as their primary category (BreachRx, CYPFER, Kroll, Surefire Cyber, Sygnia), 31 as a secondary one (category record).
• NIST replaced its 2012 incident response guide with SP 800-61 Revision 3 on 3 April 2025, rebuilding the recommendations around CSF 2.0's six functions.
• The global average cost of a data breach reached $4.99 million in 2026, a 12% increase, and detection and escalation plus lost business made up 63% of that cost.
• Our own SEC Item 1.05 incident tracker counts 85 Form 8-K filings naming a material cybersecurity incident, each starting a four-business-day disclosure clock once materiality is determined.

What an incident response vendor actually does

Incident response and forensics covers two different jobs that the market sells together under one name. The first is investigation and containment: a team that joins once a company knows or suspects it has been compromised, confirms what happened, stops it from continuing, and recovers systems. The second is coordination: software that keeps track of who is doing what, which regulatory clock is running, and what the company will need to show a regulator, an insurer or a board after the incident ends.

Kroll is an example of the first kind. Its Enterprise Security Risk Management practice describes itself as a senior adviser to clients on security and threat-related issues, running end-to-end engagements that uncover exposures and fine-tune detections after an incident. Kroll's retainer bundles access to what it describes as a global team of more than 700 incident response, litigation and breach notification specialists, the kind of bench a single company rarely keeps on staff for an event it hopes never happens.

BreachRx is an example of the second kind. Its Rex Platform is a shared workspace that tracks decisions, deadlines and regulatory obligations during a live incident and produces a record of what happened, running above the detection and remediation tools rather than replacing them. The two approaches answer different questions: Kroll's is "who actually does the investigation," BreachRx's is "who keeps the company's own response organized and defensible while it happens."

NIST's rewritten guidance ties response to the rest of the risk program

For thirteen years, the federal government's baseline incident response guide was SP 800-61 Revision 2, a 2012 document built around a four-phase lifecycle: preparation, detection and analysis, containment and eradication, and post-incident activity. NIST withdrew it in April 2025 and replaced it with Revision 3, retitled Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile.

The rewrite's point is that incident response does not stand apart from the rest of a cybersecurity risk management program. NIST's incident response project page describes a three-level model: preparation activities under the CSF's Govern, Identify and Protect functions are "much broader cybersecurity risk management activities that also support incident response," not part of the response itself; the response proper runs across Detect, Respond and Recover; and an Improvement layer in the middle feeds lessons learned from every function back into the program.

That framing matters for how a CISO reads a vendor's pitch. A product or service that only covers Detect, Respond and Recover is covering the incident itself, not the governance and asset-visibility work that determines how fast an organization can even tell what was touched. NIST's own guidance also normalizes the mixed model most companies actually run: "many organizations may use more than one of these approaches, such as internally performing basic incident response and engaging third-party resources for assistance with certain incidents," which is the retainer model described below, stated as a recommendation rather than an exception.

What a breach costs, and why detection and escalation now drive that cost

IBM's 2026 Cost of a Data Breach study puts the global average cost of a breach at $4.99 million, a 12% increase over the prior year and a record high. The same study found that AI-enabled malicious breaches run about $1 million above that average. The increase was not spread evenly across cost categories: IBM's own account of the study says "two cost categories, detection and escalation alongside lost business, made up the majority (63%) of costs."

That is the specific cost an incident response vendor is hired to shrink. The same IBM account warns that faster attacks are outrunning defenders: "when attack velocity increases, the enterprise has less time to detect, validate and contain an incident." A retained investigator who already knows a company's environment, or a coordination platform that does not need to be configured for the first time mid-incident, is a direct answer to a cost category IBM says is now doing most of the damage.

Our read: the IBM finding and the NIST rewrite point at the same problem from two directions. NIST says preparation under Govern, Identify and Protect determines how fast Detect, Respond and Recover can run; IBM says the cost that is actually growing sits in detection and escalation, the exact handoff between those two groups of functions. A vendor evaluation that only asks what happens during the incident is skipping the half of the problem both sources say matters most.

The SEC's disclosure clock is a reason speed is now contractual, not just operational

Speed matters for a second reason beyond cost: a legal clock. A company that determines a cybersecurity incident is material has four business days to disclose it on a Form 8-K under the SEC's Item 1.05 rule, and the clock starts at the materiality determination, not at discovery. CISO Tribune's own materiality decision guide walks through that distinction in detail, and our Item 1.05 incident tracker has logged 85 such filings from SEC EDGAR as of its last snapshot.

An incident response engagement that produces a clear, defensible account of what happened and when is not a nice-to-have once that clock is running. It is the evidence a company's disclosure committee uses to make the materiality call in the first place, and the record it points to later if a regulator or plaintiff asks how the determination was made.

How CISOs compare incident response vendors

Start by naming what you are actually buying: a services engagement where a vendor's own analysts investigate and contain, a software platform that organizes your own team's response, or a retainer that holds a services team on standby for when your internal team is not enough. NIST's own guidance treats the mixed model, in-house for routine events and an outside firm on retainer for the rest, as the norm, not a fallback.

For a services retainer, ask for the committed response time in writing, how unused hours are treated at renewal, and whether the team that shows up during a real incident is the same one that scoped the retainer, not a different bench entirely. For a coordination platform, ask how it tracks regulatory deadlines across the jurisdictions your company actually operates in, and whether it integrates with the detection tools your security operations center already runs rather than asking analysts to work in a second system mid-incident. For either, ask what the vendor can hand your legal and disclosure teams afterward: a timeline, a scope-of-compromise statement and supporting evidence a regulator, insurer or court would accept, not just an internal summary.

Vendors on CISO Tribune's record

The vendors below are pulled live from our record, alphabetical and unranked. Each files under incident response and forensics as either its primary or a secondary category.