CrowdStrike Incident Response
Incident response services, available on retainer.
Incident Response
Incident response retainer
Experts are on call before the worst day, not searched for during it.
Addresses 179 stories in our coverage in the last 90 days 4 products that provide it
What it is
A pre-agreed contract with an incident response firm, with guaranteed response times, so investigators can start within hours of a serious incident.
How to value it
In a major incident the first hours decide how much is lost, and NIS2 asks for an early warning to the authorities within 24 hours. Negotiating contracts during an attack wastes that time. A retainer usually also covers preparation such as plan reviews and tabletop exercises.
Questions to ask a vendor
- 1What response time is guaranteed, and in which countries and languages?
- 2Can unused hours go to preparation such as tabletop exercises?
- 3Do you meet our cyber insurer's requirements for response firms?
- 4Can you support regulatory reporting under NIS2, DORA and GDPR?
For your risk register
- Risk
- A slow, uncoordinated response to a major incident increases damage and misses reporting deadlines.
- Control
- Incident response retainer with a tested escalation path.
- Owner
- CISO.
- Measure
- Time from declaring an incident to responders engaged.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Mandiant Incident Response
Incident response services from Mandiant, available on retainer.
Unit 42 Retainer
Incident response retainer with Unit 42, including preparation services.
Truesec Incident Response
Incident response team with a retainer option.
Recent stories it addresses
675 stories in total- 13 Nov 2026NCSC – CERT-SE veckobrev v.46
Swedish cybersecurity agencies issue weekly brief highlighting recent cyberattacks and phishing campaigns.
- 13 Nov 2026Microsoft 365 Massive Outage – Fixes Fail as Restored Servers Keep Going Unresponsive
Microsoft 365 experiences a massive global outage as fixes fail to restore server stability.
- 12 Nov 2026CISOs say OT will survive a cyberattack, but their engineers aren’t so sure
CISOs are confident OT systems can survive cyberattacks, but engineers are less sure, according to a SANS survey.
- 11 Nov 2026Poland shuts down government services platform ePUAP following cyberattack
Poland shuts down government services platform ePUAP following cyberattack.
- 10 Nov 2026SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users
SGLang RCE vulnerability breached NEAR AI, exposing 100 users' account data and 18 AI agents.
- 10 Nov 2026Vanderbilt University reels following ransomware attack claimed by BYOD group
Ransomware group BYOD claims attack on Vanderbilt University, compromising student and employee data.
- 10 Nov 2026AI company Fireworks says hackers stole data, billing info during October breaches
AI company Fireworks reports data and billing info stolen in two October breaches.
- 10 Nov 2026Fireworks AI Breach Widens to Expose Customer Billing Data and Incomplete Model Weights
Fireworks AI breach expands to expose customer billing data and incomplete model weights.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.