Understand the cyber incident-response market before you enter or buy

For investors, insurers and providers sizing up the cyber incident-review and forensics market.

Engagement type: Team Pod
Experts: 2 experts
Hours: ~30
Duration: 2 weeks

What the client needed

A firm needed to understand the cyber incident-response market: who conducts incident reviews and whether it is in-house or outsourced to forensics firms, what a review is expected to deliver, who the key providers are and their advantages, how fragmented and competitive the space is, which breaches go through review, what part of the value chain forensics firms control, and the outlook.

The experts engaged

Previously at PwC, Accenture, Infosys · 20+ years

Roles helddirector, risk advisory consulting · vice president, digital, technology risk and cyber security · associate director, technology risk

Technology-risk, GRC and third-party-risk transformation programmes
Risk consulting for six captive/GCC accounts; forensic accounting and e-discovery

Atlas Verified · Tier B

Previously at Amazon, Deloitte · 12 years

Roles heldsenior security solutions expert · senior solutions advisor, cyber security risk advisory

Led cyber-security audit teams for identity and access management; PAM risk analysis and remediation
Digital identity and third-party risk management for Fortune 500 clients in the US, UK and APAC

Atlas Verified · Tier C

A exceptional · B strong · C competent — the tier is derived from the whole assessment, not a single score. The transcript and report are open to you before you engage. How verification works →

The brief

The questions on the table

As the client wrote them, lightly shortened. Client and respondents are not named.

Q1
Who conducts a cyber incident review — in-house or outsourced forensics — and what is expected from it?
Q2
Who are the key providers and what advantage do they hold? How fragmented and competitive is the space?
Q3
Do all breaches go through review, or only some? What part of the value chain do forensics firms control?
Q4
What is the outlook?

The hours

What the work involved

01
Consultation guide
Seven themes, same for both consults.
02
Expert consults
A risk-advisory director who has led technology-risk and forensic programmes, and a cyber-risk advisor who has run security audits and incident programmes for Fortune 500 clients.
03
Synthesis
Market structure, providers, value chain and outlook, with the points where the two views differed.

Deliverables

What the client received

Market structureWho does what, in-house versus outsourced.
Provider landscapeKey firms and their advantages.
Value-chain mapWhat forensics firms control.
OutlookWith the reasoning.
Consultation notesDe-identified.

The terms

What an engagement like this costs

You buy hours in blocks and can change the expert at the end of any block, at no extra cost. Longer projects run in stages: pause after a block, pick up the next stage when you are ready.

Pricing in full →

Rate band: $65–$250 /hr; Senior specialists can be up to $500
Hour blocks: 1 · 2 · 5 · 10 · 20 · 50 · custom
This engagement: Team Pod · ~30 hours · 2 weeks

Looking at the incident-response market?

Describe what you need

For example: “We are evaluating a forensics firm and need to understand who really controls the incident-review value chain.”

We aim to come back with matched experts within 24 to 72 hours.