Skip to main content
Marsh logo

Article

Incident response capacity is tightening — What this means for your organisation

The volume and complexity of cyber incidents worldwide have climbed sharply and a fundamental shift in volume is outpacing how quickly incident response (IR) firms can hire and train qualified responders.

12/11/2026

Over the last several months, the volume and complexity of cyber incidents have climbed sharply. This is not a single catastrophic event, but rather a fundamental shift in volume that is outpacing how quickly incident response (IR) firms can hire and train qualified responders. It is not merely IR firms facing this challenge — law firms and extortion negotiators are similarly experiencing a strain on capacity.

Three noteworthy forces currently converging in the cyber event landscape include the following:

  1. Volume is up. Third-party threat activity, ransomware, privacy incidents, and vendor-driven events are all rising at once. Every investigation is still bespoke, and there is no single playbook, which means more incidents are competing for the same limited pool of responders. Marsh, cyber insurers, IR firms, law firms, and extortion negotiators are all seeing similar sustained spikes in volume.
  2. The environment under attack has shifted. Cloud-native infrastructure and web application incidents have increased from a small share of new cases to a significant area of impact. Thirty-five percent of recent investigations were revealed to include cloud or SaaS assets. This matters because not every IR team has deep cloud expertise, which narrows the pool of qualified responders further than headcount alone would suggest.
  3. AI is changing speed and scale. The market is seeing clear signs that attackers are using AI-enabled and agentic tools to identify vulnerabilities, move faster, and sustain access longer, which can complicate and slow containment and response. This does not appear to be making attacks more sophisticated, but it is making typical weaknesses (for example, unpatched systems, weak identity controls) exploitable at much greater speed and scale. Organisations should immediately review their controls around patching, vulnerability management, and identity access management. Regular application of fundamentals and good cyber hygiene practices are more important than ever.

Access to an insurer’s panel is not a capacity guarantee 

Many organisations may assume that because their cyber policy includes access to an insurer's IR panel, a response firm will always be available when needed. As that may not be the case, it is important to understand the key differences between panel access, preferred commercial terms, and contractual response commitments. 

Incident response firms are increasingly forced to make hard choices about whose calls to answer first. In practice, that typically means:

  • Panel access is not the same as reserved capacity. Being on a panel may provide access to a vetted firm and negotiated or preferential rates, but it does not necessarily reserve a team for you when faced with an incident.
  • Retainer clients may receive priority. Many IR firms prioritise clients with a paid retainer because those arrangements often include contractual service-level commitments for response times. Clients without a retainer may be supported on a best-efforts basis, depending on the provider's capacity at the time. 
  • Your incident may be routed differently than expected. Depending on availability, some matters may be referred or reassigned to another firm with capacity. That can affect continuity, familiarity with your environment, and speed to engagement. 
  • Response windows and terms may vary. Grace periods and service terms are shifting. Some response-time windows that used to be measured in days are stretching out as firms manage their own capacity constraints.

At the same time, insurer panel arrangements can still provide meaningful value. They are intended to offer access to experienced providers, more efficient engagement paths, and preferential commercial terms. Understanding in advance what is contractually guaranteed is key to your organisation’s incident response and resilience. 

What a retainer is designed to buy you

A retainer is not just a faster phone call. In many cases it offers:

  • A contractual response-time commitment, as opposed to a best-efforts promise.
  • Priority access to a specific team, often one that already knows your environment from pre-incident planning.
  • A resiliency service that includes proactive readiness support (for example, tabletop exercises, playbook development, threat intelligence) that can help reduce the impact of an eventual incident.

What to do before the next incident

If your organisation does not currently have IR firm retainers in place, or you are unsure what your current coverage actually guarantees, then you should: 

  1. Determine if your current arrangement includes a contractual response-time SLA or access to a panel only. If there is a preferred vendor, has your insurer pre-approved its use? 
  2. Identify both primary and backup response options. If the first-choice responder cannot take the call, what is the escalation path? 
  3. Assess whether a retainer is appropriate for your organisation's risk profile, operating model, and budget. 
  4. Run tabletop exercises that include response vendor availability and decision-making, not just technical and legal workflows. 

How Marsh can help 

Marsh can work to support your incident response readiness and response capabilities in the following ways. 

  1. Review your current insurance and incident response arrangements to clarify what is covered, what is preferred, and what — if anything — is contractually guaranteed.
  2. Explain how your insurer panel access, vendor approval, and response-time commitments work in practice. 
  3. Evaluate retainer options and other response models and identify incident response providers whose capabilities align with your organisation, including where specialised expertise may be needed.
  4. Build incident response readiness into a broader resilience programme, including incident response plan reviews, tabletop exercises, and clear escalation paths if an assigned responder cannot immediately engage. 
  5. Connect you with cybersecurity vendors to help enhance cybersecurity hygiene.
  6. Use Marsh Central, a secure off-band communication platform, to upload plans and communicate with key stakeholders before, during, and after an incident.

Contact us

To learn more about our cyber incident response offerings and how we can work with you to improve your resilience, please fill out the form below.