When a client gets hit, you don't have time to vet your incident response (IR) provider. That decision needs to be made well before the ransom note appears or the mouse starts moving on its own.

The problem is, many MSPs either don't have an IR firm on retainer at all, or they're relying on a relationship they've never pressure-tested. And the incident response space has a dirty secret: many firms have competing interests with the MSPs they're supposed to be helping. They use the chaos of a breach to pitch their own managed services, sideline the existing MSP, and walk away with the client.

When evaluating an incident response provider, MSPs should prioritize five things: no competing managed services, fast containment focus, compatibility with your existing security stack, cyber insurance expertise, and the ability to handle the full range of incidents including business email compromise and financial fraud.

Here's what to look for in an IR partner and why it matters as much as the technical credentials on paper.

1. They Have No MSP Services of Their Own

This is the non-negotiable. If your IR firm also sells managed detection and response, co-managed security, or any ongoing SOC services to end clients, they have a structural reason to make you look bad when things go wrong.

It happens more than you'd think. An IR firm gets called in during a breach, takes control of the environment, and tells your client to keep the MSP out. The stated reason is forensic integrity. The real reason, often, is that they want the recurring contract when the dust settles.

A good IR partner has no services to sell your client. Their only job is getting that client back up and running as fast as possible. No finger-pointing. No fault-finding. No pitch deck waiting in the wings.

When evaluating a firm, ask directly: do you offer ongoing managed security services? If the answer is yes, understand what safeguards they have in place. If they can't articulate a clear answer, walk away.

2. They Treat Recovery Speed as the Only Metric That Matters

For the small and mid-market businesses most MSPs serve, a breach isn't just a security event, it's an existential one. Every hour of downtime is a client relationship at risk. Every day offline is revenue that may never come back.

The right IR firm understands this urgency at a gut level. They engage fast, they're structured to get containment quickly, and they use every available resource, including your MSP, to shorten the timeline.

That last point matters more than it sounds. Some IR firms arrive on-site and immediately bench the MSP in the name of "controlling the investigation." That adds days to a recovery that might otherwise take hours. Your knowledge of the client's environment (e.g., their backup architecture, critical systems, and access credentials) is one of the fastest paths to resolution. An IR partner who sidelines you is working against the client's best interest.

Ask prospective IR firms: what's your typical time to containment, and what role does the MSP play in your response process?

3. They Work Within Your Existing Security Stack

The IR firms that bring in their own toolset and refuse to work with your platform aren't optimizing for speed. They're optimizing for their own forensic workflow or for the upsell opportunity at the end.

A well-integrated IR partner should be able to leverage the telemetry you already have. If you're running an MDR or SIEM solution, that data is invaluable. It contains the lookback history of what happened before the breach, not just what's happening in real time. An IR firm that ignores it, or worse, asks you to disable it, is leaving your client exposed.

The right partner actively wants to work with your stack. They see your platform data as a head start, not a complication. And in cases where a client doesn't yet have full detection coverage in place, the best IR partners will deploy a temporary trial of your platform to get better telemetry during the investigation, with the added benefit that the client gets to see what they were missing.

4. They understand how cyber insurance fits into the picture

Cyber insurance is a critical part of any incident response engagement, and the right IR firm needs to understand how to operate within that context.

The tension between MSPs and insurance carriers is well-documented. MSPs often feel like carriers don't pay out or point fingers when things go wrong. Carriers often feel like MSPs aren't properly securing their clients' environments. Neither side is entirely wrong, and neither position helps your client when they're two days into a ransomware recovery and can't open their files.

A good IR partner navigates this constructively. They should have relationships with carriers and know how to work within policy terms to get the claim moving quickly. They should also be advocates for getting your clients into better insurance programs proactively, ones that are tied to security certification and structured to enable fast, collaborative response rather than adversarial claims processing.

One specific question to ask: does your IR firm have preferred relationships with any insurance carriers? Firms that are integrated into the insurance ecosystem can often unlock faster approvals and cleaner recoveries.

5. They Can Handle the Full Range of Incidents, Not Just Ransomware

Ransomware grabs headlines, but it's not what most clients face most of the time. Business email compromise (BEC) is far more common and often far more damaging than it initially appears.

A client resets one compromised email account and thinks the problem is solved. In reality, attackers may have had persistent access for weeks. They may have set up mail forwarding rules, compromised additional accounts, or positioned themselves to intercept an invoice and redirect a payment. By the time money goes missing, containment is no longer about limiting a breach — it's about tracing financial fraud.

The right IR firm handles this confidently. That means compromise assessments: the ability to evaluate a client's environment and answer a simple question — is there still an active threat, or do we have a clean bill of health? It also means depth across financial fraud cases, not just the headline incidents.

When vetting a firm, ask about their case mix. How many BEC and financial fraud cases have they handled? Do they offer compromise assessments as a proactive service, not just a reactive one?

What This Means for Your MSP

Having an IR firm on retainer isn't just a service you can offer clients — it's a differentiator when you're responding to RFPs and a shield when a breach happens and everyone's looking for someone to blame.

The right IR partner makes your MSP faster, more credible, and harder to displace. The wrong one can cost you a client at the exact moment you're trying to help them.

The Todyl Assurance Marketplace makes it easier for MSPs to access vetted IR partners, cyber insurance integrations, and third-party security validation all in one place. If you're a Todyl partner, it's already available to you under the GRC section of the platform. If you're not yet a partner, it's a good reason to take a look.

Frequently Asked Questions

What is an incident response retainer for MSPs?

An incident response retainer is a pre-negotiated agreement between an MSP and an IR firm that guarantees response availability when a breach occurs. Rather than sourcing a firm in the middle of a crisis, the MSP has a vetted partner on standby with agreed-upon response times, scope, and pricing. For MSPs serving small and mid-market businesses, a retainer means faster containment and a clearer path through the chaos of a live incident.

How do I choose an incident response firm that won't poach my clients?

Look for firms that have no managed security services of their own. If an IR provider also sells MDR, co-managed SOC, or ongoing security monitoring to end clients, they have a financial incentive to displace you during a breach. Ask every prospective firm directly: do you offer any recurring security services to the clients you respond for? A firm that can't give you a clean answer to that question is a firm that hasn't thought through the conflict of interest.

What is a compromise assessment and do MSPs need one?

A compromise assessment is a point-in-time review of a client's environment to determine whether a threat actor has active or dormant access. Unlike incident response, which begins after something has already gone wrong, a compromise assessment answers the question before a breach becomes a crisis. MSPs should offer compromise assessments as a proactive service, particularly after a client has experienced a suspicious event, employee departure, or third-party exposure, rather than waiting for a full incident to trigger a response.

How does cyber insurance affect incident response?

Cyber insurance policies often dictate which IR firms a client can use, what data must be preserved for the claims process, and how quickly certain decisions need to be made. An IR partner who doesn't understand insurance policy requirements can accidentally complicate a claim or slow down an approval. The best IR firms have established relationships with carriers and know how to move a response forward in a way that supports rather than jeopardizes the client's coverage.

What is the difference between MDR and incident response?

Managed detection and response (MDR) is an ongoing security service that monitors an environment, detects threats, and contains them in real time. Incident response is a reactive engagement that begins after a confirmed breach or security event. MDR is designed to reduce the frequency and severity of incidents; incident response is what happens when one gets through. For MSPs, having both is the most defensible position: MDR to catch threats early, and a vetted IR partner for the cases that require deeper investigation, forensic analysis, or legal and insurance coordination.