The first hour of a breach is typically the most consequential, and companies that have not planned for it in advance spend that hour making decisions under maximum stress with minimum information. Who do you call first — your MSP, your cyber insurance carrier, your legal counsel? In what order? What actions do you take to contain the incident without destroying forensic evidence? This guide answers those questions and explains what incident response resources are available to SMBs before and during a security incident.
The First Hour: A Decision Sequence
The right sequence when you discover a potential breach:
1. Call your cyber insurance carrier or broker first. Before you call your MSP, before you call an IR firm independently. Most cyber insurance policies require you to notify the insurer and, critically, to use the insurer's approved IR panel vendors in order for the IR costs to be covered. Hiring an IR firm before notifying your insurer is the single most common way companies inadvertently disqualify their IR coverage. Your policy will have a claims or incident notification number — have it printed and posted before you need it.
2. Contact your legal counsel. Data breach notifications, regulatory obligations, and potential litigation exposure need attorney involvement from the beginning. A breach may trigger notification obligations under state data breach laws, HIPAA, or other regulations. Legal counsel — ideally someone with privacy and data breach experience — protects communications under attorney-client privilege.
3. Begin isolation, not remediation. Until your IR team arrives (remotely or on-site), the priority is isolation: disconnect affected systems from the network if that can be done without destroying evidence, do not power off systems (RAM evidence is lost when you power off), and do not wipe or reformat affected machines. Premature remediation destroys the forensic evidence needed to understand scope.
4. Engage the IR firm (from the insurer's panel). The IR firm's job is forensic investigation, scope determination, and technical remediation. Give them full access and follow their guidance on preservation.
What an Incident Response Firm Does
An incident response firm provides the specialized technical capability to investigate a breach, determine its scope, contain the attacker, and restore operations. IR is distinct from your MSP's normal support — an MSP that patches servers and manages your help desk is not typically equipped to investigate an active ransomware deployment, recover encrypted systems, or determine how an attacker maintained persistence.
IR engagement typically involves: forensic imaging of affected systems, log analysis, network traffic review, malware reverse engineering, attacker Tactics, Techniques, and Procedures (TTPs) identification, containment and eradication of the threat, and recovery planning. For ransomware incidents, IR firms also manage negotiations with the threat actor if that path is elected, and manage decryption if a ransom is paid.
Major IR firms with SMB-accessible services include Mandiant (now part of Google Cloud), CrowdStrike Services, Arctic Wolf, and numerous regional and boutique firms. Your cyber insurance carrier's panel will include approved firms; using panel firms typically means costs are pre-negotiated and coverage is assured.
IR Retainer vs Break-Glass: Costs
Break-glass IR (no prior relationship): Engaging an IR firm for the first time during an active incident at emergency rates. Costs for SMB incidents typically run $30,000–$150,000 depending on breach severity, scope, and the firm engaged. Complex ransomware incidents can exceed this range. Hourly rates for emergency IR are typically $300–$500/hour for senior incident responders.
IR retainer: A pre-negotiated agreement with an IR firm that provides discounted emergency response rates in exchange for an annual retainer fee. Retainers for SMBs typically cost $5,000–$20,000/year and include some proactive hours (tabletop exercises, IR plan review, threat hunting) along with priority and discounted emergency response. For companies with meaningful breach exposure, a retainer can pay for itself many times over in a single incident.
Cyber insurance often covers IR costs above the retainer amount — confirm coverage limits, deductibles, and panel requirements with your broker.
Building an IR Plan Before You Need It
An incident response plan doesn't need to be a 100-page document. For an SMB, a usable IR plan includes: the decision sequence described above (who to call in what order, with actual names and phone numbers); the locations of your cyber insurance policy, your MSP contract, and your key vendor contacts; the technical steps for isolating a compromised workstation and a compromised server; your data classification inventory (what sensitive data you hold and where it lives); and notification obligations (which state and federal laws apply to your data).
That plan should be printed and stored in a physical location accessible when your IT systems are down, and should be tested via a tabletop exercise at least annually — a two-hour meeting where your relevant stakeholders walk through a scenario and identify gaps in the plan.
Frequently Asked Questions
Do you have to pay a ransom?
No, and payment is not recommended by CISA or the FBI. Paying a ransom does not guarantee recovery (some decryptors provided by threat actors are defective), and payment may fund future attacks. However, the decision is ultimately a business decision made in consultation with legal counsel and insurance carrier. Companies with no viable backup path and mission-critical data sometimes conclude that payment is the least-bad option; IR firms can advise on the risk and manage the technical process if payment is elected.
What are your legal notification obligations after a breach?
Breach notification requirements vary by state (virtually all US states have data breach notification laws), industry (HIPAA for healthcare, GLBA for financial), and the type of data involved. Most state laws require notification to affected individuals and, in many states, to the state attorney general, within 30–60 days of discovering a breach. Legal counsel with privacy experience should make the determination for your specific situation; this is not the place for DIY analysis.
Should your MSP be on the IR response team?
Your MSP has context about your environment that the IR firm doesn't, making them a valuable resource during the investigation. However, your MSP also has a potential conflict of interest if the breach occurred in a system they managed. The IR firm should run the investigation with MSP assistance, not the other way around. If the breach involved a failure of the MSP's managed services, the IR firm's independence is especially important.