Most incident response plans have a step that reads something like “Call the insurer’s hotline and engage the forensics firm.” It looks finished on paper, but it quietly assumes that someone on the other end has time for you.

Right now, that assumption is being tested.

On November 9, executives at Mandiant, CrowdStrike and Kroll told NBC News that demand for emergency response is surging as attackers use AI to automate their attacks, and that some top firms are turning away new customers seeking emergency help.

For an SMB client with no retainer and no prior relationship with a responder, “new customer” is exactly what they’ll be on the worst day of their year.

What responders are saying

The NBC report isn’t the only sign of strain. Over the past few weeks, responders have described the same thing from different angles:

• The industry has a name for it. A run of serious flaws and coordinated attacks that landed within days of each other pushed response teams to their limits in what’s being called “Black October,” according to WSJ’s Risk Journal. CrowdStrike’s Adam Meyers warned it could become “a Blacker November.”

• Workloads have compressed. Sophos said it handled seven major corporate emergencies in seven days, a workload that would normally span three months.

• Waits are being quoted. Forensics firm MoxFive began warning prospective clients they might wait up to five days for help because of the volume of requests.

• The overflow is full too. Palo Alto Networks’ head of incident response told Axios that demand had risen by double digits in six weeks, that even its subcontractors were at full capacity, and that investigations one consultant used to handle now take teams of five to 20.

• Firms are borrowing from each other. Sophos says other digital forensics and incident response firms have asked whether Sophos can provide overflow support when their teams reach capacity.

None of this means help is unavailable. It means help may be slower, may go first to clients with existing contracts, and may arrive after the most important decisions have already been made.

This week made it concrete

Two of this week’s biggest stories show how quickly MSPs themselves can end up needing outside help.

When MSP Process, a software vendor serving more than 1,000 MSPs, was breached, attackers used stolen app secrets to reach partner and client Microsoft tenants. The company engaged Sophos to lead its incident response, and Huntress reported successful malicious token grants in 47 tenants. Every MSP using that product suddenly had its own investigation to run.

Then N-able took hosted N-central offline worldwide and told on-premises customers to shut down their servers, after a researcher published proof-of-concept exploits for more than 30 alleged zero-days (BleepingComputer). MSPs relying on that platform lost a core management tool overnight.

Neither was an incident at a single client. Both could have left dozens of MSPs calling the same handful of response firms in the same week.

The gap no one wrote down

When a firm says “we can be there in five days,” the incident doesn’t pause. Attackers keep moving, logs keep rolling over, the client keeps asking whether to shut things down, and someone has to decide.

In most SMB environments, that someone is the MSP. You know the network, hold the admin credentials and have the logs. Whether or not your contract says so, you own the gap between “we found something” and “the experts have arrived.”

So the real question isn’t whether your client has an incident response plan. It’s whether the plan still works if the outside firm can’t start for several days.

The playbook

1. Lock in capacity before you need it

A retainer is the most direct way to move from “new customer” to “existing client.” Kroll, for example, describes its retainer as including prioritized access to incident response services. Other firms offer similar arrangements.

“Priority” is only useful if it’s defined. For any retainer a client signs, find out in writing:

• The guaranteed time to first contact, and the time to a responder actively working the case

• Whether that commitment holds during industry-wide surges, or whether there are capacity carve-outs

• Whether unused hours roll over, convert to proactive work, or expire

• Whether remote triage can start before a full engagement is approved

For clients that can’t justify a full retainer, at least get a signed master services agreement with a chosen firm, so no contract has to be negotiated mid-incident.

2. Name a second and third option

One firm is a single point of failure. For each client, identify a primary responder and at least one backup, and check with the insurer that each is approved. Some cyber policies require panel vendors or prior consent, so going off-panel can put coverage at risk.

We covered how to vet these firms, including fee models and conflict-of-interest questions, in “Who’s Really on Your Incident Response Call?” The new point here is depth: if the first call is answered with “we’re at capacity,” the second call should already be decided.

3. Write the MSP’s first-24-hours playbook

If outside help could be days away, the MSP’s own actions in the first day matter more than ever. Write them down for each client so no one improvises at 2 a.m.:

• Contain without destroying evidence. Define how to isolate affected endpoints and accounts, such as network isolation from EDR, disabling accounts and revoking sessions, without wiping or reimaging anything.

• Preserve before you fix. Capture logs, memory where feasible, disk snapshots and cloud audit data before rebuilding or restoring. Know how long each log source keeps data, and export anything close to aging out.

• Get communications off the compromised systems. If email or Teams may be compromised, move to a pre-agreed backup channel, such as phone trees, a separate messaging app or personal numbers.

• Notify the right parties in the right order. Most cyber policies require prompt notice to the insurer, and breach counsel often needs to be involved early. In the U.S., incidents can be reported to CISA through its online form or at 1-844-Say-CISA.

• Keep a timeline from the first minute. Record who did what, and when. Forensics, insurers and regulators will all ask for it.

NIST’s updated incident response guidance, SP 800-61 Rev. 3, frames preparation as part of everyday risk management rather than a separate binder. That’s the right mindset: this playbook should be maintained like any other client runbook.

4. Settle who can decide what

During the gap before outside responders arrive, the hardest moments are usually decisions, not technical tasks. Agree in advance who can authorize:

• Taking a production system, site or cloud tenant offline

• Disabling an executive’s account or forcing a company-wide password reset

• Spending money: emergency licenses, extra staff hours or a second response firm

• Notifying the insurer, engaging counsel and contacting law enforcement

• Communicating with employees, customers or the press

Put names, alternates and phone numbers in a decision matrix that’s stored offline. If the only copy lives in the client’s SharePoint, assume you won’t be able to open it when you need it most.

5. Pre-stage what a responder will ask for

When a firm does arrive, the first day often goes to collecting basics. You can shorten that by keeping these ready for each client:

• A current asset and identity inventory, including service accounts and third-party apps with tenant permissions

• Network diagrams and a list of internet-facing systems

• Log sources, where each one lives and how long it’s kept

• Backup locations, immutability status and the date of the last tested restore

• Admin access paths for the responder, ready to grant quickly and revoke cleanly

A responder who can start on day one with this information delivers far more value from a limited number of hours.

6. Rehearse the “no one answers” scenario

Most tabletop exercises assume the cavalry arrives on time. Run one where it doesn’t. Tell the room the primary firm is at capacity, the backup can’t start for 72 hours, and the attacker is still active. Then work through who decides what, and in what order.

The weak spots that come up, such as an unclear authority, a missing phone number or a log that already aged out, are exactly what you want to find before a real incident.

Turning it into a service

This is incident readiness, and it fits naturally as an MSP add-on. A simple package might include:

• Responder bench: primary and backup firms identified, insurer approval confirmed, agreements or retainers in place

• First-24-hours runbook: the MSP’s containment, preservation and notification steps, written for each client

• Decision matrix: authority, alternates and contacts, kept offline

• Responder-ready pack: inventory, diagrams, log map and backup status, refreshed quarterly

• Annual tabletop: including the “no one answers” scenario, with findings tracked to closure

Each item produces a record that’s useful well beyond an incident. It supports insurance renewals, gives auditors evidence of preparation, and gives you a clear story for the next client meeting: if something happens and the big firms are booked, here’s exactly what we do, and here’s who comes next.

The capacity crunch may ease, or it may get worse. Either way, the clients who come through it best will be the ones whose plans didn’t depend on someone else having a free afternoon.

Frequently asked questions

Q: Are incident response firms really turning clients away?

A: Executives at Mandiant, CrowdStrike and Kroll told NBC News that demand is surging and that some top firms are turning away new customers seeking emergency help. Separately, forensics firm MoxFive has warned prospective clients of waits of up to five days.

Q: Why is demand so high right now?

A: Responders attribute it to attackers using AI to automate attacks, combined with a cluster of serious vulnerabilities and coordinated campaigns in October. Palo Alto Networks reported a double-digit rise in demand over six weeks, with subcontractors also at full capacity.

Q: Does an incident response retainer guarantee help?

A: It improves your position, but only as much as its terms say. Retainers are commonly sold with prioritized access. Confirm in writing the guaranteed response times, whether they apply during industry-wide surges, and what happens to unused hours.

Q: What should an MSP do before outside responders arrive?

A: Contain without destroying evidence, preserve logs and snapshots before rebuilding, move communications to a backup channel, notify the insurer and counsel as the policy requires, and keep a timestamped record of every action. In the U.S., incidents can also be reported to CISA.

Q: Can a client use any response firm it wants?

A: Not always. Some cyber insurance policies require panel vendors or prior consent, and using an unapproved firm can put reimbursement at risk. Confirm the panel and any pre-approvals at renewal, and choose a backup firm that the insurer will also cover.

Q: How can MSPs offer this as a service?

A: Package it as incident readiness: a vetted responder bench with insurer approval, a written first-24-hours runbook, an offline decision matrix, a responder-ready information pack, and an annual tabletop that includes a scenario where outside help is delayed.