Incident response firms in the United States

Microsoft sells software, cloud services, hardware, and gaming products.

Palo Alto Networks provides cybersecurity platforms and services to protect organizations from cyber threats.

CrowdStrike provides AI-native cybersecurity solutions to stop breaches.

Commvault provides a cloud-native platform for data security, identity resilience, and cyber recovery.

IBM is a technology company that sells software, infrastructure, and consulting services.

US-headquartered cybersecurity consultancy with 800+ employees, serving ~40% of the Fortune 500. FedRAMP 3PAO, PCI QSA, and HITRUST accreditations.

Global risk advisory firm with a 400+ person cyber practice. IR-led penetration testing that feeds active breach intelligence straight into test scoping.

Managed security provider that now runs Trustwave's SpiderLabs penetration testing team, with CREST-accredited testing, red and purple teaming, and deep PCI DSS expertise.

Sophos provides cybersecurity products and managed detection and response services to organisations worldwide.

Denver-based offensive security boutique with a community-first red team culture. Home of PTES co-authors and the Continuous Red Team retainer.

Offensive security firm founded by former NSA operator David Kennedy, delivering CREST-accredited penetration testing, red teaming, and adversary simulation to Fortune 500 and government clients.

Community-driven penetration testing firm known for free security education, open-source tools, Wild West Hackin' Fest, and practical offensive security services.

RedTeam Security is now part of DeepSeas, which offers penetration testing, red teaming and physical testing as its offensive security practice.

US-wide pen testing firm serving major cities including Atlanta, Dallas, Denver, Houston, and Miami with security assessments.

Potenza Services is a veteran-owned firm based in Tampa, Florida, founded in 2012.

Arctic Wolf provides managed security operations, threat detection and incident response services to organisations.

Artemis Security provides an AI-native security operations platform that detects, investigates and responds to cyber attacks.

Provides agentic threat intelligence and validation for critical infrastructure security teams.

Cofense provides phishing detection and response services using AI and human validation.

Critical Start provides managed detection and response services to monitor, investigate, and resolve security threats for organisations.

Computer and IT infrastructure maker whose PowerProtect Data Manager software and Data Domain appliances back up data, detect ransomware and speed recovery.

Dragos provides cybersecurity for industrial control systems and operational technology environments.

EC-Council is a cybersecurity certification and training body.

ERMProtect provides cybersecurity assessments, penetration testing, compliance audits, and digital forensics services.

Expel provides managed detection and response security services using AI and human analysts.

Hardware and software that detect cyber attacks and cargo theft on fleet vehicles, backed by a vehicle SOC.

Galvanick provides behavioral threat detection for operational technology environments.

Intezer provides an AI-powered security operations center that investigates all alerts at forensic depth.

Lorikeet Security provides penetration testing, incident response, and security leadership services.

MonsterCloud provides managed cloud, IT and cyber security services, including ransomware recovery, to businesses across the United States.

Morphisec sells endpoint security software that blocks ransomware and governs AI tools on devices.

Netrio provides managed IT, cybersecurity, cloud, and connectivity services to mid-market enterprises.

Ontinue provides managed detection and response services for Microsoft security customers.

SANS Institute provides cybersecurity training, certifications, and resources to professionals and organisations worldwide.

Sunnyvale and Pune firm selling in-vehicle intrusion detection, vehicle SOC analytics, secure OTA and security assessments.

Semperis provides identity-driven cyber resilience and crisis management for critical identity systems.

Onboard monitoring platform that detects cyber and electronic warfare threats on military vehicles, aircraft, ships and trains.

Sucuri provides cloud-based website security.

Georgia start-up whose TranzSecure service flags cyber attacks, unknown devices and cargo theft across trucking fleets.

TRM Labs provides blockchain intelligence and AI tools to help investigate and disrupt criminal networks.

UnderDefense provides managed detection and response, incident response, and compliance automation services.

Veeam provides data resilience, security, and AI trust solutions for hybrid cloud environments.

Athena Agentic provides a unified cyber operations platform that automates detection, response, and hardening.

Cybersecurity consulting and engineering for US government and industry, including threat hunting, zero trust, incident response and defence of critical infrastructure and weapon systems.

Data security and backup platform with immutable backups, threat detection and ransomware recovery, protecting more than 1,000 workload types.

Managed security operations, threat intelligence and incident response services delivered from global security operations centres by an IT infrastructure services provider.

Optiv advises, deploys, and operates cybersecurity programs for organizations.