CMDashCybersecurity Maturity Dashboard

← All landscape areas

Incident Response & Resilience · Core

Digital Forensics & IR (DFIR)

Investigates and remediates security incidents.

11 options listedTypical cost: $25k-$150k/yrRESPOND (RS) / RECOVER (RC)

Overview

DFIR services and tooling perform breach investigation, evidence collection, containment, and recovery during incidents. Most orgs buy a retainer for guaranteed response time plus hourly engagement. Internal teams supplement with forensic tooling, much of it open source. Insurers increasingly steer retainer selection.

A pre-arranged retainer shortens breach impact and is insurer-aligned.

Advantages

Mandiant/Unit 42 elite expertise
retainers guarantee response SLAs
Velociraptor/TheHive/Autopsy free
aligns with cyber-insurance.

Trade-offs

Expensive hourly rates during incidents
retainer is sunk cost if unused
availability surge-constrained
internal skills still needed.

Vendors & tools in this area

MandiantCommercial

Elite incident response and threat intelligence.

CrowdStrike ServicesManaged service

Elite incident-response and proactive services.

Unit 42Managed service

Palo Alto IR + threat-intel consulting.

KrollManaged service

IR, forensics and cyber-risk services.

Arctic WolfManaged service

Broad MDR / security-operations concierge model.

VelociraptorOpen source

DFIR endpoint visibility and hunting.

TheHiveCommercial

IR case management, now commercial-only via StrangeBee.

AutopsyOpen source

Digital-forensics platform.

VolatilityOpen source

Memory-forensics framework.

Magnet ForensicsCommercial

Enterprise DFIR: unified endpoint, cloud, and mobile evidence in one case.

GRR Rapid ResponseOpen source

Google-built, Apache-2.0 remote live-forensics framework.

Start free trial Browse the full atlas

Digital Forensics & IR (DFIR) — Cybersecurity Landscape Atlas — CMDash