Insights · Question
Who do we call first in a breach?
Your own incident lead first, to start the log of decisions and preserve evidence before anyone rebuilds anything. Then the cyber insurer, within the policy’s notification deadline, because coverage can depend on it and the insurer often controls which counsel and forensic vendors may be used. Then breach counsel, so that the investigation is directed under privilege and the regulatory and contractual notification deadlines are managed. The forensic firm is engaged through counsel from the insurer’s approved list. Law enforcement is coordinated through counsel. All of these relationships should exist before the incident; the first hours are too late to procure any of them.
In more detail
The reasoning.
The order matters because engaging the wrong firm before notifying the insurer can forfeit coverage, and because an investigation started without counsel may not attract privilege. The policy terms, the deadline and the approved vendor list belong in the response plan, read before the incident.
The instinct to fix it first destroys evidence: rebuilding a server, deleting a mailbox, wiping a laptop. Preservation comes before containment, by a workflow decided in advance.
See working with legal, forensic and insurance partners during a breach, coordination with partners, the incident response plan template and evidence preservation during an incident.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 90 days