Incident Response

Incident Response (IR) is the structured process of detecting, containing and recovering from cybersecurity breaches. The discipline is directly implicated in this update through Mandiant's M-Trends 2026 report documenting 393-day average dwell time for UNC5221 BRICKSTORM intrusions and through the DOJ prosecution of Ryan Goldberg (an IR professional at Sygnia) and Kevin Martin (a ransomware negotiator at DigitalMint) for using ALPHV/BlackCat against US victims they were engaged to help.

The IR industry provides the primary detective and remediation capability against advanced persistent threats and ransomware. Mandiant's M-Trends 2026 sets the 393-day BRICKSTORM dwell benchmark as the baseline performance challenge for IR programmes: any detection and response capability that does not surface persistent access within that window is operating below the observed median attacker advantage. Recovery Denial tactics, in which attackers target backup and disaster-recovery infrastructure to extend the IR window, are flagged as a growing ransomware TTP.

The Goldberg-Martin case introduces a new IR risk category: insider abuse by personnel with privileged pre-existing access to victim environments. For organisations procuring IR and ransomware negotiation services, the case shifts due diligence from technical competence assessment to personnel-control verification. The question is no longer only whether a vendor has the skills to respond, but whether it has the controls to prevent its staff from exploiting the access.