When to call outside incident response help, and when you don't need to

Call outside help when any one of these is true: the incident might create a legal duty to notify anyone; it's ransomware or an extortion demand; the attacker has or may have administrative access; you can't say with confidence within 48 hours what happened and whether it's over; or your cyber insurance policy requires it. If none of those is true, a competent internal team can handle it, and often should, because they know the environment. The mistake is waiting for certainty before calling. The call is cheap. The delay isn't.

The thresholds, in the order I'd apply them

Insurance first, because it decides who you call. Most cyber policies require you to notify the carrier promptly and to use approved vendors, and some won't cover a firm you picked yourself. Read the policy now, not during the incident. If you have a panel firm, that's your first call after counsel.

Legal exposure. The moment there's a plausible chance that personal data, health data, payment data, or material business information was accessed, you're inside notification law. Public companies face a four-business-day filing clock once an incident is determined material (U.S. Securities and Exchange Commission, 2023). Financial institutions under the FTC Safeguards Rule have thirty days to notify the FTC for events involving 500 or more consumers (Federal Trade Commission, n.d.). State breach laws vary. The investigation that supports those decisions has to be defensible, and that usually means outside counsel directing it and an outside firm doing the forensic work. Internal teams can do good work, but a regulator or a plaintiff will ask who checked it.

Ransomware or extortion. Even if you have no intention of paying, you want people who've negotiated before, who know which groups honour deals and which don't, and who understand the sanctions exposure. The U.S. Treasury's sanctions office has said plainly that facilitating a payment to a sanctioned party can bring civil penalties even if you didn't know, and that prompt reporting to law enforcement is a mitigating factor (Office of Foreign Assets Control, 2021). That's not a conversation to have for the first time under pressure.

Administrative compromise. If the attacker had domain admin, cloud tenant admin, or hypervisor access, assume everything they could reach is in question. Scoping that properly takes tooling and experience most internal teams use once a year at best.

The 48-hour test. This one's mine, and it's simple. If after two days your team can't tell you how the attacker got in, what they touched, and whether they're out, you need more hands. Not because your people aren't good, but because the work expands faster than a small team can cover while also keeping the business running. NIST's incident response guidance expects organisations to decide in advance which capabilities they'll keep in-house and which they'll source externally, precisely so this isn't a judgement call at 3 a.m. (Nelson et al., 2025).

When you genuinely don't need outside help

A single phished mailbox with no evidence of forwarding rules, no sensitive data in it, and clean logs. Commodity malware caught by endpoint tooling before it ran. A lost laptop with full-disk encryption and a verified key. Internal teams handle these daily and should. What they should still do is write it up properly, because a series of "small" incidents sometimes turns out to be one large one seen in pieces.

What outside help actually costs, and what it buys

Retainers for incident response firms are typically a fixed annual fee that converts to hours when something happens, with the hourly rate rising sharply if you call without one. The fee buys a phone number that answers, a team that already knows your environment, and the ability to start in hours rather than days. What it doesn't buy is a plan. If your organisation hasn't decided who can authorise containment, who talks to the carrier, and who tells the board, an outside firm will spend its first day finding that out at your expense.

What I'd do next

Pull your cyber policy and write down the notification deadline and the vendor requirements on one page. Then decide, now, which of the five thresholds above would trigger a call, and who makes it. If you'd like a second pair of eyes on that before it matters, request a briefing. On running the exercise that tests it, see Your Incident Response Tabletop Should Make People Uncomfortable.