NCC Group named in Forrester cyber response report

NCC Group has been named among notable companies in Forrester's Cybersecurity Incident Response Services Landscape, Q3 2026.

The report reviews the market for cyber incident response services.

The inclusion places the UK-headquartered cyber security firm among providers serving organisations that need support before, during and after cyber attacks. Forrester noted that the market is moving beyond traditional digital forensics and containment as clients seek broader support across preparation, response, recovery and resilience.

That shift reflects a widening role for incident response providers as attacks become more disruptive and technology environments more complex. Businesses and public sector bodies are increasingly turning to outside specialists that can investigate breaches while also helping restore operations and manage the wider business impact.

Market shift

Forrester's assessment points to growing demand for providers that can combine AI-assisted analysis with human oversight while preserving evidential integrity during investigations. Customers now require support across the full incident lifecycle rather than a narrower focus on technical containment.

NCC Group identified three trends shaping the incident response market: the rise of AI and autonomous agents as a new security challenge, a shift away from detection-led services towards integrated response and recovery work, and greater operational complexity caused by fragmented technology estates, cloud systems, operational technology and interconnected supply chains.

It said these issues are appearing across client environments globally, and pointed to demand from organisations in regulated and critical sectors where service disruption can carry broader operational and social consequences.

Sector focus

According to the report, NCC Group's industry focus includes government and public sector, financial services and insurance, and education. These sectors remain prominent targets for cyber criminals because of the sensitivity of their data, reliance on essential services and pressure to restore systems quickly after an incident.

NCC Group said its incident response teams regularly work with organisations where outages and data loss can have significant effects. Recent examples included support for three London councils after a cyber incident and work for a FTSE 100 company dealing with a major cyber security event.

Those assignments underline how incident response work now often extends beyond initial breach analysis. Recovery can involve restoring systems, managing external specialists, advising leadership teams and helping organisations return to normal operations while preserving evidence for further review.

Industry pressure

The wider backdrop is a cyber security market under pressure from more varied attack methods and the growing use of artificial intelligence by both defenders and attackers. Security teams are having to adapt as criminal groups and other threat actors test AI tools and enterprises apply AI to their own monitoring and investigations.

For incident response firms, that creates a balance between speed and caution. Clients want rapid answers during a crisis, but they also need clear decision-making, accurate evidence handling and advice that can withstand scrutiny from boards, regulators, insurers and law enforcement.

Matt Hull, Vice President, Cyber Intelligence and Response, NCC Group, addressed that point in comments released alongside the announcement. "What resonated most with us is that incident response is no longer just about digital forensics. Organisations increasingly need partners who can help them prepare for disruption, respond, recover and build resilience. As AI becomes a growing factor in both cyber attacks and investigations, trusted expertise and human judgement remain critical to achieving the right outcomes for clients," Hull said.