Do you need an external incident response provider, or is your in-house team enough?

For a minor incident, your in-house team or MSP is often enough. For a serious compromise (ransomware, a breach of your directory services, a data leak), it rarely is: in-house staff know the systems, but usually lack forensic skills, round-the-clock availability and distance from events. The best set-up combines both, with roles agreed before anything happens.

This article is part of our series on how incident response unfolds. For the full picture, see How does incident response work?.

What your in-house team does better than anyone

The internal IT team, or the MSP that plays that role in many SMEs, has strengths no outside provider brings on day one:

• Knowledge of the estate: architecture, critical applications, data flows, exceptions, history.
• Access: admin accounts, consoles, backups.
• Business knowledge: which activities are critical, who to call, what can run in degraded mode.
• The ability to act: isolate a server, cut a connection, restore a backup, rebuild a laptop.

Without them, an external provider loses precious time learning the environment. NIST, in Revision 3 of SP 800-61 published in April 2025, points out that incident response involves the whole organisation, not just a specialist team.

What is usually missing in-house

For a serious incident, most SMEs and mid-sized firms lack several skills and resources:

• Digital forensics: analysing memory and logs, rebuilding the timeline, spotting persistence and data exfiltration.
• Knowledge of attackers: their methods, tools and habit of coming back.
• Availability: an attack is handled day and night, often for several days, which a small team cannot sustain on top of day-to-day work.
• Coordination: managing the technical work alongside management, insurer, lawyer and authorities.
• Distance: the in-house team may be implicated by the incident, or have compromised accounts of its own.

France’s PRIS framework, published by ANSSI (version 3.2, October 2025), gives a good sense of what a professional service covers: hunting for indicators of compromise, digital forensics, malware analysis, steering and coordinating investigations, and cyber crisis management.

Who does what in a combined set-up

Activity	In-house team or MSP	Incident response provider
Detection and alerting	Reports what it sees	Triages the incident (often through the SOC)
Containment	Carries out isolation	Advises what to isolate without destroying evidence
Investigation	Provides access and context	Runs the analysis, builds the timeline
Eviction	Resets passwords, applies fixes	Designs the coordinated eviction plan
Recovery	Restores and rebuilds	Checks that systems are clean
Decision	Briefs management	Advises management on residual risk
Reporting	Documents the actions taken	Writes the incident report

Team roles are covered in more detail in Who is on an incident response team?.

When your in-house team may be enough

Your internal team can handle an incident alone when all of the following hold:

• the incident is limited and well understood (a single infected laptop isolated by the EDR, a blocked phishing email);
• no privileged account is involved;
• no personal or sensitive data has leaked;
• no reporting obligation is triggered.

As soon as one of these no longer holds, calling in a provider is the prudent choice. For entities in scope of NIS2, Article 23 provides for an early warning within 24 hours and an incident notification within 72 hours, which leaves little time to look for help.

The MSP case

An MSP is often on the front line when a client is attacked. It has the access and the knowledge of the estate, but not always an investigation team available overnight. That is what a partner SOC working alongside a CERT can provide.

At Cyna, incident response is handled by its CERT, a member of InterCERT France, which works with the SOC teams and can be mobilised quickly. The incident response on-call team is available 24/7 from the Report an incident page. The MSP keeps the client relationship and the hands-on work on the systems; the CERT brings investigation and coordination. Cyna’s certifications and security documents are available on its Trust Center. To go further, see Managed SOC vs in-house SOC for MSPs.

Talk to an expert

Want to agree who does what, for your business or your clients, before the next incident? If you already work with a Cyna partner, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Can our MSP handle a ransomware attack on its own?

It can restore and rebuild, but the investigation (entry point, scope, data theft) calls for specialist skills. Many MSPs rely on a partner SOC and CERT for this. See Managed SOC and MSP: who does what?.

Should we pick a certified provider?

There is no general legal requirement. Some countries run national schemes, such as ANSSI's PRIS qualification in France, which give assurance on the provider's practices. See PRIS incident response providers in France.

Does an external provider take over our systems?

No. It works within agreed access and scope. Actions on systems are often carried out by the in-house team or MSP, following the provider's recommendations. Management keeps the final say.

What if we have no provider when the attack hits?

You can call one in an emergency, with a few precautions, but having a contract in place before an incident saves precious time. Cyna's incident response on-call team is available 24/7 from the Report an incident page. See Can you hire an incident response provider without a contract?.