Overview
Kroll is a global risk and financial advisory firm originally founded in 1932 and rebranded from Duff & Phelps in 2021. The firm is privately held and owned by Permira and Stone Point Capital, with reported revenue of approximately US$1.3 billion across roughly 7,000 employees in 35+ countries as of fiscal 2026. The cyber risk practice, led by Dave Burg since 2024, sits within Kroll's broader investigations, risk, and financial advisory portfolio and is one of the few cyber service providers with deep integration into legal hold, expert testimony, and regulatory enforcement workflows.
Cyber services span incident response and digital forensics, ransomware preparedness, managed detection and response under the Kroll Responder brand, breach notification, business email compromise investigations, and cyber due diligence for M&A transactions. The practice has handled more than 3,000 cyber incidents per year and maintains breach notification capability covering all 50 US states and most EU jurisdictions. Threat intelligence is delivered through CTAC and the Cyber Threat Intelligence team.
Buyers engage Kroll when an incident has legal, regulatory, or financial reporting implications — securities disclosure, SEC cyber rules, GDPR notifications, or litigation hold. The firm is well suited to financial services, insurance, healthcare, and legal sector buyers. Kroll is less commonly retained as a primary MDR provider for very large enterprises with established CrowdStrike or Microsoft Defender estates, where the firm's IR role typically dominates over managed operations.
Services Offered
- Incident response and digital forensics
- Ransomware preparedness and incident management
- Kroll Responder managed detection and response
- Cyber due diligence for mergers, acquisitions, and divestitures
- Breach notification and call centre services (multi-jurisdictional)
- Data privacy advisory and GDPR/CCPA compliance
- Cyber risk assessments, penetration testing, and red team exercises
- SEC cyber rule compliance and board-level reporting advisory
- Expert witness, litigation support, and cyber forensics testimony
- Identity theft and consumer remediation services
Typical Engagement
| Engagement Type | Model | Typical Range |
|---|---|---|
| Cyber risk assessment / programme review | Fixed-fee project | $100K–$400K (6–12 weeks) |
| Incident response engagement | Time & materials, retainer-drawdown | $250K–$5M+ (incident-dependent) |
| Kroll Responder MDR | Annual subscription, per asset | $6–$18 per asset/month |
| IR retainer (Kroll Cyber Risk) | Monthly retainer with drawdown | $10K–$80K per month |
| IR consultant / expert (testimony) | Hourly bill rate | $425–$900/hour |
Pricing verified May 2026 from public procurement data and reference checks; ranges vary by region and engagement structure.
Strengths
- Deep integration between cyber forensics, legal hold, and expert testimony — uniquely valuable for SEC and litigation-driven incidents
- Multi-jurisdictional breach notification capability, including all 50 US states and EU member states
- Strong cyber insurance panel relationships — Kroll is on most major carrier IR panels at preferred rates
- Cyber threat intelligence draws on Kroll's broader investigations and financial crime telemetry
- Long-running expertise in financial services, insurance, and asset management cyber risk
- Combined cyber due diligence and M&A advisory capability — useful for buy-side and sell-side transactions
Limitations
- Smaller MDR scale than dedicated platforms — Kroll Responder is competitive in mid-market but rarely selected for very large estates
- Higher hourly rates than pure managed security providers, reflecting investigations and testimony positioning
- Private equity ownership (Permira, Stone Point) creates pressure for utilisation and bench discipline that has affected senior consultant retention
- APAC and Latin America delivery is materially smaller than the US, UK, and EMEA footprint
- Less suited to long-running transformation programmes; primarily an incident-led and advisory model