Section 01 · Public Positioning
How Kroll positions publicly
Kroll is a global risk and financial advisory firm. The cyber practice grew out of investigations, digital forensics, and incident response, with offensive testing added to round out the portfolio. The brand strength is investigative depth and breach-response credibility.
Section 02 · Market Read
Where Kroll actually plays
Kroll is bought first by general counsel, CFOs, and insurance carriers. The cyber practice's center of gravity is what to do after something went wrong: forensics, breach notification, ransomware negotiation, litigation support. The offensive line exists, the people are competent, but it is not the front door and it is not where the firm's identity lives.
Section 03 · Where We Fit
Where Alacrinet sits next to them
We are the proactive offensive team you call before there is anything to investigate. If you want one firm holding the IR retainer, the forensics readiness, the cyber insurance relationship, and the testing line all on one page, Kroll's breadth is real. If you want offensive testing run by people whose entire identity is offensive testing, that is the side of the line we live on.
Section 04 · Side By Side
Side by side, on the dimensions that actually separate us
| Dimension | Alacrinet | Kroll |
|---|---|---|
| 01 Origin story | Offensive practice as the founding mission. | Financial-and-risk advisory firm that added cyber, with IR as the anchor. |
| 02 Who buys you in | Security leadership buying offensive testing. | Often general counsel, CFO, or insurance broker; security inherits the relationship. |
| 03 Best paired engagement | Recurring offensive testing program. | IR retainer plus forensic readiness; testing as one line in a broader cyber-risk program. |
| 04 Pricing posture | Mid-market accessible. | Global advisory-firm rate card, carrying investigations and breach-response cost structure. |
| 05 Voice | Operator-bylined positions, named author. | Firm-bylined research, advisory tone, investigation-flavored. |
Section 05 · Buyer-Side Honesty
When each firm is the right pick
When Kroll is the right pick
- You need an IR retainer and forensic readiness as the primary relationship, with testing as an add-on.
- Your cyber insurance carrier specifically wants Kroll on the breach-response side.
- You are in active litigation or regulatory inquiry where investigative pedigree on the cover page matters.
When Alacrinet is the right pick
- You want offensive testing as the primary relationship, not bundled inside a broader risk-advisory engagement.
- You want the operator named on the report, not a firm signature.
- You want mid-market pricing without funding an investigations-and-IR cost structure you will not use on a pentest.
- You already have IR covered by someone else (Mandiant, Unit 42, an internal team) and need the proactive half done well.
Section 06 · The Tiebreaker
How to decide without a bake-off
Send the twelve-question checklist to both firms and require written answers in the proposal. The answers will sort the fit faster than a demo or a sample report. If Kroll is the right call for your scope, the checklist will say so. If we are, the same checklist will say that too.
Section 07 · Frequently Asked
Frequently asked questions
Q1 Do you provide incident response?
No. We are intentionally a proactive offensive firm. When clients need IR, we refer to firms whose entire muscle is built around the post-incident clock.
Q2 Can you work alongside a Kroll IR retainer?
Yes, often. Many of our clients keep an IR retainer with a forensics-first firm and run the offensive program with us. The two roles are complementary.
Q3 Is Kroll more credible to my board?
On forensics and breach response, plausibly. On offensive testing, the people who matter on a board care about the depth of the finding and the clarity of the readout, not the cover-page logo. Have both pitch the same engagement and judge the answers.