Discover how prevention starts before the attack at InterSECt 2026. Watch Now
Prisma AIRS AI Gateway is now generally available
Search
INCIDENT RESPONSE SERVICES

Respond with confidence.
Emerge stronger.

Unit 42® is the industry's premier AI-powered incident response service.
Combining elite responders with agentic AI and contextual intelligence,
we contain modern threats faster, recover operations completely
and build lasting resilience.

Respond to a Cyber Attack/ Incident Response Service

When your business is on the line, our field-tested expertise and AI-driven approach make the difference.

Our seasoned expertise covers any type of incident

AI-DRIVEN ATTACKS

We match the speed and scale of
AI-powered attacks to help you contain threats and recover faster.

ATTACKS ON AI SYSTEMS

We rapidly identify attacks on AI models and agents, enabling faster containment and confident recovery decisions.

RANSOMWARE AND EXTORTION

We respond to contain spread, restore operations quickly and help negotiate ransoms.

ADVANCED PERSISTENT THREATS/NATION-STATE ATTACKS

Experts intercept stealthy intrusions, remove persistence and help expel advanced adversaries.

CLOUD ATTACKS

We isolate cloud breaches, contain threats and secure misconfigurations and identities.

BUSINESS EMAIL COMPROMISE

We investigate AI-driven BEC, contain fraud attempts and help recover compromised data.

SUPPLY CHAIN ATTACKS

We trace attacks through software, SaaS integrations and vendor compromises to contain spread.

IDENTITY ATTACKS

We investigate credential abuse, stop account takeovers and restore trusted access.

INSIDER THREATS

We identify malicious or risky insiders, contain impact and protect sensitive data.

Almost there!

Fill out the form to watch instantly.

Not You?

By submitting this form, I understand my personal data will be processed in accordance with Palo Alto Networks Privacy Statement and Terms of Use.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

AI Speed and Scale. Human Judgement.

Attackers are using AI to strike with unprecedented speed and scale. Unit 42 brings the experience, technology and operational depth to match them. From readiness through response to long-term resiliency, we help you act with precision and continuously strengthen your security program.

THREAT-INFORMED

Your attack surface is expanding and harder to see. We use telemetry from 75,000+ customers and thousands of incident engagements to identify exactly where you're vulnerable. You gain the clarity to focus resources on the threats that actually matter to your bottom line.

TECHNOLOGY-DRIVEN

Unit 42 combines deep platform integration with AI and automation to simplify operations, cut through noise, strengthen prevention and accelerate action so you reduce risk faster and stay ahead of evolving threats.

EXPERTISE-LED

You need experts who have seen it before. Our 24/7 global team spans response, readiness, threat intelligence and long-term transformation, delivering battle-tested expertise across every engagement and phase of your security journey.

TRANSFORMATION-FOCUSED

Every engagement turns lessons learned into lasting improvement. And, every engagement concludes with a roadmap to harden your defenses and prove your maturing resilience to the board. You emerge stronger and more defensible after every encounter.

Be prepared.
Learn more about Unit 42.

Insights from the 2026 IR Report

Insights from the 2026 IR Report

Learn the latest trends in modern cyberattacks based on over 750 Unit 42 engagements.

Watch now
Understand evolving AI-driven threats with Unit 42

Understand evolving AI-driven threats with Unit 42 Webinar

Unlock insights from the frontlines of incident response and threat research on how adversaries leverage AI to maximize impact.

Watch the webinar
Unit 42: A Leader in IDC 2025 IDC MarketScape for Worldwide Incident Response Services

Unit 42: A Leader in IDC 2025 IDC MarketScape for Worldwide Incident Response Services

Recognized for a strong intelligence-led incident response service.

Read now
A nation-state APT investigation

A nation-state APT investigation

Unit 42 experts responded to a nation-state APT attack on a global transportation company.

Read the story

Get immediate
IR support

If you've been breached or have an urgent matter, please reach out to the Unit 42 Incident Response team by filling out the form to get in touch immediately.

If you have cyber insurance or legal counsel, you can request Unit 42 to serve as your incident response team. Unit 42 is on over 50 cyber insurance panels as a preferred vendor.

By submitting this form, I understand my personal data will be processed in accordance with Palo Alto Networks Privacy Statement and Terms of Use.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
FAQ

Frequently Asked Questions About Incident Response

Unit 42 is the threat intelligence, incident response, and security consulting arm of Palo Alto Networks helping organizations prepare for, respond to and recover from cyber incidents.
Unit 42 is available 24/7/365 to work alongside your team to investigate, respond to, and recover from cyber incidents, minimizing impact and strengthening future defenses.
Yes. A Unit 42 Retainer gives your organization priority access to experienced responders with pre-defined SLA's before a crisis occurs. It removes the delays of finding a provider and negotiating terms during an attack, while helping your team prepare in advance and act quickly when an incident happens.
Yes. Unit 42 is on all major cyber insurance panels and can work alongside your insurer, breach counsel and internal stakeholders during an incident. Coverage, approvals and engagement requirements depend on your policy, so review them before an event occurs.
Unit 42 response SLAs range from 24 hours to two hours, based on your selected retainer and service level.
Get updates from Unit 42
Stay ahead of threats. Subscribe today.