Frost & Sullivan has named Blackpanda, which sells cyber incident response across Asia, its Asia-Pacific company of the year for incident response. It is the third year in a row the firm has taken the title, following an evaluation the analyst firm says ran over twelve months and weighed nominees against ten criteria covering innovation and customer impact.

The product at the centre of the award is Blackpanda's response subscription, which replaces the traditional model of paying a consultant by the project with a fixed fee that activates the moment an incident happens. In Japan the subscription is bundled with insurance cover of up to ten million yen, about seventy thousand United States dollars, through a partnership with the MS&AD Insurance Group. The company keeps response teams that work in local languages in Japan, Singapore, Hong Kong and the Philippines, and says it works with the Singapore Police Force, the cyber agency and the privacy regulator.

What an award measures, and what it does not

Analyst awards of this kind assess a company's position in a market — its model, its reach, its momentum. They are not a test of outcomes, and a firm can win one without publishing a figure for how quickly it contains a breach or how often a recovery succeeds. Frost & Sullivan's write-up, which the release points to, is the place to look for the criteria; the announcement itself offers no measurement.

The insurance detail is the more concrete fact, and it is worth putting in context. Seventy thousand dollars is meaningful to a small business and small against the cost of a serious ransomware incident, which frequently runs into the millions. Reading the model honestly means asking what the subscription actually guarantees — a response team arriving, a defined time to containment, or merely a promise to try — and the release does not say which.