Incident response retainers
A retainer exists so the first hour of an incident is not spent on procurement. Here is what one covers, and what to ask before you sign.
You are not buying hours. You are buying a warm start.
The value of a retainer is almost never the hourly rate. It is that when something happens, the people arriving already hold your network diagram, your escalation paths, your legal and regulatory constraints, and the authority to act inside them. None of that can be assembled while an intrusion is live.
The alternative is a procurement conversation during the worst week your organization has had, with an unfamiliar team asking for architecture documents while the estate is still moving. That is the cost a retainer removes.
Before, during and after
Preparation
Architecture review, escalation paths agreed, authority model documented, contact tree tested. Done while nothing is on fire, so it is accurate when it matters.
Response
Urgent requests triaged in under 15 minutes. Containment, forensics and recovery run by one team rather than handed between three.
Hardening
Root cause, the changes that close it, and the reporting your regulator or board needs, drawn from the record the responders actually worked in.
Questions to ask any provider
Including us. If a provider cannot answer these in writing, the retainer is a billing arrangement rather than a response capability.
Who actually turns up?
Named responders, or a pool? A retainer that guarantees a response but not a team means your first hour is spent briefing someone on an architecture they have never seen.
What starts the clock?
Your call, or triage completion? These are very different commitments, and the gap between them is where most disappointment lives.
What happens to unused hours?
Some retainers expire them, some roll them, some convert them to assessment work. The last is the only one that returns value in a quiet year.
Who holds the evidence?
If forensic images leave your jurisdiction to be processed, that is a decision you want to make deliberately rather than discover during a regulatory notification.
Is preparation included?
A retainer where nobody has read your network before the incident is an invoice with a phone number attached.
What is explicitly out of scope?
Ask for the exclusions in writing. Litigation support, regulatory notification, and recovery engineering are commonly assumed and commonly excluded.
Your incident data stays in your jurisdiction
Forensic material is evidence before it is telemetry. Ours is processed inside the boundary you nominate, including fully disconnected environments, because the moment you are most likely to face a regulatory notification is exactly the moment you least want to explain why the images went to a vendor cloud in another country.
- Analysis inside your nominated boundary
- Support access approved by you, time-bounded and recorded
- Chain of custody maintained to an investigative standard
- Export formats documented, so the evidence stays portable
Retainers are scoped, not priced off a page
Scope depends on estate size, deployment model, regulatory exposure and how much preparation you want done up front. Tell us the constraint and we will map it.