Question 1

What is an incident response retainer?

Accepted Answer

A pre-negotiated agreement that gives your organization priority access to an incident response team the moment a breach occurs. The contract, environment documentation, and access authorizations are all in place in advance, so response starts in minutes instead of days. It's the difference between a rehearsed procedure and a scramble.

Question 2

What's the difference between a retainer and break-fix incident response?

Accepted Answer

Break-fix IR means finding, vetting, and onboarding a vendor mid-breach — at emergency rates, while ransomware spreads. A retainer means pre-negotiated terms, a contractual SLA, and a team that already knows your environment. Organizations without a pre-existing IR relationship lose 30+ hours on average before real response begins.

Question 3

How fast will you respond?

Accepted Answer

Our retainer SLA is a 15-minute critical acknowledgement, 24/7/365 — a certified practitioner actively engaged, not a ticket confirmation. The SLA is written into your agreement.

Question 4

What does an incident response retainer cost?

Accepted Answer

It depends on the model. An on-demand retainer is a pre-purchased block of hours at a fixed rate with no monthly commitment; a full-service retainer is a fixed monthly fee covering unlimited activations, threat hunting, and tabletop exercises. We don't publish rates, but the discovery call gets you a written quote — and either model costs far less than emergency-rate break-fix IR.

Question 5

Do I need an IR retainer if I have cyber insurance?

Accepted Answer

Yes — they solve different problems. Insurance reimburses some costs after the fact; a retainer minimizes the damage while it's happening. Many insurers also require a documented IR capability as a condition of coverage, and a retainer agreement is exactly that evidence. Some policies let you nominate your own IR firm — we can be that firm.

Question 6

What if we never need it?

Accepted Answer

Unused hours roll over quarterly. Some clients view this as security insurance. If you go a year without an incident, that's a good year.

Question 7

Do you work alongside law enforcement?

Accepted Answer

Yes. We're familiar with notification requirements, evidence preservation standards, and law enforcement coordination in North America, EU, and UK.