IR Retainer vs Ad-Hoc Incident Response: The Real Cost Difference

The Question Every CISO Eventually Faces

At some point, every organisation confronts the same decision: pay an annual retainer for incident response capability you hope never to use, or wait until something happens and engage a firm under emergency terms. On the surface, the retainer feels like insurance on top of insurance. The ad-hoc route looks cheaper — until you actually need it.

The data tells a stark story. According to the IBM Cost of a Data Breach Report 2024, the global average cost of a data breach reached $4.45 million. Organisations with incident response teams and regularly tested IR plans reported breach costs significantly below that average. Organisations without either reported costs well above it. The gap between prepared and unprepared is not marginal — it is measured in millions.

This article breaks down the real cost difference between an IR retainer and ad-hoc emergency response, using industry benchmarks and a detailed mid-market breach scenario. The goal is to give you the numbers so you can make an informed decision.

Understanding the Two Models

Before diving into costs, it is worth clarifying what each engagement model looks like in practice.

An IR retainer is a pre-arranged contractual relationship with a DFIR consultancy. You pay an annual or quarterly fee that secures guaranteed response times, pre-negotiated day rates, and a team that has already been briefed on your environment, key contacts, and critical assets. Many retainers also include proactive services such as dark web monitoring, threat intelligence briefings, tabletop exercises, and IR plan reviews. When an incident occurs, you call your named consultant directly — no procurement, no contracting, no onboarding delay. The team is mobilised within hours, sometimes within the hour, depending on your SLA tier. Binary Response offers three retainer tiers designed for different organisational profiles.

Ad-hoc emergency response means engaging an IR firm for the first time during an active incident. There is no pre-existing relationship. The organisation must identify a suitable provider, negotiate terms under extreme time pressure, execute contracts (often requiring legal review even in a crisis), brief the incoming team on an environment they have never seen, and accept whatever rates the provider charges for emergency work. Each of these steps takes time — and during an active breach, time is the single most expensive commodity you have.

The Expanded Comparison

The following table compares the two models across the dimensions that matter most when an incident is unfolding.

A Mid-Market Breach: Walking Through the Numbers

Abstract comparisons only go so far. Let us walk through a concrete scenario to see how the cost difference plays out in practice.

Friday, 02:14 AM — Ransomware Detonates

A threat actor who gained initial access via a compromised VPN credential three weeks earlier deploys ransomware across Meridian's domain. Active Directory is encrypted. Backup servers are targeted. The ERP system, production control systems, and email are all offline. A ransom note demands £2.1 million in cryptocurrency.

The IT security analyst is woken by monitoring alerts and begins working the problem alone. By 04:00 AM, the scale of the damage is apparent. Meridian needs external incident response help — immediately.

Scenario A: Meridian Has No Retainer

The IT analyst and the CTO begin searching for incident response firms. It is a Friday night. They find three firms with advertised 24/7 capabilities. One is fully committed to another engagement. One responds by email promising a call back on Monday. The third answers, but cannot begin work without a signed engagement letter and a £50,000 upfront deposit.

Hours 0–12: Legal and procurement are pulled in. The engagement letter is negotiated under extreme pressure. The deposit is arranged. The IR firm assigns two consultants who have never seen Meridian's environment. They begin by asking for network diagrams, an asset register, AD topology, and key contact details — information that takes hours to compile while the organisation is in crisis.

Hours 12–48: The IR team is onboarded and begins triage. Containment actions start approximately 18 hours after detonation. By this point, the threat actor has had almost a full day of additional access since the initial alert.

Days 3–24: Investigation and recovery proceed. Consistent with the Coveware average of 24 days of downtime, Meridian's core systems are not fully restored until day 22. Production is partially operational from day 10 but running at approximately 40% capacity.

Scenario A Cost Summary

• IR consultancy fees: 22 days × 2 consultants × emergency day rate (£3,250 including 40% premium) = £143,000
• Lost production (22 days at ~60% capacity loss): estimated £580,000
• Emergency IT overtime and third-party rebuild costs: £85,000
• Legal and regulatory costs (ICO notification, data subject communication): £65,000
• Reputational/customer impact (contract penalties, delayed orders): £150,000
• Cyber insurance excess: £50,000
• Estimated total cost: £1,073,000

Scenario B: Meridian Has an IR Retainer

The IT analyst calls the Binary Response retainer hotline at 02:20 AM. The named lead consultant acknowledges within 15 minutes and begins remote triage immediately, using pre-existing VPN credentials and environment documentation already on file.

Hours 0–2: The lead consultant, who conducted Meridian's tabletop exercise six months ago and reviewed their IR plan in January, already knows the AD structure, the backup topology, and the critical business systems. Containment actions begin within 90 minutes of the initial call — the compromised VPN account is disabled, lateral movement paths are cut, and unaffected backup volumes are isolated before the threat actor can reach them.

Hours 2–12: A second consultant is mobilised. Because backup integrity was preserved through early containment, the recovery timeline is dramatically shortened. Forensic imaging begins in parallel with recovery rather than sequentially.

Days 1–10: Core systems are restored within 8 days. Production reaches 80% capacity by day 4 and full capacity by day 9. The total downtime at full capacity loss is approximately 3 days, with partial degradation for a further 6 days.

Scenario B Cost Summary

• Annual retainer fee (Vigilant tier, prorated per incident): £24,000
• IR consultancy fees: 10 days × 2 consultants × retainer day rate (£2,200) = £44,000
• Lost production (3 days full + 6 days partial at ~30% loss): estimated £195,000
• Emergency IT overtime and rebuild costs: £40,000
• Legal and regulatory costs: £45,000 (lower due to faster containment reducing data exposure)
• Reputational/customer impact: £60,000 (shorter disruption, faster communication)
• Cyber insurance excess: £50,000
• Estimated total cost: £458,000

Where the Savings Actually Come From

The cost advantage of a retainer is not the day rate, though avoiding the 30–50% emergency premium helps. The real savings come from three compounding factors.

1. Faster Containment Reduces Blast Radius

Every hour of uncontained access allows a threat actor to encrypt more systems, exfiltrate more data, and destroy more backups. The difference between containing an incident at hour 2 versus hour 18 is exponential. In Meridian's case, early containment preserved backup integrity, which single-handedly cut the recovery timeline by more than half.

2. Shorter Downtime Reduces Business Losses

Coveware data indicates an average of 24 days of downtime following a ransomware incident. For a mid-market organisation generating £120 million annually, each day of significant operational disruption costs roughly £45,000–£65,000 in lost productivity, delayed orders, and contractual penalties. Reducing downtime from 22 days to 9 days does not just save consultancy fees — it saves hundreds of thousands in business impact.

3. Pre-Negotiated Rates Avoid Crisis Pricing

Ad-hoc IR engagements typically carry a 30–50% emergency rate premium over standard consulting rates. This is reasonable from the provider's perspective — emergency work requires immediate resource reallocation, weekend and overnight coverage, and acceptance of commercial risk. But from the client's perspective, it means paying significantly more per hour for a team that is less efficient (because they lack environment familiarity) and takes longer to achieve containment. The retainer inverts this equation entirely: you pay less per hour for a team that works faster.

The ROI Framework

Framing the retainer as a cost misses the point. It is an investment with a quantifiable return. Here is how to calculate ROI for your organisation.

Using Meridian's numbers: (£1,073,000 − £458,000 − £24,000) / £24,000 = 24.6x return. Even if you discount these figures aggressively — halving the difference and doubling the retainer cost — the return remains compelling.

Of course, the ROI calculation assumes an incident occurs. The counterargument is straightforward: if you never have an incident, the retainer "cost" you the annual fee with no return. But consider what the retainer delivered even without an incident:

• Continuous dark web monitoring that may have detected the compromised credential before it was exploited
• A tabletop exercise that tested and improved your IR plan
• Quarterly threat intelligence briefings that kept your board informed
• IR plan review that identified gaps before they mattered
• Insurance documentation that may have reduced your premium

The retainer delivers value whether an incident occurs or not. The ad-hoc model delivers nothing until the worst day of your professional life.

What the Industry Data Says

The scenario above is illustrative, but it aligns with broader industry findings:

• IBM Cost of a Data Breach 2024: Organisations with IR teams and tested plans saved an average of $1.49 million per breach compared to those without either
• Coveware Quarterly Ransomware Reports: Median downtime following a ransomware attack is approximately 24 days; organisations with established IR relationships consistently report shorter recovery periods
• Emergency rate premiums: Industry surveys indicate ad-hoc emergency IR engagements carry a 30–50% rate premium over pre-negotiated retainer rates, reflecting the provider's opportunity cost and mobilisation burden
• Containment speed: Organisations with pre-arranged IR capability resolve incidents 40–60% faster than those engaging responders for the first time during a crisis
• Insurance impact: Multiple UK and European cyber insurers now offer premium reductions or improved terms for organisations that can demonstrate an active IR retainer

When Ad-Hoc Might Be the Right Call

In the interest of balance, there are limited circumstances where ad-hoc response may be appropriate.

• Very small organisations with minimal digital footprint and genuinely low cyber risk may not justify the annual commitment
• Organisations with mature in-house DFIR teams that only need external support for specialist capabilities (e.g., malware reverse engineering) during large-scale incidents
• Organisations already on an insurer's IR panel where the insurance provider has pre-arranged response terms on the client's behalf

For most mid-market and enterprise organisations, however, the risk calculus strongly favours the retainer model. The question is not whether you can afford a retainer — it is whether you can afford not to have one when the call comes at 2am on a Friday.

Choosing the Right Retainer

Not all retainers are equal. When evaluating providers, consider the following.

• Response SLAs: Is the response time guaranteed in the contract, or just aspirational? How is the SLA measured — from first contact to acknowledgement, or from first contact to active work?
• Named practitioners: Will you have a named lead consultant who knows your environment, or will you be assigned whoever is available on the day?
• Proactive services: Does the retainer include meaningful proactive value (monitoring, exercises, briefings), or is it purely a commercial placeholder for future reactive work?
• Overage terms: What happens when you exceed your pre-purchased hours? Are overage rates pre-agreed, or are they determined at the time of the incident?
• Flexible usage: Can unused hours be applied to proactive services, or do they simply expire?
• Credentials: Is the provider CREST-certified for incident response? Do their practitioners hold recognised DFIR qualifications?

Binary Response's IR retainer tiers — Watchful, Vigilant, and Guardian — are designed to address each of these criteria across different organisational sizes and risk profiles.

Frequently Asked Questions