Incident Response Retainer

The Problem With Calling Us After the Breach

When ransomware hits at 2am on a Friday, the last thing you want is to be Googling for incident responders, negotiating contracts under duress, and briefing a team who have never seen your environment. That delay — measured in hours — is where the real damage happens.

An IR retainer removes all of that friction. We are already engaged, already briefed, and already contractually committed to respond. When the call comes, we move.

What a Binary Response Retainer Gives You

• Guaranteed SLA response times — 1-hour acknowledgement, 4-hour mobilisation (retainer tier dependent)
• Pre-negotiated commercial terms — no rate shock mid-incident; your rates are locked at onboarding
• Named practitioners — you deal with the same senior consultants throughout, not a triage queue
• Environment pre-briefing — we ingest your network diagrams, asset registers, and key contacts before we are ever needed
• Proactive dark web monitoring — included in all retainer tiers; we alert you if your organisation appears on a leak site
• Quarterly threat briefings — sector-specific threat intelligence to keep your leadership informed
• Annual tabletop exercise — test your plan with your named IR team before a real crisis
• Insurance alignment — retainer documentation accepted by most major cyber insurers as evidence of preparedness

Retainer Tiers

How Onboarding Works

We keep onboarding deliberately lightweight. Most clients are fully onboarded within two weeks:

1. Scoping call (Day 1–2) — Understand your environment, risk profile, and critical assets. Agree SLA tier and commercial terms.
2. Technical intake (Day 3–7) — Ingest network topology, asset register, key contacts list, and existing IR plan. Identify gaps we should address pre-incident.
3. Environment walkthrough (Day 7–14) — Remote session with your IT/security team. We map your Active Directory, EDR deployment, backup topology, and cloud footprint.
4. Go-live — Monitoring active. Retainer card issued. You have a direct line to your named consultant.

Who This Is For

Our retainer clients typically fall into one of three categories:

• Mid-market organisations (200–5,000 employees) without in-house DFIR capability who need enterprise-grade response without the headcount cost
• Organisations post-incident who have already been through a breach and never want to go through the chaos of finding responders under fire again
• Cyber insurers and brokers placing clients who need a credentialled IR firm on panel to satisfy policy requirements

Frequently Asked Questions