Incident response retainer · DFIR
When it happens, your first call is not your first conversation.
A retainer gives you named responders who already know your environment, with hours and response times agreed in advance. Forensics follows, so legal, insurers and regulators get evidence they can rely on.
Under attack and not yet a client? Use the contact form or email us and mark it urgent. Retainer clients escalate through their named lead and the channel agreed at onboarding.
ops.example.com/ir/ENG-0417
Simulated environment, real workflow.
Operating model
Declare, contain, investigate, recover.
Most of the value of a retainer is spent before the incident: onboarding, a tested plan and contacts that already work.
Coverage
- Availability
- 24/7: a responder on critical incidents in under 15 minutes
- Hours
- Pre-paid block sized in your retainer, usable for incidents or readiness work
- Team
- Incident commander, forensic analysts and a communications lead
- Onboarding
- Environment review, contact tree and evidence-collection access set up in advance
- AI incidents
- Prompt-injection abuse, agent and tool misuse, and model or training-data leakage, worked with our AI red team
- Works with
- Your counsel, your insurer and its panel requirements
Escalation flow
- 1
00:09 · responder scoping
Declare
You escalate through your named lead and the channel agreed at onboarding. A responder scopes the situation and opens an engagement under your retainer.
Critical: responder in under 15 minutes, 24/7
- 2
+3h · spread stopped
Contain
We stop the spread first: isolate systems, cut attacker access and preserve evidence before it is lost.
Remote start: per retainer terms
- 3
+2d · root cause found
Investigate
Forensic analysis of hosts, identities, email and cloud logs to establish what happened and what was taken.
On site: when the case needs it
- 4
+3w · report delivered
Recover and report
Guided recovery, then a written report with timeline, root cause and fixes, fit for legal and insurers.
Report: on the timeline agreed at close
Clock times show one illustrative case. Your SOW sets the target for each stage.
What we commit to in your contract
Each metric gets a target per severity in your statement of work (SOW), and every monthly review reports our times against it.
- Critical response
- Under 15 minutes, 24/7Clock starts: you escalate through your agreed channelClock stops: a responder is scoping with you
- Remote start
- Clock starts: Incident declaredClock stops: remote containment and forensics begin
- On-site arrival
- Clock starts: On-site requestedClock stops: responder at your location
How each severity reaches you
- Critical
Remote work starts: Timed, retainer target
On site: When the case needs it
- High
Remote work starts: Timed, retainer target
On site: On request
- Medium
Remote work starts: Next business day
On site: Not applicable
- Low
Remote work starts: Scheduled
On site: Not applicable
A case, start to finish
Containment in the first hours. A report your counsel can use.
A typical ransomware case on retainer: containment and forensics start together, recovery overlaps the investigation, and the report closes the case.
- Done
- In progress
- Planned
Week
| Phase | Start week | End week | Status |
|---|---|---|---|
| Declare + contain | 0 | 1 | Done |
| Forensics | 0 | 3 | In progress |
| Eradicate | 1 | 2.5 | Done |
| Recover systems | 2 | 4 | In progress |
| Report for counsel | 3.5 | 5 | Planned |
| Lessons learned | 5 | 6 | Planned |
Simulated environment, real workflow.
First hour
Contain first. Then explain.
The opening hour of a retained incident follows a written runbook, so nothing waits on a contract or an access request.
Access, contacts and evidence collection are set up at onboarding, not during the incident.
AI incidents are in scope: prompt logs, tool calls and retrieval history are preserved like disk images.
Root cause goes back to consulting as a retest, and to the SOC as a detection.
Every month
What lands on your desk.
Unused hours are not wasted. They go into readiness work, reported every month.
Retainer statement
Hours used, hours left and what they were spent on.
Incident response plan
Your plan, kept current as people, systems and vendors change.
Tabletop exercises
Scenario sessions with leadership and technical teams, at a frequency set in your retainer.
Compromise assessment
A periodic check for signs of an attacker already inside.
Readiness checklist
Logging, backups and access needed for an investigation, with the gaps listed.
Threat briefing
Attacks hitting companies like yours, and whether you are exposed to them.
FAQ
Questions buyers ask us.
Anything else, ask an expert. You will talk to an analyst, not a script.
What is the difference between a retainer and calling when something happens?
With a retainer the contract, access and context are already in place, so work starts in minutes rather than days. Rates are usually lower too.
How much does a retainer cost?
Retainers start from $15,000 a year. Unused hours convert to readiness work.
What happens to unused hours?
They can be spent on readiness work such as tabletop exercises, plan updates or a compromise assessment, under your retainer terms.
Do you work with our cyber insurer?
Yes. We coordinate with your insurer and counsel.
Is your forensic evidence usable in court?
We follow documented chain-of-custody procedures and hash every item we collect. Your counsel decides how it is used.
Do you handle incidents involving AI systems?
Yes. If an LLM app or agent was manipulated through prompt injection, misused a tool, or leaked data from a model or retrieval store, we investigate it like any other incident: preserve prompts, tool-call logs and retrieval history, establish what was exposed, and hand the fix to our AI red team to retest.
Can you help if we are not a customer?
Yes. Use the contact form or email our security team and mark it urgent. A retainer makes the first hours faster, but we do take emergency engagements.
Set up the call before you need to make it.
We walk through retainer options and what onboarding involves for your environment.