Incident Response Retainer

Confidence, clarity, and support — before you need it

Cybersecurity incidents are unpredictable, but your response doesn’t have to be. Our Incident Response Retainer gives your business peace of mind — with trusted experts ready to respond when you need help most. Retainer clients receive priority access, reduced hourly rates, and support beyond emergencies, including readiness planning, exercises, and forensic advice. We offer flexible tiers to suit your needs: from 10 hours/year for smaller organisations to full-service, round-the-clock coverage for larger clients. See our testimonials.

Incident Response Retainer

Service Overview

Our retainer service ensures you’re never alone in a crisis. It provides pre-agreed annual hours for response or advisory use, priority access to our DFIR consultants, and a structured onboarding process to reduce delays during incidents. It's insurance, but with added value — use your hours for proactive planning or expert support even when there’s no incident.

Business Benefit

  • Gain fast access to senior security responders
  • Reduce hourly costs compared to ad-hoc rates
  • Reassure clients, partners, and regulators with a formal response plan
  • Use hours flexibly — not just for emergencies
  • Improve security maturity through readiness activities

What's included

  • Prepaid annual hours for IR and advisory use
  • Priority SLA response (2–4 hour initial contact)
  • Onboarding and IR readiness checklist
  • Monthly summaries and annual hour review
  • Use hours for incident triage, threat hunting, playbooks, workshops, or policy review
  • Rollover up to 10% of unused hours each year

Our Engagement Process

  1. Client selects retainer tier (Access, Bronze, Silver, Gold)
  2. Onboarding call and document collection
  3. IR readiness review and SLA confirmation
  4. Monthly engagement check-ins (optional)
  5. Use of hours as needed — reactive or proactive
  6. Year-end review with rollover or renewal options

What we do

Preparedness Assessment

We begin by understanding your environment and documenting key contacts, systems, and procedures for faster response.

Flexible Hour Use

Hours can be used for advisory calls, threat hunting, policy reviews, IR playbooks, and more.

Incident Response Support

In the event of an incident, you receive priority triage and expert guidance from our DFIR team.

Annual Review

We provide a year-end report showing usage, outcomes, and any rollover hours available for next year.

Pricing & Timeline

Price: Access: £1800/year (10 hrs) • Bronze: £9600/year (60 hrs) • Silver: £18,000/year (120 hrs) • Gold: £33,600/year (240 hrs)

Estimated Timeline: Initial onboarding completed within 5 business days. Response SLA depends on tier (Access = best effort, Bronze+ = 2–4 hours).