Incident response.
The first 24 hours of an incident decide most of what happens next. A retainer means you're not negotiating a contract while the encryption clock runs.
Overview
The IR retainer establishes the relationship before it's needed: a signed master services agreement, an executed NDA, network architecture documented in advance, and a written runbook for the most likely incident classes (ransomware, business email compromise, insider misuse, cloud account takeover). When the alert fires, response begins on the call. There's no procurement, no scoping delay.
What's included
- Pre-incident readiness: tabletop exercises, runbook authorship, evidence collection plan
- Triage and severity classification
- Containment and eradication coordination with internal IT or MSP
- Digital forensics and root-cause analysis
- Indicator-of-compromise development and threat intelligence enrichment
- Breach notification support in coordination with breach counsel
- Post-incident hardening recommendations
What you get
- Runbook. Authored at retainer onboarding, reviewed annually.
- Tabletop exercise. One per year, scenario tailored to the business.
- Live response leadership. Incident commander on every material event.
- Final incident report. Timeline, IOCs, root cause, recommended hardening, formatted for breach counsel and audit.
Retainer tiers
- Standby. Pre-incident relationship, runbook, tabletop. Response within 4 business hours.
- Active. Standby plus quarterly tabletop and warm IOC feed. Response within 1 hour, 24×7.
- 24×7. Active plus dedicated incident commander, monthly threat brief, on-site readiness. Response within 1 hour, 24×7.
Common questions
What if we are mid-incident and not on retainer?
Call anyway. We take emergency engagements with a minimum hour commitment, billed in 1-hour increments. Retainer clients are always served first.
Do you handle breach notification?
We support it. We don't provide legal advice, but we work alongside breach counsel to assemble the technical timeline, IOCs, and impacted-record analysis they need to file.
Do you coordinate with cyber insurance?
Yes. We work with the insurer's incident response panel and forensic counsel directly when the policy requires it.