If a serious cyber incident would significantly impact your business, and you don't have incident response capability in-house, a retainer makes sense. It guarantees expert help is available when you need it most—not scrambling to find someone during a crisis.
Quick answer: If a serious cyber incident would significantly impact your business, and you don't have incident response capability in-house, a retainer makes sense. It guarantees expert help is available when you need it most—not scrambling to find someone during a crisis.
What Is an IR Retainer?
An incident response retainer is a pre-arranged agreement with a security firm to provide help during cyber incidents. You pay a fee (monthly or annual) to guarantee:
- Availability: They'll respond when you call
- Response time: Agreed SLAs (often 2-4 hours)
- Pre-engagement: They already know your environment
- Priority: You're not competing with other victims for attention
When You Need One
You don't have IR capability in-house
Most SMEs don't have dedicated security teams, let alone incident response specialists. When ransomware hits at 2am, who do you call?Incidents would be business-critical
If a cyber attack could:- Stop operations
- Expose customer data
- Trigger regulatory notification
- Cause significant financial loss
Your cyber insurance requires it
Many policies now require documented incident response capability. A retainer satisfies this requirement.You're in a high-risk sector
Defence, critical infrastructure, financial services, healthcare—sectors with regulatory requirements and attractive targets.You've had incidents before
If you've experienced attacks and know the pain of response without preparation, a retainer prevents repeating that experience.What a Good Retainer Includes
Pre-incident
Onboarding:
- Understanding your environment
- Documenting key systems and contacts
- Reviewing existing defences
- Establishing secure communication channels
- Incident response plan review
- Runbook development
- Contact list verification
- Regular check-ins
During incident
Response:
- Guaranteed response time (2-4 hours typical)
- 24/7 availability
- Remote and on-site capability
- Experienced responders
- Triage and containment
- Investigation and forensics
- Malware analysis
- Recovery support
- Evidence preservation
Post-incident
Follow-up:
- Root cause analysis
- Lessons learned
- Remediation recommendations
- Report for insurance/regulatory purposes
Retainer Models
Fixed fee + hourly
Structure: Annual retainer fee + hourly rate for actual incidents
Benefit: Lower retainer cost, but incidents cost extra
Best for: Organisations expecting few incidents
Hours bank
Structure: Pre-purchased hours (e.g., 40 hours/year) for incidents
Benefit: Predictable costs, hours available when needed
Best for: Organisations wanting budget certainty
All-inclusive
Structure: Fixed fee covers retainer plus incident response
Benefit: Complete cost predictability
Best for: High-risk organisations expecting to use the service
What to Look For
24/7 availability: Incidents don't wait for business hours
Response time SLA: Written commitment, not just best effort
Relevant experience: Responders who've handled your type of incident
Communication: Clear escalation and status reporting
Insurance coordination: Experience working with insurers
Legal support: Ability to work with legal counsel, preserve privilege
Geographic coverage: On-site capability if needed
Cost Considerations
Typical retainer costs: £10,000-50,000+ annually depending on scope
Compare to:
- Cost of fumbling through an incident without help
- Regulatory fines for poor response
- Extended downtime from slow recovery
- Reputation damage from mishandled breach
Our Approach
We offer incident response support:
For managed clients: IR capability is included. We already know your environment, have access, and can respond immediately.
Standalone retainers: For organisations with other IT support who want IR capability on standby.
Emergency response: We take calls from organisations mid-incident, but response is faster and cheaper with a pre-existing relationship.
---
about retainers.
---