An incident response retainer is a pre-arranged agreement with a digital forensics and incident response (DFIR) firm. Contracts, rates and contacts are agreed in advance, so experts can start within an agreed time when a breach happens, rather than spending the first critical day on procurement. Good retainers also include preparation work, such as an IR plan review or a tabletop exercise, so the hours aren't wasted if no incident occurs.
Why the first hours matter
In ransomware and business email compromise cases, early decisions shape the outcome: what to isolate, which logs to preserve before they roll over, whether to engage law enforcement, when to notify the insurer, and what to tell customers. Negotiating an MSA and statement of work while systems are encrypted wastes time and pushes companies toward whoever answers the phone first.
Common retainer models
| Model | How it works | Best for |
|---|---|---|
| Zero-dollar / paper retainer | Terms and rates pre-agreed; you pay only if you use it | Companies that want the paperwork done, with no committed spend |
| Prepaid hours | A block of hours bought upfront with a guaranteed response time; unused hours often convert to proactive services | Organisations that want guaranteed priority plus readiness work |
| Insurer panel engagement | Your cyber insurer assigns or approves the DFIR firm and breach counsel | Insured companies, but check whether your preferred firm is on the panel |
| Bundled with managed security | IR included with MDR or MSSP services from the same team | Companies that want detection and response under one owner |
Retainers and cyber insurance
Many cyber policies require you to use panel vendors, or to get the insurer's consent before engaging a firm, or costs may not be covered. Before you sign a retainer:
- Read the incident-notification and vendor-consent clauses of your policy.
- Ask the DFIR firm which carriers' panels they're on, and whether they work under breach counsel (to preserve legal privilege).
- Record the insurer's hotline, the policy number and breach counsel's contact in your IR plan.
Our cyber insurance readiness assessment reviews these terms alongside the technical controls insurers require.
What a strong retainer includes
- A response-time commitment in writing: when a senior responder engages, by phone and in practice.
- Named senior leads, not just a hotline.
- Full DFIR scope: ransomware, BEC, cloud (Microsoft 365, Google Workspace, AWS), malware analysis, insider threats, and expert-witness support if litigation follows.
- Pre-incident work: IR plan review, a tabletop exercise, log-retention checks, and a contact tree.
- Onboarding: the firm learns your environment before an incident, not during it.
- Clear rates for overage hours, after-hours work and travel.
Questions to ask before you sign
- Who exactly will answer at 3 a.m., and what's their experience?
- Do you contain threats remotely (isolate devices, disable accounts) or only investigate?
- Can you work with our MSP and internal IT team?
- How do unused hours roll over or convert?
- Will you provide findings in a form suitable for regulators, insurers and courts?
What happens when you call: the first hour
| Time | What a prepared retainer client experiences |
|---|---|
| 0โ15 min | Hotline call answered; incident logged; senior responder assigned |
| 15โ30 min | Triage call: what's affected, what's been done, who is on the response team (IT, legal, leadership, insurer) |
| 30โ60 min | Immediate containment guidance (isolate hosts, disable accounts, preserve logs); evidence-collection plan; next check-in time agreed |
| Hours 1โ24 | Forensic collection and analysis; scoping; updates to counsel and insurer; recovery planning |
Without a retainer, the same first hour is usually spent finding a firm, agreeing terms and explaining the environment from scratch.
Build your IR plan around the retainer
- Put the retainer hotline, the account reference and the named lead at the top of the incident response plan.
- List who is authorised to activate the retainer, including after hours.
- Keep an "environment pack" ready: network diagram, critical systems list, admin contacts, log locations, backup locations and EDR console access.
- Rehearse it. A yearly tabletop using the retainer's real contact path shows whether the plan works.
When a retainer is worth it
Retainers are most valuable for organisations that handle regulated data (health, financial, personal), depend on systems that can't be down for long, carry contractual breach-notification deadlines, or have been targeted before. For smaller organisations, a zero-dollar retainer still removes the contracting delay at almost no cost.
Frequently Asked Questions
Do we need an incident response retainer if we have cyber insurance?
Often yes. Insurance pays for a response; a retainer ensures your chosen firm can start immediately. Check that the firm is acceptable to your insurer.
What does an incident response retainer cost?
It depends on the model. Zero-dollar retainers cost nothing until used; prepaid retainers are priced on the hours and response commitment purchased.
What happens to unused retainer hours?
Many firms let you convert unused hours into proactive services such as tabletop exercises, compromise assessments or plan reviews.
Can we engage an IR firm without a retainer?
Yes, but contracting during an incident costs time. Defensible responds to non-clients too, but retainer clients get priority and pre-agreed terms.
Set up your retainer before you need it. Defensible's DFIR team, led by former Stroz Friedberg senior leaders, offers retainers with pre-incident readiness built in. Set Up a Retainer. Active incident? Call (646) 349-4252.
