Incident Response Retainer
An incident response retainer is a pre-arranged agreement with a digital forensics and incident response (DFIR) firm. Terms, rates and contacts are agreed in advance, so experts start work when a breach happens instead of after a day of procurement. With Defensible, a senior responder engages within one hour of your call.
Founded by former Stroz Friedberg leaders. 24/7 hotline (646) 349-4252.
Why Set Up a Retainer Before You Need One?
In ransomware and business email compromise cases, early decisions shape the outcome: what to isolate, which logs to preserve before they roll over, when to notify the insurer and what to tell customers.
Negotiating a contract while systems are encrypted wastes time and pushes companies toward whoever answers the phone first. A retainer moves that work to a calm day.
Procurement delays
Legal and finance review a new vendor while the attacker is still active.
Lost evidence
Logs roll over and volatile data disappears before anyone collects it.
Explaining from scratch
A new firm has to learn your environment during the incident.
Insurer conflicts
Engaging a firm without insurer consent can affect coverage.
What Does an Incident Response Retainer Guarantee?
A retainer guarantees access, not outcomes. You know who to call, how fast they will engage, what they cost and what they can do, before you need them.
A senior responder engages within one hour of your call to our 24/7 hotline.
Contract, rates and scope settled in advance, so work starts immediately.
Ransomware, BEC, cloud, malware analysis, insider threats and litigation support.
We learn your systems and contacts before an incident, not during it.
What Does the Retainer Cover?
Readiness work before an incident, and the full Defensible DFIR team during one.
Before an Incident
Retainers can include pre-incident work, so the relationship adds value even in a quiet year. Your agreement sets the scope.
- IR plan review — Roles, severity levels, decision rights and contact trees
- Tabletop exercise — Practice the response before you need it
- Readiness checks — Log retention, backups and EDR coverage reviewed
During an Incident
The team that responds has investigated incidents for years. They contain the threat, recover operations and document what happened.
- Containment — Isolate devices, disable accounts and stop the spread
- Forensic investigation — Court-admissible evidence collection and analysis
- Recovery support — Restore operations and close the gaps that let the attacker in
When Is a Retainer Worth It?
Retainers are most valuable when downtime or a data breach would be expensive, regulated or public.
Health, financial and personal data with notification deadlines.
Operations that can't be down for long.
Customer contracts with breach-notification terms.
Law, finance and PE-backed companies that attract BEC and ransomware.
What Happens When You Call the Hotline?
Call (646) 349-4252, any time. A senior responder engages within one hour.
- STEP 1Call
The incident is logged and a senior responder is assigned.
- STEP 2Triage
What's affected, what's been done and who is on the response team.
- STEP 3Contain
Immediate guidance to isolate hosts, disable accounts and preserve logs.
- STEP 4Investigate
Forensic collection, scoping and updates to counsel and your insurer.
- STEP 5Recover and report
Recovery support and a detailed findings report.
What Is Defensible's Response-Time Commitment?
A senior responder engages within one hour of your call to our 24/7 hotline, (646) 349-4252. Not a ticket queue: a senior person who can make containment decisions with you.
Put the hotline, your account reference and the people authorized to activate the retainer at the top of your incident response plan, and rehearse the contact path in a tabletop.
How Does a Retainer Work With Your Cyber Insurer?
Many cyber policies require you to use panel vendors, or to get the insurer's consent before engaging a firm, or costs may not be covered. Read the vendor-consent and notification clauses before you sign a retainer.
Ask your broker whether your preferred firm can be approved, and record the insurer's hotline, policy number and breach counsel's contact in your plan. Our cyber insurance readiness assessment reviews these terms alongside the controls insurers require.
Containing a Server Breach for a vCISO Client
- Customer: A long-term vCISO client in the nonprofit sector
- Challenge: Suspicious activity on an internet-facing Confluence server shortly after it was migrated to Microsoft Azure
- Why it went faster: Defensible already knew the environment and controls, so the team acted quickly
- Result: Incident confirmed as limited in scope and contained, with no signs of attacker persistence or spread
"I've worked with Defensible for years, and they're in a different league from other MSPs and security providers. Their team brings unmatched expertise, sharp strategic thinking, and a level of commitment that's rare in this industry. When it comes to protecting your business and making smart, confident decisions, Defensible is the partner you want in your corner."
— Max Everett, CISO, Shaw Industries · Former CIO at The White House and U.S. Department of Energy
Frequently Asked Questions
What is an incident response retainer?+
A pre-arranged agreement with a DFIR firm. Terms, rates and contacts are settled in advance, so responders can start immediately when an incident happens, rather than after a day of contracting.
How fast does Defensible respond?+
Our 24/7 hotline is (646) 349-4252, and a senior responder engages within one hour. That responder then coordinates directly with your team to begin containment and investigation.
What happens to unused retainer hours?+
Unused hours terms are set in your retainer agreement. Ask us during scoping how hours can be applied, including to readiness work such as a plan review or tabletop exercise.
Will my cyber insurer let me use Defensible?+
It depends on your policy. Many policies require panel vendors or insurer consent before you engage a firm. Check the vendor-consent clause and talk to your broker before an incident. Defensible works with carriers and breach coaches to meet insurance and legal requirements.
Do we need to be a managed services client?+
No. You don't need to be an existing client to engage our DFIR team. If you already use Defensible's managed security, incident response sits with the same team that monitors your environment.
Can you work with our IT team and outside counsel?+
Yes. Our responders work alongside internal IT, your MSP, legal counsel and insurers, and provide the documentation needed for insurance claims and post-incident reporting.
Know Who You'll Call Before You Need To
Put terms, contacts and a one-hour senior response in place now. If you have an active incident, call (646) 349-4252.