Guaranteed response times. Pre-negotiated rates. Experienced practitioners who already know your environment — ready before you need them.
When ransomware hits at 2am on a Friday, the last thing you want is to be Googling for incident responders, negotiating contracts under duress, and briefing a team who have never seen your environment. That delay — measured in hours — is where the real damage happens.
An IR retainer removes all of that friction. We are already engaged, already briefed, and already contractually committed to respond. When the call comes, we move.
For organisations who want the safety net without dedicated hours. Dark web monitoring included as standard.
Pre-purchased hours, faster SLAs, and a named lead consultant who knows your environment.
Full embedded partnership. Your dedicated team is on standby with deep environment knowledge and priority access to all capabilities.
We keep onboarding deliberately lightweight. Most clients are fully onboarded within two weeks:
Our retainer clients typically fall into one of three categories:
| IR Retainer | Ad-Hoc Emergency | |
|---|---|---|
| Response time | < 1 hour guaranteed | Best effort (4–8 hours typical) |
| Day rate | Reduced retainer rate | Emergency rate (+40% premium) |
| Priority queue | ✔ Always first | Subject to availability |
| Monthly readiness check | ✔ Included | Not available |
| Annual tabletop exercise | ✔ Included | Additional cost |
| Team familiarity | ✔ We know your environment | Starting from zero |
The bottom line: Organisations with IR retainers typically spend 40–60% less on total incident costs — not just in fees, but from faster containment reducing business impact.
“When an attack happens at 2am on a Sunday, you want a team that already knows your network, your people, and your recovery priorities.”
Unused hours roll over for 12 months. Any unused hours at contract renewal are credited against the following year's retainer fee, not forfeited.
Guardian tier includes negotiation advisory as standard. Watchful and Vigilant tiers can add negotiation capability at a pre-negotiated rate. We never charge success fees — our incentive is always to minimise your loss, not maximise the settlement.
We have existing panel arrangements or documented relationships with several major cyber insurers. We can provide documentation confirming your retainer status for inclusion with your policy submission. If your insurer requires specific qualification evidence, contact us — we will work directly with them.
SLA clock starts from first contact via your dedicated retainer line. Acknowledgement is a qualified response from a named consultant — not an automated ticket. Mobilisation means a senior practitioner is actively working your incident, whether remotely or en route to site.
Yes — you can upgrade at any time (effective immediately). Downgrade requests are honoured at the next annual renewal point.