Incident Response Retainer
A breach is a procurement problem before it is a technical one. The retainer settles the scope, the response commitment, the contacts and the escalation path while everyone is calm, and one incident a year is already paid for, so the call at 2am starts with investigation instead of a purchase order. It is priced as a subscription rather than by the emergency hour, which is what makes it sellable: you know the cost before the incident, your customer knows it too, and it renews without a second conversation. You hold the retainer, not your end customer, which means you can point it at whichever of them needs it.
$3,675USDannual retainer
List $4,900 — what your customer pays. You keep the difference. · 25% off list
- Priced by
- annual retainer
- Delivered as
- Your brand, your template
- Client access
- Scoped, granted by your customer
Scoped before you quote, not after you have sold it
One incident a year is included in the fee. This is a subscription, not a deposit against an emergency hourly rate nobody can price in advance, and what counts as one incident is defined in the agreement rather than argued about afterwards.
The response commitment is four hours, counted from the moment you raise the call, and the escalation number is answered by the same 24/7 SOC shift rather than a web form that gets read the next working morning.
Work beyond the included incident is billed at the hourly rate written into the retainer, fixed on the day you sign rather than set while the incident is running, so an overrun is an invoice you can predict.
Scope and rules of engagement are signed at retainer time. Nothing about authority, access or price has to be settled while systems are down.
Forensic work is documented to an evidentiary standard, with chain of custody, hashes and timestamps, and the findings are written twice over: a technical account for the engineers and a plain one your account manager can take to a board.
You remain the contracted party throughout. Our responders work behind your incident commander and are never introduced to your customer.
You quote it, we operate it, you deliver it
Your price is the published list price minus 25%, on every line in the catalogue. You decide what your customer pays and keep the difference, so your margin is settled before the quotation leaves your office.
Our engineers work it from Bangkok on UTC+7, against a methodology that is written down rather than improvised per customer. A senior engineer reads every finding before it leaves the building, because you are the one who has to defend it.
Findings, reports and escalations reach you in your template with your logo on them. Your customer talks to you, and our name is not on the ticket.
What a partner checks before putting this on their price list
Why sell a retainer instead of quoting the emergency?
Because an emergency cannot be quoted. Hourly incident work has no price until the day your customer needs it, which is the day they are least able to argue about it. The retainer turns the same capability into a line you sell once and collect every year, at a cost you knew before the incident and can mark up like any other subscription. You only pick up the phone to us when something actually happens.
Can we hold one retainer across several customers?
Yes — the retainer is held with you rather than with an end customer, so you can direct it, and the incident it includes, at whichever of your customers has the problem. That is the main reason it is worth buying as a partner rather than passing the problem to your customer to solve alone.
What are we paying for in a year when nothing happens?
The settled scope, the signed rules of engagement, the named contacts and the response commitment — all the work that otherwise gets done badly, at speed, on the worst day of the year. Readiness work such as a playbook review or a tabletop with your engineers is commonly attached to the retainer, and whether an unused incident carries into the following year is a term of the agreement, so settle both when you sign.
Who is the incident commander, you or us?
You are, by default, with our responders supplying the forensics and containment capability behind your commander. If you would rather we drive the technical response, that is agreed in the retainer in advance — still under your name and your customer relationship.
Does the retainer cover legal notification or PR?
No — we cover technical investigation, containment support and the written findings only. Regulatory notification, legal advice and communications belong to your customer and their counsel, and we give you the factual timeline they will need.
Do you negotiate with ransomware operators?
No — we do not negotiate with or pay threat actors under any circumstances. We handle investigation, containment and recovery support, and will work alongside whichever specialist your customer or their insurer appoints for that part.
What do you need from us when an incident starts?
The affected environment, a contact who can authorise containment actions, and access arranged through you. Scope, rate and authority were all settled when the retainer was signed and the incident itself is already paid for, so the first hour goes into the investigation rather than into procurement.
Pick one customer. We will run it for 60 days.
Choose a customer you already serve. We deliver Managed Exposure on their domain for two months, in your template, at no cost — so you can see exactly what your customer would receive before you sign anything.
Apply as a partner