The flagship
Guaranteed response. And nothing you pay for is wasted.
The classic problem with incident response retainers is paying for something you hope never happens. Ours removes it. You get a guaranteed response commitment, from a team that already knows your environment, on a direct line that isn’t public. And your hours are yours to use from week one: response first, and everything else our firm does with whatever the year doesn’t consume. A monthly checkpoint keeps the work pointed at whatever matters most right now.
Use your hours however you like, from week one.
Your annual pool covers incident response first; the terms hold a reserve so response is always there. Beyond that, direct your hours into any of our proactive services from the first week: Breach Readiness & Cyber Strategy, AI Security, Assessments & Compliance, or forensic readiness. At your monthly checkpoint we steer together: this month a playbook, next month a phishing-resistance push, the month after an assessment. If you need more hours, you buy them at your retained rate, not a stranger’s.
Response starts informed, not cold.
Before anything happens, we learn your environment: architecture, critical systems, key people, decision-makers. When you call, the responder isn’t asking what your network looks like; they already know. At the Embedded tier we maintain a documented response runbook for your environment, so hour one is spent responding, not orienting.
Three tiers. One promise.
Every tier includes: 24/7 answer on a direct line that isn’t public, triage beginning on that call, re-purposable hours, the monthly checkpoint, retained rates on additional work, and the annual Adversary Briefing.
Standby
Active remote response underway within 24 hours
60 hrs annual hours pool- Core environment immersion
- Written Adversary Briefing
- Re-purposable hours, monthly checkpoint
- Retained rates on additional work
Priority
Active remote response underway within 8 hours
120 hrs annual hours pool- Extended environment immersion
- Adversary Briefing presented to IT leadership
- IR plan and playbook review in year one
- Re-purposable hours, monthly checkpoint
- Retained rates on additional work
Embedded
Active remote response underway within 4 hours
240 hrs annual hours pool- Deep immersion with a maintained response runbook for your environment
- Adversary Briefing presented to your board
- Annual IR plan and playbook review
- Annual executive decision exercise
- Re-purposable hours, monthly checkpoint
- Retained rates on additional work
Larger or regulated environments: scoped individually.
Priced fairly. Explained plainly.
From $1,000/month for schools and not-for-profits (Standby, 12-month term). Commercial pricing is scoped to your environment and confirmed in writing before you commit.
12-month and 36-month terms are both available; longer terms cost less because they let us plan response capacity further ahead.
We cap the number of concurrent retainer clients so response commitments hold.
Our pricing principles, on every engagement
Scope fixed before work starts · inclusions in writing · no surprise extensions · rates agreed up front, even at 2am.
The first-quarter clause.
If after ninety days you don’t judge the retainer to have made you measurably better prepared, end it. Keep everything we’ve produced. We’d rather earn the renewal than hold you to a signature.
The Adversary Briefing.
Once a year: who targeted organisations like yours, how they got in, and what that means for where your next dollar goes. Written at Standby, presented to IT leadership at Priority, presented to your board at Embedded.
The fine print, out loud.
What counts as “active response underway”?
A responder hands-on: evidence preservation and containment in progress, not a ticket acknowledged. Triage guidance starts on the first call regardless of tier.
What happens to unused hours?
They don’t sit there. From week one you can direct them into readiness, assessments, AI security or forensic readiness work at your monthly checkpoint. The terms keep a reserve for response.
Does the retainer satisfy our insurer?
Increasingly, insurers expect an IR arrangement, and some price for it. We’ll happily talk to your broker about what your policy expects.
Why is there a client cap?
Because a response commitment we can’t keep is worse than one we never made. We cap concurrent retainer clients so the maths always works.
One call to scope it.
Twenty minutes with a senior responder: your environment, the right tier, and a written figure. No obligation.