Cyber Incident Response
When an incident happens, the time you spend deciding who to call is time an attacker keeps moving. An incident response retainer means that call is already made.
What is incident response?
Incident response is the structured process of detecting, containing, eradicating and recovering from a security incident - a ransomware outbreak, a compromised account, a data exfiltration attempt - followed by the root-cause analysis that stops it happening again.
Most organisations only think about incident response once they're already in one. A retainer changes that: scope, contacts and response SLAs are agreed in advance, so containment starts immediately instead of after a negotiation.
What's included
Response Retainer & SLA
Incident response retainer with a guaranteed response SLA.
Containment & Eradication
Containment and eradication of active threats.
Forensic Investigation
Forensic investigation to establish what happened and how.
Root-Cause Analysis
Root-cause analysis and remediation recommendations.
Post-Incident Reporting
Post-incident report suitable for leadership and auditors.
Regulatory Notification Support
Support with regulatory breach notification obligations.
How it works
Detect & triage
Confirm the incident is real, assess scope and severity, and mobilise the response team.
Contain
Isolate affected systems and accounts to stop the incident from spreading further.
Eradicate & recover
Remove the threat and restore affected systems to a known-good state.
Review
Root-cause analysis and a post-incident report, so the same gap doesn't get exploited twice.
Questions we get asked first
What is an incident response retainer?
A pre-agreed arrangement that sets scope, contacts and response SLAs in advance, so when an incident happens, response starts immediately rather than being negotiated during the crisis.
How is this different from Managed SOC?
Managed SOC is the 24/7 monitoring and first-line response that catches and triages incidents as they happen; incident response is the deeper containment, forensics and recovery capability for confirmed, significant incidents - the two work together.
Do you help with regulatory breach notification?
Yes - where a breach triggers notification obligations under regulations like GDPR or DPDPA, we help you understand the requirement and prepare the notification.
Do we need a retainer, or can we call you during an incident?
We can respond on demand, but a retainer guarantees your response SLA and means we already know your environment before an incident happens, which materially speeds up containment.
Ready before you need it?
Tell us about your environment and we'll come back with a scoped incident response retainer proposal within two working days.