How do incident response retainers and annual contracts actually work?

We had a minor business email compromise incident last year without a retainer in place. The first firm we reached out to turned us away, saying they prioritize contracted clients. The second one took us on as an emergency case, but billed at £450 an hour, and the total invoice came out to £14,000. Not to mention the operational downtime we suffered.

Look closely at what the vendor actually does during onboarding before signing anything. Are your system logs being forwarded to a central SIEM, and are forensic imaging tools already deployed? If no prep work is done beforehand, the first 24 hours of an incident will be wasted just trying to get them access credentials.

Don't blindly trust SLA response times. A clause promising response within 2 hours doesn't mean a SWAT team of engineers will be on-site or remediating in two hours. In many contracts, it just means an analyst will answer the phone and acknowledge the ticket within two hours. Get clear commitments on when actual technical containment starts.

Check your cyber insurance policy's approved incident response vendor panel. If the vendor you choose isn't on your insurer's approved list, your carrier might refuse to reimburse the response costs incurred during an incident.

When comparing quotes, insist on these 3 points: 1) What is the SLA for remote triage vs. on-site presence if physical access is needed? 2) Can unspent retainer hours be converted to tabletop exercises or security audits? 3) Are forensic evidence collection and regulatory reporting documentation included in the base rate?

we initially saw it as an unnecessary overhead too, but we framed it to the board as a cyber fire extinguisher. we had them run an annual tabletop exercise; watching the leadership team realize how unprepared they were during a simulated panic was worth every penny alone.

not knowing who to call during a breach is the ultimate nightmare. having a dedicated line ready to go is 100% essential, just make sure unused hours roll over or youre literally throwing budget down the drain.

In financial advisory, client data confidentiality and mandatory breach notification windows are extremely strict. Since you have regulatory reporting obligations in a breach, the forensic investigation report provided by an accredited IR retainer firm protects your firm when regulators come knocking.

Could you elaborate on that? Payment information changes are never verified through the channel they came from.

That's all, sorry if I went on too long.

Following.

We experienced almost the exact same thing last year. Taking measures without an inventory leaves doors you haven't seen open.

If I were you, I'd go this route.

To get into the details: Solutions that work at a small scale collapse when you grow; I learned this late.

I'm also curious if anyone does it differently.

There are three things to check when doing this. I mean payment information changes are never verified through the channel they came from.

Payment information changes are never verified through the channel they came from.

I have an objection here. If permission and scope aren't in writing, don't start that test.

Most incidents start with a leaked password, not a vulnerability.

Quick summary for newcomers: The answer varies greatly by industry; there is no one-size-fits-all rule.

Everything goes well for the first three months; problems arise in the fourth. Proven by experience.

Don't miss this: Just because everyone does it doesn't mean it's right.

When we decide without measuring, we always end up in the same place. Proven by experience.

We got stuck at the same point for a while. An untested backup is not a backup.

Everything goes well for the first three months; problems arise in the fourth. If you have questions, write them; I'll answer as best I can.

Following. Security isn't absolute; it's about making attacks not worth the effort.