2 November 2026 · 11 min read · By Michael van Mameren, Lead Penetration Tester (OSCP)
Incident response retainer: how it works, what it includes and how to size one against your regulatory clocks
An incident response retainer is a pre-negotiated contract that puts a digital forensics and incident response team on call before anything happens. This guide covers the commercial models, what a good retainer includes, how it compares with managed detection and response and with your insurer's panel, and what to verify before you sign.
What an incident response retainer is
An incident response (IR) retainer is a standing agreement with a security firm that guarantees access to digital forensics and incident response (DFIR) specialists when a breach, ransomware event or other security incident occurs. Scope, rate card, engagement procedure and the time commitment for getting a responder on the line are negotiated in advance, so the first hours of an incident go to containment rather than procurement, conflict checks and non-disclosure agreements. The alternative, calling a firm cold on the day, means emergency rates from whoever has capacity and no prior knowledge of your environment.
Retainers are standard for US public companies, regulated financial institutions, healthcare providers and defence contractors, and increasingly a condition of cyber insurance cover. The buyer is typically the CISO together with the general counsel, because the retainer sits where technical response, legal privilege and regulatory notification meet. NIST SP 800-61 Rev. 3, the 2025 revision of the incident response guidance aligned with NIST CSF 2.0, treats arrangements with external responders as preparation work in the Govern and Identify functions, not as a reaction once an incident is under way. A retainer is not monitoring and not insurance: it detects nothing and pays for nothing. It secures people, process and a time commitment.
The three retainer models, and the hybrid
Providers use different labels, but nearly every retainer on the market is one of these constructs or a combination of them.
Prepaid hours
You buy a block of DFIR hours, commonly for a 12-month term, at a committed rate. Unused hours can often be converted into readiness work such as tabletop exercises or playbook reviews. The risk is sizing: a ransomware investigation consumes far more hours than a small block covers, and unused hours at term end are lost unless the contract allows rollover.
Zero-dollar (no-cost) retainer
No upfront fee. You sign the master services agreement, agree a rate card and an engagement procedure, and pay only when you declare an incident. You gain contract certainty and a known rate. The engagement-start commitment is usually weaker than in paid models, and your call may sit behind paying clients during a widespread exploitation campaign.
Subscription (full-service) retainer
A fixed annual fee covers a defined response entitlement plus proactive services: a readiness assessment, named contacts, periodic tabletop exercises and an onboarding so responders know your network, identity provider and logging before an incident. The strongest time commitments and the model insurers and regulators are most comfortable with.
Hybrid and bundled
A smaller prepaid or subscription core with pay-as-you-go overflow, or a retainer bundled into a managed detection and response contract. The bundle makes sense when the same team already watches your telemetry: it removes the hand-off between the people who saw the alert and the people who run the investigation.
Time to engage, scope of DFIR and legal privilege
The clause that matters most is the time commitment for engagement start: how long after you declare an incident a qualified responder is working with you in your environment, and how long until a lead investigator is assigned. Providers express this in hours and distinguish remote engagement, the norm, from on-site presence, which takes longer and is usually optional. Check whether the clock starts at your call, at the provider's acknowledgement or at signature of a statement of work; those moments can be hours apart. Then check what the commitment is worth if missed: a service credit against a zero-dollar retainer is worth nothing.
Scope defines what responders will actually do. Full DFIR covers triage and scoping, forensic acquisition and preservation, log and endpoint analysis, threat actor identification, containment and eradication direction, recovery support and a written report. Narrower retainers cover remote triage only and bill forensics separately. Confirm coverage of cloud tenants (Microsoft 365, Google Workspace, AWS, Azure), identity providers, SaaS platforms and OT environments, since many standard scopes were written for on-premises endpoints.
In the United States, incident response is usually engaged through outside counsel, with the DFIR firm retained by the law firm so that investigative work product can be argued to fall under attorney-client privilege or the work-product doctrine. Courts have not consistently accepted that argument, particularly where the same firm already provided services under a pre-existing contract and the report circulated widely. Keep the counsel-directed investigation a separate, clearly scoped track and the technical remediation deliverables apart from the legal report. EU organisations face a different regime: GDPR Article 33(5) requires the controller to document every personal data breach regardless of privilege.
What a complete retainer includes
Compare proposals on these nine elements. A retainer missing more than two of them is a rate card, not a retainer.
1. Readiness assessment and onboarding
A review of your IR plan, logging coverage, EDR deployment, backup isolation and identity architecture, so responders know what evidence will exist on day one. Gaps found here cost far less to fix now than during an incident.
2. Playbooks and escalation contacts
Scenario playbooks for ransomware, business email compromise, cloud credential abuse and insider data theft, with named contacts on both sides, out-of-band channels and a decision matrix stating who may declare an incident.
3. Tabletop exercises
At least one facilitated exercise per year with executives, legal, communications and IT against a realistic scenario. This is where the plan meets the people who will execute it; the sibling guide on tabletop exercises covers the design.
4. Forensic acquisition and analysis
Memory and disk acquisition, cloud audit log export, timeline reconstruction, malware analysis and attribution to a known threat actor where the evidence supports it. Evidence handling must hold up in litigation and before a regulator.
5. Containment and eradication direction
Hands-on direction for isolating hosts, revoking tokens, rotating credentials, blocking command-and-control infrastructure and removing persistence, coordinated with your IT team, internal SOC or MDR provider.
6. Recovery support
Prioritising restoration, validating that backups are clean, deciding when systems are safe to reconnect, and watching for re-entry in the weeks after containment, when attackers return through the credentials nobody rotated.
7. Regulatory notification support
Factual input for the notifications your counsel files: which data, which systems, how many individuals, which jurisdictions. The clocks below run from awareness, so the retainer must produce defensible facts within hours.
8. Threat actor communication, where chosen
If your organisation and its insurer decide to engage with an extortion group: a specialist negotiator, sanctions screening against OFAC and EU lists, and payment logistics. Many retainers exclude this entirely; know the position before you need it.
9. Post-incident report and lessons learned
A written report with root cause, timeline, actions taken, evidence inventory and prioritised remediation, in a form your auditors, insurer and board can use, followed by a session to adjust controls, detections and playbooks.
Retainer vs managed detection and response vs cyber insurance panel
The three are often confused because all three put experts on the phone during an incident. They solve different problems, and most mature programmes hold all three.
| Aspect | IR retainer | Managed detection and response (MDR) | Cyber insurance panel |
|---|---|---|---|
| What it is | Pre-negotiated access to a DFIR team when you declare an incident | A continuous 24/7 service that monitors endpoint, identity and cloud telemetry and responds to what it detects | Approved breach coaches, forensic firms and PR agencies your insurer will pay for |
| When it starts working | At declaration of an incident | From onboarding, every day | After you notify the carrier and the claim is accepted |
| Who chooses the responders | You, in advance | Your MDR provider's analysts | The insurer, unless you negotiated your own firm onto the policy |
| Knows your environment beforehand | Yes, if onboarding and readiness work are included | Yes, through daily telemetry | Rarely; the panel firm meets you on your worst day |
| Detects incidents | No | Yes, that is its core purpose | No |
| Pays incident costs | No; it fixes the rate and the time commitment | No; response within the monitored scope is part of the service | Yes, within limits, sub-limits and exclusions |
| Best for | Organisations with a SOC or MDR that need surge forensics, privilege and regulatory support | Organisations without 24/7 detection and containment capability | Transferring financial risk; not a substitute for the other two |
How to size a retainer
Size the response entitlement against a realistic worst case, not an average. A business email compromise affecting one mailbox is a matter of a few investigator days. An enterprise ransomware event with domain-wide encryption, data exfiltration and notifications across several jurisdictions keeps a team of responders occupied for weeks. If you buy prepaid hours, model the ransomware case and check what happens when the block is exhausted: does the committed rate continue, and does the engagement-start commitment survive?
Then size the proactive side. Organisations with an immature IR plan should push hours toward readiness: plan review, logging gaps, a first tabletop exercise. Organisations with a mature SOC should push them toward forensic depth and privilege support. Finally, map the retainer to your footprint: countries, cloud tenants, subsidiaries with separate identity providers, OT sites. A practical test: ask the provider to describe the staffing on days one, three and ten of their last three engagements of the type you fear most. That answer tells you more than the rate card.
Contract checklist: what to verify before signing
Have counsel and the CISO review these clauses together, with the insurer's requirements on the table.
- Engagement-start commitment stated in hours, with a clear definition of when the clock starts and what remedy applies if it is missed
- Named lead responders or a defined seniority level, and the right to refuse substitutions below that level
- Scope statement covering endpoints, servers, cloud tenants, SaaS, identity providers, OT, and the subsidiaries and jurisdictions included
- Rate card for every role with overtime, weekend and travel terms, fixed for the term; treatment of unused prepaid hours (rollover, conversion or forfeit)
- Engagement under outside counsel: who contracts with whom, who owns the report, how technical deliverables are separated from the privileged investigation
- Evidence handling, chain of custody, data residency and retention periods for forensic images and logs, including GDPR terms for EU personal data
- Capacity terms: what happens when a mass-exploitation event means dozens of the provider's clients call on the same day
- Coordination clause with your MDR provider, MSSP or internal SOC: who leads, who holds administrative access, how hand-offs are logged
- Insurer alignment: confirm your carrier accepts the firm as a panel or pre-approved vendor, or add it to the policy at renewal
Regulatory clocks the retainer must help you meet
Notification deadlines run from the moment you become aware of or classify an incident, not from the moment you understand it. The retainer's job is to produce defensible facts inside these windows. Counsel confirms applicability per legal entity.
| Regime | Who it applies to | Clock | What is due |
|---|---|---|---|
| GDPR Art. 33 and 34 (EU) | Any controller processing EU personal data | 72 hours from awareness of a personal data breach | Notification to the supervisory authority; affected individuals without undue delay where the risk is high |
| NIS2 Art. 23 (EU) | Essential and important entities in 18 sectors | 24 hours early warning, 72 hours incident notification, final report within one month | Reports to the national CSIRT or competent authority for significant incidents; see our guide on managed security for NIS2 for how monitoring supports these deadlines |
| DORA Art. 19 (EU financial sector) | Banks, insurers, investment firms, payment institutions and others | Initial notification within four hours of classifying an incident as major and no later than 24 hours from awareness; intermediate report within 72 hours; final report within one month | Reports to the competent financial authority, in the Netherlands DNB or AFM |
| SEC Form 8-K Item 1.05 (US) | US-listed public companies | Four business days after determining the incident is material | Public disclosure of nature, scope, timing and material impact |
| HIPAA Breach Notification Rule, 45 CFR 164.400 to 164.414 (US) | Covered entities and business associates | Without unreasonable delay and no later than 60 calendar days from discovery | Notice to affected individuals and to HHS; to the media for breaches affecting 500 or more residents of a state |
| NYDFS 23 NYCRR 500.17 (US) | Entities licensed by the New York Department of Financial Services | 72 hours from determining a cybersecurity incident occurred; 24 hours for any extortion payment | Notice to the Superintendent, with a written explanation of any payment within 30 days |
| CIRCIA (US critical infrastructure) | Covered entities in the 16 critical infrastructure sectors, once the final rule is in force | 72 hours for covered incidents, 24 hours for ransom payments | Report to CISA |
How the retainer connects to MDR and to tabletop exercises
A retainer is the surge layer above continuous detection. Managed detection and response watches your telemetry around the clock and contains what it sees; the retainer brings forensic depth, privilege-aware investigation and regulatory support when an event exceeds what the monitoring team can close in its normal flow. The friction point is the hand-off. With two providers, define in both contracts who leads, who holds administrative access and how evidence collected by the monitoring team is preserved. With one provider, confirm that the response team is not simply the same analysts working overtime.
Tabletop exercises are where the retainer earns its proactive value. A facilitated exercise against a ransomware or business email compromise scenario tests the escalation contacts, the declaration decision, the counsel route and the notification clocks above, with the people who will have to act. Organisations that run one every year find the gaps in the retainer (a wrong contact, an excluded cloud tenant, an unclear declaration authority) before an incident finds them.
How HackersHub supports incident response
HackersHub is an Amsterdam-based offensive-security firm with more than ten years of experience that also runs managed security for enterprise clients in the EU and the US, delivered remotely with on-site travel where an engagement needs it. Our managed detection and response service combines 24/7 monitoring, SIEM and EDR management and detection engineering informed by our offensive work, with incident response support built into the service rather than sold as a separate emergency. Readiness reviews, playbooks and tabletop exercises are part of that onboarding, designed by the same testers who run red-team engagements against environments like yours. We do not sell a standalone retainer product; the response capability comes with the monitoring.
Service terms are set per client, in the managed detection and response contract, after a scoping conversation about your footprint, regulatory exposure and existing monitoring. We do not publish response-time figures or a price list, because both depend on scope. Reporting maps to the frameworks your auditors and supervisors use, including NIST CSF 2.0, ISO 27001:2022, NIS2 and DORA.
Frequently asked questions
Related guides
- Managed detection and response by HackersHub
- Cybersecurity tabletop exercise: how to design and run one
- Ransomware readiness assessment: what it covers
- MDR vs EDR vs XDR: tool or service?
- MSSP vs MDR vs SOC: the differences explained
- NIS2 compliance and penetration testing
- Managed security for NIS2: meeting the notification clocks
- DORA penetration testing and TLPT explained
- NYDFS Part 500 penetration testing requirements
Want responders who already know your environment?
Our managed detection and response service builds incident response support into daily monitoring, with readiness reviews, playbooks and tabletop exercises as part of onboarding. Talk to an expert about what your footprint and your regulators require.