Home / Services / Incident response
IR
Incident response
Prepaid retainers with a one-hour response, and emergency response for companies that call us on their worst day.
A retainer buys you a phone number that is answered by an incident responder, a one-hour response commitment, prepaid hours at a lower rate and an onboarding that means we already know your environment when the call comes. No retainer? Call anyway. Emergency engagements start within four hours, with a 20-hour minimum, and we work with your cyber insurer's panel requirements and counsel.
from $12,000 per year
What is included
- 24×7 hotline answered by an incident responder, not a dispatcher
- One-hour remote response on the retainer; four hours for emergency engagements
- Scoping, containment, eradication and recovery with your IT team
- Forensic imaging and log preservation to an evidentiary standard
- Ransomware negotiation support and restoration planning
- Coordination with counsel, insurer and law enforcement; breach notification support
What you receive
- Incident response plan and contact tree (retainer onboarding)
- Daily situation reports during an incident
- Final report: timeline, root cause, scope of access, data affected, remediation
- Lessons-learned session and a hardening plan
How it runs
- 1
Call
Hotline, email or portal. A responder is on the line and scoping within the hour.
- 2
Contain
Stop the spread: isolate, block, revoke, reset, with evidence preserved first.
- 3
Eradicate and recover
Remove persistence, rebuild what cannot be trusted, restore from clean backups in priority order.
- 4
Report
Timeline and root cause for leadership, counsel and the insurer; a plan so it does not happen twice.
Questions about incident response
Do we need a retainer if we have an MDR plan?
Enterprise plans include retainer-level response. Essential and Professional clients get a 25% discount on the retainer, and many take it for the prepaid hours and the tabletop exercise.
Do you work with our cyber insurance carrier?
Yes. We are on several carrier panels and work with the rest as a client-selected vendor. Call your carrier first if the policy requires it; we can join that call.
Can you negotiate with a ransomware group?
We support negotiation and payment decisions with counsel and the carrier, including sanctions screening, but we do not recommend paying and most of our clients do not. Recovery planning starts in parallel.
Other services
Scope incident response for your environment.
Thirty minutes with the people who will do the work, and a fixed price in writing the same day.