Incident Response Retainer Costs: Prepaid, Zero-Dollar and Subscription

An incident response retainer buys two things: a guaranteed response time and a rate locked in before you are desperate. Both matter most at the moment you have least leverage.

Buying response during an incident means paying surge rates to a firm that has never seen your environment, and waiting while contracts and conflict checks clear. Firms are busiest exactly when you need them, because attack campaigns hit many organisations at once.

The three structures

Zero-dollar retainers are underused. No fee, guaranteed response times, locked rates, and the provider gets right of first refusal. For an organisation with no budget line for this, there is almost no argument against having one. The provider's economics work because a proportion of holders eventually have an incident.

Prepaid hours suit organisations that will use the hours regardless, because good providers let unused hours go to proactive work — tabletops, readiness reviews, playbook development. That converts an insurance premium into something with a return.

Subscription suits organisations wanting a defined service level and predictable accounting.

What the price reflects

The terms that decide whether it helps

This is where retainers differ most, and where the cheap ones reveal themselves:

• When does the clock start? It should start when you declare an incident, not when the provider acknowledges, triages or assigns.
• What is the response? A phone call from an analyst is not the same as an engaged team.
• Are rates protected during surge periods? During a widespread campaign, unprotected rates rise exactly when you need help.
• Do unused hours convert to proactive work, or simply expire?
• Is the scope limited by system type? Some exclude OT or specialised platforms entirely.
• Who actually shows up — named senior responders, or whoever is free?

The insurance interaction

Check your cyber policy before signing. Many insurers require you to use a responder from their approved panel, and engaging someone else can reduce or void a claim. If your preferred provider is not on the panel, ask the insurer to add them — usually possible in advance, never mid-incident. See in-house versus retained response.

Making it worth the money

An unexercised retainer is a phone number. Before you need it:

1. Run a tabletop using retainer hours, so they learn your estate and you learn their people
2. Provide network diagrams, asset inventory and log sources in advance
3. Test the activation path, including out of hours
4. Agree data handling — forensic images contain sensitive data, so the contractual terms need to exist
5. Agree escalation criteria so nobody debates whether to call

See tabletop exercises for how that first item usually runs.

Where to start

If you have no retainer, get a zero-dollar one. It costs nothing, takes a few weeks to put in place, and converts the worst hour of a bad year from a procurement exercise into a phone call.

What it costs without one

The comparison that justifies the spend is not retainer fee against zero. It is retainer fee against what an unretained response actually involves:

The second and fourth rows are the expensive ones. During a broad campaign the firms you want are fully committed to organisations that signed paperwork months earlier.

Scaling the commitment to the organisation

• Small organisation, low complexity — a zero-dollar retainer with defined response times is usually sufficient
• Regulated, or holding sensitive data — prepaid hours, with unused hours converting to a tabletop each year
• Clinical, OT or 24/7 operations — a subscription with a tight response commitment and a provider that understands your operational constraints
• Multi-site or multi-jurisdiction — confirm geographic reach and whether on-site attendance is included

GuardsArm offers incident response retainers including tabletop facilitation from retainer hours. See incident response services or book a scoping call.