Incident response retainer
When something gets past the watch, our response lead takes over within the hour, with hours already paid for.
Coverage
Response lead on the phone within 1 hour
Price
40 hours a year in the top plan, or $325 an hour
The watch contains most incidents in minutes. A few need days: a forensic image, a conversation with your insurer’s breach panel, a careful rebuild. That is what the retainer is for.
The first hour
Our response lead calls you and your insurer’s hotline if the policy requires it.
Evidence is preserved before anything is rebuilt.
A plain written status goes to your leadership every four hours until it is over.
Included every year
One tabletop exercise with your leadership team, built around your own systems and a scenario your insurer cares about. Most clients run a ransomware Friday.
Rates
Watch, Hunt and Respond includes 40 hours a year and Watch and Hunt includes 10. Extra hours are $325 each, billed in quarter hours, and quoted in writing before they start.
Is it right for you?
In a 30 minute risk review we look at what you run today and tell you whether this service would change anything. If it would not, we say so.
Other services in the plan
Managed detection and response
24/7, a person on it within 15 minutes
Managed SIEM and log retention
13 months of searchable logs
Vulnerability management
Scanned monthly, reviewed on the call
Microsoft 365 and identity monitoring
Every sign-in and rule change, day and night
Virtual CISO and compliance
4 hours a month from one named person
Thirty minutes to find out who is watching your network tonight.
Bring your last insurance questionnaire or audit finding. We tell you in plain words where you are exposed after hours and what closing it would cost, then send a written quote within two business days.