In a serious incident, minutes are expensive. With our IR/DFIR retainer the contract is signed, the SLA is agreed and a prepaid hour bank is waiting before the alarm goes off. One number, 24/7. A team that already knows your environment. A defensible timeline from minute one.
Activation
24/7 SLA with emergency channel
Model
Prepaid hour bank
Frameworks
Evidence for DORA, NIS2, ISO 27001
An incident response retainer isn't an insurance policy — it's pre-activated capability. We sign the contract before the incident, prepare your environment, agree the SLA and leave a hour bank ready to consume the moment it's needed.
When the bad day arrives — and statistically it does — organisations that improvise lose the first hours arguing over budget, NDAs and internal sign-off. With a retainer, triage and containment start in minutes, not days.
And the retainer doesn't just contain the incident. It delivers a defensible timeline, a technical report and an executive one, preserved evidence and hardening recommendations. Everything your board, insurer, auditor or supervisor will ask for afterwards.
Key point:
A retainer isn't measured by how many times you activated it. It's measured by how quickly it stopped the incident — and the shape the organisation was in afterwards.
24/7 emergency channel, a contractual first-contact SLA and triage that starts with evidence preserved from minute one.
Hours booked in advance for IR, DFIR, reactive threat hunting, forensics and advisory. No waiting for purchase orders while the network burns.
We don't wait for the incident. We know your environment, your privileged identities, your playbooks and your on-call list before the phone rings.
We coordinate with your cyber insurer, legal, comms, board and supervisor. Clean reporting, a timeline that holds up and evidence that survives scrutiny.
End-to-end cover for the incidents that actually land today across financial services, public sector and industry.
Containment, encryption triage, vector analysis, prioritised recovery, informed pay/no-pay guidance and tight coordination with your insurer.
Session revocation, identity forensics in Entra ID, malicious inbox-rule discovery, post-incident hardening and a clean audit trail.
DFIR across initial vector, persistence, lateral movement, exfiltration and root cause — with reporting that holds up to regulatory scrutiny.
Controlled analysis, forensic preservation, chain of custody and support for legal or disciplinary action when required.
A serious retainer isn't just a phone number with an SLA. It's contracts, readiness, reporting, evidence and an annual review.
Signed retainer with activation SLA, scope, escalation matrix, named responsibilities and contract term.
Prepaid hours consumable for incidents, forensics, reactive hunting, advisory or exercises — with transparent usage reporting.
Onboarding session, collection of critical information, contacts, escalation playbooks and validation of the emergency channels.
A clear procedure so any authorised person can invoke the retainer in seconds — inside business hours or at 3am.
After each activation: timeline, evidence, incident classification, actions and recommendations for the board and the auditor.
Usage, activations, lessons learned, shifts in exposure and recommendations for the next cycle.
From contract to first real incident. Step by step, no surprises when it matters.
Agree on scope, SLA, hour bank, applicable frameworks (DORA/NIS2/ISO) and sign with 24/7 cover in place.
We capture critical architecture, privileged identities, points of contact, cyber-insurer details and comms channels.
We validate the emergency channel actually works, measure real response times and fine-tune the playbook before the first real incident.
Retainer is armed. Your team calls a single 24/7 number and the protocol kicks off with a full audit trail from minute one.
Triage, containment, DFIR, eradication, recovery — and comms with the board, legal, the insurer and, where relevant, the supervisor.
Root cause, final report, detection and hardening improvements, plan update, and reporting for committee and audit.
Illustrative examples drawn from the client profile we work with. Details are anonymised to protect confidentiality.
Regulated estate under DORA/NIS2 obligations, with an active cyber-insurance policy.
Activation
Activation triggered by ransomware detection at a regional subsidiary, out of office hours.
Outcome
Triage and isolation inside the hour, DFIR running in parallel, coordination with the insurer and legal, recovery prioritised by service criticality, and a timeline delivered to the supervisor that held up under review.
Mixed on-prem and cloud footprint, with external maintenance providers in the picture.
Activation
Suspected BEC fraud — attempt to redirect payments to external accounts.
Outcome
Revocation of compromised sessions, M365 forensics, malicious inbox rules identified, the payment diversion stopped before the transfer settled and a reinforced finance playbook.
IT segmented from OT, with maintenance windows granted to external vendors.
Activation
Ambiguous alert on anomalous activity against a server accessed by a vendor privileged account.
Outcome
Fast DFIR confirmed vendor credentials reused in an external campaign. Rotation, third-party hardening, vendor-profile detection rules and a contract review.
Three different things — and they're complementary. Confusing them gets expensive.
IR Retainer
Executes the response. Contract, SLA, hour bank, readiness and a DFIR team on standby. Stops the incident.
On-demand
Same service, booked under fire. More expensive, slower to start, and the team walks in blind.
Cyber insurance
Transfers part of the financial cost of the incident. It doesn't run the technical response — it delegates to approved providers. Pairs well with a retainer.
The retainer is the rapid-activation layer. It gets stronger when it sits alongside continuous detection, proactive hunting and governance.
Incident response (hub)
Full IR/DFIR picture at Hard2bit — capabilities, scope and flow.
Digital forensics
Evidence preservation and root cause with legal and regulatory rigour.
SOC/MDR 24/7
Continuous detection — the earlier the incident is seen, the earlier the retainer triggers.
Threat Hunting
Shrinks dwell time so the retainer fires before impact compounds.
SLA, hour bank, insurer coordination, regulatory fit, and where it differs from on-demand response.
The retainer is the commercial product with SLA and hour bank inside the Incident Response pillar, which also covers on-demand IR, forensics and continuity.
Sign the retainer before the incident and stop wondering what happens the day one lands.
Antes de irte…
Te damos un diagnóstico rápido de 15 min y te decimos qué priorizar primero: M365, pentesting, vulnerabilidades, SOC y/o DORA, NIS2, ENS o ISO 27001.
Sin spam. Respuesta en 24h.
