Every CISO eventually has the same uncomfortable realization: the night an incident lands is a bad time to be hiring an incident response firm. Here is how we structure a retainer that is actually useful when the call comes — and what the common pitfalls look like.
Every CISO eventually has the same uncomfortable realization: the night an incident lands is a bad time to be hiring an incident response firm. By then, the attacker has hours of head start, your team is panicked, and the firms you call are negotiating their rate.
A retainer fixes that. But most retainers are written like insurance policies — heavy on legal, light on the things that matter when the alert fires at two in the morning. Here is how we structure one that is actually useful.
The four things a useful retainer guarantees
- A named human, on call. Not "an analyst from our team." A specific person whose phone you have, who has reviewed your environment, who has signed your NDA.
- A response-time commitment with teeth. Not "best effort within 24 hours." A signed SLA tied to severity, with credits if missed.
- Pre-approved scopes of work. The first hour of a real incident is a bad time to negotiate a statement of work. The retainer should pre-define the scopes — triage, containment, forensics, regulatory support — and the rates for each.
- A "warm" handoff package. Network diagrams, asset inventory, account map, escalation matrix. Refreshed every six months. The IR firm reviews it and asks questions before any incident happens.
The structure that works
Three tiers, sized to the customer:
- Foundation. Twelve hours of pre-paid response per year, two-hour acknowledgment SLA on critical, annual tabletop. For organizations with no internal IR capability.
- Active. Forty hours of pre-paid response, one-hour acknowledgment SLA, quarterly tabletop, semi-annual readiness review. For organizations with a small internal team that needs surge support.
- Embedded. Dedicated lead, twenty-four-by-seven escalation, monthly tabletop, monthly cycle of attack-path review, on-call seat in the customer's primary channel. For regulated industries and high-target organizations.
The pricing on each tier should be transparent and posted, not negotiated for every contract. Surprise pricing during a sales conversation tells the customer the retainer was overpriced for the previous customer.
The clauses that actually save the day
- A "no charge for false alarm" line. The customer should not be punished for calling you when they were not sure.
- A "data residency" clause naming where forensic artifacts will be stored and for how long.
- A right-to-counsel clause acknowledging the customer's external counsel can join calls and review reports.
- A "lessons-learned" clause requiring a written postmortem within fourteen days.
- A "credit on missed SLA" clause that pays out automatically, not "upon written request."
The clauses that look helpful but are not
- "Unlimited hours" — somebody is going to lose money on that contract, and the work suffers when they do
- "Best-in-class tooling" — every IR firm uses similar tooling; this is a marketing line
- "Senior staff" — make them name the staff
- "Dedicated war room" — virtual war rooms are the same effort with less drama
How to scope the first conversation with a customer
Five questions, in order:
- What does your environment actually look like?
- What is your existing IR capability?
- What regulatory regime are you under?
- When was your last tabletop, and what did it expose?
- If something landed tonight, what's the first phone call you'd make?
The answers tell you which tier they need, what the readiness review should focus on, and where the relationship should grow. They also tell you which customers are not ready for a retainer yet — and the most useful thing you can do for them is say so.
Onboarding done right
The retainer is signed. Now do not wait for an incident to use it.
- Within two weeks: kickoff call with the named lead, NDA exchange, secure credential vault setup
- Within four weeks: environment review, asset map verified, escalation matrix loaded
- Within eight weeks: first tabletop, scoped to a realistic scenario for the customer
- Within twelve weeks: first quarterly readiness review with concrete recommendations
A retainer that is signed and not exercised is a retainer that does not work in production. The customer learns the IR firm. The firm learns the customer. By the time the first real incident lands, neither side is starting cold.
The hardest part: pricing it for both sides
The customer wants a low rate when they are not using it and a high cap when they are. The firm wants the opposite. The honest answer is that the retainer fee covers readiness and the on-call premium, and the hourly rate during an actual incident is at the firm's standard rate. Padding the retainer to absorb incident hours hides the real cost from the customer and tempts the firm to over-staff between incidents.
Be honest about it. Customers respect transparency.
What "good" looks like after a year
- One tabletop done, one near-miss handled, one false alarm called in without embarrassment
- Both teams know each other's names
- The customer's playbook has been updated based on lessons from the readiness review
- The firm's playbook for this customer is a living document, not an onboarding artifact
- Neither side dreads the other's calls
If you build the retainer that produces that outcome, you have built something genuinely useful — not a piece of paper, a working relationship.