Incident Response Retainer for Your Business
An incident response retainer means experts are lined up before the breach, not searched for during it. Omeiro's DFIR team takes command of an active incident, isolates compromised assets and works to remove the attacker's footholds, using hours you have already bought each month.
What incident response retainer looks at
The main areas we check, by hand with tools as support. The exact scope depends on your package and is agreed in writing before work starts.
Alerts and logs
- Which logs are kept
- Alert rules
- Who gets alerted
What happened
- Timeline of events
- Affected systems
- Entry point
Clean-up
- Removing access
- Resetting secrets
- Restoring from backup
Next time
- Written response steps
- Contacts list
- Lessons learned
Checklist Based on common risks and good practice. The exact scope depends on your package and is agreed in writing before work starts.
What you get with incident response retainer
Priority emergency SLA triage during active cyber breaches. Expert DFIR incident commanders take control, isolate compromised assets, and eliminate adversary footholds.
Basic Package
Up to 5 hours of emergency response a month, 4 h response. 24h turnaround, 2 revisions.
Standard Package
Up to 15 hours, 2 h response; yearly drill. 24h turnaround, 2 revisions.
Premium Package
Up to 40 hours, 1 h response; quarterly drills. 24h turnaround, 2 revisions.
Clear brief first
We confirm what you need before work starts, so the scope is clear on both sides.
Revisions listed
Each package shows its revision rounds. A round is one list of changes sent together.
Yours once paid
Copyright of the final work passes to you once the order is paid in full.
Work starts only after the scope is agreed in writing and you confirm you own or control the systems involved.
How our incident response retainer works
Onboard
We note your systems, contacts and escalation path ahead of time.
Practise
Drills on Standard and Premium test the plan with your team.
Respond
When an incident hits, we start work within your tier's response time.
Review
After an incident, you get a clear account of what was done and what to improve.
Why choose Omeiro for incident response retainer
You choose a tier that sets how many emergency hours you have and how fast we respond. Hours and response windows are stated in each plan so nothing is vague.
In short
- Fixed price, shown before you order.
- Copyright yours after full payment.
Incident Response Retainer: common questions
How much does incident response retainer cost?
Prices are fixed and shown by package on our Incident Response Retainer pricing page, so you see the full price before you order. You can also ask for a custom quote.
How long does cyber incident response take?
Delivery depends on the package: Basic 24h turnaround; Standard 24h turnaround; Premium 24h turnaround.
What is included in the Basic Package?
The Basic Package includes: Up to 5 hours of emergency response a month, 4 h response. Higher packages add more scope, revisions and support.
Can I get a custom emergency breach response package?
Yes. If none of the packages fits, use the custom package form on our pricing page to describe what you need, and our team sends you a fixed price.
What happens to unused hours?
The plan describes monthly allowances, so please check how rollover is handled before you subscribe.
Does a retainer include breach legal advice?
No. We handle technical response, and legal advice comes from your own counsel.
Can we use hours for non-emergencies?
The hours are for emergency response, so ask us before assuming planned work counts.
Why have drills?
A drill finds gaps in contact lists and decisions while nothing is on fire.
Who owns the final work?
Copyright of the final work passes to you once the order is paid in full. Paid fonts, stock files or licences, if used, are licensed in your name.
Ready to start your incident response retainer?
Compare the packages and pick the one that fits. Not sure which? Write to us and we will help you choose.