Emergency Incident Response Retainer

We confirm what you are seeing, which systems are involved, and whether the activity is ongoing. Because onboarding already mapped your estate, this call is minutes, not hours. We set an initial scope and decide what evidence to preserve before anything changes.

We cut the attacker’s access without destroying the evidence you will later need: revoking credentials and sessions, isolating affected hosts, and closing the exploited route. Deliberate containment keeps memory and logs intact so the forensic picture stays readable.

We remove every foothold the intruder left, including backdoor accounts, web shells, scheduled tasks and altered configuration. An incident is not over because one password changed. It is over when the persistence and every copy of it is gone.

We bring systems back to a known-good state, verify they are clean before they return to production, and restore from trusted backups where data was touched. Recovery is faster on a retainer because your backup and rebuild processes are already documented from onboarding.

Every response ends by closing the door that opened. You get a prioritised remediation list tied to the specific failure, and because we hold the relationship over time, we can confirm those fixes stick rather than filing a report and vanishing.

Contract, NDA and data-handling terms are agreed at retainer signing. When you call, there is nothing to negotiate and nothing to wait for. The engineer is authorised to act on the first call.

Onboarding captures your architecture, your critical systems, your logging, your backups and your key contacts. That context is what lets a responder move fast and avoid mistakes, and it simply does not exist when a stranger arrives mid-breach.

A retainer includes an agreed escalation path and contact tree, so at 3am there is no scramble to work out who can authorise isolating a production server. The decision-makers and the technical owners are already on the list.

We build or sharpen your IR plan and the playbooks for the scenarios most likely to hit you, so your own team knows the first ten steps before we even arrive.

We run tabletop exercises that walk your leadership and technical staff through a realistic breach. Plans that read well on paper fail in practice when nobody has rehearsed them, and a tabletop surfaces those gaps cheaply.

We hunt for signs of intrusion you have not noticed and check that your logging would actually let us investigate a breach. Discovering that a critical system keeps no useful logs is far better learned during a quiet review than during a live incident.

Backup restore testing

We test that your backups restore to a clean, working state. An untested backup is a hope, not a recovery plan, and ransomware is exactly the moment you find out which one you had.

We document your critical systems, your network shape, where your sensitive data lives, and how your identity and access is structured. This is the map we would draw during a breach anyway, done calmly in advance so it is accurate rather than reconstructed under pressure.

We agree how we get access when you call, who is authorised to approve containment actions, and who must be told at each step. A signed escalation path means nobody wastes time at 3am working out who can approve isolating a production database.

We check that the systems most likely to be targeted keep logs we could actually investigate. If a key server retains nothing useful, that is a gap worth fixing before an incident, not a nasty discovery in the middle of one.

If your business runs on business hours and a few hours of response time during the working day is acceptable, a standard retainer covers you well. You still get onboarding, a prepaid hour pool and priority over cold callers, at the lowest monthly cost.

If you run services around the clock, hold large volumes of personal data, or operate under DORA or NIS2 expectations, a priority retainer with a tighter clock and weekend cover is the safer choice. The extra monthly cost is small against the downtime it prevents.

A specialist retainer alongside your MSP

A managed service provider keeps your systems running day to day, which is a different job from investigating a breach and rebuilding trust in a compromised network. Many clients keep their MSP and add a specialist incident response retainer for the moments that need offensive-security experience, with the two working side by side.

The single biggest threat to a timely notification is losing days to hiring a responder. On a retainer, forensic scoping begins on the first call, so the categories of data, the approximate record counts and the containment status can be established while the clock still allows a considered submission. We provide those facts to your DPO and counsel; the notification remains yours to make.