Insight
2025-04-08 · 6 min read
When to retain incident response (before you need it)
The first hour of an incident is a bad moment to negotiate a contract, share a tenant, or learn who can talk to your lawyer.
A retainer is not a superstition. It is a pre-agreed identity in your cloud, a counsel introduction, and a human who has already read your network diagram.
Buy one if you hold regulated data, if you cannot restore from backup in hours, or if your board would expect a briefing the same day something pages.
We will still take emergency work without a retainer when we have capacity. You will wait in a queue, and we will spend the first hours on paperwork you could have done in peacetime.
What a retainer is not: a promise to recover stolen cryptocurrency, undo a wire fraud at the far end, or operate on systems you do not control. Those are law-enforcement and banking problems. We will help you document, contain, and brief. We will not attack a third party on your behalf.
Want more
Contact us for a team briefing, or for an authorized review if a site you own looks poisoned with SEO spam. We will not run black hat campaigns.
Related: How to hire an ethical hacker.
Next step
Tell us what you need answered.
A 30-minute scoping call is enough to know whether a pentest, a cloud review, or a retainer is the right buy. We will say if it is not.