When to retain incident response (before you need it)

A retainer is not a superstition. It is a pre-agreed identity in your cloud, a counsel introduction, and a human who has already read your network diagram.

Buy one if you hold regulated data, if you cannot restore from backup in hours, or if your board would expect a briefing the same day something pages.

We will still take emergency work without a retainer when we have capacity. You will wait in a queue, and we will spend the first hours on paperwork you could have done in peacetime.

What a retainer is not: a promise to recover stolen cryptocurrency, undo a wire fraud at the far end, or operate on systems you do not control. Those are law-enforcement and banking problems. We will help you document, contain, and brief. We will not attack a third party on your behalf.