Retainers

Incident response retainer and cyber recovery retainer

A retainer puts Triden’s forensic responders and recovery engineers under contract before anything goes wrong. We learn your environment in advance, so when an incident happens we can deploy quickly, find the cause and get you running again.

Talk to an expert Compare retainers

24/7 response for clients under retainer
Forensics and recovery from one team
Onboarding and readiness work included

Hand stopping a line of falling dominoes

24/7 for retainer clients

Response around the clock once your retainer is in place

DFIR

Root cause and extent of compromise, found quickly

Recovery engineers

Networking, cloud and systems engineers to restore operations

Consultants reviewing plans with a client on site

Why a retainer

Sign the contract before the incident, not during it

Without a retainer, the first hours of an incident go to finding a firm, agreeing on terms, arranging access and explaining your network. A retainer settles all of that in advance. Contacts, escalation paths, access methods and legal terms are ready, and our team has already reviewed your environment.

Retainers also help with governance. Boards, auditors, regulators and cyber insurers increasingly ask who you would call during an incident. A retainer gives you a clear answer, backed by a plan you have tested.

Retainer options

Two retainers, one team

Choose the DFIR retainer, the cyber recovery retainer or both. Most organizations that depend on continuous operations take both.

24/7 DFIR retainer

Rapid deployment of digital forensics and incident response to find the root cause and extent of a compromise. Responders contain the threat, preserve evidence and give leadership, counsel and insurers the facts they need for decisions and notifications.

24/7 cyber recovery retainer

Rapid deployment of engineers in networking, cloud and systems to contain an incident and restore operations. Recovery engineers rebuild and restore systems, validate that they are clean and bring the business back online in a planned order.

Both retainers together

Investigation and recovery under one agreement. Forensic responders and recovery engineers work from the same plan, so root cause findings shape how and when systems are restored.

What’s included

What an IR retainer covers

Onboarding and environment review

We document your systems, critical applications, backups and contacts so responders start with context.

Incident response plan review

We review your IR plan and suggest changes so it matches how you would actually respond.

IR plan template

Agreed runbooks and access

Escalation paths, decision owners and the access responders need, agreed and tested before an incident.

24/7 activation

Clients under retainer can reach our team around the clock through the contacts in their agreement.

Readiness exercises

Tabletop exercises that test your plan and prepare leadership and IT to work with us.

Tabletop exercises

Post-incident reporting

Findings, root cause, actions taken and the fixes that prevent a repeat, written for IT and leadership.

How it works

Setting up your retainer

Scope

We review your environment, critical systems, insurance requirements and existing plans, and recommend the retainer that fits.

Onboard

We collect contacts, document your environment, agree on runbooks and set up the access responders will need.

Prepare

We review your incident response plan and can run a tabletop exercise so your team knows how response will work.

Stay ready

We keep your information current as your environment changes, and deploy under the retainer when an incident happens.

Cyber insurance

How a retainer works with your cyber insurance

Many cyber insurance policies include requirements for incident response, such as notifying the carrier first or using firms the carrier approves. Read your policy before you choose a retainer, and share it with us during scoping.

We structure the retainer to fit around those rules. That can mean working alongside a carrier-appointed firm, focusing on recovery engineering or supporting your internal team. Either way, you know in advance who does what.

Review of your policy’s incident response requirements
Roles agreed with you before an incident
Documentation that supports insurance applications and renewals

Advisor meeting with a client at a table

FAQ

Incident response retainer questions

An incident response retainer is an agreement, signed in advance, that gives you access to a response team when an incident happens. Terms, contacts and access are settled beforehand, and the team learns your environment so it can deploy quickly.

The DFIR retainer focuses on investigation and containment, finding the root cause and extent of compromise. The cyber recovery retainer focuses on restoring operations, with engineers in networking, cloud and systems who rebuild and bring systems back safely. Many clients take both.

Retainer cost depends on the size and complexity of your environment, which retainers you choose and how much readiness work, such as plan reviews and tabletop exercises, is included. Response effort during an incident depends on the incident itself. We scope the retainer with you and explain what is included before you sign.

Retainers are designed to be set up before an incident, so we can respond without delays. If you are dealing with an incident now and are not a client, contact your cyber insurance carrier first. Then talk to us about a retainer for the future.

MDR catches and contains most threats early. A larger incident, such as ransomware or a significant breach, can need forensic investigation and recovery engineering beyond day-to-day response. Triden MDR clients can add a retainer so the same team handles both.

Key contacts and decision owners, an overview of critical systems and applications, your backup approach, your incident response plan if you have one and your cyber insurance requirements. We help fill any gaps.

Related services