Incident Response

Incident Response Retainer

Availability, coverage, contacts, activation and commercial terms apply only as documented in the written service schedule; response is not guaranteed or described as immediate.

Discuss a response retainer See how a retainer works

Named contacts and activation route
Coverage defined in a written service schedule
Preparation activities and environment context
Incident support within agreed terms

The proposition

Agree incident support before an event

Agree the practical route to incident support before an event, with coverage and responsibilities stated in writing. The work focuses on named contacts and activation route and records where evidence or authorization limits the conclusion.

Retainers should remove ambiguity

A retainer should remove ambiguity, not create promises.

An incident retainer can establish contacts, onboarding information, handling expectations and the commercial mechanism for agreed support. Its value depends on both parties understanding activation, authority and dependencies.

Cyberus records availability, scope, exclusions and any response objectives only in the written service schedule. This page makes no promise about continuous coverage or response timing.

Support arranged before it is needed

Likely needs. Critical services and credible scenarios shape what the arrangement should cover.
Written terms. Coverage, contacts, activation and exclusions are agreed in a service schedule.
Prepared context. Environment, access and evidence details are gathered so support need not start from nothing.
Authorized request. A named contact asks for help through the agreed route, with the information responders need.

Why it matters

Business risk: Negotiating terms, access and contacts in the middle of an incident adds friction when clarity matters most.
Decision it supports: Leaders can decide what support to arrange in advance and who is allowed to ask for it, with limits stated plainly.
What you receive: You receive a written service schedule, onboarding record, activation guide and readiness reviews, within the agreed terms.

Retainer arrangements that can be checked

Service schedule

Defines coverage, activation, contacts, scope, exclusions and applicable response objectives.

Why it matters: Disputes about what is covered are costly during a crisis, so the document sets expectations in advance.
Supports: A clear basis for deciding what is and is not included

Onboarding record

Captures environment context, evidence sources, access prerequisites and key dependencies.

Why it matters: Responders who already know the environment waste less time asking basic questions.
Supports: Background that shortens the start of an engagement

Activation guide

Explains how an authorized contact requests support and what information to provide.

Why it matters: Panic leads to missing details or the wrong person calling, so a simple guide keeps requests usable.
Supports: A repeatable way to request support

Readiness review

Records agreed preparation activity and material changes that should update the arrangement.

Why it matters: Arrangements go stale as systems and people change, which can quietly break activation.
Supports: Evidence that contacts and prerequisites stay current

How a retainer is established

Define likely needs
Review critical services, incident scenarios, current capability and external dependencies.
Why it matters
Starting from real scenarios avoids paying for coverage that does not match how the business could be hurt.
Agree written terms
Document coverage, contacts, activation, scope, exclusions and applicable objectives.
Why it matters
Written terms remove ambiguity and avoid assumptions about timing or scope that nobody agreed.
Prepare context
Collect agreed environment, access and evidence information without over-retaining sensitive data.
Why it matters
Collecting only what is needed keeps preparation useful without storing more sensitive data than necessary.
Review the arrangement
Update contacts and prerequisites after material changes, exercises or service reviews.
Why it matters
Regular review keeps the arrangement accurate as the organization changes.

Why choose Cyberus for incident response retainer

Authority
Named activation contacts
Coverage
Written service schedule only
Preparation
Context and access prerequisites
Constraint
No response guarantee on this page

Team certifications

Individual qualifications held by members of the Cyberus team. They are not company accreditations, and not every consultant on an engagement holds every badge.

OSCP
Hands-on penetration testing skills, from enumeration to exploitation and privilege escalation.
OSWE
Web application security skills, including source code review and exploiting complex web vulnerabilities.
OSED
Exploit development skills, including analysing Windows software and writing custom exploits.
OSCP+
Hands-on penetration testing skills, from enumeration to exploitation and privilege escalation.
CRTA
Red team analysis skills, including adversary tactics and techniques.
eWPT
Web application penetration testing skills, from assessment method to exploiting common web flaws.
eWPTX
Advanced web application penetration testing skills, including complex attack techniques.
eMAPT
Mobile application penetration testing skills for Android and iOS applications.
BTL1
Defensive security skills across security operations, phishing analysis, forensics and incident response.
eCIR
Incident response skills, including investigating, containing and analysing security incidents.
CRTE
Red teaming skills focused on Windows environments and the tradecraft used against them.
CCT
EC-Council's Certified Cybersecurity Technician (CCT) validates foundational security, network, and defense skills.
Security+
CompTIA Security+ validates core skills in baseline cybersecurity, risk management, and threats.