It is 2 AM. An alert fires, or someone in finance notices a wire transfer that does not match an invoice. Someone has to decide what happens next, and the decisions made in the first hours shape everything after them.
A retainer does not change what the attacker has already done. It changes how quickly your side can act, and most of that is settled long before the call.
What the retainer buys you
A practitioner, not a queue. You call a number you already have and reach the designated lead who knows your environment. Response follows the SLA your tier defines.
Terms that are already signed. The master services agreement and the incident response statement of work are in place. Nobody negotiates contract language while your systems are exposed.
Authority agreed in advance. Isolating an endpoint, suspending an account, or pulling logs each carries operational risk. When those actions are approved ahead of time, the team can contain first instead of waiting for sign-off at every step.
Context that is already documented. Access paths, log sources, your identity and endpoint tooling, and the people who can authorize decisions are recorded during onboarding. The first hour goes to the incident, not to background.
A path to counsel and your carrier. Who engages legal counsel, how privileged reporting works, and how your insurance carrier is notified are decided before they are needed.
The first hours, as an example
This is an illustration, not a client engagement or a promised timeline. Actual timing depends on the incident, the available evidence, and your agreed terms.
A business email compromise is reported overnight, and you call the retainer line. The lead practitioner confirms access through the permissions set up during onboarding and starts collecting Microsoft 365 audit data. Under the authority you approved in advance, the affected account is secured: sessions revoked, credentials reset, and suspicious inbox rules and forwarding removed. The team then checks whether other accounts were touched. By the start of the business day, leadership has a short written brief covering what happened, what was contained, what is still unknown, and which decisions need their input.
What to confirm before you need it
- What your SLA measures: acknowledgment, contact with a practitioner, or the start of technical work.
- The hours your coverage applies to, including nights, weekends, and holidays.
- How activation works, and who on your side can authorize it.
- Whether onboarding is complete, with access, contacts, and log sources documented.
- Your carrier's notification requirements and provider-approval process.
How we structure it at Strace
Our retainer tiers define included hours, response SLAs, and on-site availability. Each includes a designated lead practitioner, pre-negotiated terms, a quarterly tabletop or readiness review, and an annual IR plan review. The 2 AM call goes better when that work is already done.