® 
Your insurance for
cyber crises.
An Incident Response Retainer means you arrange cooperation, procedures and guarantees in advance. When an incident hits, you act immediately instead of signing contracts under pressure.
What is an Incident Response Retainer?
An Incident Response Retainer is your insurance against cyber crises. It includes guaranteed response times, pre-agreed procedures, knowledge of your environment and direct access to the CSIRT team. When an incident occurs, there is no startup time: the team knows your architecture, contacts and escalation procedures. Retainer hours can also be used proactively for threat hunting and exercises.
Ready before the incident happens
The retainer includes guaranteed response times, pre-agreed procedures, familiarity with your environment and direct access to the CSIRT team. When an incident occurs, there is no startup time: the team already knows your architecture, your contacts and your escalation procedures.
Retainer hours can also be used proactively: for threat hunting, compromise assessments, incident response exercises or security advice. This maximises value even when no incident occurs.
More and more insurers and regulators require an IR retainer or demonstrable IR capacity. A retainer with DEFION meets that requirement and gives management confidence that professional help is immediately available.
Without a retainer, you lose critical time
-
Onboarding takes time you do not have during a crisis
Without a retainer, an IR team spends the first hours getting familiar with your environment. With a retainer, that knowledge is already in place. In ransomware incidents, the first hours are decisive.
-
Insurers and regulators require demonstrable IR capacity
Cyber insurers increasingly require a qualified IR retainer. NIS2 requires organisations to have demonstrable incident handling capacity. A retainer with DEFION meets both requirements.
-
Ad hoc engagement is more expensive and slower
Engaging an IR team without a pre-existing relationship means higher rates, slower startup and no guaranteed availability. During a major incident, qualified IR teams are in high demand.
What the retainer includes
How the retainer works
Onboarding
Inventory of your environment, contacts, escalation procedures and communication channels. The team learns your architecture before any incident occurs.
Readiness assessment
Assessment of your current IR readiness and recommendations for improvement. Gaps are identified and addressed during the retainer period.
SLA and procedures
Documenting response times, communication agreements and escalation paths. All agreed before any incident occurs.
Periodic maintenance
Annual update of environment information and exercise. The retainer stays current as your environment evolves.
Activation on incident
Immediate mobilisation in accordance with the agreed SLA. No startup time, no contracting under pressure, no unfamiliar team.
Deliverables
- Retainer agreement with SLA
- Environment documentation and contact list
- Readiness assessment report
- Annual IR exercise
- Flexible deployment of retainer hours
- 24/7 hotline access
- Named CSIRT contacts who know your environment
Designed for organisations that cannot afford downtime
Organisations that want guaranteed IR capacity
You need certainty that professional help is immediately available when an incident occurs. A retainer provides that guarantee.
Companies with cyber insurance requiring an IR retainer
Many insurers require a qualified IR retainer as a condition of coverage. DEFION meets the qualifications insurers expect.
Organisations with NIS2 reporting obligations
NIS2 requires demonstrable incident handling capacity. A retainer with DEFION provides the documented evidence regulators require.
Boards that want certainty about crisis response
Under NIS2, boards are personally liable for incident management. A retainer gives them the assurance that professional support is in place.
Vendor-agnostic by design
DEFION works with the tooling you already have, or brings ours. No vendor lock-in.
FAQ
What does a retainer cost if there is no incident?
How fast is the guaranteed response time?
Can we use the retainer for proactive security?
How often is the environment information updated?
Is a retainer accepted by cyber insurers?
Ready before the next incident?
Arrange your IR retainer now. Know that professional help is guaranteed when you need it most.