BLOG

By David Chernitzky, CEO, Armour Cybersecurity  ·  Serving Toronto and organizations across North America  ·  Last updated August 21, 2026

Key Takeaways

• An incident response retainer is not incident response insurance. It is a professional services agreement that puts a specific team on standby with guaranteed activation terms. The retainer documents the relationship, the response time commitment, the scope of services, and the billing rate for actual incident consumption. It does not cover the cost of the incident; it ensures the response team is already in place and already familiar with the organization when the incident arrives.
• The critical value of a retainer is the pre-established relationship and the onboarded context. A response team that has conducted a proactive onboarding session knows which systems are business-critical, who the key stakeholders are, how to reach them outside business hours, what communication channels to use, and what the environment looks like before the incident starts. This context eliminates the hours a cold-start engagement spends on orientation while the incident progresses.
• Traditional retainer models require an upfront block-hour purchase. The organization buys a defined number of professional hours, typically ranging from 20 to 100 hours, at an agreed rate, paid at signing. Hours are drawn down during incidents. If no incident occurs during the term, the hours may be forfeited or partially credited toward renewal. This model provides committed capacity but requires a budget commitment many SMBs cannot or will not make against a risk that has not yet materialized.
• The zero upfront model removes the budget barrier without removing the relationship. A retainer structured with no upfront block-hour fee lets the organization establish the relationship, complete the onboarding, and secure guaranteed response activation without a financial commitment beyond the onboarding session. When and if an incident occurs, the organization pays for the actual hours consumed at the agreed rate. If no incident occurs, the cost is the onboarding investment and nothing more.
• A retainer satisfies cyber insurance and compliance expectations for documented IR readiness. Cyber insurance carriers increasingly expect evidence of a pre-established incident response relationship with a defined activation path. Some compliance frameworks, including those aligned with the NIST Cybersecurity Framework and ISO 27001, expect incident response capability documentation. A signed retainer agreement with a documented response team and activation guarantee satisfies these expectations in a way that an informal we-will-call-someone-if-it-happens posture does not.

What a Retainer Actually Covers

Proactive onboarding: the investment that makes the response faster

The proactive onboarding session is the most overlooked component of an incident response retainer. Most organizations focus on the reactive capability, the guarantee that someone will pick up the phone when the breach happens, and underestimate the value of the work that happens before any incident occurs. The onboarding session maps the organization’s environment: networks, servers, endpoints, cloud services, business applications, SaaS platforms, and any other systems that would be relevant in a response scenario. It identifies the key stakeholders across IT, security, legal, communications, and executive leadership, with contact information for each and out-of-band communication channels that will still work if the organization’s primary communications systems are compromised during an incident.

The onboarding session also produces the asset and stakeholder inventory that the response team uses as a starting point the moment an incident is declared. Without this inventory, the first hours of an incident response are spent asking questions: which systems are affected, who owns them, who needs to be notified, and what does the normal state of the environment look like so that anomalous behavior can be identified? With it, the response team arrives at the incident with answers already in hand. The difference in response speed is measurable, and the difference in stress for the organization’s leadership during an active incident is significant.

Guaranteed activation: what 24-hour response means in practice

The 24-hour remote response activation guarantee means that from the moment an incident is declared, a comprehensive remote response from the senior team begins within 24 hours. This is not a best-effort commitment; it is a contractually guaranteed response time anchored to the declaration of the incident. The response begins with the team that conducted the onboarding, not a different team working from a handover document. The same people who know the organization’s environment are the people who respond to the incident.

For organizations that have never engaged incident response during an active breach, 24 hours may sound like a long time. In reality, the first hours of a confirmed incident are typically consumed by internal triage and escalation: confirming that an incident is actually occurring rather than a false positive, escalating to senior leadership, engaging legal counsel, and beginning the notification and communication process internally. By the time the response team activates, the organization has typically just completed its own initial assessment, and the external team arrives at the right moment to accelerate the containment and investigation phases.

The full response lifecycle

An incident response retainer covers the complete response lifecycle from the moment an incident is declared through the final post-incident report, following the phases defined in NIST SP 800-61, the widely adopted standard for computer security incident handling. Identification and triage confirms the incident, assesses its nature and severity, and identifies the indicators of compromise that define the scope of the problem. Short-term containment stops the immediate spread of the incident: isolating affected systems, blocking attacker communication channels, and preventing further lateral movement or data exfiltration while the investigation proceeds. Long-term containment addresses the root conditions that allowed the incident to occur and that would allow it to recur if only short-term measures were applied. This is the core of what breach response services deliver during an active engagement.

Eradication removes the malicious presence from the environment: malware, implanted backdoors, attacker-controlled accounts, and any other artifacts of the compromise. Recovery restores affected systems to operational status with integrity verification to confirm they are clean before they return to production. Communications coordination manages the flow of information to internal stakeholders, legal counsel, cyber insurance carriers, regulatory bodies, customers, partners, and the public as appropriate to the incident type and the organization’s obligations. And documentation captures the complete record of the incident: the timeline, the actions taken, the decisions made, the evidence preserved, and the lessons learned. The post-incident report, supported by technical forensics, is the output that supports legal proceedings, insurance claims, regulatory reporting, and the internal improvements that reduce the risk of a recurrence. To see how this is structured as a zero upfront commitment, review Armour’s zero dollar IR retainer.

Why Most SMBs End Up Without a Retainer

The pattern is consistent across organizations of every size below the enterprise threshold. Leadership recognizes the value of incident response readiness in principle. The security team recommends an IR retainer. The retainer proposal arrives on the CFO’s desk alongside a cloud migration project, a compliance audit engagement, and a new endpoint security platform. The upfront block-hour commitment, with no guaranteed incident to justify it, does not survive the budget prioritization conversation. The retainer is deferred to next year’s planning cycle.

Next year arrives, other priorities compete again, and the retainer remains unbudgeted. Then the incident occurs, and the organization discovers that the first call during an active breach is to a firm they have never spoken to before, one that has no knowledge of their environment, that may or may not have capacity to engage immediately, and whose first hours of billable time are spent learning what the onboarding workshop would have established before the incident started. The zero dollar retainer model is specifically designed to interrupt this pattern by removing the budget barrier that causes organizations to defer the relationship until it is too late.

Across the 260+ organizations Armour Cybersecurity protects in 52+ industries, the businesses that come through an incident with the least damage are rarely the ones with the largest security budgets. They are the ones that had a response relationship in place before the breach, so the first hour was spent containing the incident rather than searching for someone to call.

Frequently Asked Questions

How is a retainer different from just calling an IR firm when something happens?

Calling an IR firm when something happens without a retainer in place is called a break-glass engagement. It works, but it carries costs that a retainer eliminates. First, firms with capacity accept break-glass clients on availability; a firm that is fully committed to existing incidents may not be available to engage on a Friday night when your breach is detected. A retainer guarantees availability. Second, a break-glass engagement starts cold: the responding team has no knowledge of your environment, your systems, your stakeholders, or your communication preferences. The first hours of the engagement build that context while the incident progresses. A retainer eliminates the cold start through proactive onboarding. Third, the stress of identifying, evaluating, and engaging a response firm during an active incident falls on whoever is managing the response at the worst possible moment. A retainer means that call has already been made, the relationship is already in place, and the only call needed is the activation call.

What size organization needs an IR retainer?

Any organization that holds data or operates systems whose compromise would cause meaningful harm to the business, its customers, or its partners benefits from an IR retainer. In practice, the organizations that most need pre-established incident response capability are those without a dedicated internal security operations team, because those organizations have the least internal capacity to manage a response when an incident occurs. Mid-market organizations, professional services firms, regulated businesses such as financial services and healthcare practices, and any organization subject to compliance frameworks that expect documented incident response capability are all appropriate candidates. The zero upfront model makes the retainer accessible to organizations that would not fit the traditional block-hour commitment into their security budget.

Does an IR retainer replace having an incident response plan?

No. An incident response plan is the internal document that defines how the organization will detect, escalate, and manage a cyber incident using its own resources. An IR retainer is the external relationship that provides professional response capability when the incident exceeds what the organization can manage internally. The two complement each other. An organization with an IR plan but no retainer has a documented process but no guaranteed external resource. An organization with a retainer but no IR plan has external response capability but no internal process for the first hours before the retainer team is engaged. The onboarding workshop conducted as part of the retainer often surfaces gaps in the organization’s internal incident response plan and provides the opportunity to address them before an incident occurs.

What incident types does the retainer cover?

The full range of cyber incident types that affect small and mid-market organizations: ransomware and extortion events, business email compromise and wire fraud, data exfiltration and unauthorized access, malware infections including advanced persistent threats, denial of service, insider threats, website and database compromise, phishing campaigns, and email-based attacks. The response team works across IT, cloud, and OT environments and engages on both externally-driven incidents (attacker-originated) and internally-driven incidents (insider threat, accidental exposure). The specific response approach varies by incident type; the onboarding session covers the organization’s environment in sufficient detail for the response team to understand which incident types are most likely and what the response priorities would be for each.

The Bottom Line

An incident response retainer does not stop a breach from happening. What it does is make sure that when one happens, the first call is to a team that already knows your environment, is contractually committed to activate within a guaranteed window, and can start containing the incident instead of learning who you are. For most small and mid-market businesses the only thing standing between them and that readiness is the upfront block-hour cost, which is exactly what the zero upfront model removes: you establish the relationship and complete the onboarding now, and you pay for response hours only if an incident actually occurs. The worst time to meet your incident response team is during the incident. Armour Cybersecurity’s zero dollar IR retainer puts the relationship in place before the breach, so the readiness is there when it is needed and the cost is not there when it is not.