Incident Response Retainer

An IR retainer is a pre-negotiated agreement that guarantees a response SLA when a cyber incident occurs. Without a retainer, you are calling vendors cold during a crisis — response times are measured in days, hourly rates jump to $800-$1,500, and the first several hours are spent on-boarding your environment while the attacker moves laterally. With a retainer, we already know your environment, your IR plan is written and tested, and a senior engineer picks up the phone within hours. The retainer is breach insurance for your breach insurance.

Standby tier: $750 per month ($9,000 per year) — SLA guarantee, IR plan, annual tabletop, no prepaid hours. Ready tier: $1,500 per month ($18,000 per year) — includes 40 hours per year of response time. Priority tier: $3,000 per month ($36,000 per year) — includes 100 hours per year, 1-hour response SLA, and guaranteed on-site within 4 hours. Overage hours are billed at $150-$200 per hour depending on tier — significantly below the $800-$1,500 per hour rate for non-retained incident response.

No. Hours reset annually. This keeps the retainer cost predictable. The reality: if you are using 100 hours of incident response in a year, the retainer already saved you $50,000-$100,000 compared to non-retained rates. The value is in the SLA and the discounted hourly rate, not in banking hours.

Any event that threatens the confidentiality, integrity, or availability of your systems or data: ransomware, business email compromise, unauthorized access, data exfiltration, malware infection, phishing that resulted in credential compromise, or a suspected breach identified by your monitoring tools or staff. A suspicious email that your team caught and reported before any damage — that is not an incident, that is a ticket. We will not manufacture incidents to burn hours.

Increasingly, yes. Cyber insurance carriers in 2026 are requiring or strongly incentivizing documented IR plans, 24/7 monitoring, and pre-established vendor relationships for incident response. Some carriers offer premium discounts for businesses with active IR retainers. Our retainer documentation package is designed to satisfy carrier requirements — we have pre-approval from major cyber insurance carriers through our MDR partners.

Hour 0-1: Alert triggers, senior engineer assesses scope and severity. Hour 1-4: Containment — isolate affected systems, cut lateral movement, preserve forensic evidence. Hour 4-12: Investigation — identify attack vector, map the blast radius, determine data exposure. Hour 12-48: Remediation — eradicate threat, restore from backup, harden the environment. Day 2-5: Recovery — validate systems, monitor for persistence, restore normal operations. Day 5-14: Post-incident — written report, root cause analysis, remediation recommendations, insurance carrier and regulatory documentation.

Sage handles initial triage, containment, and coordination directly. For 24/7 SOC monitoring and advanced digital forensics (malware reverse engineering, deep disk forensics, threat intelligence correlation), we partner with a managed detection and response provider — Huntress or Arctic Wolf depending on the client stack. Both are pre-approved by major cyber insurance carriers. You deal with Sage as a single point of contact; the MDR partner operates behind the scenes.

Managed cybersecurity (EDR, SIEM, backup, patching) is prevention. The IR retainer is the response plan for when prevention is not enough. Managed cybersecurity clients on the Secure or Sovereign tier already have significant overlap — the monitoring, the backup infrastructure, and the environmental knowledge are in place. Adding a Standby IR retainer for $750 per month adds the guaranteed SLA, the written IR plan, the annual tabletop, and the insurance-ready documentation. Existing managed clients receive a 10% discount on IR retainer pricing.

A facilitated walkthrough of a realistic incident scenario — ransomware hits at 2 AM on a Friday, business email compromise targets your CFO, or a disgruntled employee exfiltrates client data before quitting. Your team walks through the response: who calls whom, what gets shut down first, when legal is notified, how clients are informed, what the insurance carrier needs. The exercise exposes gaps in your IR plan before a real incident does. We facilitate one per year and update the IR plan based on findings.

The $250,000+ average cost figure for SMB ransomware attacks includes direct costs (ransom if paid, recovery labor, forensics, legal, notification) and indirect costs (business interruption, lost revenue, reputation damage, increased insurance premiums). Businesses with mature IR plans refuse to pay ransom 86% of the time because they have tested backups and a documented recovery process. The retainer is not about paying us $750 a month — it is about not paying an attacker $250,000.