Incident Response Retainer · Responders on standby
Know who to call before the breach.
A retainer gives you pre-arranged access to our experienced incident response team when a breach hits, backed by a response plan tailored to your organisation in advance, so nobody negotiates terms in the middle of a crisis.
Why a retainer
Breaches arrive unannounced. Your response shouldn't.
No procurement in a crisis
Contracts, contacts and access are agreed in advance, so the first hours of an incident go on containment rather than paperwork.
Limit the damage
Experienced responders move quickly to contain the threat and reduce the operational, financial and reputational impact of the incident.
A plan that fits you
Customised incident response planning means our team already understands your environment, priorities and escalation chain before anything goes wrong.
How the retainer works
Ready in advance. Decisive on the day.
The retainer runs in two modes: preparation while things are calm, and hands-on response from the moment you call.
Onboarding
We learn your environment, critical systems and key contacts, and agree how you will activate the retainer when needed.
IR planning
We build or refine an incident response plan tailored to your organisation, with clear roles, escalation and decision points.
Activation and triage
When you call, responders assess the situation, establish what is affected and agree response priorities with your team.
Containment
We help isolate affected systems and stop the activity spreading, keeping essential operations running wherever possible.
Recovery and lessons
Systems return to a secure state, and you receive a report on what happened and how to reduce the risk of a repeat.
What's included
Before, during and after an incident.
Expected outcomes: a faster, coordinated response when an incident occurs, reduced operational and financial impact, and documented readiness for auditors.
01 · Prepare
Before an incident
Retainer onboarding
Customised incident response plan
Agreed activation process
Key contacts and escalation chain
02 · Respond
During an incident
Pre-arranged access to IR resources
Triage and scoping
Containment support
Investigation of the attack
03 · Recover
After an incident
Eradication and recovery guidance
Incident report
Recommendations to prevent recurrence
Track record
Response expertise, trained and tested.
Financial & banking sector · Jordan · 2025
CBJ Cybersecurity Bootcamp: 40 completed, including ECIH and CHFI
Government · Jordan · 2025
CHFI forensic investigator training delivered for a ministry
Tier II service provider · KSA · 2025
MDR services advisory and support set-up awarded
Related services
Prepared to respond. Better at preventing.
A retainer covers the worst day. These services reduce how often it comes and how much it costs.
Reactive Compromise Assessment
A focused forensic investigation into root cause and impact once an incident has occurred.
Explore RCAManaged Detection & Response (MDR)
24/7 visibility and threat detection so incidents are spotted early and handled through structured response.
Explore MDRSOC Framework Development
Incident response playbooks, escalation procedures and governance for your own security operations.
Explore SOC frameworksIncident handler training
EC-Council ECIH and CHFI courses that prepare your people to handle and investigate incidents.
View IR coursesFAQ
The retainer, explained before you need it.
What organisations ask before putting incident responders on standby.
What does the retainer give us?
Pre-arranged access to our experienced incident response resources when a breach or security incident occurs, plus customised IR planning so the response fits your organisation.
What response times do you commit to?
Response commitments are defined in each retainer agreement according to your needs and environment. We agree them with you at the outset, so expectations are clear before any incident.
Do we need an incident to get value from it?
No. The planning work strengthens your readiness straight away, giving your team clear roles, escalation steps and decisions agreed in advance.
Can you work with our internal IT team?
Yes. Our responders work alongside your IT and security staff, guiding containment and investigation while your people keep business services running.
How does this support regulatory obligations?
Frameworks such as ISO 27001 and many regional regulators expect a planned, documented incident response capability. The retainer and its tailored IR plan help you evidence that capability to auditors and regulators.
Get IR cover in place
Describe your readiness. We'll shape the retainer.
Share how you handle incidents today, and an incident response lead will propose retainer terms and a planning approach that fits.
Describe your current incident readiness
An incident response lead reviews your needs
We send a retainer proposal with planning scope