Incident response — pick up the phone, we're already on the bridge in 30 minutes
Ransomware, business email compromise, data exposure, insider threats.
Retainer engagements skip the credential dance.
Three ways to engage. One hotline, one bridge, one chain of custody.
Two retainer options for when you want the discount and the rehearsals. Emergency hourly when the building is on fire and you need us today. All three lanes feed the same SOC and the same insurance-aligned reporting format.
- Breach hotline
- 8 prepaid response hours (rolls forward, never expires inside the term)
- IR plan template tailored to your stack and headcount
- Pre-signed engagement letter on file, zero paperwork at 3am
- Cyber insurance carrier panel pre-clearance (Beazley, Chubb, AIG, Coalition, At-Bay and 9 more)
- Annual readiness review and IR plan update
- Everything in IR Retainer
- 40 prepaid response hours (5x the base tier)
- Quarterly tabletop exercise: ransomware, BEC, insider, third-party scenarios
- Drafted IR runbook customized to your environment, network diagrams included
- Annual purple-team exercise with detection-engineering feedback loop
- Board-ready quarterly readiness report
- Engagement letter via DocuSign
- Same playbooks, same forensic stack, same chain-of-custody discipline
- Same cyber-insurance reporting format your carrier expects
- Post-incident option to roll into a retainer at the discounted rate
- No long-term commitment if you'd rather pay-per-incident going forward
Different fires, different first moves.
Every retainer client gets a copy of these playbooks during onboarding. They are written so a non-technical executive can read them on a Sunday morning and understand what we are doing and why.
| Incident type | First 60 minutes | What we contain |
|---|---|---|
| Ransomware encryption | Identify patient zero, isolate via EDR network containment, block C2 at the firewall, snapshot affected systems for forensics. Engage Coveware for negotiation track in parallel. | Lateral movement halted. Encryption stopped. Backup integrity verified. Decision matrix delivered: restore vs negotiate. |
| BEC + wire fraud attempt | Force password rotation + revoke all sessions for compromised mailbox, pull mail rules, contact bank fraud line on three-way call to recall wire if in flight. | Mailbox secured, malicious rules removed, audit trail captured for FBI IC3 filing. Wire reversed if flagged within the 72-hour window. |
| Insider data exfil | Preserve under chain of custody (do not tip off the user), pull email and USB activity, image laptop if accessible, freeze cloud sync tokens. | Full timeline of what was taken, when, and where it went. Declaration ready for HR, counsel, and any TRO motion. |
| Cloud token theft | Revoke OAuth grants, rotate impacted IAM credentials, force MFA re-enroll, pull CloudTrail / Azure Activity / GCP Audit logs for the access window. | Blast radius mapped: every API call the stolen token made, every resource it touched, every secret it could have read. |
| Web app compromise | Take the app behind a maintenance page or WAF block, snapshot the host and DB, pull access logs, identify the exploit path (SQLi, RCE, deserialization). | Patched or rolled back, malicious accounts disabled, webshell removed, DB integrity verified. Public-facing return-to-service plan drafted. |
| Phishing-led credential theft | Reset compromised account, revoke sessions and refresh tokens, hunt for inbox forwarding rules, sweep tenant for the phishing template against other users. | All affected accounts secured, phishing infrastructure reported for takedown, awareness email sent to the org with the actual lure for recognition. |
| Third-party / supply-chain breach | Inventory every integration, API key, and shared credential with the breached vendor. Rotate everything. Review logs for anomalous calls from the vendor's IP space. | Vendor-side blast radius scoped. Your environment confirmed clean or contaminated. Counsel briefed on contractual notification triggers. |
Every retainer engagement gets the full 28-page playbook library. Ask for a redacted sample chapter.
Reports your carrier accepts. Evidence your counsel can file. Notifications your regulator expects.
Every engagement produces a deliverable package built for the three audiences that actually matter after a breach: the cyber insurance carrier, your breach counsel, and (if the incident is reportable) the regulator. We've never had a claim denied on our watch.
Honest answers.
Will you negotiate the ransom?
We do not negotiate ransoms ourselves. We work with two pre-vetted ransomware negotiation firms, Coveware and GroupSense, and bring them onto the bridge if negotiation becomes the right call. We give you the data they need to start the conversation: variant identification, known leak-site behavior of the threat actor, and historical pay-vs-no-pay outcomes for that group.
We will tell you honestly when payment is the wrong move, and just as honestly when it's the only viable path.
How does this work with our cyber insurance?
We are panel-approved or pre-approved by major cyber carriers including Beazley, Chubb, AIG, Travelers, Coalition, At-Bay, Corvus, CFC, Hiscox, Tokio Marine HCC, Zurich, Cowbell, Resilience, and Cysurance. Engaging us inside your panel means your policy responds without a coverage fight.
Every report we deliver is structured to the format your carrier's claims team expects: incident timeline, indicators of compromise, scope of access, data-affected analysis, remediation steps, and lessons learned. If you are not sure whether we are on your carrier's panel, we can confirm.
Do you handle breach-notification legal requirements?
We do not give legal advice, but we work directly with your breach counsel under attorney-client privilege. If you do not have one yet, we partner with four firms with deep cyber bench: Mullen Coughlin, BakerHostetler, Constangy, and Lewis Brisbois.
Our forensic findings drive their notification analysis: which states require notice (we maintain the 50-state matrix), which regulators (HHS for HIPAA, state AGs, SEC for material public-company incidents under Item 1.05), and what the notification window looks like. We deliver evidence in formats counsel can actually file, not just dump as raw artifacts.
Can you help even if we don't have a retainer yet?
Yes. Emergency engagements without a retainer are billed at $475/hour with a $9,500 minimum for the first 24 hours. The hotline is (888) 574-5120.
Most clients then move to an IR Retainer once the immediate fire is out, because the retainer rate works out to roughly one-third the emergency rate when you factor in prepaid hours, and it includes the prevention work (tabletops, runbook drafting, carrier pre-clearance) that keeps the next incident smaller.
Don't wait until you need us at 3 AM.
Most of the calls we field are from companies whose IT lead just realized they have nobody to call. Get an IR retainer in place this week. The hotline number, the engagement letter, the carrier pre-clearance, the runbook. All of it on file before you need it. The base IR Retainer is $4,800 for the year, less than the price of a single emergency response hour after the fact.