Incident response pricing works differently from a scheduled assessment, because timing, uncertainty, and severity all drive the number in ways a planned engagement doesn't have to deal with.
An active incident can't wait for a lengthy scoping process the way a scheduled assessment can. We move on containment first and finalize paperwork alongside the work, with pricing based on severity and time-to-containment rather than a pre-agreed flat fee negotiated in advance.
This isn't unique to us — it reflects the nature of incident response generally. Anyone promising a fixed, pre-negotiated price for an incident of unknown scope and severity is either padding the estimate heavily or setting an expectation they can't actually meet.
Scope is the largest driver: how many systems are affected, how deeply the compromise has spread, and how quickly it was detected all shape the total effort required.
Whether forensic evidence preservation is needed — for legal proceedings, insurance claims, or regulatory reporting — adds real time and specialized handling, and should be budgeted for if there's any chance you'll need documented, defensible evidence later.
Retainer-style incident response arrangements, where scope and rates are pre-agreed before anything happens, can meaningfully reduce both cost and response time when an incident does occur, since there's no negotiation happening under crisis conditions.
Retainers also mean the response team already has some familiarity with your environment before day one of an incident, which speeds up triage considerably compared to a completely cold start.
Yes. A pre-agreed retainer means faster activation and clearer pricing if an incident happens, instead of negotiating terms during a crisis when leverage and time are both working against you.
Many cyber insurance policies do cover incident response costs, though coverage details vary significantly by policy. It's worth confirming your specific coverage and any required response-vendor approvals before an incident happens, not during one.
Response engagements scale to the actual scope of the incident — there's no artificial minimum, though very small, contained incidents naturally cost less than widespread compromises.