In short
An incident response retainer is a subscription that lines up specialist responders before a cyber attack, with terms agreed in advance, and usually lets you use unspent time on readiness work such as IR plans and tabletop exercises. Forever Systems supplies the Cisco Talos Incident Response and Sophos retainers, and MDR services with incident response included.
Get a quote for an incident response retainer plan
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What is an incident response retainer?
When ransomware, business email compromise or a data breach hits, most organisations do not have digital forensics and incident response (DFIR) specialists on the payroll. Finding a firm, agreeing a contract, sorting out scope and getting software deployed can eat up the first critical hours.
A cyber incident response retainer removes that delay. You agree a subscription with an incident response provider ahead of time, covering:
- Emergency response when an incident happens: coordination, investigation, forensics, containment advice and remediation guidance
- Pre-agreed terms, so the legal and commercial paperwork is not holding things up during an attack
- Proactive services you can use in a quiet year, such as readiness assessments, IR plans, playbooks and tabletop exercises
Think of it as having the specialists' details, contract and onboarding already sorted, rather than searching for help at the worst possible moment.
Reactive and proactive use
Good retainers are designed so the investment is not wasted if you have no major incident. Typical services split like this:
| Reactive (during an incident) | Proactive (before an incident) |
|---|---|
| Emergency incident response and coordination | IR readiness assessment |
| Digital forensics and malware analysis | Incident response plan, written or reviewed |
| Compromise assessment and scoping | Playbooks for ransomware, business email compromise and other likely threats |
| Threat hunting across the affected environment | Tabletop exercises for leadership and technical teams |
| Post-incident report and recommendations | Log architecture review to close visibility gaps |
What you can use, and how hours or units are counted, depends on the provider and the retainer level. We go through the service description with you so you know what is included before you sign.
Not sure which plan fits? Ask us
Tell us what you need and we will recommend the right plan for your organisation, with a quote.
Retainers and IR services we supply
Forever Systems does not provide incident response itself. We supply retainers and services from vendors with established IR teams, help you choose and set them up, and stay involved as your coordinator.
| Option | What it gives you | Read more |
|---|---|---|
| Cisco Talos Incident Response retainer | Emergency response plus proactive services: readiness assessment, IR plan, playbooks, log architecture assessment, tabletop exercises, threat hunting, compromise assessment and more; also included in Cisco XDR Premier and Breach Protection Suite Premier | Cisco Talos Incident Response |
| Sophos incident response retainers | The Incident Response Services Retainer gives on-demand access to Sophos's DFIR responders, a discount on emergency response, an external vulnerability scan and a health check; the broader Security Services Retainer adds prepaid Service Units for testing and readiness work | Sophos incident response retainer |
| Sophos Emergency Incident Response | Sophos's emergency DFIR service (formerly Sophos Rapid Response) for organisations already under attack, Sophos customers or not | Sophos Emergency Incident Response |
| Sophos MDR Plus | 24/7 MDR with full-scale incident response, a dedicated incident response lead and root cause analysis | Sophos MDR |
| Check Point MDR | 24/7 MDR with incident response included in the service | Check Point MDR |
| Perception Point | Email, browser and Microsoft collaboration security in which every subscription includes a 24/7 managed incident response service | Perception Point |
If you already have, or are buying, an MDR service with IR included, check what that entitlement covers before adding a separate retainer. Our vendors page compares the services.
Retainer or MDR with IR included?
These are different things, and many organisations end up with both.
| MDR with incident response | Standalone IR retainer | |
|---|---|---|
| Main job | 24/7 monitoring, detection and containment | Expert investigation and recovery support for serious incidents |
| When it acts | Continuously, as alerts arrive | When you invoke it, or for planned readiness work |
| Scope | The tools and data connected to the MDR service | Usually your whole environment, including systems the MDR service cannot see |
| Best for | Stopping attacks early | Major incidents, forensics, insurer and regulator reporting, and preparation |
MDR reduces how often you need a retainer; a retainer covers what MDR cannot, such as a breach that started on an unmonitored system or before the service was in place. See cyber security monitoring services for the monitoring side.
Is an incident response retainer plan the right fit for you?
We will check it against your systems and requirements and recommend the right option.
UK reporting duties to plan for
An incident is a legal and regulatory event as well as a technical one. A retainer and a written plan help you meet these duties on time:
- UK GDPR: personal data breaches that pose a risk to individuals must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware. Since 30 September 2026 the regulator has been the Information Commission, still known as the ICO.
- NIS Regulations 2018: operators of essential services must notify their competent authority without undue delay and no later than 72 hours after becoming aware of a NIS incident; see the NIS Regulations.
- Cyber Security and Resilience Bill: at the time of writing it is not yet law. The government's factsheets describe an initial notification within 24 hours and a full report within 72 hours for regulated entities, including relevant managed service providers; see what the Bill means for MSPs.
- NCSC: the National Cyber Security Centre runs an incident reporting service for significant cyber incidents affecting UK organisations.
- FCA-regulated firms: the FCA's new operational incident and third party reporting rules (PS26/2) come into force on 18 March 2027; see FCA operational resilience.
- Cyber insurance: policies can set their own notification requirements and may name approved responders, so check your policy before choosing a retainer.
The evidence gathered during a response, such as the timeline, data affected and containment steps, is what these reports are built from. Good logging makes it far easier; see SIEM as a service.
How Forever Systems helps
- We review your current position: any MDR service and its IR entitlement, your cyber insurance terms and any regulatory reporting duties.
- We recommend a retainer, an MDR service with IR included, or both, and explain what each covers.
- We help with onboarding so the provider has your contacts and environment details on file before anything happens.
- We can help you plan proactive hours, such as a tabletop exercise or an IR plan review, so the retainer earns its keep.
- During an incident we work alongside the responders as your coordinator, and afterwards we help close the gaps they identify.
Recovery often depends on backups an attacker could not reach; Forever Group's cloud backup can help with that. Retainer costs depend on the provider, the level and the proactive services you want, so ask us for a quote and contact us.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What is an incident response retainer?
An incident response retainer is a subscription with a specialist incident response provider, agreed before an incident. It gives you emergency response on pre-agreed terms and often includes proactive services such as IR plans, playbooks and tabletop exercises.
Do I need an incident response retainer if I have MDR?
Possibly. MDR monitors and contains threats on the systems it can see. A retainer brings forensic experts for serious incidents across your whole environment. Some MDR services, such as Sophos MDR Plus and Check Point MDR, include incident response, so check what yours covers first.
What happens to unused retainer hours?
It depends on the provider. Retainers such as Cisco Talos Incident Response are designed so time can go on proactive services, such as readiness assessments and tabletop exercises, when you have no emergency.
How quickly do I have to report a cyber incident in the UK?
Under UK GDPR, reportable personal data breaches go to the ICO without undue delay and, where feasible, within 72 hours. Operators of essential services under the NIS Regulations have 72 hours. Your insurer and contracts may set shorter deadlines.
How much does an incident response retainer cost?
It depends on the provider, the retainer level, the hours or units included and any proactive services. Ask us for a quote and we will compare the options.
Still have a question about an incident response retainer plan?
Ask us and a member of our team will reply by email.