Home / Security Operations / Incident Response

Incident
Response

Rehearsed playbooks and hands-on help when it counts — containment, eradication, recovery, and a clear post-incident review. Available as a retainer with a guaranteed SLA so you are never starting from scratch.

Pricing Contact us Book a call
Overview

Be ready before the breach.

When an incident hits, the cost is decided in the first hours — by whether you have a plan, the right people, and a way to reach them fast. Incident response readiness turns chaos into a practised drill.

We help you prepare (plans, playbooks, and tabletop exercises) and respond (containment, forensic investigation, recovery, and breach-notification guidance). An IR retainer with a guaranteed SLA means expert help is one call away.

Coverage

What we deliver.

Preparation and response, before and during an incident.

Aligned to: NIST SP 800-61 SANS PICERL MITRE ATT&CK
FAQ

Incident response FAQ

The questions we're asked most about scope, cost, and timing.

How much does an incident response retainer cost?
An IR retainer is typically €5,000–10,000 per year, including an annual tabletop and plan review, plus priority access during incidents. Emergency response is scoped per engagement.
What is an incident response retainer?
A pre-arranged agreement that guarantees you priority expert help with a defined SLA when an incident occurs, plus preparation like plan reviews and tabletops.
Do you help during an active breach?
Yes — we provide hands-on containment, investigation, and recovery, whether or not you hold a retainer (retainer clients get guaranteed priority).
What does incident response include?
Containment, eradication, forensic investigation, recovery support, breach-notification guidance, and a post-incident review with lessons learned.
How quickly can you respond?
Retainer clients get a guaranteed response SLA agreed up front; we prioritise active incidents.
Do you run tabletop exercises?
Yes — realistic, scenario-based exercises that test your plan and decision-making before a real incident.
Can you help with breach notification?
Yes — we guide regulatory and customer notification (e.g. under GDPR and NIS2), though we are not a substitute for your legal counsel.
How does this relate to managed security?
Incident triage is part of managed security and MDR; this service adds rehearsed plans and guaranteed hands-on response for serious incidents.
Related services

Explore more.

Parent serviceSecurity Operations→ RelatedManaged Detection & Response→ RelatedRansomware Readiness→ RelatedAdvisory→

Ready before the breach?

A 30-minute scoping call costs nothing. An unplanned response costs considerably more.

Book a meeting Send an email