Skip to main content
VexaroSecurity
Incident response retainer

Incident response retainer & DFIR

When a breach hits, the clock is already running. A retainer sets out in advance how to reach us and guarantees how quickly we respond to investigate, contain and eradicate the threat and help you recover. The work follows NIST SP 800-61 Rev. 3 and can be engaged through your legal counsel.

Scope

Before, during & after an incident

Incident response covers preparation, detection and analysis, containment, eradication and recovery, and post-incident learning. NIST SP 800-61 Rev. 3 (2025) frames it across the six CSF 2.0 Functions: Govern, Identify, Protect, Detect, Respond and Recover. A retainer covers the readiness work up front and a fast response when something happens, so you are not negotiating scope in the middle of a breach.

Typical scope
  • Retainer with a guaranteed response-time SLA and a named escalation path
  • Preparation: IR plan review, playbooks and a readiness assessment
  • Detection & analysis: triage, scoping and forensic investigation (DFIR)
  • Containment, eradication and recovery support
  • Root-cause analysis and a post-incident lessons-learned report
  • Engagement through your legal counsel where you need it
How we work

A standards-based lifecycle

We align the work with NIST SP 800-61 Rev. 3 and the CSF 2.0 Functions, and map adversary activity to MITRE ATT&CK so the investigation is structured and the narrative is defensible. Where you need it, we can be engaged through your legal counsel.

  1. 1

    Preparation

    Before any incident, we review your IR plan, agree response times and escalation paths in writing, and sign an NDA.

  2. 2

    Detection & analysis

    On activation we triage, scope the incident and run the forensic investigation to establish what happened.

  3. 3

    Containment

    We help you contain the incident to stop the bleeding while preserving forensic evidence.

  4. 4

    Eradication & recovery

    We help remove the foothold, close the entry vector and bring systems back safely.

  5. 5

    Post-incident review

    We deliver a root-cause analysis and lessons-learned so the same path can't be used twice.

Deliverables

What you receive

Readiness up front, a defined response when it counts, and a written record afterwards that holds up when your board, your regulators or your insurer ask for it.

What you get
  • Retainer agreement with a response-time SLA and escalation contacts
  • IR readiness assessment and playbook review
  • Forensic investigation findings with a timeline of attacker activity
  • Attacker techniques mapped to MITRE ATT&CK
  • Containment, eradication and recovery guidance
  • Root-cause analysis and post-incident lessons-learned report
Methodology & standards

Aligned with NIST SP 800-61 Rev. 3 (CSF 2.0)

NIST SP 800-61r3DFIRMITRE ATT&CK (v19)Response-time SLAVia your counselLessons learned

The retainer is aligned with NIST SP 800-61 Rev. 3 (2025), which organises incident response around the CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, Recover). Our engagement phases run from preparation through detection and analysis, containment, eradication and recovery to post-incident review, with attacker activity mapped to MITRE ATT&CK. Where you want it, the engagement can be commissioned through your legal counsel; whether privilege applies is for your counsel to determine. Response-time commitments are set in the retainer agreement.

Agree your response in advance.

Tell us about your environment and risks. We'll propose a retainer with a guaranteed response time, review your readiness and be ready to investigate and contain an incident if one happens, all under NDA. The first consultation is free.