What Your IR Retainer Actually Covers (and What It Does Not)
You signed a retainer with a digital forensics and incident response firm. You have a contract, a phone number, and an SLA that promises someone picks up within four hours. Good. That covers a lot of organizations.
Here is what it does not cover: the decisions you will be making before the IR team even arrives, the forensic evidence that will disappear in the meantime, the scope creep that will push your bill past anything in the contract, and the communication expectations your board has that no retainer document ever mentions.
A retainer is a relationship, not an incident response plan. Most organizations treat it as the latter.
What You Actually Bought
A DFIR retainer typically includes pre-agreed hourly rates, some amount of pre-paid hours, a defined SLA for initial response, and legal privilege protection when the retainer is structured through your counsel (which it should be). It also includes access to people who know how to run an investigation, which is not a small thing.
What it does not include: someone who knows your environment. The firm has never seen your network topology, your naming conventions, your list of crown-jewel systems, or your authentication infrastructure. On the call at 2am, you will be explaining all of this to people who are starting from zero. Every hour they spend learning your environment is a billed hour.
Organizations that keep an inventory of their critical assets, maintain documentation of their logging infrastructure, and have a clear contact list ready do not necessarily have faster incidents. They have faster engaged IR teams. The difference is real.
The Response Time Misread
The SLA says four hours. Four hours to what, exactly? Usually four hours to initial contact and triage, not four hours to having analysts actively working in your environment. If you are on-premise and need forensic tools deployed, physical media shipped, or VPN access provisioned, the actual time to useful activity can be significantly longer.
Remote investigation capabilities have improved this substantially over the past few years. Most firms now have tooling that can be deployed remotely and work reasonably well. But "reasonably well" is not the same as having immediate command-line access to your domain controllers at 2am, and if your incident involves a heavily segmented network, a compromised VPN, or systems that are physically isolated, the SLA clock and the actual-work clock diverge.
The SLA should be understood as a floor for relationship engagement, not a ceiling for time-to-useful-investigation. Test it before you need it.
Where the Hours Go
Pre-paid retainer hours sound like a budget. They are not. They are a deposit against what the investigation will actually cost, which is usually more.
Scope in incident response is not controlled the way scope is controlled in a project. You do not know at the start how many systems are involved, how long the attacker has been present, or what artifacts are relevant. Every lead that is worth following extends the investigation. Every system that needs forensic imaging adds hours. Every finding that requires legal review pauses the technical work while people talk.
Organizations that have done tabletop exercises with their DFIR firm, worked through a realistic scope expansion scenario, and understood how hourly billing actually accrues go into real incidents with less financial surprise. Organizations that have never spoken to their retainer firm except to sign the contract do not.
Know your rate card. Know what triggers after-hours billing. Know whether travel time is billable. These are not exciting questions. The answers matter when you are on the phone authorizing work at midnight.
The Evidence That Is Already Gone
Most investigations are impaired by evidence problems that existed before the call was made. Logs that do not go back far enough. Network traffic that was not captured. Endpoint telemetry that was overwritten. Memory that was cleared when a system was rebooted before anyone thought to preserve it.
The IR firm did not make those decisions. They inherit the forensic environment as it exists when they arrive. If your logging retention is 30 days and the attacker has been present for 45 days, the firm cannot manufacture 15 days of missing logs. They can work around the gap, but the investigation is materially limited.
Forensic readiness is a pre-incident decision. What you capture, how long you retain it, and whether your endpoint tooling preserves volatile data are choices made in advance or not made at all. A retainer gives you skilled people to work with your evidence. It does not retroactively create evidence you chose not to collect.
Before You Need to Call
The practical preparation that makes a retainer actually useful:
Run a tabletop with the retainer firm. Not the scenario where everything goes perfectly, but the one where scope expands at 6am on a Saturday and three executives are calling asking for status. Know what the firm does and does not do under pressure.
Document your environment for external consumption. A network diagram, a list of critical systems, your authentication infrastructure, where your logs live and how far back they go. Keep it current. The first hour of an engagement goes to answering these questions if you have not answered them in advance.
Understand what is out of scope. Some retainer firms do not handle communications. Many do not handle legal privilege preservation on their own. Some require you to manage law enforcement relationships. Know the edges before you hit them.
Test the number. Actually call it, at a non-emergency time, and confirm the escalation path works. Numbers change. Contracts lapse. The number on the retainer document is only useful if it actually reaches someone.
A signed retainer is meaningfully better than no retainer. But the distance between "signed a retainer" and "actually prepared for an incident" is where most organizations are sitting, and that gap is visible the moment things go wrong.