Incident Response & Cyber Security Retainer
Key takeaways
- Scope, price band and delivery date are agreed in writing before any testing starts.
- Every finding ships with a reproduction step and a concrete fix, not a tool name.
- A one-page plain-English summary is included so non-technical decision makers can act.
- A retest after remediation is included and lists each finding as closed, partial or open.
- The report states what was tested and what was not, so you know the limits of the result.
What the engagement includes
24/7 help when something is already happening — and a retainer to stop it happening. The concrete scope depends on your estate, and we set it out line by line in the rules-of-engagement document before we begin.
- 24/7 emergency contact and triage call
- Containment, eradication and recovery guidance during an active incident
- Forensic preservation of logs, disk images and message artifacts
- Post-incident report with root cause and control gaps
- Retainer option with scheduled testing and priority response
What you receive
- Incident timeline built from your logs, with a reconstructed sequence
- Root cause analysis naming the control that failed
- Remediation and hardening plan, prioritised
- Board-ready incident summary for notification obligations
How the engagement runs
Every engagement follows the same sequence, because the sequence is what makes the result defensible. First a scoping call, where we look at your systems and tell you what a useful test would cover. Then a written rules-of-engagement document naming every system, every date, the test window, the contact, and what is explicitly out of scope. You sign it, we sign it, and both sides keep a copy. Testing happens only inside that window. Then the report, then your fixes, then the retest.
| Stage | What happens | What you get |
|---|---|---|
| Scoping | A call and, where needed, a short technical discovery | A written scope and a fixed price band |
| Authorisation | Rules of engagement signed by both parties | A document for your legal and insurance files |
| Testing | Manual and AI-assisted testing inside the agreed window | A live finding log you can ask about at any point |
| Reporting | Technical report plus a one-page executive summary | Prioritised findings with reproduction steps and fixes |
| Remediation | Your team fixes, we answer questions during the work | Support while the fixes are in flight |
| Retest | We re-test what we raised | A retest certificate per finding |
How we price it
₹1,50,000 – ₹9,00,000 per year, or per-incident from ₹35,000 is the indicative band for a typical scope of this type. The final figure depends on the number of assets, the depth of authentication, the number of environments, and whether the engagement includes remediation support. We quote a fixed price, not an hourly one, and we confirm it in writing before work starts.
Common questions about this service
Request a scoped quote for incident response & retainer
Send us the scope you have in mind — the number of applications, the number of users, the environments, and the deadline you are working to. You will get a fixed price and a start date.
Request a quote See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.