Worked costings and choosing a provider
Incident-response retainer pricing: prepaid hours, response times and unused hours
How cyber incident-response retainers are priced in Australia, zero-fee versus prepaid models, an illustrative incident costing, insurer panel issues and contract points.
An incident-response (IR) retainer is an agreement, made before anything goes wrong, that gives you access to responders at agreed rates and response times. It is usually priced as an annual fee converted into prepaid hours, a zero-fee retainer with pre-agreed terms and rates but no guaranteed hours, or a subscription bundled into an MDR or managed security service. In the illustrative example below, a $6,000 retainer for 20 hours at a discounted rate reduces the cost of a 60-hour incident from $22,800 to $18,000 and, more importantly, removes the delay of finding and contracting a responder during a crisis.
This guide supports the selection method. Read it with the first 72 hours of a ransomware incident and cyber insurance. Figures are illustrative, ex GST.
Retainer models compared
| Model | How it works | Good for | Watch out for |
|---|---|---|---|
| Zero-fee retainer | Contract and rates agreed in advance; no annual fee; you pay only if you call | Businesses that want paperwork done before a crisis without upfront spend | Response time may be "best efforts"; no priority over paying clients |
| Prepaid hours | Annual fee buys a block of hours at a discounted rate | Most SMBs wanting priority and predictable rates | Unused hours may expire; check if they convert to other services |
| Subscription with SLA | Monthly fee for guaranteed response times, often with some hours included | Businesses with high downtime cost or contractual obligations | Higher cost; check what "response" means |
| Bundled with MDR | Provider includes a number of IR hours or "unlimited containment" | Simplicity, one provider | Containment is not full investigation, recovery or breach assessment |
What an IR retainer should include
- Response time. For example: phone contact within 1 hour, remote work starting within 4 hours, on-site within 24 hours (if needed). Write down which of these the SLA guarantees.
- Hours and rates. Prepaid hours, the rate for extra hours, any after-hours or weekend premiums and minimum charges.
- Scope of services. Triage, containment, forensic investigation, recovery support, evidence preservation, and support for the Privacy Act 30-day assessment and any 72-hour ransomware payment report.
- Onboarding. A short readiness review so responders know your environment before an incident.
- Unused hours. Whether they roll over or convert to a tabletop exercise, a plan review or training.
- Legal privilege. Whether the responder can be engaged through your lawyer, which some businesses do to protect advice. Take legal advice on this.
Illustrative incident costing
A business suffers a ransomware incident that needs 60 hours of responder time over the first week: triage, containment, forensic imaging of two servers and five laptops, scoping what data was accessed, and recovery support.
| Scenario | Calculation | Cost |
|---|---|---|
| No retainer, standard emergency rate of $380 an hour | 60 × $380 | $22,800 |
| Retainer: $6,000 for 20 hours at $300 an hour, extra hours at $300 | $6,000 + 40 × $300 | $18,000 |
| Saving on this incident | $22,800 − $18,000 | $4,800 |
In a year with no incident, the retainer costs $6,000. If unused hours can be converted into a tabletop exercise and an incident response plan review, that money still buys preparation. If they simply expire, the retainer works more like insurance for priority access.
The real value is time. Without a retainer, the first hours of an incident can be spent finding a firm with capacity, agreeing terms and giving them access. In a ransomware case, those hours matter.
Retainers and cyber insurance
Many cyber insurance policies include incident response services through the insurer's panel of approved firms, and some require you to use the panel or get consent before engaging another firm for the costs to be covered. Before buying a retainer:
- Read your policy or ask your broker whether you must use the insurer's panel.
- If your preferred responder is not on the panel, ask whether the insurer will approve it in advance.
- Make sure your incident plan says who calls the insurer and when; notification deadlines in the policy can be short.
- Check whether the retainer fee or the excess (deductible) fits together sensibly.
Duplicating cover is common: a business pays for a retainer that its insurer would not reimburse and also has panel access it never uses. See cyber insurance and managed security.
Renewal and price
IR retainers usually renew each year. If the provider raises the rate, the uplift calculator shows the effect: a $6,000 retainer with an 8% uplift becomes $6,480 ex GST, or $7,128 including GST.
Frequently asked questions
Is an IR retainer worth it for a 10-person business?
A zero-fee retainer, or panel access through cyber insurance, is often enough at that size. Free help is also available: the Australian Cyber Security Hotline (1300 CYBER1) and, for businesses with 19 or fewer employees, IDCARE's Small Business Cyber Resilience Service.
Does my MDR provider handle incident response?
It usually contains threats. Forensic investigation, breach scoping and recovery are often extra. Ask the provider to show where containment ends and billable IR begins.
Can unused hours be refunded?
Rarely. Negotiate conversion into preparation services instead.
Should the retainer be with a different firm from my MSSP?
There are arguments both ways. A separate firm gives an independent view of what went wrong, including any failure by the MSSP; the same firm already knows your environment. Some businesses choose a separate IR firm for that reason.
Sources
- ASD's Australian Cyber Security Centre — incident response planning and reporting a cyber incident
- IDCARE — Small Business Cyber Resilience Service for businesses with 19 or fewer employees
- business.gov.au — what to do if your business is hit by a cyber attack
- Australian Financial Complaints Authority — complaints about insurance claims, including for small businesses
