Retainer Hours

Pre-purchased hours available for emergency incident handling, proactive advisory, digital forensics & malware analysis, and tabletop exercises & training. Unused hours can be rolled over or repurposed for proactive activities.

24x7 Incident Hotline

A dedicated incident reporting hotline and email contact available 24/7/365 for initiating support under the retainer.

Emergency Incident Response

Upon activation: initial triage and scoping, rapid deployment of remote or on-site incident handlers, containment, eradication, and recovery guidance, and coordination with third parties.

Digital Forensics and Malware Analysis

Evidence collection and preservation, memory and disk analysis, reverse engineering of malware, and identification of attack vectors, TTPs, and IOCs.

Threat Intelligence Support

Real-time contextual intelligence on threats affecting the organization, correlation of incident data with global threat feeds, and attack attribution where possible.

Post-Incident Reporting

Detailed incident report including timeline, root cause, impact analysis, and recovery steps. Executive Summary and lessons learned included.

Proactive Services (Optional)

Threat Hunting Exercises, Tabletop Simulations, Playbook Development, IR Plan Review, Purple Teaming.

• EDR/XDR integration (CrowdStrike, SentinelOne, Microsoft Defender, etc.)
• SIEM integration (Splunk, QRadar, Azure Sentinel, etc.)
• Forensic tools (Volatility, Autopsy, FTK, EnCase)
• Case Management (ServiceNow IR Module or Secure Portal)