- Home
- Incident Response & Forensics
- IR retainer
Agree the terms before the breach,
not during it.
A Mjolnir Response retainer puts our team on contract before you need it: terms agreed, a guaranteed response time, and readiness work done in advance. Three tiers, Shield, Fortress and Valhalla, with guaranteed response from four hours down to one.
The difference between a call and a negotiation.
Without a retainer, engaging an incident response firm means agreeing scope, terms and legal frameworks while the attacker is still inside. That delay is measured in hours you do not have. A retainer removes it: the paperwork is done, the response time is guaranteed, and the team answering already knows who to call on your side.
Every tier starts with an onboarding assessment of your environment, your escalation contacts and the systems that matter most, so the first call is about the incident, not about your network diagram. The tiers differ in guaranteed response time, how often we exercise with you, and how much proactive work is included.
- Engagement terms agreed in advance, so the response starts on the first call
- A guaranteed response time set by your tier, starting the moment you contact our incident team
- An annual onboarding and environment assessment, so we know your estate before the first call
- Incident response playbooks reviewed or written for your environment
- Tabletop exercises and compromise assessments scaled to your tier
- Priority over organizations calling without a retainer
From signature to standing by.
Choose a tier
We scope the tier against your risk, your regulators and your team, then agree the terms once.
Onboard
We learn your environment, your contacts and your crown jewels, and write or review the plan with you.
Drill
We exercise the plan with your team on the cadence your tier sets, and update it as you change.
Respond
When something happens, you contact our incident team and the team that already knows you mobilizes at agreed terms.
Three service levels,one team.
The tiers describe service levels. Pricing is scoped to your environment; request it and an engineer will walk you through it. Every tier includes everything in the tier before it.
Shield
For lean IT teams who need a team on call and a plan on file.
- Engagement terms agreed in advance
- Guaranteed response: 4 hours in business hours, 8 hours after hours
- Annual onboarding and environment assessment
- Incident response playbook review and recommendations
- A named account manager
- Priority over organizations without a retainer
- A monthly bank of hours for advisory use
Fortress
For regulated mid-market organizations that must show they are ready.
- Everything in Shield
- Guaranteed 2-hour response, 24/7/365
- Tabletop exercises twice a year
- Quarterly threat briefings for your industry
- Custom incident response playbooks, up to three scenarios
- An annual compromise assessment
- Direct access to senior incident responders
- Cyber insurance liaison and documentation support
Valhalla
For critical infrastructure and organizations where downtime is not an option.
- Everything in Fortress
- Guaranteed 1-hour response, 24/7/365
- Guaranteed on-site deployment within 12 hours
- Quarterly tabletop exercises
- Unlimited incident response playbook development
- Compromise assessments twice a year
- A dedicated incident response lead for your account
- Executive and board-level incident briefings
- Law enforcement liaison coordination
- Threat intelligence and indicators of compromise fed into your defences
Who it is for
Every organization that would rather make the call than run a procurement process mid-incident. Shield suits lean IT teams, Fortress suits regulated mid-market organizations, and Valhalla suits critical infrastructure operators and anyone who needs a responder on site fast.
- Incident response, what the retainer puts on call
- Tabletop exercises and playbooks, the plan, written and rehearsed
- Cyber war gaming, Vigriðr, stress-test the plan with real ransomware
- MSOC, 24/7 monitoring alongside your retainer
What buyers ask.
We'll deal with it if it happens.
Then you will be signing contracts while your business is down. A retainer means the team answers first, at agreed terms, and already knows your environment.
Our cyber insurer already gives us a panel firm.
Check what that panel actually guarantees: response time, priority and whether anyone has seen your environment before. A retainer gives you all three, and we work alongside your insurer when a claim is involved.
How much does it cost?
It depends on tier and environment, so we scope it rather than publish a rate card. Request pricing and an engineer will walk you through the options, no charge.
Can we move between tiers?
Yes. Many organizations start with Shield and move up as their regulators, insurers or board ask for more evidence of readiness.
Put the team on contract before you need it.
Tell us about your environment and we will recommend a tier and send pricing. No charge, no commitment.