Retainer Detect, respond, recover
Incident response retainer (IRaaS)
When an incident hits, the first hours set the cost. With a retainer, you make one call, and a specialist IR team that already knows your estate gets to work.
- Hotline
- 24/7one number, answered by the IR team
- Partner
- Specialistdedicated IR firm, coordinated by ITB
- Remote response
- [x] hoursfrom your call
- On site
- [x] hourswhere it's needed
01 / The problem
The worst time to find an IR team is during the incident.
The first hours decide the cost
Every hour an attacker stays in, more data leaves and more systems are encrypted.
Hiring help mid-incident is slow
Contracts, scoping and access all take time you don't have, while the attacker keeps going.
Everyone wants answers at once
Your board, your insurer and possibly the ICO all need facts quickly, and you need someone gathering them.
02 / What’s included
Ready before it happens. Fast when it does.
Readiness onboarding
We map your estate, key systems, contacts and suppliers before anything goes wrong.
IR plan and playbooks
An incident response plan, plus playbooks for the likely cases: ransomware, email compromise, data theft.
Pre-staged tooling
Investigation tools agreed and ready to deploy, so we start work on the first call.
Response and containment
Our IR partner triages, contains the attacker and removes their access, with ITB and your IT team or MSP alongside.
Forensics and root cause
The partner's forensic team establishes how they got in, what they touched and what left, with evidence kept properly.
Recovery and reporting support
We guide the return to normal and give you the facts your insurer and the ICO will ask for.
[Placeholder: offer for this service, written by ITB]
03 / How it works
From signed retainer to lessons learned.
- Onboard We learn your estate, agree contacts and access, and pre-stage our tools.
- Prepare We write or review your plan and playbooks, and can run a tabletop exercise to test them.
- Respond You call, the IR team triages, then contains, investigates and removes the attacker. We stay alongside.
- Recover and learn We help restore services, then report what happened and what to change.
Nobody wants to be negotiating a contract while the servers encrypt. Sign it now.
How ITB runs incident response
04 / Why ITB
Call a team that already knows you.
A retainer turns a cold call to a stranger into a call to people who've seen your network, your plan and your contacts. We deliver it with a specialist incident response firm: they bring the dedicated IR and forensic team, we bring what we know about your estate, and we coordinate between you, them and your IT.
| What it takes | Find help mid-incident | With an ITB retainer |
|---|---|---|
| Getting started | Contracts and scoping while the attack runs | Agreed in advance |
| Knowing your estate | Learned on the day | Mapped at onboarding |
| Tooling | Deployed after the call | Pre-staged |
| Response time | Whatever's available | [x] hours, agreed in writing |
| Insurer and ICO evidence | Gathered after the fact | Collected as we go |
· 05 / Questions
IRaaS, plainly answered.
Q01 What do we get before anything goes wrong?
Onboarding, an agreed plan and playbooks, and our tools pre-staged on your estate. That preparation is what lets us start work on the first call rather than the third day.
Q02 How quickly will you respond?
Remote response starts within [x] hours of your call, and on-site within [x] hours where it's needed. Both are written into the retainer.
Q03 Who actually responds?
Our specialist incident response partner, a dedicated IR and forensics firm. We onboard you with them, brief them on your estate and stay involved throughout, so you aren't managing a stranger mid-incident.
Q04 Do we need to be a SOC customer?
No. If you are, our SOC hands over to the IR team with the context already gathered. If you're not, onboarding gives us the same starting point.
Q05 We have cyber insurance. Do we still need this?
Possibly. Many policies include a panel of approved responders, and some set conditions on who you can use. Tell us at onboarding and we'll check how a retainer works alongside your policy.
Q06 Will you report the breach to the ICO for us?
Under UK GDPR, a personal data breach that's likely to risk people's rights must be reported to the ICO within 72 hours of you becoming aware. The decision and the report are yours. We give you the facts and timeline to make them.
Related services
Managed SIEM / SOC
Detects the incident and hands it straight to IR.
See the serviceBackup & DRaaS
The clean copies recovery depends on.
See the serviceSecurity Control Validation & Red Teaming
Tabletop wargames that rehearse your plan.
See the serviceEDR / XDR / MDR
The endpoint tooling that makes containment fast.
See the service· [Placeholder]
[Placeholder] [Placeholder]
[Placeholder: written by ITB]