Forensics and Investigation Cost: DFIR Rates, Scope, and eDiscovery in 2026
Forensics and investigation cost is one of the dominant line items in any major incident-cost stack. The cost decomposes into three independent components: Digital Forensics and Incident Response (DFIR) firm time, eDiscovery for litigation-bound data, and expert-witness work for the long-tail litigation that follows most major incidents. Each has its own commercial structure, retainer dynamics, and cost-control discipline. What none of them has is a public rate card: the major DFIR firms quote per engagement and publish no hourly rate, so this page sets out what determines the size of the bill and which figures in this market are actually citable.
What the DFIR Market Actually Publishes
There is no public DFIR rate card. The major firms scope every engagement individually and treat price as a negotiation lever, so an hourly rate is something you obtain in a written quote, not something you can look up. The figures that are citable come from firms selling through public procurement surfaces, where a listed price is a condition of the channel. Those are worth knowing because they bound the annual-commitment end of the market, even though none of them is an hourly rate.
| Firm | What is published | Surface | Notes |
|---|---|---|---|
| IBM X-Force | $37,000-$105,000/yr retainer | AWS Marketplace listing | Prepaid response hours plus Proactive Service Units; no hourly rate published |
| IBM X-Force (UK) | GBP 24,158.67 / 55,897.93 / 96,673.99 | Filed G-Cloud 14 pricing document | 50 / 150 / 250 hours; triage within 4 hours on Tier 1, 1 hour on Tiers 2 and 3 |
| Arctic Wolf | $44,000/yr, up to 100 users | AWS Marketplace listing | MDR Basic; response bundled with 24/7 monitoring |
| Sophos | GBP 2.32 per user / 12 months | Filed G-Cloud 15 pricing document | 200-user minimum; reseller cost line, not a Sophos customer list price |
| Mandiant, CrowdStrike, Kroll, Unit 42 | Nothing | Data sheets describe structure only | No hourly rate, retainer fee or per-engagement figure; quoted per engagement |
AWS Marketplace and Crown Commercial Service G-Cloud listings, checked September 2026. Per-firm pricing models and quote drivers: IR firm pricing matrix.
What moves your forensics bill is therefore scope, not a published rate. The levers worth negotiating before an incident are the ones below.
| Driver | Why it moves the bill |
|---|---|
| Retainer in place | Contracts a drawn rate and a triage SLA in calm conditions instead of scoping under pressure, and reserves capacity that tightens market-wide during large simultaneous campaigns. |
| Surviving telemetry | Endpoint and log coverage that predates the incident is the single biggest reducer of consultant hours; without it, responders rebuild visibility before they can investigate. |
| Dwell time and blast radius | Hours scale with systems touched and how long the intruder had. Mandiant M-Trends 2026 puts global median dwell at 14 days, and at 26 days where an outside party raised the alarm. |
| Litigation-bound scope | Evidence handled to a forensic standard for later litigation costs more than the same investigation run purely for remediation. |
| Regulatory reporting load | Regulated data and multi-jurisdiction notification add consulting time beyond the technical investigation. |
Surcharges and pass-through costs are where an engagement quietly exceeds the headline rate, and they are negotiable terms rather than published ones. Ask explicitly whether out-of-hours work during an active incident window carries an uplift, how travel time is billed, and whether on-site dispatch expenses are charged on top. IBM, for example, states that travel and living expenses are billed on top of its filed G-Cloud prices. Get each of these into the engagement letter before work starts, because an active multi-day incident is the worst possible moment to discover them.
Scope-of-Work Cost Bands
Total forensic investigation cost is the function of hourly rate and total hours, which in turn is the function of investigation scope. The following bands are typical for 2026 engagements.
| Engagement Scope | Total Cost Range | Typical Duration | Notes |
|---|---|---|---|
| Single-endpoint targeted investigation | $25K-$75K | 3-10 days | Compromise of single workstation; exfiltration determination |
| Mid-scope multi-system investigation | $75K-$300K | 2-5 weeks | 10-50 endpoints, network forensics, persistence sweep |
| Large enterprise investigation | $300K-$2M | 1-3 months | Multi-region, multi-vector; persistence-aware investigation |
| Nation-state-class long-running investigation | $5M-$25M+ | 3-12+ months | SolarWinds, Storm-0558-class; adversary-tracking |
| PCI Forensic Investigator (PFI) | $50K-$300K | 2-6 weeks | Mandatory after card-data breach; defined scope per PCI SSC |
| Cyber-insurance triage | $10K-$50K | 1-2 weeks | Initial triage paid by carrier panel firm |
eDiscovery Cost
eDiscovery cost is the cost of identifying, preserving, collecting, processing, hosting, and reviewing electronically stored information for legal proceedings. For incidents that go to litigation (which is most major incidents within 2-5 years post-event), eDiscovery cost can equal or exceed the original forensic-investigation cost. eDiscovery work is priced per gigabyte rather than per hour, with separate rates for each phase of the EDRM lifecycle.
| EDRM Phase | Pricing | Notes |
|---|---|---|
| Identification and preservation | Project-based $10K-$100K | Legal-hold notices, custodian interviews, data-source mapping |
| Collection | $50-$200/GB | Forensic imaging or remote collection at scale |
| Processing | $25-$200/GB | Indexing, deduplication, metadata extraction |
| Hosting and review platform | $5-$50/GB/month | Relativity, Everlaw, Disco; year-long matters incur 12 months of hosting |
| Document review (managed) | $1-$5 per doc | Managed-review attorneys at lower rates; AI-assisted review continuing to compress cost |
| Document review (outside counsel) | $25-$200 per doc | Privilege review, key-document review by trial team |
| Production | $0.05-$0.20 per page | Bates labeling, redaction, format conversion |
For a typical 500GB matter (a moderate-size cyber-litigation matter with 5-7 custodians), total eDiscovery cost runs $200K-$2M depending on review intensity. AI-assisted review (technology-assisted review, predictive coding, GenAI-augmented review) has materially compressed review cost since 2022; well-managed AI-assisted review programs can reduce review cost 60-80% versus traditional first-pass linear review while maintaining defensible accuracy.
Expert-Witness Cost
Cyber-incident litigation almost always involves expert witnesses on both sides. Plaintiff and defense each typically retain their own technical expert plus a damages expert, and may add specialist experts on regulatory compliance, threat actor attribution, or cybersecurity standards of care. Expert engagement is one of the most consistently priced services in the cyber-litigation cost stack.
| Expert Type | Hourly Rate | Total Engagement Cost |
|---|---|---|
| Technical expert (DFIR, security architecture) | Not published | Quoted per matter |
| Damages expert (economist, financial) | $400-$1,200/hr | $150K-$1M typical |
| Regulatory compliance expert | $400-$1,000/hr | $100K-$500K typical |
| Threat-actor attribution expert | Not published | Quoted per matter |
Class-action matters involving multiple competing experts can reach $5M+ in expert fees. Major precedent matters (Equifax, Yahoo, Anthem long-tail) have produced expert fees in the $10M+ range. Expert work is typically not capped under defense costs (in cyber insurance terms) so the cost is borne by the defendant in addition to the underlying loss.
Retainer Economics
The DFIR retainer is one of the most consistently positive-ROI investments in any security budget. The arithmetic is robust across firm tier and organisation size.
- Annual retainer cost: published only by a minority of firms; IBM lists $37K-$105K/yr on AWS Marketplace, most others quote per organisation
- Hourly rate discount: firms confirm a retained rate sits below the emergency rate but publish neither, so ask for both figures in writing
- Response SLA: whatever your retainer contracts; IBM files four-hour triage on its entry tier and one hour on its upper two
- Pre-engagement value: tabletop exercises, IR plan review, threat-model alignment all included or discounted
- Scope-creep control: existing relationship makes scope discussions more efficient and less adversarial
For an organisation with even moderate incident probability (per IBM CODB 2025, organisation-wide incident probability over a 5-year window runs 25-35% across most sectors), the retainer pays for itself on the first activation. The full response cost analysis covers retainer economics in greater depth.