Reference: IR Firm Pricing · Updated September 2026

Incident Response Firm Pricing: Who Publishes a Price, and What It Says

Most major DFIR firms route their pricing to "contact sales." Three of the eight here do not: IBM X-Force and Arctic Wolf list retainer and MDR prices on AWS Marketplace, and a reseller files the Sophos IR retainer on UK G-Cloud. This page gives you those published figures, and for the firms that publish nothing it gives the pricing model and the drivers that decide your quote.

Every price here is attributed to the surface that publishes it and carries a check date. Where a firm publishes no price, this page says so rather than estimating one: a guess at a vendor's undisclosed rate reads as a fact the reader cannot check, and it is not one we have.

The Firm Pricing Matrix

Firm	Published price	How it is priced	Specialism
MandiantGoogle Cloud	Not published	Prepaid hours	Tier-1 DFIR, authors of the M-Trends report
CrowdStrike ServicesCrowdStrike	Not published	Prepaid units	Falcon-integrated IR and proactive retainer
Kroll	Not published	Pre-purchased credits	Cyber risk retainer with breach notification services
CovewareVeeam	$1,880,612	$150,000	Ransomware negotiation and recovery specialist
Unit 42Palo Alto Networks	Not published	Prepaid hours	Palo Alto Networks DFIR and proactive retainer
IBM X-ForceIBM	$37K-$105K/yr	1 hr	Tier-1 DFIR retainer; authors Cost of a Data Breach
Sophos	GBP 2.32	200 users	Fixed-fee Rapid Response IR plus MDR (Secureworks Taegis)
Arctic Wolf	$44,000/yr	IR included	MDR with incident response included

Published prices from AWS Marketplace listings (IBM X-Force, Arctic Wolf) and filed Crown Commercial Service G-Cloud pricing documents (IBM X-Force, Sophos), each checked September 2026. Pricing models from the firms' own retainer data sheets. Coveware ransom figures from Coveware's Q2 2026 marketplace report. Updated September 2026.

Per-Firm Cost Pages

Mandiant (Google Cloud)

Not published

Tier-1 DFIR, authors of the M-Trends report

CrowdStrike Services (CrowdStrike)

Not published

Falcon-integrated IR and proactive retainer

Kroll

Not published

Cyber risk retainer with breach notification services

Coveware (Veeam)

$1,880,612

Ransomware negotiation and recovery specialist

Unit 42 (Palo Alto Networks)

Not published

Palo Alto Networks DFIR and proactive retainer

IBM X-Force (IBM)

$37K-$105K/yr

Tier-1 DFIR retainer; authors Cost of a Data Breach

Sophos

GBP 2.32

Fixed-fee Rapid Response IR plus MDR (Secureworks Taegis)

Arctic Wolf

$44,000/yr

MDR with incident response included

How to Read These Numbers

Most DFIR firms do not publish rate cards, because every engagement is scoped individually and price is a negotiation lever. That leaves two honest categories, and this page keeps them apart. Where a firm publishes, the figure is quoted as published and attributed to the surface that carries it: an AWS Marketplace listing or a filed G-Cloud pricing document, both public and checkable. Where a firm does not publish, the entry reads "not published" and the page gives the pricing model and the quote drivers instead.

Be wary of confident hourly rates for Mandiant, CrowdStrike, Kroll, or Unit 42 anywhere on the web, including in AI answers. None of the four publishes one, so any specific figure originated as somebody's estimate and acquired authority by being repeated. This page previously carried such estimates and no longer does.

The structural advice holds regardless of price. The biggest lever you control is having a retainer in place before the incident: across every firm here it is what contracts a first-response commitment and replaces emergency scoping with a drawn rate against prepaid hours or credits. The second is telemetry, because responders who inherit working endpoint visibility spend fewer hours establishing what happened.

Frequently Asked Questions

How much do incident response firms charge?

Most of them do not say. Of the eight firms covered here, three publish a citable price: IBM lists its X-Force IR Retainer at $37,000-$105,000 per year on AWS Marketplace and files three tiers on UK G-Cloud from GBP 24,158.67 to GBP 96,673.99, Arctic Wolf lists MDR Basic at $44,000 per year for up to 100 users on AWS Marketplace, and a reseller files the Sophos IR Retainer on G-Cloud 15 at GBP 2.32 per user for 12 months against a 200-user minimum. Mandiant, CrowdStrike, Kroll, and Unit 42 publish no hourly rate, no retainer fee, and no per-engagement figure. Any specific number you see attributed to those four is an estimate rather than a citation.

Which incident response firm is the cheapest?

That cannot be answered from public sources, because four of the eight firms here publish nothing to compare. What can be said is where the published floors sit: Arctic Wolf's $44,000 per year for up to 100 users and IBM's $37,000 per year entry retainer on AWS Marketplace are the lowest published annual commitments among the named firms, and both bundle more than reactive response. For a commodity ransomware case, a regional DFIR firm outside this list is often cheaper than any of them. The only reliable comparison is to put the same scope to several firms and compare written quotes.

Do I need a DFIR firm and a ransomware negotiator?

Often yes: a full-scope DFIR firm such as Mandiant, CrowdStrike, Kroll, or Unit 42 handles forensics, containment, and eradication, while a specialist such as Coveware handles ransom negotiation, sanctions screening, and payment logistics. The two roles are additive in cost and are quoted separately. Neither side of that pairing publishes a rate, so budget from written quotes rather than from a market average; the one figure that is documented is the ransom itself, which Coveware put at a $150,000 median and a $1,880,612 average in Q2 2026.

Is an MDR provider cheaper than an IR retainer?

An MDR provider such as Arctic Wolf bundles 24/7 monitoring with incident response into a subscription. Arctic Wolf publishes MDR Basic at $44,000 per year for up to 100 users on AWS Marketplace, with larger estates custom-priced, which is typically cheaper than building a SOC plus buying on-demand IR for organisations with no in-house security operations. A standalone IR retainer is quote-based and cheaper than MDR but only covers reactive response, not the proactive monitoring that MDR adds.