IR Firm Reference · Updated September 2026

Kroll Incident Response Cost: What You'll Actually Pay

Kroll runs one of the highest case volumes in the industry and is known for a flexible Cyber Risk Retainer whose credits span far more than incident response. It also offers breach-notification and victim services that many pure-DFIR firms outsource. Kroll publishes the retainer mechanic in detail, including the credit model and the rollover allowance, but it publishes no hourly rate and no retainer price. This page states no dollar figure for Kroll, because Kroll states none.

How much does Kroll cost? Kroll does not publish an hourly rate or a retainer price. What it does publish is the commercial mechanic, and in more detail than most of its peers: the retainer is bought as service credits, eligible credits can be applied across Kroll's wider risk menu rather than incident response alone, and up to 20 percent of unused credit rolls into the following year at renewal. Breach notification is quoted separately on record count. Your number comes from a written quote sized to your estate and the credit block you buy.

Not published

Rate card

Pre-purchased credits

Retainer structure

Up to 20%

Unused credit rollover

Notification in-house

Breach services

Prices shown here are quoted as published and attributed to the surface that carries them, an AWS Marketplace listing or a filed G-Cloud pricing document, with a check date. Where this firm publishes no price, the entry reads "not published" and the quote drivers are given instead; we do not estimate a vendor's undisclosed rate. Always get a written quote for your estate.

Pricing Models

Model	Cost	Notes
Emergency DFIR (no retainer)	Not published	Scoped per incident. Kroll markets case volume and responder bench depth rather than a published rate.
Cyber Risk Retainer (pre-purchased credits)	Not published	Credits are usable across cybersecurity, regulatory compliance, financial crime, and other Kroll practice areas, not just IR. Up to 20 percent of unused credits roll over at renewal.
Retained rate against credits	Not published	Retainer holders draw against credits during an incident instead of being scoped from cold.
Breach notification and call centre	Priced per record / per project	Mailing, call-centre operations, and credit-monitoring co-ordination, quoted on record count and scope rather than at a list price.

What Drives What You'll Actually Pay

Driver	Cost	Basis
Whether notification is in scope	Not published	Mass notification is priced on record count and runs alongside the forensic work. A breach touching 100,000 records carries mailing, call-centre and monitoring costs the forensics quote does not include.
How broadly you use the credits	Not published	Kroll's retainer credits span its wider portfolio, so the retainer can be sized against several risk functions rather than incident response alone.
Rollover at renewal	Up to 20% of unused credits	Kroll publishes the rollover allowance, which caps what an over-bought retainer actually wastes.

Verified Facts

Kroll markets a Cyber Risk Retainer that goes beyond a typical IR retainer, with credits usable for proactive, response, and notification services. No price is published. — Kroll Cyber Incident Response Retainer page, checked September 2026

Kroll states that up to 20 percent of unused services credit may be applied to the following year upon renewal. — Kroll Cyber Incident Response Retainer page, checked September 2026

Kroll states that clients can apply 100 percent of eligible credits across its wider services menu, spanning cybersecurity, regulatory compliance, financial crime, AI risk management, and executive and physical security. — Kroll Enterprise Risk Retainer pages, checked September 2026

Kroll provides breach-notification and consumer-victim services alongside DFIR. — Kroll cyber services pages, checked September 2026

When Kroll Is the Right Pick

Right pick when

+You want one firm for DFIR and the downstream breach-notification logistics.
+You value a flexible retainer where unused hours become proactive services.
+You want enterprise-grade depth without the very top-tier hourly rate.

Wrong pick when

−You need Falcon/Chronicle-native telemetry integration during response.
−You only need ransom negotiation (a specialist may be cheaper).
−You require the single most recognised brand name on a nation-state report.

Frequently Asked Questions

How much does Kroll incident response cost?

Kroll does not publish an hourly rate or a retainer price. What it does publish is the commercial mechanic, and in more detail than most of its peers: the retainer is bought as service credits, eligible credits can be applied across Kroll's wider risk menu rather than incident response alone, and up to 20 percent of unused credit rolls into the following year at renewal. Breach notification is quoted separately on record count. Your number comes from a written quote sized to your estate and the credit block you buy.

What is the Kroll Cyber Risk Retainer?

It is a pre-purchased credit agreement rather than a pure incident-response retainer. Kroll states that clients can apply 100 percent of eligible credits across services spanning cybersecurity, regulatory compliance, financial crime, AI risk management, and executive and physical security, and that up to 20 percent of unused credit carries into the next year on renewal. That breadth is the differentiator: an over-bought retainer can be spent on adjacent risk work instead of expiring.

Does Kroll handle breach notification?

Yes, Kroll provides breach-notification and consumer-victim services including mailing, call-centre operations, and credit-monitoring co-ordination, which many pure-DFIR firms outsource. This makes Kroll a single-vendor option for organisations that want forensics and the downstream notification logistics handled together. Notification is priced per record or per project on top of the forensic work, so a large record count can dominate the total bill.

Is Kroll cheaper than Mandiant or CrowdStrike?

Nobody outside the procurement process can answer that, because none of the three publishes a rate. Kroll, Mandiant, and CrowdStrike are all quote-only for incident response, so a genuine comparison requires running them against the same scope and comparing written quotes. The structural differences are public and worth weighing: Kroll's credits span its wider risk portfolio and it keeps notification in-house, while Mandiant and CrowdStrike offer telemetry integration with Google Cloud and Falcon respectively.

Compare Other IR Firms

Mandiant

Tier-1 DFIR, authors of the M-Trends report

CrowdStrike Services

Falcon-integrated IR and proactive retainer

Coveware

Ransomware negotiation and recovery specialist

Unit 42

Palo Alto Networks DFIR and proactive retainer

IBM X-Force

Tier-1 DFIR retainer; authors Cost of a Data Breach

Sophos

Fixed-fee Rapid Response IR plus MDR (Secureworks Taegis)

Arctic Wolf

MDR with incident response included

Sources: Kroll Cyber Incident Response Retainer page (retainer mechanic published, no price), checked September 2026; Kroll Enterprise Risk Retainer and breach-notification pages, checked September 2026. Updated September 2026.

IncidentCost.com is independent and not affiliated with Kroll. All figures are for planning purposes only.