IR Firm Reference · Google Cloud · Updated July 2026

Mandiant Incident Response Cost: What You'll Actually Pay

Mandiant, now part of Google Cloud, is the reference-class DFIR firm: it authors the annual M-Trends report and runs many of the largest nation-state and ransomware response engagements. It publishes no rate card, no retainer price, and no per-engagement figure, and neither do the distributors that resell it. This page sets out what Mandiant does disclose, which is the pricing model and the SLA structure, and what actually drives the number on your quote. It states no dollar figure for Mandiant, because Mandiant states none.

How much does Mandiant cost? Mandiant does not publish a price. There is no rate card on its own pages, no figure on the Google Cloud retainer page, and no price displayed against the reseller SKUs that distributors list for it. Anyone quoting a specific Mandiant hourly rate is estimating rather than citing. What is public is the structure: emergency work is scoped per incident, retainer holders draw prepaid hours at a contracted rate, and the quote is driven by whether a retainer exists, the scope and dwell time of the intrusion, and the regulatory reporting load. Get a written quote for your estate.

Not published

Rate card

Prepaid hours

Retainer structure

CS-IR-HR

Hourly reseller SKU

14 days

Median dwell, M-Trends 2026

Prices shown here are quoted as published and attributed to the surface that carries them, an AWS Marketplace listing or a filed G-Cloud pricing document, with a check date. Where this firm publishes no price, the entry reads "not published" and the quote drivers are given instead; we do not estimate a vendor's undisclosed rate. Always get a written quote for your estate.

Pricing Models

Model	Cost	Notes
Emergency IR (no retainer)	Not published	Scoped and quoted per incident. Reserved consultant capacity is scarcest during large simultaneous campaigns, which is the practical argument for a retainer.
Consulting Retainer (prepaid hours)	Not published	Prepaid hours convertible across IR, red team, and proactive assessments; unused hours roll within the term. Priced on the size of the hour block and the term.
Retained hourly draw	Not published	Retainer holders draw against prepaid funds at a contracted rate. Mandiant confirms the two-rate structure exists but publishes neither rate.
Distribution SKUs	Listed, price not shown	Resellers list Mandiant IR as an hourly service fee (CS-IR-HR) and as 2-hour SLA blocks (CS-IR-2H-SLA). The SKUs are public; the prices are quote-gated.

What Drives What You'll Actually Pay

Driver	Cost	Basis
Whether a retainer is already in place	Not published	The single largest lever. A retainer contracts a lower drawn rate and a faster response SLA; emergency engagement without one is quoted at peak.
Scope and dwell time	Not published	Consultant hours scale with the number of systems, the length of the intrusion, and how much telemetry survived. M-Trends 2026 puts global median dwell at 14 days.
Regulatory and reporting load	Not published	Regulated data, multi-jurisdiction notification, and board or regulator reporting add consulting time beyond the technical investigation.

Verified Facts

Mandiant authors M-Trends; the 2026 edition reports global median dwell time of 14 days for 2025, three days worse than the prior year, driven by espionage and North Korean IT-worker cases where median dwell reached 122 days. — Mandiant M-Trends 2026 (Google Cloud), checked September 2026

M-Trends 2026 reports median dwell of 26 days when an external party notified the victim, 10 days when the organisation detected the activity itself, and 5 days when the adversary announced itself, usually via a ransom note. — Mandiant M-Trends 2026 (Google Cloud), checked September 2026

Mandiant was acquired by Google and operates within Google Cloud's security portfolio. — Google Cloud (acquisition completed 2022)

Mandiant Consulting offers a prepaid Consulting Retainer convertible across IR and proactive services. No price is published on the data sheet or the Google Cloud retainer page. — Mandiant Consulting retainer data sheet / Google Cloud, checked September 2026

Distributors list Mandiant IR as catalogue SKUs, an hourly service fee (CS-IR-HR) and a 2-hour SLA agreement (CS-IR-2H-SLA), without displaying a price. — CDW and Insight public catalogue listings, checked September 2026

When Mandiant Is the Right Pick

Right pick when

+You face a sophisticated or nation-state-grade adversary and need top-tier attribution.
+Your board or regulator expects a recognised name on the post-incident report.
+You already run Google Cloud / Chronicle and want integrated threat intelligence.

Wrong pick when

−You are an SMB with a commodity ransomware case where a regional firm costs far less.
−Budget is the primary constraint and you have no retainer to discount emergency rates.
−You need 24/7 monitoring rather than reactive IR (consider MDR instead).

Frequently Asked Questions

How much does Mandiant incident response cost?

Mandiant does not publish a price. There is no rate card on its own pages, no figure on the Google Cloud retainer page, and no price displayed against the reseller SKUs that distributors list for it. Anyone quoting a specific Mandiant hourly rate is estimating rather than citing. What is public is the structure: emergency work is scoped per incident, retainer holders draw prepaid hours at a contracted rate, and the quote is driven by whether a retainer exists, the scope and dwell time of the intrusion, and the regulatory reporting load. Get a written quote for your estate.

Does Mandiant offer a retainer?

Yes. Mandiant Consulting sells a prepaid Consulting Retainer whose hours convert across incident response, red teaming, threat hunting, and proactive assessments, with unused hours rolling within the term. The retainer is the mechanism that secures a faster response SLA and a contracted drawn rate instead of emergency scoping. Mandiant does not publish what the retainer costs; price depends on the size of the hour block and the term length.

Is Mandiant worth the premium over a regional IR firm?

Mandiant is worth it when you face a sophisticated or nation-state adversary, when a board or regulator expects a recognised name on the report, or when you need deep threat-intelligence attribution. For commodity ransomware at an SMB, a regional DFIR firm often delivers a comparable technical outcome for less. Because neither Mandiant nor most of its peers publish rates, the comparison has to be made on written quotes rather than on list prices.

How fast does Mandiant respond to an incident?

Response speed is contracted through the retainer rather than published as a universal SLA. Retainer agreements across the top-tier DFIR market specify a first-response commitment; without a retainer you are scoping and contracting from a standing start, and reserved consultant capacity tightens further during large simultaneous ransomware campaigns when demand spikes across the whole market. Mandiant's own M-Trends 2026 data shows how much detection source matters: median dwell was 10 days for self-detected intrusions against 26 days when an outside party raised the alarm.

Compare Other IR Firms

CrowdStrike Services

Falcon-integrated IR and proactive retainer

Kroll

Cyber risk retainer with breach notification services

Coveware

Ransomware negotiation and recovery specialist

Unit 42

Palo Alto Networks DFIR and proactive retainer

IBM X-Force

Tier-1 DFIR retainer; authors Cost of a Data Breach

Sophos

Fixed-fee Rapid Response IR plus MDR (Secureworks Taegis)

Arctic Wolf

MDR with incident response included

Sources: Mandiant M-Trends 2026 (Google Cloud), checked September 2026; Mandiant Consulting retainer data sheet and Google Cloud retainer page (no price published), checked September 2026; CDW and Insight public catalogue listings for Mandiant IR SKUs (no price displayed), checked September 2026. Updated July 2026.

IncidentCost.com is independent and not affiliated with Mandiant or Google Cloud. All figures are for planning purposes only.