IR Firm Reference · Palo Alto Networks · Updated September 2026

Unit 42 Incident Response Cost: What You'll Actually Pay

Unit 42 is the threat-intelligence and DFIR arm of Palo Alto Networks. It integrates with Cortex XDR and XSIAM telemetry and publishes a widely cited ransomware and extortion threat report. It does not publish an hourly rate, a retainer price, or a per-engagement figure. This page covers the retainer model and the quote drivers, and states no dollar figure for Unit 42, because Unit 42 states none.

How much does Unit 42 cost? Unit 42 does not publish a price. Palo Alto Networks lists no hourly rate, no retainer fee, and no per-engagement figure for Unit 42, and quotes each engagement individually. What is public is the model: a prepaid-hour retainer convertible to proactive work, and emergency engagement scoped per incident. The drivers that move your quote are whether Cortex XDR or XSIAM is already deployed, whether a retainer exists before the incident, and how much attribution and regulatory support the case needs.

Not published

Rate card

Prepaid hours

Retainer structure

Cortex-native

Telemetry model

Palo Alto Networks

Parent

Prices shown here are quoted as published and attributed to the surface that carries them, an AWS Marketplace listing or a filed G-Cloud pricing document, with a check date. Where this firm publishes no price, the entry reads "not published" and the quote drivers are given instead; we do not estimate a vendor's undisclosed rate. Always get a written quote for your estate.

Pricing Models

Model	Cost	Notes
Emergency IR (no retainer)	Not published	Scoped per incident. Unit 42 deploys its own tooling where Cortex is not already in place.
IR retainer (prepaid hours)	Not published	Hours convert to incident response, compromise assessment, and tabletop exercises. Priced on the hour block and the term.
Retained hourly draw	Not published	Retainer holders draw against prepaid hours rather than being scoped at emergency terms.
Per-engagement ransomware/breach	Not published	Scope and dwell-time driven. Existing Cortex XDR or XSIAM telemetry is the main lever on consultant hours.

What Drives What You'll Actually Pay

Driver	Cost	Basis
Whether Cortex XDR or XSIAM is deployed	Not published	Native telemetry shortens triage and reduces consultant hours; without it Unit 42 deploys its own tooling during the engagement.
Retainer in place versus cold start	Not published	The retainer contracts prepaid hours and a response commitment ahead of the incident instead of scoping under pressure.
Attribution and regulatory depth	Not published	Threat-intel attribution and multi-jurisdiction regulatory support add consulting time on top of the technical investigation.

Verified Facts

Unit 42 is the threat-intelligence and incident-response team of Palo Alto Networks. — Palo Alto Networks Unit 42 pages, checked September 2026

Unit 42 publishes an annual Ransomware and Extortion / Incident Response report. — Unit 42 threat reporting, checked September 2026

Unit 42 IR integrates with Cortex XDR and XSIAM telemetry during engagements, and deploys its own tooling where those products are not in place. — Palo Alto Networks Cortex / Unit 42 pages, checked September 2026

Unit 42 offers an incident-response retainer providing prepaid hours convertible to IR, compromise assessments, and tabletop exercises. No price is published. — Palo Alto Networks Unit 42 retainer pages, checked September 2026

When Unit 42 Is the Right Pick

Right pick when

+You run Palo Alto Networks Cortex XDR/XSIAM and want native telemetry during response.
+You want threat-intel-led attribution backed by Unit 42 research.
+You want IR and proactive assessments under one retainer.

Wrong pick when

−Your stack is built on a competing XDR and you do not want platform lock-in.
−You need pure ransom negotiation rather than full-scope DFIR.
−Budget is the dominant constraint and a regional firm suffices.

Frequently Asked Questions

How much does Unit 42 incident response cost?

Unit 42 does not publish a price. Palo Alto Networks lists no hourly rate, no retainer fee, and no per-engagement figure for Unit 42, and quotes each engagement individually. What is public is the model: a prepaid-hour retainer convertible to proactive work, and emergency engagement scoped per incident. The drivers that move your quote are whether Cortex XDR or XSIAM is already deployed, whether a retainer exists before the incident, and how much attribution and regulatory support the case needs.

Does Unit 42 offer a retainer?

Yes. The Unit 42 retainer provides prepaid hours convertible to incident response, compromise assessments, and tabletop exercises, and contracts a response commitment ahead of an incident. It is the standard way to secure priority access to Unit 42 responders and to replace emergency scoping with a contracted drawn rate. Palo Alto Networks does not publish what the retainer costs; it is priced on the hour block and the term.

Do I need Palo Alto Networks products to use Unit 42?

No, you do not need Palo Alto Networks products to engage Unit 42, but organisations running Cortex XDR or XSIAM benefit from native telemetry integration that shortens triage and reduces consultant hours. Without that telemetry, Unit 42 deploys its own tooling during the engagement, similar to other DFIR firms, so the integration is a cost advantage rather than a requirement.

How does Unit 42 compare to Mandiant?

Both are top-tier, threat-intel-led DFIR teams, and neither publishes a rate, so there is no price comparison to be made from public sources. The difference you can evaluate before requesting quotes is ecosystem: Unit 42 integrates with Palo Alto Networks Cortex, Mandiant with Google Cloud. If you already run one of those stacks, the native telemetry shortens the investigation, which is the clearest lever on cost. Otherwise, put both on the same scope and compare written quotes.

Compare Other IR Firms

Mandiant

Tier-1 DFIR, authors of the M-Trends report

CrowdStrike Services

Falcon-integrated IR and proactive retainer

Kroll

Cyber risk retainer with breach notification services

Coveware

Ransomware negotiation and recovery specialist

IBM X-Force

Tier-1 DFIR retainer; authors Cost of a Data Breach

Sophos

Fixed-fee Rapid Response IR plus MDR (Secureworks Taegis)

Arctic Wolf

MDR with incident response included

Sources: Palo Alto Networks Unit 42 service and retainer pages (no price published), checked September 2026; Unit 42 Ransomware and Extortion / Incident Response reports, checked September 2026. Updated September 2026.

IncidentCost.com is independent and not affiliated with Unit 42 or Palo Alto Networks. All figures are for planning purposes only.