Reference: Response Cost · Updated July 2026

Incident Response Cost: Published Retainer Prices and What You'll Actually Pay

Q: How much does an incident response retainer cost?

Three firms publish a price you can cite. IBM lists its X-Force Incident Response Retainer at $37,000 to $105,000 per year on AWS Marketplace, and files three tiers on UK G-Cloud 14 at GBP 24,158.67 for 50 hours, GBP 55,897.93 for 150 hours with a one-hour triage SLA, and GBP 96,673.99 for 250 hours plus dark-web analysis. Arctic Wolf lists MDR Basic, which bundles incident response, at $44,000 per year for up to 100 users on AWS Marketplace. A reseller files the Sophos Incident Response Retainer on UK G-Cloud 15 at GBP 2.32 per user for 12 months against a 200-user minimum. Mandiant, CrowdStrike, Kroll, and Unit 42 publish no retainer price at all.

Q: What is an IR retainer and is it worth it?

An IR retainer is a pre-arranged agreement with an incident response firm, bought as a block of prepaid hours or credits, that contracts a first-response commitment and a drawn rate before an incident happens. It is the single biggest lever on response cost that you control in advance, for two reasons that hold across every firm: it replaces emergency scoping under pressure with a rate agreed in calm conditions, and it reserves consultant capacity that tightens across the whole market during large simultaneous ransomware campaigns. IBM's filed G-Cloud tiers are the one public illustration: Tier 1 buys 50 hours with a four-hour triage commitment at GBP 24,158.67, Tier 2 buys 150 hours with a one-hour commitment at GBP 55,897.93. The gap covers both the extra hours and the faster SLA, so it is not a price for response speed alone.

Q: Why do most incident response firms not publish prices?

Because every engagement is scoped individually and price is a negotiation lever, most DFIR firms route pricing to contact sales. The firms that do publish are the ones selling through a channel that requires a listed price: AWS Marketplace listings and UK G-Cloud filings are public procurement surfaces, which is why IBM X-Force, Arctic Wolf, and Sophos have citable numbers while Mandiant, CrowdStrike, Kroll, and Unit 42 do not. Treat any confident hourly rate quoted for those four as an estimate rather than a citation, wherever you find it.

Q: What is the difference between MDR and IR?

IR (Incident Response) is reactive: you call an IR firm when an incident occurs. MDR (Managed Detection and Response) is proactive: an MDR service provides 24/7 monitoring and detection, and includes incident response in the subscription. The published entry points illustrate the difference in commitment: Arctic Wolf lists MDR Basic at $44,000 per year for up to 100 users on AWS Marketplace, covering monitoring plus response, while IBM's X-Force retainer starts at $37,000 per year on the same surface for prepaid response hours without continuous monitoring. For organisations with no SOC, MDR usually beats buying monitoring tools and on-demand IR separately; for organisations that already run a mature SOC, a retainer alone is the cheaper fit.

$37K-$105K

IBM X-Force retainer/yr (AWS)

$44K

Arctic Wolf MDR/yr, 100 users

GBP 2.32

Sophos IR retainer/user/yr (filed)

4 of 8

Named firms publishing nothing

Incident Response Retainer Pricing: What Is Actually Published

Direct answer. Three named firms publish an incident-response price you can cite. IBM lists its X-Force IR Retainer at $37,000-$105,000 per year on AWS Marketplace, and files three tiers on UK G-Cloud from GBP 24,158.67 (50 hours, four-hour triage) to GBP 96,673.99 (250 hours plus dark-web analysis). Arctic Wolf lists MDR Basic, which bundles response, at $44,000 per year for up to 100 users. A reseller files the Sophos IR Retainer at GBP 2.32 per user for 12 months against a 200-user minimum. Mandiant, CrowdStrike, Kroll and Unit 42 publish no price at all, so budget those from written quotes.

Firm	Published price	What it buys	Source surface
IBM X-Force IR Retainer	$37,000-$105,000/yr	Prepaid response hours plus Proactive Service Units, 12-month term	AWS Marketplace listing
IBM X-Force, Tier 1 / 2 / 3	GBP 24,158.67 / 55,897.93 / 96,673.99	50 / 150 / 250 hours; triage within 4 hours on Tier 1, 1 hour on Tiers 2 and 3	Filed G-Cloud 14 pricing document
Arctic Wolf MDR Basic	$44,000/yr	24/7 monitoring, detection and response bundled, up to 100 users	AWS Marketplace listing
Sophos IR Retainer	GBP 2.32 per user / 12 months	On-demand responder access, 200-user minimum; reseller cost line, not a Sophos list price	Filed G-Cloud 15 pricing document
Mandiant, CrowdStrike, Kroll, Unit 42	Not published	Prepaid hours or credits drawn during an incident; scoped and quoted per engagement	Data sheets describe structure, not price

AWS Marketplace and Crown Commercial Service G-Cloud figures checked September 2026. Per-firm pricing models and quote drivers are on the IR firm pricing matrix.

Pricing Models

Model	Rate / Cost	Best For	Commitment
Hourly emergency (no retainer)	Not published	One-off incidents; no prior relationship	None; invoice per engagement
Hourly retained	Not published	Organisations with an annual retainer	Annual retainer fee + hourly draws
Annual retainer (fixed hours)	$37K-$105K/yr published (IBM X-Force, AWS)	Mid-market and enterprise wanting a contracted triage SLA	Annual; unused hours roll or convert within term
Per-incident fixed fee	Not published	Defined-scope ransomware or breach response	Per-engagement; SOW based
MDR subscription (includes IR)	$44K/yr published for 100 users (Arctic Wolf, AWS)	No in-house SOC; 24/7 monitoring plus response	Annual; larger estates by private offer
In-house IR team (fully loaded)	Your headcount x loaded rate	Enterprise with high incident frequency	Full headcount commitment

What Is Included in IR Services

Detection and triage

Log analysis
Malware analysis
Threat identification
Scope determination

Containment

Network isolation
Account lockdown
Attacker eviction
Persistence removal

Eradication

Malware removal
Backdoor elimination
Credential reset
Patch application

Recovery

System restoration
Backup validation
Service testing
Monitoring setup

Post-incident

Forensic report
Root cause analysis
Lessons learned
Regulatory support

Legal and regulatory

Regulatory notifications
Legal hold support
Evidence preservation
Expert witness

Emergency vs Retained Rates: Do the Math With Your Own Quotes

The comparison to run. No major DFIR firm publishes its emergency or retained hourly rate, so this is arithmetic you do on your own quotes rather than a number anyone can look up. Ask each firm for three things in writing: the emergency rate with no retainer, the drawn rate under a retainer, and the annual retainer fee. Then compare (hours x emergency rate) against (hours x drawn rate) + retainer fee for an incident the size you actually plan for. Because the retainer fee is credited against hours used, the break-even usually sits well inside a single serious incident, and the contracted triage SLA is worth something on top. IBM's filed G-Cloud tiers are the one public illustration of how the two move together: Tier 1 buys 50 hours with a four-hour triage commitment at GBP 24,158.67, while Tier 2 buys 150 hours with a one-hour commitment at GBP 55,897.93. The gap covers both the extra hours and the faster SLA, so it is not a price for response speed on its own, but it does show a vendor putting real money against the difference.

What to compare	Without Retainer	With Retainer	The difference
Hourly rate	Emergency rate, quoted under pressure	Drawn rate, agreed in advance	Ask both firms for each in writing
200-hour engagement	200 x emergency rate	200 x drawn rate + retainer fee	Break-even depends on the gap between the two rates
500-hour engagement	500 x emergency rate	500 x drawn rate + retainer fee	The larger the incident, the more the drawn rate dominates
First response	Scoping and contracting from a standing start	Contracted triage commitment (IBM files 4 hours on Tier 1, 1 hour on Tiers 2 and 3)	The SLA is bought, not assumed

In-House vs Outsourced IR

Consideration	In-House Team	Outsourced (Retainer/MDR)
Annual cost	Your headcount x fully loaded rate (a 5-person senior IR team is the usual minimum for 24/7 cover)	$37K-$105K/yr published for IBM's retainer; $44K/yr for Arctic Wolf MDR at 100 users
Response time	Minutes (team on-premise or on-call)	The triage SLA written into your retainer; without one, scoping starts from cold
Expertise breadth	Limited to team's specialisms	Wide: forensics, malware, cloud, OT, legal
Scalability during major incident	Constrained by headcount	Scalable: firm assigns more consultants
Institutional knowledge	Deep knowledge of your environment	Must onboard and learn environment each time
Best for	Enterprise with 20+ incidents/yr	Mid-market; orgs with 0-5 major incidents/yr

MDR Alternative: 24/7 Monitoring Bundled with IR

Managed Detection and Response (MDR) services bundle continuous 24/7 monitoring, detection, and IR response into a single subscription. This eliminates separate monitoring tool costs, SOC staffing costs, and on-demand IR costs. MDR providers include Arctic Wolf, Huntress, Red Canary, Sophos MDR, CrowdStrike Falcon Complete, and Expel.

MDR Provider	Target Market	Approx. Pricing
Huntress	SMB/MSP market	Per-endpoint, quote-based
Arctic Wolf	Mid-market	$44K/yr, 100 users (AWS); custom above
Red Canary	Mid-market to enterprise	Per-endpoint, quote-based
CrowdStrike Falcon Complete	Enterprise	Subscription, quote-based
Sophos MDR	SMB to mid-market	Channel-priced (partner)
Expel	Mid-market to enterprise	Subscription, quote-based

Most MDR providers do not publish list prices; pricing is quoted per estate on endpoint count, data volume, and contract length. Arctic Wolf is the exception, publishing MDR Basic at $44,000/year for up to 100 users on AWS Marketplace (checked September 2026); larger estates route to a custom Private Offer. Contact vendors for quotes.

Pricing by Named Firm

The figures above are the market-wide picture. For what each firm publishes, or states plainly that it does not, plus the pricing model and quote drivers per firm, see the per-firm reference pages. Each names how that firm prices and when it is the right or wrong pick.

Mandiant CrowdStrike Kroll Coveware Unit 42 Arctic Wolf Sophos

See the full IR firm pricing matrix

Frequently Asked Questions

How much does an incident response retainer cost?

Three firms publish a citable price. IBM lists its X-Force IR Retainer at $37,000-$105,000/yr on AWS Marketplace and files three UK G-Cloud tiers at GBP 24,158.67 (50 hours), GBP 55,897.93 (150 hours, 1-hour triage) and GBP 96,673.99 (250 hours plus dark-web analysis). Arctic Wolf lists MDR Basic at $44,000/yr for up to 100 users. A reseller files the Sophos IR Retainer at GBP 2.32 per user for 12 months, 200-user minimum. Mandiant, CrowdStrike, Kroll and Unit 42 publish nothing.

What is an IR retainer and is it worth it?

A retainer is a block of prepaid hours or credits bought before an incident, which contracts a triage SLA and a drawn rate in calm conditions rather than under pressure. It is the biggest lever on response cost you control in advance, and it reserves consultant capacity that tightens across the market during large simultaneous ransomware campaigns. IBM's filed tiers show the SLA being priced: four-hour triage on Tier 1, one hour on Tiers 2 and 3.

Why do most incident response firms not publish prices?

Because engagements are scoped individually and price is a negotiation lever. The firms that do publish are the ones selling through channels that require a listed price: AWS Marketplace and UK G-Cloud are public procurement surfaces, which is why IBM X-Force, Arctic Wolf and Sophos have citable numbers and Mandiant, CrowdStrike, Kroll and Unit 42 do not. Treat any confident hourly rate quoted for those four as an estimate, not a citation.

What is the difference between MDR and IR?

IR is reactive: you call a firm when an incident occurs. MDR is proactive: 24/7 monitoring and detection with response included in the subscription. The published entry points show the difference in commitment: Arctic Wolf lists MDR Basic at $44,000/yr for 100 users covering monitoring plus response, while IBM's retainer starts at $37,000/yr on the same surface for prepaid response hours without continuous monitoring. No SOC favours MDR; a mature SOC favours a retainer alone.

How much does a 5-person in-house IR team cost?

Model it from your own numbers rather than a market figure: headcount times your fully loaded cost per senior security hire, plus tooling and training. Five is the usual minimum for genuine 24/7 cover once leave and on-call rotation are accounted for. Compare that total against the published retainer and MDR anchors (IBM $37K-$105K/yr, Arctic Wolf $44K/yr for 100 users). In-house tends to win only at very high incident frequency or an unusually high risk profile such as critical infrastructure.