Be ready before a cyber incident happens

Because detection and response stop where forensics begins. Monitoring commits to finding it, triaging it and — where there is authority and tooling — containing it. What it does not cover is the work that comes afterwards: imaging a machine and examining it properly, establishing how they got in, determining what data actually left, and carrying an investigation through to something a regulator, an insurer or a court will accept. The retainer also removes the worst delay in any incident, and it is not a technical one: agreeing terms with a firm you have never contracted with while your estate is encrypting.

The response commitment is written into your contract rather than quoted as one number for everybody, because it depends on what you buy and where you are. What makes any number achievable is the preparation rather than the promise: the people authorised to raise an incident are named in advance, the channels are agreed, remote access is provisioned before anything happens, and the terms are already signed. A firm arriving without those spends its first day on paperwork and credentials, whatever it put in its proposal. If a provider quotes you a fixed figure, ask what happens when they miss it.

No, and the retainer is built so that you do not. Up to half of the year’s unused hours carry into the next one. The hours are not restricted to incidents either — they can go on proactive work such as purple teaming or phishing testing. And the engagement runs on a quarterly rhythm whether or not anything breaks: a review meeting that goes through the period and picks out the small-looking events worth investigating properly, plus quarterly threat reporting. A quiet year is when the muscle memory gets built, which is the part you actually want in place before a loud one.

Depending on where you are, Spirity’s own responders or our partner’s — the team is assembled to fit the client rather than dispatched from one country. At onboarding you are assigned a named incident lead who is your direct point of contact, and an introductory session settles who is involved on both sides and how they reach each other at two in the morning. The work is remote-first by design: access is provisioned in advance precisely so that the response begins with investigation rather than with a request for credentials.

There are specialists for it, and it happens only if you ask us to, for that specific case — never as a default. Where it does happen the purpose is investigative first: what the actor actually has, what they actually took, and what evidence can be drawn out of the exchange. Whether to pay is not our decision and we will not present it as one. That belongs to your board, with your counsel and your insurer. What the retainer gives you is the technical picture the decision has to rest on, at a point where you would otherwise be guessing.

Four things, and they are the first phase of the engagement rather than paperwork. The people authorised to raise an incident, and the channels to reach them. A walkthrough of your systems and security configuration, written up so the team works from it on the day instead of learning it during the incident — and where that walkthrough turns up something worth changing, we will say so. Remote access provisioned in advance. And a data discovery exercise, where we work with your IT to identify the evidence that will actually be asked for and check that it comes out in a usable form. That last one is the one most organisations skip and most regret.

Yes to all three, and the investigation is run on the assumption that it will be read by somebody else’s expert. The team is experienced in carrying an investigation from the first scoping call through to litigation, including giving evidence, and the partner behind the practice is trusted by more than twenty cyber insurers to do this work for their insured clients. We work alongside your counsel and your insurer rather than around them — and engaging counsel is one of the things the readiness work settles before an incident rather than during one.

They are kept isolated. Images are uploaded into a separate tenant belonging to that client and analysed there — not pooled, not sitting alongside anyone else’s evidence. The analysis itself runs in a prepared forensic environment, which can sit in our private cloud or be deployed inside your own environment if you would rather the evidence never leaves it. That second option is worth raising early: for some organisations it turns a difficult conversation with their own legal and data protection people into a short one.

It contributes; it does not discharge. Both regimes expect documented, tested incident handling, and a retainer with named contacts, agreed terms, access provisioned in advance, validated evidence and a quarterly review is good evidence that you are prepared for one. What it is not is compliance in itself, and it does not file anything on your behalf — the notification duties and their timelines stay with you, and whether they apply at all depends on your sector and classification. Anyone telling you that a retainer makes you NIS2-compliant is selling rather than advising.

The block of expert hours included for the year. A larger block costs more and makes each additional hour cheaper, so choosing a tier is a judgement about how much investigation you expect to want — not only about how many incidents you expect to have. The term is twelve months, and the forensic environment is part of the fee rather than something billed separately each time it is used.