What is an incident response retainer, and do we need one?
A retainer is an agreement with an incident-response firm, signed before anything happens, that guarantees you a response within an agreed time and fixes the price and the terms. Without one, you are searching for a provider, negotiating a contract and granting access while the attacker is still active. Many cyber insurers have their own panel of response firms and expect you to call them first, so check your policy before signing anything separately. A small company may not need a paid retainer if the insurer's hotline covers this, but it does need to know whom to call, what that firm needs on day one and how it will reach your systems. NetSenX is not an incident-response firm. It gives the firm you call explained alerts and a network history from before the incident, which is usually the evidence that is hardest to reconstruct afterwards.