Every CISO evaluating incident response has run into the same two words, over and over, in nearly identical proposals: “guaranteed response.” The problem is that two providers can use that exact phrase to describe two fundamentally different services. One means a phone number that gets answered fast. The other means a team that already knows your environment before the phone rings.
That difference is the entire decision. This guide breaks it down the way you’d want it broken down if you were the one signing the contract: what each model actually is, what it costs, what it gets you when the incident actually hits, and which questions separate real readiness from a well-written SLA.
Two Models, One Vocabulary
Almost every IR vendor markets some version of a “retainer.” Almost none of them mean the same thing by it. Broadly, the market splits into two structures.
Break-glass retainers are on-call arrangements. You pay an annual fee, sometimes for a pre-purchased block of hours, in exchange for priority access to a responder when something goes wrong. Between incidents, the relationship is largely dormant: no ongoing visibility into your environment, no continuous assessment, often no contact at all until the day you need one.
Pre-emptive IR inverts the model. The engagement starts before the incident, not after it. The provider maintains continuous visibility into your environment, scores your readiness on an ongoing basis, and the same team that’s been watching your environment is the team that responds. When the incident happens, response is a continuation of work already in progress, not a cold start.
The market calls both of these “retainers.” Profero doesn’t, on purpose. Pre-emptive IR is a subscription, not a standby contract, and that distinction is the point of this entire guide.
What a Break-Glass Retainer Actually Buys You
The break-glass model isn’t a scam or a bad-faith product. It solves a real problem: without any retainer, an organization in crisis has to find a firm, negotiate a contract, and get a responder assigned, all while the clock is running. Industry pricing puts that unretained, emergency-rate engagement at roughly $800 to $1,500 an hour from top-tier firms, against $175 to $400 an hour for the same work under a pre-negotiated retainer. Retainer pricing itself typically runs $10,000 to $100,000 a year, priced against a defined block of hours and a response SLA that’s usually two to four hours. On pure hourly economics, a retainer of some kind is close to mandatory.
Where the break-glass model falls short isn’t price. It’s context. A responder who has never seen your network before doesn’t spend the first hour investigating. They spend it asking for credentials, mapping your infrastructure, and figuring out what’s normal before they can identify what isn’t. That ramp-up happens on your clock, during your worst week of the year, and it happens every single time, because nothing about the relationship persists between incidents.
The SLA also measures something narrower than most buyers assume. A “four-hour response” commitment usually means four hours to a first acknowledgment or an initial call, not four hours to a qualified practitioner actively triaging your specific environment. Read that clause closely before you rely on it.
What Pre-Emptive IR Changes
Pre-emptive IR is built around a simple premise: the fastest response is the one that doesn’t have to start from zero. Continuous readiness scoring means the provider already knows your environment, your priorities, and your existing gaps before an incident ever happens. When the call comes in, the response isn’t an activation. It’s a continuation of work already underway.
This is the model behind Profero’s own subscription clients on the Rapid-IR platform: incidents resolved in an average of 4.5 hours, against an industry standard closer to 300 hours for the same category of intrusion. The gap isn’t staffing or budget. It’s whether the responder already knows what they’re walking into.
The mechanism matters as much as the outcome. A 20-minute guaranteed response is only credible if the practitioner answering that call has environment context preloaded, not if they’re opening a ticket queue. That’s the distinction the Profero Incident Response Team is built around: the same practitioners who monitor your readiness are the ones who pick up when you call.
The Full Comparison
Here’s the side-by-side, expanded past the headline differences into the details that actually shape a contract negotiation.
| Dimension | Break-Glass Retainer | Pre-Emptive IR |
|---|---|---|
| State between incidents | Dormant. No ongoing visibility into your environment. | Active. Continuous readiness scoring runs daily. |
| First-hour reality | Responder builds environment context from scratch, under pressure. | Responder inherits existing context. Response starts, it doesn’t ramp up. |
| What the SLA measures | Usually time to acknowledgment or first call. | Time to a qualified practitioner actively triaging, with context preloaded. |
| Cost structure | Annual fee plus hourly rate for hours used, typically $175–$400/hour retained, $800–$1,500/hour if unretained. | Subscription that bundles readiness monitoring, assessment, and response into one predictable line item. |
| Team continuity | Whoever is available when you call. Often not the same practitioner across engagements. | Same team monitors your environment and responds to your incidents. |
| Board reporting | Produced after the fact, once the engagement concludes. | Continuous readiness data is available before an incident, not just after one. |
| Cyber insurance fit | May or may not be on your insurer’s approved panel; off-panel engagements can face rate disputes or coverage sublimits. | Structured around continuous, documented readiness that maps directly to what insurers and auditors ask to see. |
| Compliance documentation | Typically limited to incident-specific reports. | Continuous audit trail generated as a byproduct of ongoing assessment. |
| Scalability across incidents | Each engagement effectively restarts the relationship. | Readiness data and institutional knowledge compound over time. |
| What you’re proving to the board | “We have a contract with a firm.” | “Our environment is scored daily and our response time is guaranteed.” |
The Cost Math CISOs Actually Need
Retainer pricing is the easy part of this comparison. The harder, more consequential number is what happens to total breach cost depending on how ready you actually were.
IBM’s 2025 Cost of a Data Breach Report puts the global average breach cost at $4.44 million, with the average breach lifecycle running 241 days from identification to containment. In the United States specifically, the average cost climbs to $10.22 million, and organizations that take longer than 200 days to detect and contain a breach pay materially more than those that move faster.
Readiness is the variable that moves those numbers. IBM’s 2024 report found that organizations with an incident response team in place and a regularly tested plan had an average breach cost of $3.26 million, 58% lower than the $5.29 million average for organizations without one. That’s not a retainer contract line item. That’s the difference between a plan that exists on paper and one that’s been tested against a team that actually knows your environment.
Put the two numbers next to each other and the framing changes. A break-glass retainer might save you money on hourly rates during an incident. A pre-emptive model is aimed at the much larger number: how much the incident costs you in total, because readiness, not hourly billing, is what actually shortens a breach lifecycle.
The Cyber Insurance Angle Most Buyers Underweight
If your organization carries cyber insurance, or your board has started asking about it, the retainer conversation isn’t purely a security decision anymore. Most insurers maintain a panel of pre-approved IR firms, typically ten to thirty vendors whose rates and methodology the insurer has already vetted. Some policies require you to use a panel firm, or apply a coverage sub-limit if you don’t. Using a firm your insurer hasn’t pre-approved doesn’t necessarily disqualify a claim, but it introduces friction and potential rate disputes at exactly the moment you can least afford delay.
This is where the “named IR provider” requirement that shows up in more cyber insurance renewals starts to matter. It’s no longer enough to have a retainer. Insurers increasingly want to see who it’s with, what the SLA actually guarantees, and whether that provider can produce documentation on demand. A continuously scored, continuously documented readiness posture answers that question by default. A dormant retainer answers it only after you’ve already had the incident.
Where AI-Induced Incidents Complicate the Comparison
One more variable is reshaping this decision, and most retainer contracts haven’t caught up to it: incidents caused by an organization’s own AI agents now produce forensic signatures that look identical to ransomware, insider threats, or data exfiltration. Telling the difference in the first thirty minutes of triage requires a specific framework, and it requires a responder who’s built one. We covered the classification framework we use for that in detail elsewhere on this blog. The relevant point for this comparison: a break-glass responder meeting your environment for the first time has no basis to distinguish an autonomous agent’s error from an active attacker. A team that already knows your environment, and your AI deployments, does.
The Questions That Actually Separate the Two Business Models
Whichever direction you’re leaning, these are the questions that reveal whether a contract is pre-emptive in substance or just in marketing language:
- What does the response-time SLA measure: acknowledgment, or an actively triaging practitioner with context already loaded?
- Is my environment assessed continuously, or only at the start of the contract term?
- Will the same practitioners who monitor my environment be the ones who respond to an incident?
- Is this provider on my cyber insurer’s approved panel, and if not, what happens to my claim if I use them anyway?
- What does the provider actually know about my environment on the day I sign, versus the day I call?
- Can the provider tell the difference between an external attacker, an insider, and an AI agent gone wrong, and how quickly?
If the answers point toward “we’ll figure that out when it happens,” that’s a break-glass retainer regardless of what it’s called in the proposal.
The Bottom Line
A break-glass retainer answers one question: who do I call? A pre-emptive model answers a harder one: is my organization actually ready, right now, today, before anything has gone wrong? For a board that’s stopped accepting “we have a retainer” as proof of readiness, and for regulators and insurers asking increasingly specific questions about documented preparedness, that second answer is the one that holds up.
As for us, we built Pre-Emptive IR around that second answer: continuous readiness scoring, a 20-minute guaranteed response from a practitioner who already knows your environment, and a single subscription that replaces the guesswork of “who do we call” with a program the board can actually see. The team is independently certified under SOC 2 Type II, ISO 27001, and GDPR, and works directly with cyber insurers, legal counsel, and boards as part of the standard engagement, not as an add-on negotiated after the fact.
Ready to see what that looks like against your own environment? Talk to our IR team and we’ll walk through exactly where your current retainer, if you have one, leaves gaps that a pre-emptive model closes.
