What CISOs Don’t See Until It’s Too Late
A lot of CISOs sleep better because a signed IR retainer sits in a folder somewhere. It feels like insurance. A number was negotiated, a contract was signed, a line item appeared in next year’s budget, and the box got checked.
Then the incident happens, and the retainer turns out to be a promise that someone will show up. It says almost nothing about how fast they will actually be useful once they do.
That gap between “we have a retainer” and “we are actually ready” is where the real cost of a break-glass model hides. It doesn’t show up on the invoice for the retainer itself. It shows up three weeks later, buried in overage billing, an insurance dispute, and a containment timeline that ran days longer than anyone expected.
What “break-glass” actually means
Break-glass is the term the industry uses for a retainer where the relationship starts on paper and ends there until the day you need it. You sign an agreement, you get a guaranteed response time, and the firm files you away until you call. Nobody from that firm has looked at your network, your EDR deployment, your log retention, or your escalation chain. The first time they see any of it is during the incident.
That’s a meaningfully different model from one where an IR partner is already inside your environment, evaluating readiness continuously so the responding team isn’t starting from zero. On our own platform page, we describe that second model plainly: continuous readiness, not break-glass. The distinction matters because most of the “hidden costs” below aren’t flaws in any single retainer contract. They’re structural consequences of a model where familiarity with your environment is built during the incident instead of before it.
Hidden cost #1: the hours you pay for while the IR team learns your business
Every retainer promises a response SLA, and most of the market clusters around a 2 to 4 hour first-response window once the retainer is activated. That number sounds fast, and against the alternative it is: firms working without a retainer in place routinely quote 24 to 72 hours for first response, because contract negotiation and onboarding must happen before anyone touches your environment.
But “responding” and “being useful” are not the same milestone. A retainer buys you a person on a call within a few hours. It does not buy that person knowledge of your network topology, your identity provider, which endpoints run your EDR agent, or where your logs actually live. Some retainer firms insist on deploying their own stack mid-crisis if yours isn’t one they already work with, which adds hours or days before the investigation itself even begins. Every one of those hours is billed, and every one of those hours is dwell time for whoever is still inside your network.
That distinction is exactly why response-time SLAs alone are an incomplete way to evaluate a retainer, something worth its own scrutiny when comparing providers.
Hidden cost #2: discovering your retainer firm isn’t on your insurer’s panel
This is the one that surfaces in the worst possible moment: mid-incident, in front of the board, with a claim already filed.
Most commercial cyber insurance policies require policyholders to use a pre-approved panel of forensics firms and breach counsel, or to get the insurer’s written consent before retaining anyone else. Reporting on how cyber insurance has reshaped incident response has found that when a security vendor isn’t on a carrier’s panel, the breach coach the insurer assigns becomes the primary decision-maker, not the vendor the client already trusts, and the process itself can delay the response. Insurers including Chubb and AXA XL publish explicit non-panel provider processes for exactly this reason: if your retained firm isn’t listed on your policy before the incident occurs, you may need approval just to keep using them, and going off-panel without it can put reimbursement at risk.
None of this is disclosed by the retainer contract. It’s buried in the insurance policy’s “retention of vendors” clause, a document most security teams never cross-reference against their IR agreement until the day both matter at once.
Hidden cost #3: the invoice that arrives after the incident is “over”
Retainer hours are a prepaid, capped bucket. Real incidents rarely respect the cap. Once the prepaid hours are gone, billing typically shifts to a surge rate that runs 50 to 150% above the retainer rate, often billed in four-hour increments, meaning a 90-minute call can cost four hours at the surge price. Retained rates in the market generally run somewhere between $175 and $400 an hour; the same hour purchased on the open market during an active incident, with no pre-negotiated agreement, can run $800 to $1,500.
The other side of that coin is just as costly in a quieter way: unused retainer hours frequently expire at the end of the contract term if they aren’t rolled over or converted to credit, which means an organization can pay for readiness capacity every year and simply lose whatever it doesn’t burn through. That’s not a flaw unique to any one vendor. It’s how the hours-based retainer model is typically built.
Hidden cost #4: every one of these delays compounds the number that actually determines the bill
None of the above matters in isolation. It matters because of what IBM’s 2025 Cost of a Data Breach Report already quantified: organizations that identified and contained a breach in under 200 days paid an average of $3.87 million, while those that took longer paid $5.01 million, a 29% premium for slower response. The global mean time to identify and contain a breach in 2025 was 241 days, the fastest that figure has been in nine years, and it’s still driven largely by how quickly a response actually starts and how much ground it has to cover before it’s effective.
Onboarding delays, panel disputes, and surge billing don’t just cost money directly. They extend the exact window IBM’s data shows is the single biggest lever on total breach cost. A retainer that guarantees a callback in two hours but needs two more days to actually understand your environment isn’t buying you the readiness the line item implies.
The NetDiligence 2025 Cyber Claims Study, which analyzed roughly ten thousand cyber insurance claims from 2020 through 2024, found average crisis services costs for small and mid-sized organizations of around $152,000 per incident, with total incident costs averaging $264,000. Crisis services (forensics, breach counsel, notification, PR) are precisely the category that break-glass onboarding friction and surge billing inflate.
What CISOs are actually evaluating, whether they realize it or not
The retainer question was never really “do we have coverage.” It’s “does the team that shows up already know enough about us to be useful in hour one, not day three.” We’ve written before about how business email compromise and extortion cases turn on exactly this kind of speed and familiarity, in The $5 Million Letter, where a fast, informed response distinguished a real crisis from a hoax within hours rather than days, and in our breakdown of what actually went wrong at LastPass, where the gap between detection and full understanding of scope stretched into months.
The pattern in both is the same one this piece has been describing: readiness that exists on paper isn’t the same as readiness that exists in practice. If you want the broader argument for why most organizations are still structured around the first kind, we’ve made that case here.
The alternative isn’t a bigger retainer. It’s a different starting point
None of this is an argument against having a retainer. It’s an argument against assuming a retainer and a readiness program are the same thing. The firms and the CISOs who get the most value from an IR engagement are the ones where the relationship, the environment access, and the escalation paths were built and tested long before anyone needed to use them, which is the whole premise behind Rapid-IR: Reforged, the platform built specifically to make readiness continuous instead of theoretical, backed by a 20-minute guaranteed response from the same practitioners who already know what they’re walking into.
If you’re evaluating what you currently have against what “pre-emptive” looks like in practice, that’s exactly the comparison our Pre-Emptive IR page walks through, and our full buyer’s comparison guide lays out side by side. Or, if you’d rather talk it through directly, talk to our team.
