Pricing Models, Comparisons and 2026 Rules
Incident-response retainer pricing: prepaid hours, standby agreements and what they cover
How incident-response retainers are priced: prepaid hours, standby deals, insurer panels, response times and how to size one in CAD.
An incident-response (IR) retainer is a contract signed before anything goes wrong that guarantees a firm will help you within an agreed time when it does. It is usually priced in one of two ways: a prepaid block of hours at a set hourly rate, often with readiness work (a tabletop exercise, a plan review) that can use unspent hours, or a standby agreement with a small or no upfront fee that fixes rates and terms but bills only when you call. Your choice depends on how likely you are to use the hours, whether your cyber insurer requires you to use a firm from its panel, and how much your managed security provider already includes.
This guide is part of managed cybersecurity service pricing in Canada. Rates and hours are illustrative.
What incident response covers that monitoring does not
Monitoring and MDR services detect and contain. Incident response deals with what comes after:
- Scoping: which systems, accounts and data were affected, and since when.
- Forensics: collecting and preserving evidence in a way that can support insurance claims, legal advice and regulator reports.
- Eradication and recovery: removing the attacker's access, rebuilding systems, restoring from backups.
- Breach assessment support: facts your lawyer needs to decide whether there is a real risk of significant harm under PIPEDA, a risk of serious injury under Quebec's Law 25, or a reportable incident under Alberta's PIPA. See breach reporting rules.
- Reporting: a written account of what happened, the timeline and the remedial steps.
Ask your MDR or MSSP provider how many IR hours, if any, are included in your monthly fee, and at what point they hand over to a specialist.
Retainer models compared
| Model | How it is priced (illustrative) | Advantages | Watch out for |
|---|---|---|---|
| Prepaid hours | e.g. 40 hours × $300 = $12,000 a year | Guaranteed capacity; hours can fund readiness work | Unused hours may expire at year end |
| Standby (low or zero fee) | Small annual fee or none, hourly rate fixed (e.g. $350) | No large upfront spend | Response time may be longer; onboarding not done |
| Included in MDR | A set number of hours a year, e.g. 10–40 | One provider, quick start | Hours may be limited to the provider's own tools |
| Insurer panel | Insurer appoints and pays firm under the policy | Costs may be covered after the deductible | Need to call the insurer's hotline first; panel rules apply |
| Hybrid | Small prepaid block plus standby rates | Balances cost and readiness | Two sets of terms to manage |
Sizing a retainer
Illustrative example. A 70-person Saskatoon distributor considers a retainer. It estimates that a moderate incident (one compromised mailbox used for invoice fraud) would take about 25 hours of IR time, and a serious ransomware incident 150 to 300 hours or more. It does not plan its budget around the worst case, because its cyber policy would respond to a large incident, but it wants fast help and readiness work.
| Option | Calculation | Yearly cost |
|---|---|---|
| 40 prepaid hours at $300 | 40 × $300 | $12,000 |
| 20 prepaid hours at $320 | 20 × $320 | $6,400 |
| Standby only, $1,500 fee, $375 an hour when used | $1,500 + hours used × $375 | $1,500 in a quiet year |
If 12 of the 40 prepaid hours go to a tabletop exercise and a plan review, 28 remain for incidents. In a quiet year with the standby option, the distributor would still need to pay separately for the readiness work, for example 12 × $375 = $4,500, bringing the standby year to $6,000. The prepaid option costs $6,000 more but includes 28 hours of guaranteed response capacity.
Questions to ask before signing
- Response time: how quickly a responder will engage remotely and, if needed, on site, and in which Canadian cities.
- Hours of availability: 24/7 hotline, or business hours with best-effort nights.
- Rate card: hourly rates for each role (incident lead, forensic analyst, negotiator if any), travel and expenses.
- Rollover: whether unused hours roll over or convert to readiness services.
- Insurer coordination: whether the firm is on your insurer's panel, or whether the insurer will approve it. Read your policy and talk to your broker; see cyber-insurance requirements.
- Legal privilege: whether engagement will be through your lawyer, which some organisations prefer so that reports are prepared to obtain legal advice. Ask your lawyer.
- Data and evidence handling: where forensic images are stored, for how long, and how they are destroyed.
- Third parties: who pays for specialist services such as data recovery, and whether the firm subcontracts.
Readiness work worth buying with retainer hours
- An incident response plan tailored to your business, which is the first of the Cyber Centre's baseline controls.
- A tabletop exercise with management, IT and your managed security provider.
- Contact lists and decision rules: who can authorise shutting down systems, contacting police, the insurer and regulators.
- A backup restore test to confirm recovery times.
- A review of what your SOC or MDR provider can do without asking.
Retainers sit alongside the overall budget; for the full picture, see the worked cost examples and log retention in SIEM pricing.
Frequently asked questions
Do I need a retainer if I have cyber insurance?
Possibly not a large one. Many policies provide access to response services, but you usually have to call the insurer's hotline first and use approved firms. A small retainer or plan review may still be worth it. Check your policy wording.
Does the Cyber Centre provide incident response?
The Canadian Centre for Cyber Security accepts incident reports and provides advice and guidance; it is not a substitute for a private response firm for your recovery. Report through its website, and contact local police for crimes.
What if the attacker demands a ransom?
Get legal advice and involve your insurer and the police. Payment decisions raise legal and practical issues that a response firm and your lawyer should help you assess.
Can my MSSP also be my IR firm?
Yes, if it has the capacity and skills, but consider whether you want an independent firm to investigate an incident in an environment the MSSP manages.
Sources
- Canadian Centre for Cyber Security — reporting a cyber incident and incident-response planning
- Office of the Privacy Commissioner of Canada — breach assessment and reporting
- Canadian Anti-Fraud Centre — reporting fraud and cybercrime
- Insurance Bureau of Canada — general information on business insurance
