Prepaid response hours
Hours scoped to your organisation and drawn against triage, containment, and Incident Response work at your committed rate. Priority access over all non-retainer traffic.
Incident Response Retainer
Your incident response team.
Before you need one.
Prepaid response hours, a named lead responder, and a pre-agreed SLA. Built around organisations that cannot afford to improvise when an incident hits.
NCSC Assured Cyber Incident Response
Aruga is an NCSC Assured Service Provider for Cyber Incident Response at Standard Level, giving organisations confidence that our incident response service meets the NCSC's recognised standards for quality and capability.
Why a retainer matters
Incident Response without a retainer is a gamble.
Without a retainer, you join a queue. During a widespread incident, response capacity across the industry fills up fast.
Emergency Incident Response without pre-agreed terms means finding out the cost mid-crisis. Retainer clients have fixed rates agreed before anything happens.
Responders arriving cold to an unknown environment take longer to contain. A retainer means your lead responder already knows your systems, your team, and your priorities.
4rings
Answered within four rings, 24/7
60m
Specialist callback from first contact
0
Pricing surprises
100%
Unused hours converted to proactive security services at renewal
What is included
Everything you need before, during, and after an incident.
Built around organisations with over 150 employees or businesses that need a bespoke response capability — not a generic subscription.
Named lead responder
A dedicated specialist who participates in onboarding, knows your environment, and leads the response when an incident occurs. No handoffs mid-crisis.
Incident response plan
Workshop-based development of a personalised Incident Response plan. Documented, tested, and ready before you need it.
Annual tabletop exercise
A live facilitated exercise run by your lead responder each year. Tests your plan, rehearses your team, and surfaces gaps.
Defined SLA model
Call answered in four rings. Specialist callback within 60 minutes. Response begins. On-site attendance if scoped. All documented before you sign.
Hours conversion
Unused hours at year end convert to tabletop exercises, Incident Response planning or consultancy delivered within 90 days of renewal. Never wasted.
How it works
In place before you need it. Ready the moment you do.
The retainer is structured so your lead responder understands your environment from day one. Click each stage to see what happens.
Onboarding — scoped and live
Your lead responder is assigned and your scope of works is agreed. We document your environment, team contacts, key assets and priorities; map critical systems; agree SLAs; and make the retainer live.
Onboarding — scoped and live
Your lead responder is assigned and your scope of works is agreed. We document your environment, team contacts, key assets and priorities; map critical systems; agree SLAs; and make the retainer live.
Service levels
Commitments agreed before anything happens.
Every SLA is documented in your scope of works. You know exactly what to expect before you sign, not after an incident when it is too late to negotiate.
You call Aruga
24/7/365
4 rings
Call answered
60m
Specialist callback
On-site attendance
Defined in scope of works
Priority access, guaranteed
Retainer clients take priority over all non-retainer traffic. During industry-wide incidents, when response capacity tightens, your access is protected.
Unused hours
A retainer that is never wasted.
Good security means you may not use all your prepaid hours on incidents. Unused hours at year end do not disappear. They convert to proactive security work delivered within 90 days of renewal.
Tabletop exercises
Additional facilitated exercises for leadership teams.
Incident Response planning
Review, update and stress-test the IR plan.
Security consultancy
Hardening, configuration review or independent technical assessment.
Are you a smaller business?
Incident Response Assurance might be the right fit.
For businesses with up to 150 employees, Incident Response Assurance gives you a 24/7 hotline access, a specialist callback within the hour, and expert-guided containment, all for a fixed annual subscription. No prepaid hours. No bespoke scoping.
Experiencing a cyber attack right now?
Call our emergency response line, 24 hours a day, every day.
You do not need to be an existing client to call.
Get started
Get a retainer in place before you need it.
A discovery call takes 30 minutes. We will scope the right retainer for your organisation and give you a clear picture of what is included.