The Probatio Cyber Incident Retainer is an annual standby agreement providing contractual response time guarantees, prioritized on-site deployment of our experienced DFIR team, a standby emergency loaner hardware fleet, and official audit proof for NIS2, ISO 27001, and cyber insurers.
In a cyber attack, every minute counts. Companies without an active retainer lose valuable days vetting vendors, signing emergency NDAs, and establishing access protocols while operations remain paralyzed.
We invest 4 hours on-site upfront to map your network topology, critical crown jewels, escalation contacts, and authentication pathways. When an emergency happens, our responders execute immediately without delay.
Enterprise IT changes continuously. With regular semi-annual reviews (2 hours each), we keep emergency procedures, contacts, backup access keys, and runbooks verified and up to date.
Receive an annual Retainer Certificate proving dedicated external incident response capability to NIS2 supervisory authorities, ISO/IEC 27001 auditors, and cyber insurance underwriters.
A crystal-clear distinction between prepaid base retainers ensuring year-round readiness and on-demand specialized response services billed during an actual incident.
| Category / Service | Scope, Conditions & Guarantees | Status |
|---|---|---|
| Included Services (Covered by the Annual Retainer Fee of EUR 6,500.00) | ||
|
24×7 Emergency Hotline / Direct Call Right
Year-round direct escalation channel for authorized corporate contacts
|
Available 24/7/365. Contractually guaranteed response times: Remote ≤ 90 min, On-Site ≤ 4 hrs (Vienna & surrounding DACH). | INCLUDED |
|
Technical Onboarding & Runbook Creation
Initial technical and organizational posture assessment
|
4 hours on-site to assess system landscape, crown-jewel assets, escalation matrix, and formulate the incident runbook. | INCLUDED |
|
Update Meetings (Semi-Annual)
Regular readiness verification and asset updates
|
2 hours per half-year (total 4 hrs/year) to maintain, verify, and update the runbook, escalation contacts, and infrastructure access. | INCLUDED |
|
Audit Proof & Annual Certificate
Formal verification of external DFIR readiness
|
Official annual Retainer Certificate for NIS2 compliance, ISO 27001 (Control A.16), and cyber insurance underwriters. | INCLUDED |
| On-Demand Incident Services (Incurred during active engagements / billed as incurred) | ||
|
Incident Response & Crisis Management
Immediate containment, threat eradication, and team coordination
|
Rapid mobilization of incident responders and crisis commanders. Immediate isolation of affected systems, preventing spread, and protecting operational domains. | EUR 300 / HR |
|
Court-Admissible Forensics & 72h GDPR Support
Forensic timeline reconstruction and statutory data breach assistance
|
Seamless chain-of-custody evidence collection by court-certified expert witnesses. Full support for mandatory 72-hour notifications to data protection authorities (Art. 33 GDPR). | EUR 300 / HR |
|
Emergency Loaner Hardware Pool
Parallel business continuity during extensive forensic investigations
|
Prioritized allocation of up to 20 loaner laptops and 3 enterprise servers (up to 50 TB storage) to resume core business workflows while forensics proceed. | INCIDENT POOL |
|
Ransomware Negotiation & Sanctions Escrow
Specialized threat actor communication and legal compliance
|
Expert negotiation team handling communications with extortion cartels. Proof-of-decryption verification and sanctions-compliant payment handling (OFAC/EU). | SEPARATE AGREEMENT |
From initial hotline alert to complete recovery: Here is how our incident team executes under the Retainer agreement.
Your designated security officer calls our 24/7 hotline. The on-duty Incident Commander assesses the attack scope against your pre-built runbook and activates standby specialists.
Our responders connect remotely to isolate infected subnets, sever command-and-control channels, and freeze threat actor lateral movement across your active directories.
On-site arrival of our digital forensic investigators. Preservation of volatile memory (RAM), disk images, and audit logs. Drafting technical filings for the 72-hour GDPR notice.
We deploy up to 20 laptops and 3 servers (up to 50 TB storage) from our emergency fleet so your core operations can resume while forensics continues on compromised hardware.
If extortion is involved, our negotiators step in to de-escalate, gain operational time, verify decryptor integrity, and guide leadership through all legal and technical options.
The biggest bottleneck during ransomware recovery is hardware unavailability: original computers are locked as forensic evidence, leaving key personnel paralyzed. We resolve this dilemma with dedicated loaners.
Pre-imaged, secure business notebooks for executive leadership, finance, and critical operational staff to maintain communication and workflow immediately.
High-performance standby servers and high-capacity storage for staging clean backup restores and running essential infrastructure services in parallel.
Resume revenue-generating operations while preserving uncompromised evidentiary integrity on original machines for law enforcement and insurance claims.
Complete cost transparency with zero surprise clauses. A predictable annual standby retainer guaranteeing capacity, paired with clear hourly rates when deployed.
Year-round readiness, guaranteed SLAs & official compliance audit proof
Time and materials billing applied strictly during activated incident response
Contract periods begin on the 1st of any given month and run for 12 months. The agreement renews automatically for another 12-month period unless terminated in writing at least one week prior to the start of the next cycle.
Book a direct 15–30 minute strategy session with our Lead Incident Commander. We will review your threat landscape and align the appropriate retainer setup.
Clear answers to common operational, contractual, and technical questions.