Cyber Incident Response Retainer

We take on organizations we know we can defend.

A responder who is already on an incident cannot take a second one. Fulk Labs holds retainers for a limited number of organizations. Every retainer starts with the readiness assessment. It shows us, and you, whether your organization can be defended today and what has to be fixed first. Organizations that complete the assessment and act on the fix list are the ones we offer a retainer to.

What a retainer client has that others do not.

• A named lead responder who knows your environment, your people, and your escalation path before anything happens.
• The readiness assessment included, with the fix list worked through with your team over the year.
• A direct line during an incident and a response commitment set in writing in the contract.
• Emergency response when it happens, by the person who assessed you: containment, eradication, recovery, and the evidence preserved.
• Readiness work through the year from the retainer's hours: the plan, the playbooks, and exercises with the people who would run a response.
• Reports written to be read by your regulator and, if it comes to it, a court.

Regulated organizations with someone accountable for detection and response.

Banks, finance and payment companies, insurers, energy and industrial operators, and government entities in Oman that are examined on how they detect and respond, and that want a responder on contract before it is too late to call one.

Four steps, in this order.

1. 01 The readiness assessment, in your organization, with your consoles and your alerts.
2. 02 The readout and the fix list, with an owner and a date for each fix.
3. 03 If we can defend you, we offer the retainer. The contract sets the response commitment and the year's readiness work, in writing, before signature.
4. 04 Onboarding: contacts, escalation, and access arrangements agreed before day one. The first call is not the first conversation.

What the retainer is not.

• It is not a managed SOC or MDR. We do not monitor your network day to day.
• It is not a product. We sell none.
• It does not include ransom negotiation or payment facilitation.
• It is not available without the readiness assessment.
• It is not a promise of unlimited response. The commitment is set in the contract.

Find out how, on a call.

Forty-five minutes with the founder. Tell him what you run, who would respond today, and what worries you most. You leave knowing where you stand and what to fix first.

For the person accountable for detection and response.