Published incident response retainers start around $25,000 a year, break-fix work runs $350 to $600 an hour without one, and ransomware recovery averages about $1.7M per Sophos’s 2026 survey. Those 3 numbers measure different things. Mixing them up is how budgets get blown.
I’m Uprite’s CTO, and the cost question comes up on nearly every security call. The answer turns on timing. Did you sign before the incident or after? This page prices all 3 so you can compare them side by side, and what a responder actually does hour by hour, which isn’t a pricing question at all, is covered in our guide to incident response services in Houston.
Three prices matter. A retainer is paid in advance, and the one published tier list I found starts at $25,000. Hourly rates with no retainer run $350 to $600 in the guide I checked, billed while your systems are still down. The recovery bill is separate and usually bigger, averaging $1.7M in Sophos’s 2026 survey. Pay for a retainer only if your cyber policy doesn’t already name a responder.
What Does an Incident Response Retainer Cost?
An incident response retainer is a prepaid agreement with a forensics and response firm that fixes the hourly rate, the response time and the phone number before anything breaks. You pay a fee up front, the firm commits to answering, and the money is drawn down against incident work or readiness services.
Few providers print a price. LevelBlue is one that does. Its public retainer page lists 3 tiers, though it doesn’t say whether the amounts are annual, so I’ve compared them with the yearly figures other guides quote.
| Tier | Retainer amount | Discount on response work | Initial response | On-site dispatch |
|---|---|---|---|---|
| Essentials | $25,000 to $74,999 | 10% | 4 hours | 72 hours |
| Advanced | $75,000 to $149,999 | 15% | 2 hours | 48 hours |
| Premium | $150,000 and up | 20% | 1 hour | 24 hours |
The dollar figure wasn’t what caught my eye. The last column was. At the entry tier a responder has up to 72 hours to show up in person. That’s 3 full days. Ransomware doesn’t wait. In our experience the first day of a case is mostly remote anyway, with hosts isolated, logs pulled and disk images taken from a laptop in another city, so I’d weight the initial response time far above the dispatch time, and I’d read the dispatch clause twice before signing anything.
Unused money rolls over at 100% in every tier. That makes the retainer less of a sunk cost than it looks, since it can go toward readiness services at a 15% to 25% discount, which for a company that never has an incident is where the value ends up. Quiet years aren’t wasted.
Other published guidance sits lower. A 2026 pricing guide from Decryption Digest puts specialist boutiques at $25,000 to $75,000 a year, the biggest consulting firms at $75,000 to $250,000, and managed detection bundles with response built in at $50,000 to $150,000. It attributes its ranges to general market data without citing specific figures. Treat it as a sanity check on the table above, not a quote.
What Do Hourly Rates Look Like Without a Retainer?
Without a retainer you’re a stranger calling at 2 AM. You pay for that. The same guide puts break-fix work at $350 to $600 an hour, which it describes as 30% to 50% above what a retained client pays, and it lists surge rates for retained clients at $250 to $350 an hour for specialists and $350 to $500 at the biggest firms. Other guides print higher emergency figures, so I’d budget toward the top of whatever range you’re quoted, because a number printed in a guide is a starting point and an emergency rarely gets negotiated down.
Take a hypothetical case. 2 responders working 10-hour days for 5 days is 100 hours. At $350 that’s $35,000. At $600 it’s $60,000.
That’s forensics hours only. Nothing for the lawyer, the restore or the notification letters. The guide’s own estimate for a full specialist ransomware engagement is $50,000 to $150,000, so treat my 100 hours as a floor, not a forecast.
Hours are the cheap part. The unknown is how many.
Who Pays When You Have Cyber Insurance?
Often the carrier does. That changes what you should buy. A CSO Online report quotes a Forrester analyst saying companies with a policy usually pick a responder from a panel the carrier has approved, notes that the hourly rate is often negotiated in advance between that firm and the insurer, and cites a Gartner analyst who says policies often require a retainer outright.
So read the declarations page before you read any proposal, and look for a named responder, a notice window and a forensics retention, because hiring your own firm first can leave you paying for it yourself.
We walk through that sequence in our ransomware recovery guide, and the first 60 minutes get their own checklist in our post on the first hour of a ransomware attack in Houston. Still choosing a firm? Our ranking of the best incident response companies in Houston scores them on response terms rather than logos.
What Does Ransomware Recovery Cost After the Responders Leave?
The responder’s bill is the small one. Recovery is the big one, everything from rebuilding servers and restoring data to paying lawyers, mailing notices and waiting for revenue to come back. 3 sources give a usable range. None of them describes a 40-person Houston company. Check the sample column before you borrow a number.
| Source | What it found | Who it measured |
|---|---|---|
| Sophos State of Ransomware 2026 | $1.7M average recovery cost, $769K median ransom payment | 2,158 IT leaders in 17 countries at organizations of 100 to 5,000 employees, surveyed January to March 2026 |
| Coveware Q3 2026 | $400,000 median payment, about $1.03M average, nearly 80% of cases ended without a payment | Incidents Coveware worked, with a median company size of 1,121 employees |
| IBM Cost of a Data Breach 2026 | $4.99M global average and $11.5M in the US | Breaches of every type, not only ransomware |
Read Sophos’s 2026 survey as the cost of getting back to normal. Its summary page doesn’t say whether the ransom is counted in that figure. 56% of the attacks it tracked encrypted data.
Coveware’s October 2026 report comes from real negotiations, and its median payment is $400,000, with nearly 80% of the cases it saw ending without any payment. The two datasets measure different populations, a survey of IT leaders against negotiated cases.
Time is the lever you control. IBM’s 2026 report puts the mean time to identify and contain a breach at 247 days, and in the Baker Donelson summary of that report, breaches that ran past 200 days averaged $5.65M against $4.32M for faster ones. That’s a $1.33M penalty. Slow is expensive.
And 71% of Coveware’s Q3 cases involved stolen data. A restore doesn’t close those. That’s why a responder who can scope a breach quickly earns the fee.
What Does a Houston Business Owe on Top of the Invoice?
Texas puts a clock on the paperwork. The clock has a price. Under Business and Commerce Code 521.053, you notify affected individuals within 60 days of determining a breach occurred. If 250 or more Texans are involved, the Attorney General hears from you within 30 days through its online form.
Miss the individual deadline and section 521.151 allows a civil penalty of up to $100 per person for each day of delay, capped at $250,000 for a single breach. The chapter’s general penalty adds $2,000 to $50,000 per violation.
Houston isn’t a quiet corner. The FBI’s IC3 2025 report ranks Texas 2nd in the country for complaints, 97,912, and for reported losses, $1.83B, and our own count of Attorney General filings found 73 breach notices from the Houston metro in the 12 months to September 21, 2026, covering 1,154,263 Texans. The method is on our cybersecurity services page for Houston.
The responder’s invoice is only one line. Here’s who sends the others.
| Line item | Who usually bills it | Does a retainer cover it? |
|---|---|---|
| Forensics, containment and scoping | The response firm | Yes, drawn from the retainer |
| Breach counsel | A law firm, often on the carrier’s panel | No |
| Notification mailing and credit monitoring | A notification vendor | No |
| Rebuilding and restoring systems | Your IT provider | Only if your IT contract says so |
| Ransom negotiation and payment | A specialist, as a separate engagement | No |
What Does Uprite Charge, and What Don’t We Cover?
Our pricing page publishes plans, not a standalone retainer. Security on top of IT you already run is MSSP Security Focus, from $40 per user per month. The plan lists advanced firewall management, SIEM and SOC monitoring, threat intelligence, vulnerability scanning, incident response, compliance automation and a quarterly security review, and our managed security services in Houston page has the local detail.
A 50-person company pays about $24,000 a year at that starting rate. 100 people pay $48,000. Licensing and anything else in a custom plan come on top.
Don’t set that beside the LevelBlue table and call it a win. We’re a managed IT and security provider. We’re not a forensics firm. Forensic imaging, attribution and expert testimony belong with a specialist, ideally the one your carrier already approved. What we handle is everything around that work, which in practice means helping contain the spread, resetting accounts and restoring from backups, and our average first response is 5 minutes.
What the page doesn’t print is a response-hour allowance or an on-site window for an incident. Get both in writing, from us or from anyone else.
When Is a Retainer Not Worth It?
Sometimes it isn’t. If your policy already hands you a named responder and carries no retention on forensics, a separate $25,000 retainer mostly buys a second phone number. In my experience a small team with a clean policy and restore-tested backups does better putting that first $25,000 into MFA and an endpoint tool somebody actually watches.
Buy one when the policy is silent on vendors. Buy one when you hold regulated data. Buy one when a day of downtime costs more than the annual fee.
How Do You Price It for Your Own Company?
- Pull your cyber policy and write down the named responder, the notice window and the forensics retention.
- Ask each provider for a rate card, the response-time commitment, the on-site window and what happens to unused funds.
- Multiply their break-fix rate by 100 hours. That’s your cold-call forensics number.
- Add counsel and notification, and ask your broker for a range, because they hold claims data for your industry and a made-up number from me wouldn’t help you plan.
- Compare the total with the retainer. If the retainer is a fraction of the gap, it’s cheap insurance.
Want these numbers checked against your own policy and headcount? We’ll walk through it with you. No sales script.
Get a Free IT AssessmentQuestions Houston Owners Ask About Incident Response Cost
How much does incident response cost for a small business?
A specialist firm’s retainer runs $25,000 to $75,000 a year, and one 2026 pricing guide puts a full specialist ransomware engagement at $50,000 to $150,000. That’s the response firm’s bill alone. Recovery, legal and notification costs sit outside it.
Is an incident response retainer worth it?
Only if your cyber policy doesn’t already name a responder. Where the carrier supplies a panel firm at a pre-negotiated rate, a separate retainer mostly duplicates it. Without that cover, a retainer fixes your rate and your response time before the worst day arrives. Check the policy first.
What’s the hourly rate for incident response?
One 2026 pricing guide gives $350 to $600 an hour for break-fix work with no retainer, about 30% to 50% above retained rates. Surge rates for retained clients run $250 to $350 for specialists and $350 to $500 at the largest firms.
Does cyber insurance cover incident response costs?
Often, but through the carrier’s approved vendors. Cyber policies commonly cover forensics and breach counsel, and they tend to set a notice window and name panel firms, so hiring your own responder first can leave you paying for it. Read yours tonight.
Do unused incident response retainer hours roll over?
Often, yes, for a period. LevelBlue’s published tiers roll over 100% of unused funds, and CSO Online reports unused hours often carry into the next contract year. Rollover can usually go toward readiness work. Ask whether yours does.
How long do Texas businesses have to report a breach?
You have 60 days to notify affected individuals after determining a breach occurred, and 30 days to notify the Attorney General when 250 or more Texans are affected. Late notice can cost up to $100 per person for each day, capped at $250,000 for one breach.
