Rex says
Money math without the spreadsheet headache. Plug in your numbers and I'll show you exactly where the dollars land.
Try a scenario
Click to load — tweak from there.Inputs
Result
Expected annual cost with retainer
$42,000
Expected annual cost without retainer
$15,000
Expected savings from retainer
-$27,000
Savings as % of no-retainer cost
-180%
Hours beyond prepaid block (typical incident)
80
Psst — share this and help Rex grow
One click, a permanent link with your numbers baked in.
How to use this
- 1Enter probability of needing ir support this year (%).
- 2Enter estimated ir hours for a typical incident.
- 3Enter emergency (no retainer) hourly rate.
- 4Enter annual retainer fee.
- 5Enter prepaid hours included in retainer.
- 6Enter retainer hourly rate (beyond prepaid).
- 7Read your expected annual cost with retainer on the right — it updates as you type.
- 8Hit Share to keep the scenario or send it to someone.
About this calculator
Incident response firms charge dramatically more for emergency, no-retainer engagements than for pre-negotiated retainer clients, often 1.5-2.5x the retainer hourly rate, and emergency engagements also carry longer response-time SLAs since retainer clients get priority staffing. This calculator compares the annual cost of a retainer (which usually includes a block of prepaid hours plus a committed response SLA) against the expected cost of needing emergency IR services without one, based on your estimated probability of needing IR support in a given year and the typical hours a real incident consumes. It also captures the value of faster response time itself: a retainer client typically gets a responder on a call within 1-4 hours versus 24-72 hours for a new emergency client sourcing a firm cold, and that gap directly extends dwell time and downtime cost during exactly the incident you're trying to contain quickly.
Worked example
Using the values the calculator loads with:
Inputs
- Probability of needing IR support this year (%): 25
- Estimated IR hours for a typical incident: 120
- Emergency (no retainer) hourly rate: 500
- Annual retainer fee: 35000
- Prepaid hours included in retainer: 40
- Retainer hourly rate (beyond prepaid): 350
Results
- Expected annual cost with retainer: $42,000
- Expected annual cost without retainer: $15,000
- Expected savings from retainer: -$27,000
- Savings as % of no-retainer cost: -180%
- Hours beyond prepaid block (typical incident): 80
What each field means
Inputs
- Probability of needing IR support this year (%)
- The probability of needing ir support this year (%) used in the calculation. Starts at 25 so you have a working example on load. Accepted range: 0–100.
- Estimated IR hours for a typical incident
- The estimated ir hours for a typical incident used in the calculation. Starts at 120 so you have a working example on load.
- Emergency (no retainer) hourly rate
- The emergency (no retainer) hourly rate used in the calculation. Starts at 500 so you have a working example on load.
- Annual retainer fee
- The annual retainer fee used in the calculation. Starts at 35000 so you have a working example on load.
- Prepaid hours included in retainer
- The prepaid hours included in retainer used in the calculation. Starts at 40 so you have a working example on load.
- Retainer hourly rate (beyond prepaid)
- The retainer hourly rate (beyond prepaid) used in the calculation. Starts at 350 so you have a working example on load.
Results
- Expected annual cost with retainer
- Returned as a money amount in US dollars and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Expected annual cost without retainer
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Expected savings from retainer
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Savings as % of no-retainer cost
- Returned as a percentage. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Hours beyond prepaid block (typical incident)
- Returned as a whole number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
FAQ
Is a retainer worth it if I might never need IR support?
Even at a modest 15-25% annual probability of needing support, the expected cost calculation usually favors a retainer once you include the faster response-time value, but if your probability is genuinely under 10% (small, low-profile organization with mature controls) a retainer may not pencil out purely on the math, though the guaranteed response SLA still has value during any incident, including ones that turn out to be false alarms.
What does 'faster response time' actually save?
Every hour between detection and a skilled responder starting containment is an hour attackers can spread laterally or continue exfiltrating data, so the 1-4 hour retainer response window versus 24-72 hours for a cold emergency engagement can meaningfully shorten total dwell time, which correlates directly with total breach cost in every major cost-of-breach study.
Do unused retainer hours roll over or expire?
This varies by contract, some IR firms let you use retainer hours for proactive work like tabletop exercises or readiness assessments if no incident occurs, while others treat it as a pure standby fee that expires unused. Read the contract terms carefully since this materially changes the retainer's value if you go a year without an incident.
How many hours does a typical incident really take?
A contained, well-scoped incident (single system, clear ransomware note, tested backups) might run 40-80 hours of IR firm time; a complex multi-system breach with forensic investigation, regulatory reporting support, and negotiation can run 200+ hours, so budget your hours-per-incident input based on your actual environment complexity, not a best-case scenario.
Accuracy and limitations
- Results are estimates before tax, fees, and inflation unless an input explicitly covers them.
- Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.
- This is educational maths, not financial advice. Check anything contractual with the lender or your accountant.
Related tools
Cyber Insurance Premium vs. Retention Calculator
Compare a higher deductible/lower premium against expected annual loss.
MTTD/MTTR Cost Impact Calculator
See how faster detection and response times translate into dollars saved.
Ransomware Downtime Cost Calculator
Model lost revenue, labor, and recovery cost for each day systems are down.
Cite this calculator
Writing about this topic? Grab a citation — every link helps keep these tools free.
RevenueLab. (2026). Incident Response Retainer Value Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/incident-response-retainer-value
<p>Source: <a href="https://www.revenuelab.fyi/toolbox/incident-response-retainer-value" target="_blank" rel="noopener">Incident Response Retainer Value Calculator — RevenueLab</a> (2026).</p>
Source: [Incident Response Retainer Value Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/incident-response-retainer-value) (2026).