Reduce recovery times

Reduce recovery times with prearranged communication channels and predefined response playbooks.

Manage costs

Manage costs with predictable budgets and improved response efficacy through tabletop reviews and readiness assessments.

Mitigate downstream risks

Mitigate downstream risks by following digital forensic best practices and defensible processes to satisfy regulators and remain expert witness ready.


  • Flexibly apply retainer credits to incident response or proactive risk mitigation
  • Eliminate hidden threats and vulnerabilities before an incident occurs
  • Lower the likelihood and cost of a breach
  • Quickly investigate and contain threats
  • Recover from attack swiftly

Incident Response Expertise Is Just the Beginning

From cases involving rogue insiders to organized crime syndicates and nation-state threats, Unit 42 performs more than 1,000 incident response investigations each year. The Unit 42 Retainer gives you deep forensics and response expertise when you need it most, with predetermined service-level agreements (SLAs).

You can also allocate your retainer credits for proactive Unit 42 cyber risk management services scoped during the contract term. Our trusted advisors can assist your team with security strategy, assessment of technical controls, and overall program maturity. Use retainer credits for any of these services:


Mitigate downstream risks
Assess and Test Your Security Controls
  • Attack Surface Assessment
  • BEC Readiness Assessment
  • Breach Readiness Review
  • Compromise Assessment
  • Cyber Risk Assessment
  • M&A Due Diligence
  • Penetration Testing
  • Purple Team Exercises
  • Ransomware Readiness Assessment
  • Supply Chain Risk Assessment
  • Tabletop Exercises
Mitigate downstream risks
Respond in Record Time
  • Cloud Incident Response
  • Digital Forensics
  • Incident Response
  • Incident Response Plan Development & Review
Mitigate downstream risks
Transform Your Security Strategy
  • Security Program Design
  • Virtual CISO

An Incident Response Retainer Tailored to Your Needs

We offer four retainer levels and response time SLAs to complement your organization’s existing security operations capabilities, fit your budget, and meet your incident response needs.

  Prepaid Credits Service Scope Response Time (Remote)
Tier 1 250 Designed for small and medium businesses 24 Hours
Tier 2 550 Designed for small-scale incidents or Test and Assess proactive services 8 Hours
Tier 3 1,250 Appropriate for most incident response engagements or Test and Assess, and Strategic Advisory services 4 Hours
Tier 4 2,500+ Ideally suited for large enterprise and complex forensic investigations 2 Hours


For faster assistance, you can optionally purchase an accelerated SLA response time for your desired retainer level, with an SLA upgrade option.

Approved by Cybersecurity Insurance Plans

Unit 42 serves as an approved incident response provider for over 70 major cyber insurance carriers and is a preferred partner to over 150 global law firms. 

If you need to use Unit 42 services in connection with a cyber insurance claim, Unit 42 can honor any applicable preferred panel rate in place with the insurance carrier. For the panel rate to apply, just inform Unit 42 at the time of the request for service.


If you think you may have been compromised or have an urgent matter, please contact Unit 42 Incident Response team or call North America Toll-Free: 866.486.4842 (866.4.UNIT42), EMEA: +, UK: +44.20.3743.3660, APAC: +65.6983.8730, or Japan: +81.50.1790.0200.

About Unit 42

Palo Alto Networks Unit 42® brings together world-renowned threat researchers, elite incident responders, and expert security consultants to create an intelligence-driven, response-ready organization that’s passionate about helping you proactively manage cyber risk. Together, our team serves as your trusted advisor to help assess and test your security controls against real-world threats, transform your security strategy with a threat-informed approach, and respond to incidents in record time so that you get back to business faster.


This content is also available in: