Preparing organizations for critical events and strengthening resilience before they happen.
Security and risk leaders are under pressure to respond quickly to acute risk events, but many organizations lose valuable time and visibility when support is arranged only after an event occurs.
Whether dealing with cyber incidents, misinformation campaigns, financial fraud or physical security threats, the challenge is twofold – ensuring the right support is available when it matters most, while proactively strengthening resilience.
Kroll’s Cyber Incident Response Retainer (CIRR) enables organizations to move faster, budget smarter and respond more effectively when it matters most. Prepare now with priority access to risk expertise and maximum credit flexibility to tackle evolving risks.
Secure priority access to Kroll's multidisciplinary risk experts, with defined response SLAs, while using 100% of eligible retainer credits to strengthen resilience before a crisis occurs. Flexible multiyear options, ongoing service reviews and guidance on credit usage help organizations maximize value while aligning support to evolving cyber and enterprise risk needs.
Respond faster when it matters most
Defined remote support service levels provide rapid access to Kroll’s incident response expertise.
Be ready before an incident happens
Structured onboarding, gap analysis, readiness activities and eligible executive sessions help improve preparedness.
Maximize your retainer investment
Apply 100% of eligible credits toward services within the retainer menu, with guidance on credit utilization.
Increase visibility and control
Quarterly service reviews, reporting and sector intelligence help track value and inform next steps.
Stay flexible as risks evolve
Access multidisciplinary expertise across cyber, enterprise security, investigations, diligence, compliance and other eligible services.
Plan with greater confidence
Multiyear options, enhanced rollover opportunities and service management support help align retainer usage with long-term resilience and renewal planning.
Kroll’s Cyber Incident Response Retainer offers tiered service levels designed to meet your organization's response needs, onboarding requirements, credit flexibility and long-term resilience goals. From rapid incident response to proactive assessments, each option provides flexibility, expert support and cost-effective risk coverage across cyber, compliance, financial crime and physical security.
Features | BRONZE | SILVER | GOLD | PLATINUM |
|---|---|---|---|---|
24 Hours Onsite Support |  | | | |
Max Remote Support SLA | 6 hours | 4 hours | 2 hours | 2 hours |
Onboarding | Level 1: Retainer introduction and escalation paths + Intake form | Level 2: Bronze + Intake form (Analysis & Recommendations) | Level 3: Silver + IR Readiness Workshop | |
Quarterly Service Reviews + Sector Intel Reporting
| | | | |
Threat Intelligence Reporting | | | | |
Customized onboarding including Initial Educational Session for Executives (C-Level) |  | | | |
KrollONE Platform Access | | | | |
Rollover Credits (Single year) | Up to 10% | Up to 20% | Up to 25% | Up to 30% |
Rollover Credits (Multi-year) | | Up to 40% | Up to 60% | Up to 100% |
Rate Discount – Cyber and ESRM (*) | 5% | 10% | 15% | 20% IR / 15% proactive |
Kroll’s Cyber Incident Response Retainer can be managed through KrollONE, our unified client portal for Cyber & Data Resilience engagements.
The platform brings services such as Managed Detection & Response, Retainer services, and Threat Intelligence into one connected experience, with additional capabilities added over time.
For Cyber Incident Response Retainer clients, this means retainer status, credit usage and escalation paths are available in a single, self-service view rather than spread across emails and reports.
Practical Use Cases
Kroll’s Cyber Incident Response Retainer enables organizations to use 100% of service credits across multiple risk management services, including cybersecurity, regulatory compliance, financial crime, AI risk management, executive and physical security, and more. Below are just a few examples of the services available:
Cyber and Data Resilience | Enterprise Security Risk Management | Investigations, Diligence and Compliance |
|---|---|---|
|
|
|
Kroll’s Cyber Incident Response Retainer is designed to deliver value from the start of the relationship, not only when an incident occurs. After joining, clients follow a structured journey that supports readiness, visibility and ongoing resilience planning.
Cyber and Data Resilience
Kroll merges elite security and data risk expertise with frontline intelligence from thousands of incident responses and regulatory compliance, financial crime and due diligence engagements to make our clients more cyber- resilient.
Compliance and Regulation
End-to-end governance, advisory and monitorship solutions to detect, mitigate and remediate security, legal, compliance and regulatory risk.
Threat Exposure Management
Kroll’s field-proven cyber security assessment and testing solutions help identify, evaluate and prioritize risks to people, data, operations and technologies worldwide.
