A breach can cost a business $4.5 million on average—and every minute of downtime matters. Incident response services are no longer a luxury; they're a critical line of defense that clients expect their trusted security providers to offer. Pricing these services correctly means capturing revenue while delivering genuine value when it matters most.
Why Incident Response Pricing Is Complex
Traditional managed services operate on predictable monthly retainers. Incident response flips that model: you're billing for urgency, expertise deployed under pressure, and results that directly prevent catastrophic loss. A client calling you at 2 a.m. because their systems are down isn't comparing your price to a competitor's email security package—they're asking themselves if your team can stop the bleeding.
This context shift means your pricing must account for staffing, on-call burden, tooling, and the specialized skills required to handle forensics, containment, and recovery simultaneously.
Common Incident Response Pricing Models
Retainer + Per-Incident Fees
Many firms charge a monthly retainer ($2,000–$8,000 depending on company size and scope) that covers access to senior responders and initial response capacity. When an incident occurs, additional hourly or flat fees kick in. This hybrid approach gives clients predictability while protecting your margins for complex, time-intensive incidents.
Hourly Billing
Some providers charge $250–$500 per hour for responders, with premiums (often 25–50% more) for after-hours engagement. This works if you have flexible staffing but leaves clients anxious about cost overruns during a crisis.
Incident-Based Flat Fees
Offering fixed prices for specific incident types—$10,000 for ransomware containment, $15,000 for data exfiltration investigation—provides transparency and speeds up contract negotiations. The downside: you must build in buffer for edge cases.
Tiered Retainer Model
Bronze ($3,000/month) covers email and endpoint; Silver ($6,000/month) adds network and identity; Platinum ($12,000+/month) includes 24/7 dedicated responder access. This appeals to growth-stage businesses and scales revenue naturally as clients upgrade.
What to Include in Your Pricing
Before quoting, define what's actually included:
- Initial response time (1 hour, 4 hours, 24 hours?)
- Investigation depth (containment only vs. full forensics)
- Communication cadence (hourly updates, daily briefs?)
- Post-incident deliverables (formal report, remediation roadmap, threat assessment?)
- Third-party costs (forensics subcontractors, tool licenses, legal referrals—pass-through or bundled?)
- Retainer exclusions (DDoS mitigation, nation-state threats, or incidents affecting 50+ employees may require supplements)
Being explicit prevents scope creep and uncomfortable conversations when the incident is more complex than initially thought.
Competitive Positioning
Large consulting firms (Deloitte, EY, IBM) charge $1,000–$3,000+ per hour because they bring brand trust and deep resources. Regional managed security providers typically sit at $400–$800 per hour. Smaller boutique firms or newer entrants often price at $200–$400 per hour to establish track record and win market share.
Your positioning should reflect your actual capability. If you're a one-person operation, bundling incident response into a broader managed security retainer ($5,000–$10,000/month) is safer than promising 24/7 on-call response you can't sustain.
Setting Up Your Service Offering
- Define your playbook: Document response workflows, escalation paths, and tool stacks. This clarity makes accurate estimates possible.
- Calculate your costs: Include responder salary, training, tools (SIEM, forensics platforms), cyber insurance, and on-call overhead.
- Set retainer levels: Start with 2–3 tiers targeting SMBs, mid-market, and enterprise segments.
- Build in surge capacity: Retainer hours might cover 30–40 billable hours monthly; overages at 1.5x standard rate protect you.
- Create incident response agreements upfront: Get legal review and have clients sign before an incident occurs.
Listing your incident response services on Mercoly helps you get discovered by prospects actively searching for breach response help, win qualified leads, and market these high-value services to the right audience at scale.
Frequently Asked Questions
Q: Should I offer incident response if I don't have a 24/7 SOC? No. Clients hiring incident responders expect rapid access. If you can't provide on-call coverage (even via trusted partners), clearly state your response windows and don't promise what you can't deliver.
Q: How do I estimate hours for an incident I've never seen before? Use a tiered estimate: "Containment typically takes 4–8 hours; full forensics adds 15–40 hours depending on environment size and complexity." This sets expectations and reduces post-incident billing disputes.
Q: Can I price incident response separately from my managed services? Absolutely. Many SMBs don't have managed services but buy incident response as standalone insurance, and this expands your addressable market.
Start by auditing your costs, defining your actual response capabilities, and pricing with confidence—your clients are banking on your expertise, and fair pricing reflects that value.