Incident Response Retainer for a Bank
The Challenge
The bank had strong prevention but no contracted responders. Previous incidents had lost days to procurement and onboarding before anyone with the right skills was working the problem.
Regulators expected documented response capability and notification timelines, and the fraud and security teams had never rehearsed a major incident together.
“When the attack came, the responders already knew our environment and our people. We were containing it within the hour instead of signing paperwork.”
The Execution
Onboard
We documented the environment, contacts, escalation paths, and regulatory obligations, and agreed a contracted response SLA.
Rehearse
Tabletop exercises with the security, fraud, legal, and communications teams turned the plan into practiced roles and decisions.
Respond
A credential-stuffing campaign against customer accounts was contained within the SLA, with evidence preserved and customer impact limited.
Harden
The post-incident report delivered root cause, regulator notifications, and hardening steps for authentication and monitoring.
The Outcome
The bank met its notification timelines with complete evidence, limited customer impact, and closed the authentication gaps the campaign exploited.
Unused retainer hours now fund quarterly exercises, and the response plan is part of the bank's regulatory documentation.