The Pen Test Partners Incident Response Retainer is a pre-contracted Digital Forensics and Incident Response (DFIR) service that provides organisations with guaranteed access to experienced incident responders. By agreeing to contracts, NDAs, supplier due diligence, and purchase orders in advance, the retainer eliminates administrative delays so that engagement can begin immediately when an incident occurs. The service is structured into three tiers: - Essential: Guarantees availability and faster response times during critical incidents. - Enhanced: Offers improved response times, reduced day rates, and deeper incident engagement. - Elite: Provides premium access, rapid response, proactive threat intelligence, and inclusion of OSINT and Dark Web Monitoring for early visibility into emerging threats. All tiers include free onboarding to align the Pen Test Partners team and tooling with the client's environment. Higher tiers provide progressively faster triage times and lower day rates. The service is NCSC Assured for Cyber Incident Response (CIR), meaning the provider's people, processes, and technical capabilities have been independently assessed by the UK's National Cyber Security Centre. Operationally, the team deploys remote incident response agents into client environments to support threat hunting, indicator of compromise (IOC) searching, data collection, and in some cases active breach containment — including neutralising malicious services and rogue processes. Investigations are supported by a dedicated DFIR lab.