Incident Response Retainers: How to Book Prepaid Block-Hours, Draw-Downs, and the Emergency Surge

Two businesses get hit by the same ransomware strain in the same week. Same 200 hours of forensics, containment, and recovery. One pays roughly $60,000 and has responders triaging within two hours. The other pays well past $150,000, spends the first day negotiating a contract while systems stay dark, and meets its response team for the first time during the worst week in company history. The difference was never the malware. It was a contract signed months earlier, in calm weather — an incident response retainer — and whether each business understood what it had bought.

If your business would have to Google a forensics firm while attackers move through your file shares, this post is for you. It explains what an IR retainer actually buys, how to book the prepaid block on your own books, what happens to hours you never use, and what the emergency "surge rate" does to hours past the block. The accounting matters as much as the contract: a retainer booked wrong quietly overstates your assets all year, then surprises you twice — once when unused hours expire, and again when the overage invoice lands.

What a retainer actually buys​

An incident response retainer is a prepaid block of responder hours bought before anything is on fire. You pay upfront for a defined number of hours (or credits) over a 12-month term, and in exchange you get two things a walk-in caller cannot buy: a contracted triage SLA, usually one to four hours, and a pre-negotiated drawn rate for every hour the firm works. Without one, mobilization stretches to 24 to 72 hours while you scope and contract from a standing start, and every hour bills at the emergency rate.

The market offers five ways to buy roughly the same protection, and the published prices cluster usefully:

Two things stand out. First, most big firms publish no hourly rate at all — Mandiant, CrowdStrike, Kroll, and Unit 42 all quote per engagement — so the numbers above are planning anchors, not quotes. Get your own three figures in writing: the emergency rate with no retainer, the drawn rate under a retainer, and the annual fee. Second, compare any of those retainer prices against the stakes: IBM's 2025 Cost of a Data Breach study puts the global average breach at $4.44 million, and the US average at a record $10.22 million. A five-figure retainer is rounding error next to one incident — which is exactly why the accounting for it deserves more care than a rounding error usually gets.

On your books, a retainer is an asset, not an expense​

Here is the mistake most small businesses make: the $40,000 retainer invoice arrives in October, and the whole amount lands in that month's security expense. October looks terrible, the next eleven months look artificially clean, and the balance sheet never shows what you actually own — $40,000 of future responder time.

A prepaid retainer is a prepaid expense, a current asset. You paid cash for an economic benefit you have not consumed yet: hours of expert time available on demand over the contract term. The purchase moves money between asset accounts — cash down, prepaid retainer up — and touches the profit-and-loss statement not at all. Only as hours are drawn (or expire, more on that below) does the cost become expense.

This is not pedantry. Expensing the full retainer upfront understates your assets by the unconsumed balance every month of the term, overstates that first month's expense, and hides the draw-down pattern that tells you whether the retainer was sized right. If you renew annually, the distortion repeats every year, and year-over-year security spending becomes unreadable. Book the asset, then expense the consumption. Your month-end close will thank you.

Drawing down the block as incidents consume it​

Think of the prepaid block the way you think of a bank balance: every incident is a withdrawal, and the remaining balance is an asset you can still spend. Each month (or after each engagement), take the hours statement from your IR firm and move the consumed value from the prepaid asset to security expense at the drawn rate. A 22-hour containment engagement drawn at $300 an hour is a $6,600 expense in the month the work happened — not in the month you prepaid.

Three bookkeeping habits keep the draw-down honest:

• Reconcile hours like cash. The firm's hours statement is your bank statement for this account. Log opening balance, hours drawn, rate applied, and closing balance every month, even in quiet months when the entry is "no change." The month you stop reconciling is the month a disputed 14-hour "assessment" slips through.
• Accrue work performed but not yet billed. If responders worked the last week of the month and the hours statement arrives mid-next-month, book an accrual: debit security expense, credit a payable. Otherwise the incident month looks cheap and the invoice month looks expensive, and neither reflects reality.
• Separate drawn hours from overage on the P&L. Hours drawn inside the block and emergency hours billed past it are different economic events at very different rates. One expense account can hold both only if you never want to answer "what did the retainer actually save us?" — so use subaccounts or a memo discipline that lets you split them.

The hours you never use: expiry, rollover, and the write-off​

The quietest clause in the retainer is what happens to hours you never draw. Most contracts pick one of three treatments: hours expire worthless at term end, a capped portion rolls into the next term, or unused hours convert into proactive services like tabletop exercises or compromise assessments. IBM's filed tiers, for example, bundle proactive service units alongside response hours — a built-in conversion path.

Whatever your contract says, your books must agree with it. If 40 of your 100 hours expire unused at term end, the remaining prepaid balance is no longer an asset — it is a loss. Write it off: debit security expense (or a write-off account, if you want expiry visible separately), credit the prepaid asset to zero. Skipping this entry is how prepaid accounts accumulate ghost balances that overstate assets for years.

The provider's side mirrors yours exactly, which is worth knowing before you negotiate. On the firm's books your prepayment sits as deferred revenue — a liability, cash collected for work not yet delivered — and unused hours that expire become the firm's revenue at expiry, a category accountants call breakage. Your expired hours are their margin. That is not a criticism; it is leverage. Firms that profit from breakage will often trade it: ask for rollover caps, conversion of unused hours into proactive services, or a smaller block with a cheaper top-up rate instead of a large block designed to expire. Every hour converted to a tabletop exercise is an hour that stays an asset instead of becoming a write-off.

The surge rate: what hours past the block really cost​

Now the clause that decides whether the retainer pays for itself. Hours inside the block bill at the drawn rate you negotiated in calm conditions. Hours past the block — and every hour for a business with no retainer at all — bill at the emergency rate, and the gap is the whole economics of the product.

Do the division on your own quotes, but expect the emergency rate to land roughly 50 to 150 percent above the drawn rate at most firms — the same shop that draws your block at $300 an hour may bill walk-in emergencies at $450 to $750 — while top-tier emergency engagements run $800 to $1,500 an hour against drawn rates of $175 to $400. The surge also compounds with timing: nights, weekends, and specialized forensics stack premiums on top of the base emergency rate.

The break-even arithmetic is simple enough to run before you sign. Compare (expected hours × emergency rate) against (expected hours × drawn rate) + retainer fee for an incident the size you actually plan for. Because the retainer fee is credited against hours used, the break-even usually sits well inside a single serious incident: at a $300 drawn rate versus a $750 emergency rate, a 100-hour engagement costs $30,000 plus the fee with a retainer against $75,000 without — the fee pays for itself before the second incident, and the contracted triage SLA is value on top. Size the block to the incident you plan for, not the incident you hope for, and budget a cash reserve for the overage you will still owe if the big one runs past the block. The retainer buys the rate. It does not cap the incident.

If you sell retainers, the mirror image applies​

Many readers are on the other side of this contract — MSPs, security consultants, and IT firms selling prepaid block-hours of their own. The accounting mirrors the buyer's: a client's prepayment is not your revenue, it is deferred revenue, a liability for work you owe. Recognize revenue only as hours are delivered, keep the undelivered balance on the balance sheet (under ASC 606 it is a contract liability), and recognize breakage as revenue only when hours actually expire under the contract terms — not when you feel confident the client will not use them. The same reconciliation discipline applies: if your deferred balance and your client's prepaid balance disagree, one of you is wrong, and the hours log settles it. Firms that recognize the full prepayment as day-one revenue overstate income, understate obligations, and discover the gap during due diligence for a sale, when the buyer prices every dollar of undelivered work as a liability they inherit.

What the year looks like in a ledger​

Here is a full retainer year for a buyer: a $40,000 block of 100 hours purchased in October, a 22-hour incident drawn at $300 an hour in February, 8 emergency overage hours at $750 in the same incident (a 150 percent surge over the drawn rate), and the unused balance written off when the term expires with no further incidents. If you keep your books in plain text, the docs cover the setup, and Fava turns the prepaid balance into a chart you can watch drain across the term:

2025-10-01 open Assets:Cash:Operating USD
2025-10-01 open Assets:Prepaid:IR-Retainer USD
2025-10-01 open Liabilities:Payable USD
2025-10-01 open Expenses:Security:Incident-Response USD
 
2025-10-01 * "Sentinel IR" "Annual retainer, 100 prepaid hours"
  Assets:Prepaid:IR-Retainer  40000.00 USD
  Assets:Cash:Operating  -40000.00 USD
 
2026-02-14 * "Sentinel IR" "Containment, 22 hours drawn at 300.00 USD per hour"
  Expenses:Security:Incident-Response  6600.00 USD
  Assets:Prepaid:IR-Retainer  -6600.00 USD
 
2026-02-20 * "Sentinel IR" "Emergency overage, 8 hours at 750.00 USD per hour"
  Expenses:Security:Incident-Response  6000.00 USD
  Liabilities:Payable  -6000.00 USD
 
2026-03-02 * "Sentinel IR" "Overage invoice paid"
  Liabilities:Payable  6000.00 USD
  Assets:Cash:Operating  -6000.00 USD
 
2026-09-30 * "Sentinel IR" "Term expired, unused hours written off"
  Expenses:Security:Incident-Response  33400.00 USD
  Assets:Prepaid:IR-Retainer  -33400.00 USD

Read the story the accounts tell: $6,600 of incident response bought at the calm-weather rate, $6,000 bought at the surge rate, and $33,400 that bought nothing but the option to call — the price of an oversized block. That write-off is not an argument against retainers. It is an argument for sizing the next block from this year's draw history instead of the firm's proposal, and for negotiating conversion of the unused remainder into proactive work before it expires.

A month-end checklist for retainer buyers​

Put this on the close checklist for every month the retainer is active, and the year-end version writes itself:

• Pull the firm's hours statement and reconcile it to your prepaid balance — opening hours, drawn hours, rate, closing hours — before you book anything.
• Expense drawn hours in the month the work happened, accruing unbilled work at month-end rather than waiting for the statement.
• Keep overage in its own subaccount so the surge premium stays visible next to the drawn-rate spend it exceeded.
• Calendar the expiry date with a 90-day warning: that is when you schedule the tabletop exercise, negotiate rollover, or right-size the renewal — not the week the hours die.
• At renewal, divide last year's total incident cost (drawn + overage + write-off) by hours actually used. That blended rate, not the brochure's drawn rate, is the number the next block competes against.

The business that pays $60,000 for its 200 hours and the one that pays $150,000 bought different contracts — but they also kept different books. One treated the retainer as an asset to manage, reconciled, drawn, and renewed from evidence. The other expensed it in October and met the surge rate as a surprise. Sign the retainer before you need it, book it as what it is, and let the draw history — not the sales proposal — set next year's block.