Enterprise Risk Retainer

A faster, more flexible approach to managing unpredictable risks.

Organizations today are under pressure to effectively respond to acute risk events that can threaten financial stability, regulatory compliance, executive safety and stakeholder trust.

Whether dealing with cyber incidents, misinformation campaigns, financial fraud or physical security threats, the challenge is getting the right support quickly while maintaining cost efficiency and operational resilience.

Prepare now with Kroll’s cybersecurity incident response retainer (CIRR). Kroll’s CIRR offers maximum flexibility with transparent pricing, so you get tangible value from your retainer investment and gain peace of mind knowing you can depend on Kroll’s prioritized response and global resources – not just in a crisis, but also to help make meaningful improvements to your cyber resilience.

Explore Cyber and Data Resilience

Cyber Risk Retainer

Get a Quote

24X7 Hotline

With Kroll’s Enterprise Risk Retainer, you gain

A pre-negotiated agreement for rapid access to risk expertise
Comprehensive support covering cybersecurity, regulatory compliance, financial crime, AI risk management, executive threat protection and more
Service credits to proactively strengthen your risk posture before an incident occurs
Regular threat intelligence reporting from the frontlines of thousands of Kroll IR engagements a year to stay ahead of threat actors targeting your industry
Access to our Customer Success team to ensure your engagement is structured, measurable, and focused on tangible security outcomes

By consolidating risk management service needs into a single, flexible retainer agreement, organizations can move faster, budget smarter and respond effectively—without the delays of multiple contracts or ad hoc solutions.

On-Call Access to Experts and Services across Multiple Risk Disciplines

Enterprise Risk Retainer

Get Ahead of Unknown Enterprise Risks

Kroll’s Enterprise Risk Retainer helps organizations stay ahead of emerging risks with proactive risk management, financial predictability and expert-led incident response services. By combining pre-negotiated incident response SLAs with service credits applied to a wider variety of enterprise risk services when needed, businesses can mitigate risks effectively while maintaining operational resilience.

Plan Ahead and Control Costs

Avoid unexpected costs by securing pre-negotiated credits in advance to use when required for annual audits, assessments and compliance needs.

Proactively Strengthen Risk Posture

Use 100% service credits to bolster cybersecurity, financial crime prevention, regulatory compliance, AI governance, physical security and more, helping prevent enterprise risks before they impact your business.

Expert-Led Incident Response

Limit disruption with rapid response SLAs and elite DFIR support to contain threats, investigate root causes and restore operations efficiently.

Choose the Risk Retainer Option That Fits Your Needs

Kroll’s Cybersecurity Incident Response Retainer offers tiered service levels designed to meet your organization's response needs, onboarding requirements, credit flexibility and long-term resilience goals. From rapid incident response to proactive assessments, each option provides flexibility, expert support and cost-effective risk coverage across cyber, compliance, financial crime and physical security.

Service	BRONZE	SILVER	GOLD	PLATINUM
Cyber Support
Remote Support	Incident support contact within 6 hours (24/7/365)	Incident support contact within 4 hours (24/7/365)	Incident support contact within 2 hours (24/7/365)	Incident support contact within 2 hours (24/7/365)
Onsite Support	In transit within 24 hours of request or SOW signature (for additional services)
Threat Intel & Executive Support	Global Cyber Threat Intelligence Reporting			Up to 20% of services credit may be applied to the following year upon renewal		Discounted Cyber Threat Intelligence platform + Executive Threat Intel Briefing
Service Credit Usage
Sevices Credit	Clients can use 100% of their retainer credits toward any risk consulting service Kroll offers as part of the retainer menu
Rollover Credits	No rollover	Up to 20% of unused Services Credit may be applied to the following year upon renewal	Up to 20% of unused Services Credit may be applied to the following year upon renewal	Up to 30% of unused Services Credit may be applied to the following year upon renewal
Rate Discount	Enterprise Security Risk Management Services
		No discount	10% discount on then-current rates	15% discount on then-current rates	15% discount on then-current rates
		Investigations, Diligence and Compliance Services
		No discount	3% discount on then-current rates	5% discount on then-current rates	10% discount on then-current rates
		Cyber and Data Resilience Services
		No discount	10% discount on then-current rates	15% discount on then-current rates	20% discount on then-current rates for any hourly-based incident response cyber service and 15% discount on then-current rates for any hourly-based proactive cyber service.

Flexible Access to Multiple Risk Advisory Services

Kroll’s Cybersecurity Incident Response Retainer enables organizations to use 100% of service credits across multiple risk management services, including cybersecurity, regulatory compliance, financial crime, AI risk management, executive and physical security, and more. Below are just a few examples of the services available:

Cyber and Data Resilience	Enterprise Security Risk Management	Investigations, Diligence and Compliance
Reactive Services Security Advisory and Assessments Penetration Testing and Red Teaming AI Risk Management AI Security Testing OT Security Services eDiscovery and Privacy Services Cyber Threat Intelligence Services Legal Operations Technology Advisory Crypto/Blockchain Security Data Breach Notification and Identity Monitoring Expert Witness and Litigation Advisory Corporate Legal Solutions	Executive Risk Assessment Physical Threat Management Global Business Continuity, Resiliency and Disaster Preparedness Physical Security Program Maturity Assessment Physical Security Assessments Executive Protection Program Review	Public Records-Based Background Investigations Illicit Trade / Counterfeit Goods Controlled Undercover Buys Internal Investigations Identification of Online Bad Actors Influencer Vetting Pre-Acquisition Due Diligence Review ABC, AML, Trade Compliance Policies and Procedures Fraud and ABC Risk Assessments ABC Compliance Audits ESG Services

Why Kroll

Built for Readiness, Not Just Response
Kroll helps clients prepare before an incident occurs through structured onboarding, escalation planning, intake-based gap analysis, IR readiness activities and executive-level sessions available for eligible tiers.
Designed to maximize Retainer Value
Clients can apply 100% of eligible credits toward services within the retainer menu, with rollover options, tier-based discounts and guidance on credit usage to help reduce underutilization.
Frontline Risk Intelligence from 1000s of Acute Events
Kroll handles thousands of incident response, regulatory and financial crime cases annually, providing unmatched frontline intelligence to help organizations anticipate and mitigate the most likely risks to their business.
Global Network of Accredited Experts
Kroll’s 650+ skilled cybersecurity professionals bring decades of experience in threat intelligence, digital forensics and enterprise risk management, helping organizations strengthen their risk posture.

Flexible Across Evolving Risk Needs
Our retainer is not limited to just incident response. Clients can access eligible services across Cyber and Data Resilience, Enterprise Security Risk Management, Investigations, Diligence and Compliance, and other risk advisory areas as priorities evolve.
Customer Success Manager Alignment
Get access to a single, accountable partner for your cyber outcomes. Quarterly service reviews, reporting, sector threat intelligence and strategic recommendations help clients track usage, identify opportunities and align their retainer to business priorities.
Trusted by Leading Organizations Worldwide
Kroll is trusted by leading enterprises, insurers, law firms and regulated organizations around the world to support complex cyber incidents, sensitive investigations and critical risk events.

Connect with Us

Juan Carlos Díaz

Associate Managing Director and EMEA & APAC Lead for Enterprise Risk RetainerCyber and Data ResilienceMadrid

[email protected]+34 910389092

Jerry Cotellesse

Senior Vice PresidentCyber and Data ResiliencePhiladelphia

Jerry Cotellesse [email protected]+1 6109065608

Colin Sheppard

Regional Managing Director, EMEACyber and Data ResilienceLondon

Colin Sheppard [email protected]+44 2070295072

Stay Ahead with Kroll

Cyber and Data Resilience

Kroll merges elite security and data risk expertise with frontline intelligence from thousands of incident responses and regulatory compliance, financial crime and due diligence engagements to make our clients more cyber- resilient.

Learn more

Compliance and Regulation

End-to-end governance, advisory and monitorship solutions to detect, mitigate and remediate security, legal, compliance and regulatory risk.

Learn more

Threat Exposure Management

Kroll’s field-proven cyber security assessment and testing solutions help identify, evaluate and prioritize risks to people, data, operations and technologies worldwide.

Learn more

Reactive Services

Your partner for every stage of a cyber crisis

Learn more

Cyber Risk Retainer

Kroll delivers more than a typical incident response retainer—secure a true cyber risk retainer with elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.

Learn more

Explore Insights

June 30, 2026

Cyber