Think Build Implement Repeat
London, UK +44 7367 067226
WhatsApp FOLLOW f in X
  1. Home
  2. Blog
  3. How Does a Cyber Security Firm Track the Hours Used on Each Client's Incident Response Retainer?
Problems We Solve

How Does a Cyber Security Firm Track the Hours Used on Each Client's Incident Response Retainer?

Cyber firms lose track of incident response retainer hours used, rolled over or overrun. We build retainer tracking with balances clients and your team can see.

Updated 3 min readBy SpiderHunts Technologies

Free estimateNo obligation

Get a free estimate

Tell us what you need. A senior engineer reads every enquiry.

Takes under a minute. We never share your details.

  • Free consultation
  • No commitment
  • NDA on request

Prefer to talk? Book a free 30-minute call →

Quick answer — TL;DR

Retainer hours are hard to track because incident work is urgent, spread across several responders and often at odd hours, and each retainer has its own rules on what counts, rollover and overage. We build retainer tracking that records time per incident against each client's retainer, applies their rules, shows the balance to your team and the client, and flags overage before it becomes a dispute.

After the incident, the arithmetic

A retainer client calls on a Saturday night with a suspected compromise. Three of your responders work on it over the weekend and into the next week: triage, log review, containment advice, a call with the client's insurer, and a report. Everyone is focused on the incident. Nobody is thinking about the retainer.

A fortnight later, finance asks how much of the client's retainer was used. The responders' time is in three places: one logged it in the PSA, one kept notes in a document, one did not record the weekend at all. The retainer contract says out-of-hours time counts at a higher rate, some preparation work does not count, and unused hours roll over for part of the year. Working it out takes a day and produces a figure nobody is fully confident in.

The client, meanwhile, assumes most of their retainer is still there.

Some retainers also include proactive hours: a tabletop exercise, a readiness review, a playbook update. Those get used, or forgotten, on a different timetable again.

Why retainer hours are hard to track

  • Incident work is urgent, and recording time is the last thing on anyone's mind.
  • Several responders work on one incident, often at unusual hours.
  • Each retainer has its own rules: what counts, out-of-hours rates, rollover, expiry, overage rates.
  • Retainer hours can also be used for proactive work, which is tracked differently.
  • The client cannot see their balance without asking.

What loose tracking costs

GapConsequence
Time not recorded during incidentsHours delivered but never counted
Retainer rules applied by handInconsistent, disputed balances
Overage not flaggedUnbilled work, or a surprise invoice
Proactive hours unusedClient feels the retainer was poor value
No client viewRenewal conversation starts from confusion

Insurers and legal advisers add another layer. Some incidents involve a client's insurer or their lawyers, whose own rules on who is engaged and who pays may differ from the retainer. If that is not recorded against the incident at the start, sorting out which hours belong where afterwards is slow and contentious.

The retainer tracking we build

  1. Each retainer is recorded with its rules: hours, period, what counts, out-of-hours multipliers, rollover and expiry, overage rate.
  2. When an incident or proactive task is opened for a retainer client, it is linked to their retainer in your PSA or ticketing system.
  3. Responders log time with the least effort possible: a quick entry from their phone, or a start and stop on the incident, with time of day recorded so the right rate applies.
  4. At the end of an incident, the lead responder gets a prompt to check everyone's time is in before the incident is closed.
  5. The balance per retainer is calculated under its rules and shown to your team, with a warning as it approaches its limit or its expiry.
  6. Clients can see their own balance and history in a simple portal or monthly statement, including unused proactive hours they could still use.

What your team and clients see

Finance has a correct balance per retainer without a day of reconstruction. Incident leads know when a client is heading into overage, and can tell the client during the incident rather than on an invoice afterwards. Account leads can see which clients have unused hours and suggest a tabletop exercise or a readiness review before they expire.

At renewal, both sides have the same history, which is a far better starting point than competing recollections of a busy weekend.

Picture the Saturday night call again with this in place. The incident is opened against the client's retainer with one click. Each responder starts and stops time on their phone as they go. On Tuesday, the lead sees the retainer is close to its limit and mentions it on the client call. When the incident closes, the lead confirms everyone's time is in, and the client's statement updates the same day.

Signs you need retainer tracking

  • Retainer balances are worked out by hand after incidents.
  • Responders' time during incidents is recorded inconsistently.
  • Clients do not know their remaining hours.
  • Overage is discovered after the event.
  • Proactive retainer hours expire unused.

FAQ

Frequently asked questions

The questions readers ask us after this guide.

Still have a question?

Ask us directly — a senior engineer will get back to you.

Ask about your project

Will responders have to fill in timesheets during an incident?

No. Time can be logged with a quick start and stop, and the lead checks it is complete when the incident closes.

Can each client have different retainer rules?

Yes. Hours, rates, rollover and expiry are set per retainer.

Can clients see their balance?

Yes, through a portal or a monthly statement, whichever you prefer.

Does it work with our PSA?

It links to incidents in your PSA or ticketing system where it has an API. We check yours first.

Keep reading

More on Problems We Solve

Start here

Tell us where the admin slows your security practice down

Describe how engagements run today, from scoping call to final report and retest: the reporting tool, the calendars, the trackers and the email threads. We will tell you what we would build and what we would leave alone, and if your existing tools can already do it, we will say so.

  1. You tell us what you needTwo minutes on the form, or a message on WhatsApp.
  2. A senior engineer reviews itAnd comes back with questions, a realistic range and an honest view on fit.
  3. Free 30-minute scoping callWe talk through scope, options and a realistic estimate — with no obligation.
Free estimateNo obligation

Talk to someone who builds this

Send a short brief and we will come back with an honest view and a realistic range.

Takes under a minute. We never share your details.

  • Free consultation
  • No commitment
  • NDA on request

Prefer to talk? Book a free 30-minute call →