Incident Response (IR) Retainer Selling to the CISO and General Counsel — 60-Min Training

Question

Pulse RevOps · The Machine · Accepted Answer

### Direct Answer

> **Incident Response (IR) Retainer Selling to the CISO and General Counsel** is a 60-minute training for IR-firm sellers and account directors running $75K–$1.2M retainer cycles against incumbents like **Mandiant** (Google Cloud), **CrowdStrike Services**, **Unit 42** (Palo Alto Networks), **Kroll Cyber**, **Stroz Friedberg** (Aon), **Arete IR**, **CyberCX**, **Booz Allen DarkLabs**, **Charles River Associates**, and **CYE Coyote**. The session teaches sellers to qualify against the **three-buyer reality (CISO, General Counsel, Cyber-Insurance Broker)**, run a structured discovery on **response-time-SLA and forensic-defensibility economics**, present retainer-structuring options, and trap-set the multi-year renewal at month 11. Built on **MEDDPICC**, **Force Management's Command of the Message**, and **Andy Paul's "Sell Without Selling Out"** discovery cadence.

---

## Section 1 — Why IR Retainer Selling Is Different (5 min)

Open the room by killing the SaaS-seller default. IR retainers are **legal-and-insurance-driven**, not security-driven. The General Counsel funds the retainer for **privileged investigation protection**; the CISO operationalizes it; the cyber-insurance broker selects from a panel of pre-approved IR firms.

Set the frame on the whiteboard.

- **Three buyers, one driver.** General Counsel funds for **attorney-client privilege** protection during incident investigations; CISO operationalizes; broker maintains the panel. **Coalition's 2026 binding data** shows ~88% of mid-market policies include a pre-approved IR-firm panel.
- **Response-time SLA is the differentiator.** **Sub-4-hour engagement with senior consultants** is best-in-class; **Mandiant** and **Unit 42** publish 2-hour SLAs for top-tier retainer holders.
- **Forensic defensibility is the legal scorecard.** A report that survives in litigation is worth orders of magnitude more than a faster report that doesn't. **Stroz Friedberg** (Aon) leads on litigation-grade reporting.

End the segment with **Mark Roberge's** rule: *"Sell the legal-grade investigation, not the response speed alone."*

---

## Section 2 — The 60-Minute Discovery Block (15 min)

> 1. **Opening (3 min):** "Walk me through your last 24 months of incidents — the ones that needed outside IR, and the ones that didn't."
> 2. **Response-time SLA baseline (10 min):** "What's your current IR-firm engagement SLA? **Sub-4 hours with senior consultants** is best-in-class."
> 3. **Forensic-defensibility baseline (10 min):** "Have any incidents progressed to litigation, regulator action, or insurance dispute? How did your IR firm's report hold up?"
> 4. **Retainer structure (10 min):** "Is your current retainer flat-fee with discounted hourly, or pure pre-paid hours? **Flat-fee retainer with discounted hourly burst** is the modern bar."
> 5. **Cyber-insurance panel posture (8 min):** "Which IR firms are on your carrier's pre-approved panel? Match the panel or run a parallel non-panel retainer."
> 6. **General Counsel relationship (7 min):** "Does your General Counsel have a preferred outside cyber counsel? IR firms work under the cyber counsel."
> 7. **Renewal posture (5 min):** "When is your current retainer up? What contractual extraction friction would we navigate?"

```mermaid
flowchart TD
    A[AE Schedules 60-Min Discovery] --> B[Send Pre-Brief 24 hrs Prior]
    B --> C{CISO + General Counsel + Broker?}
    C -->|No| D[Reschedule No Exceptions]
    C -->|Yes| E[Response SLA + Forensic 20 min]
    E --> F[Retainer + Carrier Panel 18 min]
    F --> G[Counsel Relationship + Renewal 12 min]
    G --> H[Confirm Retainer-Scoping Workshop]
    H --> I[Pre-Workshop Brief Sent All 3 Personas]
    I --> J[90-Min Retainer-Scoping Workshop Within 10 Days]
    J --> K[Retainer Bound Within 14 Days]
```

---

## Section 3 — The Retainer-Scoping Workshop That Wins (15 min)

**Failure modes to ban.** **Generic SLA quotes** without scope detail. **Hourly-only retainers** that consume budget without ceiling. **Single-persona scoping** (without the General Counsel).

**Wins to coach.** **Joint legal-and-security scoping session.** Walk through **Mandiant's and Unit 42's published retainer-scoping agendas** — both insist on a joint legal-and-security workshop before binding. **Named senior consultant assignment.** Identify the **named senior consultants** (with credentials) who will respond. **Tabletop exercise included.** Bundle a **half-day tabletop exercise** with the retainer.

End with **Andy Paul's** rule: *"Show the customer their incident defensibly investigated, not your retainer hours expanded."*

---

## Section 4 — Handling the Incumbent Trap (10 min)

The room will face **Mandiant**, **CrowdStrike Services**, and **Unit 42** in eight of ten enterprise deals. Coach the room on three counter-moves.

**Counter-move 1 — The named-consultant wedge.** Ask the CISO: *"Who are the named senior consultants on your incumbent's retainer? **Mandiant and Unit 42** pu

Incident Response (IR) Retainer Selling to the CISO and General Counsel — 60-Min Training

Direct Answer

Section 1 — Why IR Retainer Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The Retainer-Scoping Workshop That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 11 (5 min)

FAQ

Sources

Incident Response (IR) Retainer Selling to the CISO and General Counsel — 60-Min Training

Direct Answer

Section 1 — Why IR Retainer Selling Is Different (5 min)

Section 2 — The 60-Minute Discovery Block (15 min)

Section 3 — The Retainer-Scoping Workshop That Wins (15 min)

Section 4 — Handling the Incumbent Trap (10 min)

Section 5 — Pricing Conversation and Procurement (10 min)

Section 6 — The Trap-Set for Renewal at Month 11 (5 min)

FAQ

Sources

What does the score mean?