AWS incident readiness · one year · prepaid hours
A year of readiness for one AWS organization: the access role tested, the logs on, counsel’s paper agreed, and a rehearsal done. Then written response commitments, with service credits when we miss them.
$36,000 a year, or $9,000 a quarter, with 40 prepaid hours of readiness work at $450 per hour. One responder, at most 6 clients. Not yet offered: these terms are under counsel review.
The hour that matters most is the first, and it is mostly lost to paperwork and access. The Retainer spends it in advance.
Invoiced annually in advance, or $9,000 a quarter.
Not yet offered.
Readiness work in about 30 days, 40 prepaid hours of readiness work, and written response commitments around the clock for the year.
Charles’s time: about 48 hours of readiness work in the first 30 days, plus 40 prepaid hours of readiness work at $450 per hour ($18,000 of the fee). They do not pay for an incident. A Response is papered new through counsel and billed to counsel’s matter at $450 per hour.
One responder. The Retainer is limited to 6 clients, and the page says so because it is the honest limit of a single consultant.
Everything on this page in a document you can hand to the person who signs: scope, weeks, deliverables, price, and terms. It is tagged for screen readers.
vantalect-aws-incident-response.pdf
AWS incident response from the first call to containment declared, paid by the hour through your counsel, and a one-year retainer that readies the access, logs, and paper: stages, reports, and terms.
View AWS Incident Response in the PDF viewerDownload PDF of AWS Incident Response
The role, the logs, the guardrails, and the paper are ready in about 30 days; the tabletop is scheduled with your team and counsel within 45. Activation, when it comes, is a short list, and every step of it has been rehearsed.
The honest limit. One responder. The Retainer is capped at 6 clients. When two retained incidents overlap, the second gets the call-back commitment and a 4-hour hands-on commitment until a named backup responder exists.
Five documents: four in about 30 days, and the tabletop report once the exercise is held, within 45. Each is yours to keep.
The Retainer's first weeks and first quarter for the same bank, once its Recovery had closed: the access role drilled, the logs checked, the readout, and a tabletop on a different attack. Every report is a PDF you can open.
Every report, by engagement and week:Wrenfield All samples
The fee covers the readiness work and 40 hours of further readiness work. The hours are for a second tabletop, a compromise assessment, or a re-run of the log-readiness check. They do not pay for an incident.
At $450 per hour, $18,000 of the fee. A Response is papered new through counsel and billed to counsel’s matter, including the activation authorization of $10,800. If counsel directs after containment, we credit up to your unused prepaid hours against that matter’s invoices.
Unused hours convert to readiness work in the last 60 days of the term: a second tabletop, a compromise assessment, or a re-run of the log-readiness check. Up to 20 roll into a renewal.
The lower Retainer rate applies to every hour of a Response. No cash refund of unused hours, except when the Retainer ends early: then we keep the readiness part pro rata, and refund the unexpired fee and the unused prepaid hours.
A pre-incident contract between the company and a forensic firm, drawn on for the incident, has cost a company its privilege claim. So the Retainer is readiness work only. Each incident is engaged fresh by outside counsel, under its own papers.
A statement of work with your company: the role, the logs, the watch, the policies, the tabletop, and the prepaid hours of readiness work.
A new Counsel Engagement Letter and incident statement of work that your outside counsel signs at each activation, billed to counsel’s matter. The prepaid hours do not pay for an incident.
The role can be assumed, but every call it makes is denied until your approver removes your deny policy. Its trust policy admits only Charles’s named principal with multifactor authentication and a source identity.
Many cyber policies expect a panel vendor. The Retainer asks your broker to list Vantalect as a named non-panel provider in the readiness work, before an incident.
As in the Response: never contacting or paying an attacker, never saying an incident is reportable or not. Reports state what the evidence shows.
The Retainer has one responder and is limited to 6 clients. The commitments above are the ones that one person can keep.
Nothing exotic, and nothing you have to buy.
Everything the Retainer produces is left with you.
The activation role is deployed from a template you read first, into every member account and by one stack in the management account, and tested in a live drill.
Prepared and validated service control and resource control policies sit in your policy repository, ready to attach.
Contacts for you, counsel, your broker and carrier hotline, Vantalect, and AWS Support, with the activation steps in order.
Charles Sieg, personally, with the agents he directs. The sample engagements on this site are fictional. Vantalect is a consulting expert to your counsel, not a law firm, and its reports are not legal advice.
A call-back within 30 minutes of a page to the incident line, hands-on work within 2 hours after counsel signs the activation, and a written situation report every 12 hours until containment is declared, around the clock. A missed call-back or a missed hands-on earns a 10% service credit each, capped at 30% of the annual fee a year.
There is one responder. The second incident gets the call-back commitment and a 4-hour hands-on commitment, until Vantalect names a backup responder. The Retainer is capped at 6 clients so that overlap stays rare.
A pre-incident agreement with the company, naming the forensic firm, and drawn on for the incident, is the fact pattern that cost one company its privilege claim. So the Retainer is a statement of work with you for readiness, and each incident is engaged fresh: your outside counsel signs a new Counsel Engagement Letter and incident statement of work, billed to counsel’s matter. The prepaid hours do not pay for an incident; if counsel directs, we credit up to the unused ones against the incident invoices afterward.
In the last 60 days of the term they convert to readiness work: a second tabletop, a compromise assessment, or a re-run of the log-readiness check. Up to 20 hours roll into a renewal. There is no cash refund unless the Retainer ends early. Then we keep the readiness part of the fee pro rata for the days that passed (and, if you end it, not less than the readiness hours logged at $450 an hour), plus $450 an hour for each prepaid hour used or credited, and refund the rest. We may end it only on sixty days’ notice, other than for your breach.
No. The Response is designed to run without it, hourly, with no response-time commitment. The Retainer buys the commitments, the lower rate, and an hour that is not lost to paperwork.
Not yet offered: no incident phone number or mailbox is published. A Retainer holder would receive the incident line in its call sheet at signature, the same for everyone. The Retainer adds the commitments, not a separate number: a call-back within 30 minutes of your page, or the credit. Vantalect has one responder and no second contact. If no one answers, your incident lead proceeds with the containment policies stored in your policy repository and tells counsel. A missed call-back earns the service credit.
No. Nothing Vantalect delivers is a legal determination. Vantalect does not need a private-investigator license for this work.
Vantalect carries errors-and-omissions insurance. It carries no cyber insurance and expects to need none. Liability is capped as the master services agreement sets out.
The alerts that reach Vantalect carry event metadata only, not what your systems store, and nobody at Vantalect triages them. Charles directs software agents (AI tools) under his supervision; by default they work inside your accounts, and evidence goes to any other provider only with your and counsel’s written consent, under terms that bar training and retention. Pursuit, our tracker, runs in an account you own.
The Response runs while the attack does. The Investigation and the Recovery follow it, or start on their own for a breach found later. The Retainer buys back the first hour of the next one.
Something in your AWS organization is deleting snapshots and changing keys right now, and it is not your pipeline.
Read the engagement
You know you were breached. You don’t yet know how, what they touched, or whether they are still in.
Read the engagementThe five fixed-price engagements are separate: compare them on the home page. The incident offers are not bundle members.
Vantalect does not yet offer the Retainer. No incident phone number or mailbox is published, and nothing on this page is an offer. The terms above describe what Vantalect intends to offer.
Not yet offered.
AWS, Amazon Web Services, and the AWS service names are trademarks of Amazon.com, Inc. or its affiliates. Vantalect is not affiliated with or endorsed by any of them.
