Sample case study · AWS incident response retainer

The first hour, rehearsed
before the next one.

Wrenfield Bancorp, Inc., a fictional regional bank, signed the Retainer on Monday, August 10, once its Recovery had closed. In the first 30 days the access role was deployed and drilled in all twenty-two accounts, the logs were checked against the attacks that matter, and the paper was put in order; the drill measured 9 minutes from activation to first read. A tabletop on a different attack followed on Tuesday, September 15. The Retainer is $36,000 a year with 40 prepaid hours, and 40 of them were untouched at the end of the sample. It shows the method, not a typical year.

Book a 15-minute call with Charles Download the reports

Wrenfield Bancorp, Inc. is a fictional company: every account, bank employee, and figure on this page is simulated. The AWS services and controls are real.

An empty stone-paved town square in front of a columned limestone civic building at pre-dawn after a storm, wet paving reflecting a clearing sky and one street lamp still lit.
9
Minutes from activation to first read, in the drill
22
Accounts the activation role reached
10
Logging gaps found, each with a fix and a monthly cost
40 of 40
Prepaid hours untouched at the end of the sample
A sample engagement

Wrenfield is fictional.
The work is not.

Wrenfield Bancorp, Inc. does not exist. We built it to show what the Retainer produces in its first weeks for a regional bank that has just been through an incident: the same bank, with twenty-two AWS accounts, whose Response and Recovery are the other two Wrenfield case studies. We ran the Retainer's readiness work against it and wrote the reports.

Wrenfield is fictional. Its people, customers, accounts, figures, and attacker are invented for this sample, and any resemblance to a real bank, company, person, or threat group is coincidental. The attacker’s addresses come from ranges reserved for documentation. The reports are the real deliverables, written the way we write them for a client, and they agree with each other because every figure comes from one deterministic scenario. A drill measures the access path, not an attack, and nothing here is a promise about a future incident.

The client

Wrenfield Bancorp, Inc.

Business
A bank holding company and its commercial bank, with 61 branches across central and western New York. Core banking runs at a vendor’s service bureau and is not in AWS
People
1,240 employees, headquartered in Syracuse, New York
AWS
Twenty-two accounts in one organization, including a forensic account and a recovery vault added during the incident
Sponsor
Mireille Danvers, Chief Information Security Officer
Counsel
Diane Whitcombe, Partner, Tessaly & Brook LLP (outside counsel)
Lead
Imani Castell, Cloud Platform Lead
Risk
Anand Sethuraman, Chief Risk Officer

The next call should not
start with a search for paper.

On the night of the incident, the first hour went to finding counsel, signing the letter, and creating a role. Counsel signed at 00:52 and the bridge opened at 00:58, and the incident role was deployed 42 minutes after that. Mireille Danvers wanted that hour back for the next time.

The Retainer is the answer: the access role, the logs, the paper, and the rehearsal done in advance, with written response commitments and a lower hourly rate for the hours that follow. Wrenfield signed it on August 10, once the Recovery’s gate was met.

The Retainer
One year, $36,000, invoiced annually in advance on August 10 ($9,000 a quarter is the other option). It covers 48 readiness hours, planned for the first 30 days, and 40 prepaid hours, $18,000 at $450 an hour. The access, log, and paper work came in that period; the tabletop, the last of the readiness work, was scheduled for Tuesday, September 15, in week 6.
The commitments
Written, at any hour: a call back within 30 minutes of a page and hands on within 2 hours after counsel signs, each with a service credit when missed, and situation reports every 12 hours. One responder, so Vantalect keeps no more than 6 Retainer clients.
The rate
A Retainer holder pays $450 an hour for response work, against $675 without one. The Response in the first case study took 56 hours; at the Retainer rate it would have cost $25,200 instead of $37,800.
The access
A role deployed by the bank to every account from a template it read first, held shut until counsel's call, and tested in a drill.
The honest limit
The Retainer does not promise that an attack will not happen or will be small. It promises a prepared first hour and written commitments, with credits when they are missed.
How it went

The first weeks, and a tabletop.

Most of the readiness work is front-loaded into the first 30 days; the tabletop, its last piece, came in week 6. Then the year goes quiet until a call or a rehearsal. The sample runs to the tabletop.

  1. Week 1
    August 10 to 12
    The Retainer

    A role in every account, and a drill that found one problem.

    The access role went to every account as a stack set on August 11. On Wednesday, August 12 counsel called the incident line and said the drill word, and the activation clock started. Nine minutes later Charles had read his first account. The drill ran 11 steps against 22 accounts.

    It found one problem, D-1: The vault account sits behind a deny-all policy with two exceptions, the copy roles, so the incident role was refused even after the hold came off. A read-only exception for the role, by principal name, added to the vault account policy. Writes stay denied. It was fixed and retested the same morning, which is what a drill is for. The call sheet followed: who calls whom, in what order, with which numbers and documents.

    What it ended on. The role works in every account, the finding is closed, and the call sheet is written.

  2. Week 2
    August 17 to 21
    The Retainer

    The logs the next investigation will need.

    The log-readiness check compared 15 log sources with four attack patterns that matter: key-based ransomware, deletion, exfiltration by snapshot sharing, and persistence. It found ten gaps, 9 of them worth closing at a combined $116 a month in estimated cost, and one the bank declined, with its reason on the page.

    Pursuit's watch was installed on Wednesday, August 19 and routed to the bank's on-call and Vantalect.

    What it ended on. Every gap with a fix, an owner, and a monthly cost, and the watch installed.

  3. Week 3
    Friday, August 28
    The Retainer

    What the bank is ready for, and what is still exposed.

    The readiness readout scored six things, each with an honest label: The activation role: Ready; The log-readiness check: Ready, four gaps scheduled; Pursuit’s watch: Installed, alert tests pending; The guardrail pack: Ready; The tabletop: Scheduled; The paper: Ready, one item open. By the readout four gaps were closed and four were scheduled, the last for September 11, one more was installed and waits for its verification, and twelve residual exposures were named with their owners.

    What it ended on. A scorecard with an honest label on each line, including the alert tests that were not yet in hand.

  4. Week 6
    Tuesday, September 15
    The Retainer

    A tabletop on a different attack.

    The scenario was an Identity Center administrator’s session hijacked, chosen because it is not the attack the bank had already lived. Six bank employees and outside counsel sat in the room from 09:00 to 12:30 with Charles Sieg running eight injects at room speed.

    The after-action report lists 15 decisions with their times, six places where the team slowed down (the first was reaching the administrator), and eight gaps, each with an owner.

    What it ended on. An after-action report with every gap owned, ending the sample's year at the tabletop.

The year, so far

9 minutes from the call
to the first read.

The Retainer has no gate, because its product is readiness and readiness is a set of things that are or are not true. The drill, the gaps, and the hours are the measurements, and each is in the reports with its evidence.

Activation to first read
9 minutes

Measured in the drill on Wednesday, August 12, from counsel's call to the first account read. The written commitment is a call back within 30 minutes and hands on within 2 hours; a drill measures the path, not a live attack.

Logging gaps
10 foundto4 closed, 4 scheduled

Plus one declined with a reason. The last scheduled change is September 11. Costs are estimates built from list prices.

Prepaid hours
40 prepaidto40 untouched

The 48 readiness hours are in the fee and none of the prepaid hours were drawn.

What the Retainer costs, and what it commits to

$36,000 for the year, invoiced in advance, with 48 readiness hours and 40 prepaid hours ($18,000 at $450 an hour). Beyond them, response work is $450 an hour against $675 without a Retainer. A missed call-back or hands-on commitment earns a service credit of 10 percent of the annual fee, capped at 30 percent a year.

What the sample does not show. It ends at the tabletop, so it holds no real activation under the Retainer, and the commitments are described, not demonstrated. Four gaps were still scheduled at the readout, and the alert tests of the watch were not yet in hand, which the readout says on its scorecard instead of rounding up.

Want this gate on your own organization?

Book a call about the Retainer
The calls the owners made

Every gap, with its cost
and whose decision it was.

All prices below are estimates for this sample, built from list prices as we understood them in August 2026 and rounded up to whole dollars. Check them against the AWS pricing pages and the bank’s own volumes before you budget.

The ten logging gaps.

Four closed by the readout, four scheduled, and 1 declined because the evidence it would add was not needed.

  • G-1 · Mireille Danvers

    The trail’s files expire after 90 days and the bucket is not locked

    $34 a month, estimated

    Keep trail files 400 days: Standard for 90 days, then Glacier Instant Retrieval. Set Object Lock in governance mode with a 400-day default.

    Closed. August 25. Retention set to 400 days; Object Lock default on the trail bucket.

  • G-2 · Mireille Danvers

    Read events are not collected on the data lake

    $60 a month, estimated

    Add read data events for the data lake bucket `wf-datalake-prod` to the organization trail.

    Scheduled. September 4. Change window agreed with the data lake owner.

  • G-3 · Imani Castell

    No standing query path over the trail

    $6 a month, estimated

    Create an Athena table over the organization trail files in wf-log-archive (with partition projection by account, Region, and date), with a saved set of the investigation queries, so a query takes minutes and not a day of loading. CloudTrail Lake has been closed to new customers since May 31, 2026, so this plan uses the trail files themselves.

    Scheduled. September 11. Athena table over the trail files to be created after the trail change settles.

  • G-4 · Imani Castell

    No S3 server access logs on the three buckets that matter

    $6 a month, estimated

    Turn on server access logging for the imaging, lending documents, and data lake buckets, each delivered to a log bucket in the same account and Region as the bucket it logs (S3 requires that), then replicate those logs to wf-log-archive if the bank wants one place for them.

    Scheduled. September 11. With the data lake change.

  • G-5 · Imani Castell

    No scheduled inventory of the imaging archive’s encryption type

    $3 a month, estimated

    Schedule a weekly S3 Inventory of `wf-imaging-archive-prod` with the encryption status field, delivered to the evidence bucket. It confirms the encryption type of each object (SSE-KMS or not), not which KMS key was used. Read the key identity from the bucket’s S3 Metadata live inventory table (the `kms_key_arn` column) and keep the saved query results.

    Closed. August 27. First weekly inventory delivered to the evidence bucket (encryption type only; key identity comes from the live inventory table).

  • G-6 · Imani Castell

    No Config recorder in the two accounts created July 4

    $4 a month, estimated

    Record configuration in wf-ir-forensics and wf-recovery-vault and add both to the delegated aggregator.

    Closed. August 26. Recorder on in both accounts; aggregator updated.

  • G-7 · Mireille Danvers

    Analyzer findings do not reach the watch

    $0 a month, estimated

    Add a watch rule for new Access Analyzer external-access findings from the organization analyzer in wf-audit, on the bus already in place, so a new outside trust pages on-call and Vantalect.

    Closed. August 24. Rule for analyzer findings added to the watch; the organization analyzer itself has run since July 4.

  • G-8 · Imani Castell

    Trail integrity is validated but never checked

    $3 a month, estimated

    Run the trail’s digest validation weekly from a scheduled function and send a failure to on-call.

    Scheduled. September 4. Function written; test failure path first.

  • G-9 · Imani Castell

    No alert for Identity Center changes

    $0 a month, estimated

    Add a watch rule for permission-set, assignment, and user-store changes in IAM Identity Center, on the bus already in place.

    Pending. August 24. Installed; verification pending. The test alert result is not yet in hand. Owner: platform lead; due September 4.

  • G-10 · Imani Castell

    No flow logs on the workload VPCs

    $60 a month, estimated

    Optional. Flow logs for the five production VPCs, to S3 in wf-log-archive. They give context for network movement; none of the four patterns needs them.

    Declined. August 26. Accepted in writing by the CISO: flow logs are not needed for the four patterns.

The watch

Watching the same patterns
the attacker used.

Pursuit's watch is the Retainer's standing detection: the alert catalog that fired during the Response, installed in the bank's audit account and routed to the bank's on-call and to Vantalect. It watches four groups of patterns: key-based ransomware, deletion and recovery-point deletes, sharing outside the organization, and persistence.

The readout is honest about what was not yet proven: the watch was installed and the Identity Center rule added, and the alert tests were still to come, so the scorecard labels the line that way.

What the check and the tabletop held
  • 15log sources compared
  • 4attack patterns checked
  • 4alert groups in the watch
  • 8injects in the tabletop
  • 15decisions timed in the tabletop
  • 8tabletop gaps, each with an owner

  1. A different attack on purpose.

    The tabletop used an Identity Center administrator’s session hijacked. A team that has only practiced the last attack has practiced the wrong one.

  2. Where the team slowed down.

    The first slowdown was reaching the administrator. The report names each one, why it happened, and which gap it belongs to, instead of averaging them away.

The deliverables

The reports in this sample.

Six PDFs and 64 pages. Start with the readout; the reading guide shows how the rest fit together. All five Retainer reports are operational, for the bank’s own teams, and each says so on its cover. Each one is tagged for screen readers, and each says on its cover that Wrenfield is fictional.

Stacked cover pages from the Wrenfield sample reportsDownload all 23 Wrenfield PDFs as one ZIP6.9 MB

All of Wrenfield’s documents, by engagement and week

Start with the readout (11 pages)

Written for the sponsor, and the one to read if you read nothing else: what the bank is ready for now, what is still exposed, and the commitments in force.

  1. Week 3 of the Retainer: Readout
    August 28, 2026

For the engineers on the approved team

Every log source against the attack patterns that matter, each gap's fix and monthly cost, and the watch's coverage. Forward Operational reports within the approved team; counsel controls release of reports marked Counsel only.

  1. Week 2 of the Retainer: Log readiness
    August 21, 2026

The rest, in the order they were delivered

The reading guide first, which covers all three Wrenfield engagements, then the access drill, the tabletop, and the call sheet.

  1. Reading guide to the 22 reports
    September 15, 2026
  2. Week 1 of the Retainer: Access
    August 12, 2026
  3. Month 2 of the Retainer: Tabletop
    September 15, 2026
  4. Week 1 of the Retainer: Call sheet
    August 14, 2026

The first hour, spent now.

The Retainer is the cheapest hour of the next incident: the one you do not spend finding a lawyer, signing paper, and creating a role.

An empty stone-paved town square in front of a columned limestone civic building at pre-dawn after a storm, wet paving reflecting a clearing sky and one street lamp still lit.
The engagement · one year, $36,000

AWS Incident Response Retainer

The access role, the logs, and the paper in the first 30 days, then the rehearsal, with 40 prepaid hours and written response commitments.

Read the engagement
A three-story brick office building at night in heavy rain, one amber window lit on an upper floor and lightning glow in the clouds behind it.
Sample case study · the same client

Wrenfield: the Response, on a holiday weekend

A fictional regional bank, on a holiday weekend, with a ransom note in its loan documents bucket and an attacker who had rewritten 61.3 million of its 286 million imaging objects under keys set to expire: contained in six days, nothing paid to the attacker, and no object the bank needed under the attacker’s keys when they expired.

Read the case study
A long underground bank vault corridor receding into shadow, rows of closed steel deposit doors on both walls and a single beam of cool light across the polished floor.
Sample case study · the same client

Wrenfield: the Investigation and the Recovery

A fictional regional bank, a week after the ransom note: how the attacker got in, what they touched, whether they are out, and the six root causes (3 of 3 critical closed as code, 1 accepted in writing), with half of the $50,000 Recovery fee riding on a closure sweep.

Read the case study

Let's define the result.

Tell Charles which AWS organization, which counsel, and what you would want ready the next time. You will hear back within one business day, and the first call is fifteen minutes.

Book a 15-minute call with CharlesOr email charles.sieg@vantalect.com

AWS, Amazon Web Services, and the AWS service names are trademarks of Amazon.com, Inc. or its affiliates. MITRE ATT&CK is a registered trademark of The MITRE Corporation. Vantalect is not affiliated with or endorsed by any of them. Wrenfield Bancorp, Inc., its personnel, its customers, and the attacker are fictional. Vantalect and Charles Sieg are the real provider and author, and the named vendors and products are real and do not endorse this sample.