MDR vs Incident Response Retainer: Which to Buy First

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. MDR watches around the clock and acts as threats happen; a retainer reserves responders you call after an incident is found. Onchain funds move in minutes, so teams holding funds usually need MDR first, then a retainer.

Watch: MDR vs Incident Response Retainer: Which to Buy First 1:43

Video transcript

MDR and an incident response retainer answer different questions. Onchain funds move in minutes, so teams holding funds usually need MDR first, then a retainer.

MDR answers: will someone notice, and act, at 3 AM? It covers detection, human triage, containment and escalation, around the clock.

A retainer answers who comes to help, and how fast. At Unit 42, response times run from 24 hours to two hours.

MDR starts before anything is found. A retainer starts when you call, then investigates and recovers. Either contract should define authority to act.

TRM Labs says most of the roughly 6.36 billion dollars taken from Binance left in about 20 minutes.

A two-hour response ends long after. Containment must be decided in minutes, by someone already watching. Investigation takes days.

Before launch, teams need an IR plan and SEAL 911's contact, a free hotline, not a retainer. Live protocols and exchanges buy MDR first. Teams with their own SOC start with a retainer.

To combine them, use one escalation path, onboard the retainer firm now, agree the evidence handoff, limit access, and rehearse yearly.

Guardian's Managed Security includes MDR around the clock, with Guardian engineers responding. It watches contracts on every block, your cloud and domains through Sentry, and offers a 90-day guarantee.

Read the full article, or talk to Guardian about covering the first minutes.

MDR and an incident response (IR) retainer are both bought before anything goes wrong. They answer different questions.

MDR answers: will someone notice, and act, at 3 AM? A retainer answers: once we know something is wrong, who comes to help, and how fast?

This comparison sets them side by side and suggests which a crypto team needs first, by stage. For what MDR watches onchain, see what Web3 MDR is.

What MDR Covers

Gartner's 2023 market guide, as quoted by Rapid7, describes MDR as remotely delivered, human-led SOC functions, "ultimately delivering threat disruption and containment."

NIST's incident response guide, SP 800-61 Rev. 3 (April 2025), has a place for it. Incident handlers can be "on contract," such as a security operations center outsourced to a managed security services provider.

What you buy:

Detection around the clock, from your monitors and the provider's own.
Triage: a person decides whether each alert is real.
Containment, under authority you agree in advance.
Escalation to your team, with the evidence.

NIST notes one advantage: a provider may detect malicious activity sooner "because it can correlate events across its customers."

Scope varies by provider. Ask whether forensics, recovery and regulator reports are included, or billed separately.

What an IR Retainer Covers

NIST's other outside model is handlers "available when needed," for example from "a cybersecurity services provider." A retainer is the contract that makes that provider available.

Its responders do what NIST expects of any incident handler: verify the incident, "collect and analyze data and evidence," and "limit damage, find root causes, and restore operations."

Palo Alto Networks' Unit 42 is one example. It describes its retainer as priority access to experienced responders, with response times set before a crisis.

Response time: "Response SLAs range from 24 hours to two hours," by retainer and service level.
Payment: prepaid credits.
Flexible credit: can go to services that "proactively assess, test and strengthen your security," as well as incident response.

Crypto teams also have a free option: SEAL 911, the Security Alliance's "free, around-the-clock emergency hotline." Its volunteers handle tickets "based on available bandwidth," its README says.

For long onchain tracing work, SEAL 911 points to member firms that offer paid services. It is a lifeline, not a retainer.

MDR vs IR Retainer Compared

	MDR	IR retainer
Starts	Before anything is found	When you call
Main job	Detect, triage, contain	Investigate, eradicate, recover
Who acts at 3 AM	The provider's analyst on shift	Your team, until responders join
Knows your system	From onboarding, before any incident	Only if onboarded in advance
Speed	Continuous; agree SLAs by severity	A response SLA: 2 to 24 hours at Unit 42
Authority	Containment actions set in the contract	Whatever the contract grants
Pricing	Ongoing service fee	Prepaid credits at Unit 42

NIST asks for the same thing under both. The contract should define "authority to act on behalf of the organization" and "restrictions on what the service provider can do."

Building it yourself is the third option. Guardian's Managed Security page sets out what that takes:

Build every primitive yourself.
Staff it 24/7 for incident response.
6 to 12 months to build and integrate.
Mid six to low seven figures, plus token spend.

How Onchain Incidents Change the Math

A retainer's clock starts when you call. Onchain, the money can be gone before that call.

TRM Labs says most of the roughly $6.36 billion taken from Binance on October 29, 2026 left in about 20 minutes. Tether's first freeze came "37 minutes after the main sweep."

A two-hour response time ends long after both.

Onchain containment means pausing contracts, halting signers and asking issuers to freeze. Someone already watching has to decide in minutes.

Investigation takes days. Binance published its initial report five days later.

It says it is "engaging independent third-party cybersecurity experts," and that its findings "will be subject to further independent review." See our Binance hack explainer.

Regulators run clocks of their own. New York's cybersecurity regulation requires covered entities to notify the superintendent "in no event later than 72 hours after determining that a cybersecurity incident has occurred."

So onchain, MDR covers the first minutes and a retainer the days after. For timings across real exploits, see how fast crypto hacks are detected.

Which to Buy First, by Stage

Stage	Buy first	Add next
Pre-launch, no user funds	An IR plan and SEAL 911's contact	MDR before launch
Live protocol or treasury	MDR with agreed pause authority	A retainer as funds grow
Exchange, custodian or fintech	MDR, 24/7	A retainer for forensics and reports
Runs its own 24/7 SOC	A retainer for surge and forensics	Onchain detection coverage

Pre-launch teams have little to watch, but they need the plan. Our DeFi incident response plan covers roles, pause authority and contacts.

Regulated platforms may have less choice. Hong Kong's SFC says licensed trading platforms should have a SOC or equivalent function, with security monitoring "on a 24/7 basis, including during holidays."

Teams with their own SOC fit NIST's mixed model: "internally performing basic incident response and engaging third-party resources for assistance with certain incidents."

Combining them

One escalation path: MDR pages your team and the retainer firm together.
Onboard the retainer firm now, while nothing is on fire.
Agree the evidence MDR hands over: alerts, logs, transactions and a timeline.
Limit access. NIST notes that providers "often have privileged access" and can be compromised.
Rehearse once a year with both in the room.

How Guardian Helps

Guardian's Managed Security includes 24/7 monitoring and direct response from Guardian's MDR team.

It monitors your contracts on every block. Through Sentry, it watches your domains, DNS, certificates, cloud and code host.

When something fires, a Guardian engineer responds.

It includes a trust center with the technical evidence regulators ask for.

A 90-day guarantee applies: Guardian detects and resolves a high-severity issue in the first 90 days, or you don't pay.

For a single incident, Guardian's pentests include rapid analysis of "exposure, blast radius, and recovery paths."

Frequently Asked Questions

What is the difference between MDR and incident response?

MDR is a continuous service that detects, triages and contains threats as they happen. Incident response is the work after an incident is declared: investigation, eradication and recovery. A retainer reserves that work on call.

What is an incident response retainer?

A contract that reserves an outside team to respond when you call. Unit 42, for example, offers response SLAs from 24 hours to two hours, and prepaid credits that can also fund proactive work.

Is SEAL 911 a substitute for an incident response retainer?

No. SEAL 911 is a free, volunteer-run hotline that handles tickets based on available bandwidth. Save its contact in every plan, but it refers long tracing work to member firms that offer paid services.

Should a crypto startup buy MDR or a retainer first?

If you hold funds onchain, MDR first: funds can leave in minutes, before a retainer's clock starts. Before launch, write an IR plan and save SEAL 911's contact. Add a retainer as funds and obligations grow.

Sources

Cover the first minutes, not just the days after

Guardian's MDR team watches your contracts and infrastructure around the clock and responds when something fires.

Talk to Guardian Explore Managed Security