Lesley Carhart 
I don’t understand companies that buy a credible incident response retainer and then are terrified to activate it, even though the hours are paid for and a rate and SLA are guaranteed. When in doubt, activate your retainer! Get a fresh set of eyes! You don’t just buy the retainer for the sake of your insurer and regulator. You have specialist incident responders on call to help you and help make things better! Any legitimate company will just use the minimum required hours for the contract and situation. It isn’t a magic red button where the incident isn’t real until you press it… #infosec #DFIR
bitzbyte 
@hacks4pancakes When legal controls the ability to activate said retainer and convincing them it's worth the the "risk" takes a month or 2 just not bothering is generally the only answer.
Also, in every case I've seen an IR retainer its cost is 100% of the IR budget line. So it's held back as insurance in case "something worse" happens tomorrow.