Senior DFIR practitioners, pre-engaged, on the right model for how you actually want to use us. Pay-as-you-go, annual partnership, or annual partnership with managed detection and response layered on. Every retainer includes the Eviction Pledge.
Identity-first attacks, sub-24-hour encryption windows, agent-fatigue in the buyer market, insurance carriers demanding evidence of continuous coverage. Each retainer answers one of those pressures.
No annual fee. Standard hourly rate. Pre-engaged senior team with a contracted callback when you need us.
Annual retainer fee. Hourly rate reduced by 10%. A known team that already knows your estate when the call comes.
Annual retainer + 24/7 managed detection. Hourly rate reduced by 20%. Works with whatever stack you already chose.
Standby is the simplest retainer we offer. No annual fee, no minimums, no envelope to commit to. You pay the standard hourly rate when an incident happens, and you get a pre-engaged senior team with a contracted 1-hour callback SLA in return.
Best for organisations that already run mature internal security, have a clear internal SOC, and just want a named DFIR partner ready to pick up when their own team needs reinforcement.
Engage Standby →Continuum is the retainer for organisations that want to take the friction out of the relationship before there is an incident to manage. Annual commitment, reduced hourly, and a team that has already walked your estate, run your tabletop, and sat through your board's questions.
When the call comes, the first hour goes to containment, not introductions.
Apply for Continuum →Vanguard layers a 24/7 managed detection and response service over the Continuum partnership. Same hands that watch are the hands that handle the IR. No second vendor, no second escalation chain, no second contract. And critically: agent and solution agnostic.
The MDR market in 2025 / 2026 was a forced-replacement market. Most MDR vendors only run their own EDR, on their own SIEM, with their own SOAR. The customer paid to rip out what they had and start again.
Vanguard does not do that. We run the SOC on the agent and stack you already chose, whichever combination of CrowdStrike, SentinelOne, Microsoft Defender, Palo Alto, Sentinel, Splunk, Entra, Okta, the cloud-native telemetry your platform team built. We bring the detection logic, the runbooks, and the senior practitioners. You keep the licences.
A managed defence service where the analyst watching the alert is the practitioner who runs the IR. No hand-off, no second team, no second story.
Cyber buyers in 2027 are tired of being told to rip out their stack. They have already bought CrowdStrike or SentinelOne. They have already moved to Sentinel or Splunk. They have already standardised on Entra or Okta. Most of them are not going to do it again for the privilege of being monitored.
Vanguard is built for that buyer. We bring the senior detection logic, the runbooks, the human eyes and the IR muscle. They keep the licences and the data sovereignty. The carrier gets the evidence it asks for. Everyone gets the eviction guarantee.
It is not the cheapest model in the market. It is the model that admits what the market has been telling vendors for two years.
Quick scoping call, NDA, then a written proposal. No sales engineer in the middle.