Price the investigation question and the recovery work
There is no published standard price for an Atlant AI incident-response engagement. We prepare a proposal after understanding affected systems, current activity, evidence access and required outputs. A small historical investigation with usable logs is materially different from an active event spanning several providers and production systems.
An early estimate should name its assumptions. Ask what it covers, what could change it, who approves additional work and when the next scope decision occurs. A low headline rate is not a useful comparison if it excludes evidence collection, recovery support or the final report.
Cost drivers you can establish before a proposal
| Driver | Why it matters | Useful non-sensitive information |
|---|---|---|
| Systems and identities | More boundaries require more collection and correlation | Application, cloud, identity and provider names |
| Evidence availability | Missing or short-lived records change the investigation path | Record types, approximate volume and retention |
| Current impact | Ongoing activity can require parallel containment and investigation | Whether activity continues and what service is affected |
| Recovery requirements | Validation, change coordination and staged restoration add work | Required environments and acceptance owners |
| Third parties | Provider access and specialist involvement create dependencies | Existing responders, suppliers and insurer requirements |
| Reporting audience | Different outputs require agreed detail | Who will use the findings and for which decision |
Request a phased proposal
A practical structure is an initial assessment and preservation scope, a subsequent investigation scope, then recovery validation and improvement work. Each stage should produce a decision or deliverable, not simply consume unspecified hours. Whether work is fixed-scope or time-based is a commercial term to agree; no model is automatically best for every incident.
Specify the update cadence, assumptions, expenses, taxes, third-party costs, approval threshold and treatment of work outside the initial boundary. If an estimate changes because a new system is implicated, the team should explain the new evidence and decision rather than silently widening the engagement.
Compare retainers separately
A retainer may concern preparedness, access to responders, prepaid work or a combination. Check coverage hours, capacity commitments, activation process, unused hours, rollover, overage rates and cancellation. Distinguish acknowledgement from technical mobilisation and from containment: they are different milestones.
Read the AI response retainer scope and use the provider selection checklist. Atlant’s public form does not reserve response capacity or create an SLA.
What to send for a useful estimate
Provide a high-level description of the event, affected AI service, business impact, status and desired output. Mention existing responders and available evidence types. Attach an NDA or RFP if required. Keep credentials, detailed logs and sensitive records out of the public form. The incident brief builder prepares this information for your review.
Discuss your situation
Build an incident brief with non-sensitive context, or request a scope discussion. We confirm people, access, fees and availability before work begins.
