Respond to a Cyber Attack

Unit 42 Retainer

With the Unit 42® Retainer, our experts become an extension of your team. Put us on speed dial for assistance for security posture assessments or incident response.

Initiate your response within minutes

Let Unit 42 experts put you firmly in the driver’s seat

PREPAID CREDITS

Purchase prepaid credits at a level that fits your budget and response needs.

SLA-DRIVEN INCIDENT RESPONSE

Our best SLA aims for a 2-hour response, but our global team often replies within minutes.

PREARRANGED COMMUNICATION CHANNEL

Get a dedicated Unit 42 contact and direct channel for fast, tailored incident response.

PROACTIVE SECURITY ASSESSMENT

Credits can be used for proactive services to improve your security posture and boost resilience.

PREDEFINED PROCESSES AND PLAYBOOKS

Avoid delays with repeatable response workflows built from real-world incident expertise.

PUBLIC SECTOR EXPERTISE ON DEMAND

World-class incident response and security assessment services tailored to the needs of the public sector.

Turning Threat Intelligence into Cyber Resilience

Unit 42 brings the experience, technology and operational depth to match attacker speed. From readiness through response to long-term improvement, we help you act with precision and continuously strengthen your security program.

THREAT-INFORMED

Your attack surface is expanding and harder to see. We ground every service in real-world intelligence from thousands of client engagements and telemetry across 70,000+ customers so you focus resources on the threats that matter most and act with precision.

TECHNOLOGY-DRIVEN

Unit 42 combines deep platform integration with AI and automation to simplify operations, cut through noise, strengthen prevention and accelerate action so you reduce risk faster and stay ahead of evolving threats.

EXPERTISE-LED

You need experts who have seen it before. Our 24/7 global team spans response, readiness, threat intelligence and long-term transformation, delivering battle-tested expertise across every engagement and phase of your security journey.

TRANSFORMATION-FOCUSED

Every engagement turns lessons learned into lasting improvement. We translate frontline findings into clear actions, close control gaps, align to leading frameworks and redesign your security program so you emerge stronger and better prepared for what’s next.

Be prepared.
Learn more about Unit 42.

Asante Stakeholder

A modernized SOC revolutionizes Asante Health’s visibility and efficiency

Two-thirds of alerts resolved automatically within 30 minutes.

Unit 42 Retainer pdf

Unit 42 Retainer

World-Class Incident Response and Cyber Risk Management On Demand.

Packers Stadium

Unit 42 Customer Stories

Learn how Unit 42 delivers threat intelligence, proactive services and incident response.

Unit 42 Expertise On Demand datasheet

Unit 42 Expertise On Demand

Learn how Unit 42 delivers world-class incident response and cyber risk management on demand and tailored to the public sector.

Go from reactive,
to proactive

Ready to work together? We’ll help you assess and test your security controls, transform your security strategy with an intelligence-informed approach and respond to incidents in record time.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
FAQ

Frequently Asked Questions About Unit 42 Retainer

Unit 42 is the threat intelligence, incident response, and security consulting arm of Palo Alto Networks helping organizations prepare for, respond to and recover from cyber incidents.
A Unit 42 Retainer gives your organization priority access to experienced responders with pre-defined SLA's before a crisis occurs. It removes the delays of finding a provider and negotiating terms during an attack, while helping your team prepare in advance and act quickly when an incident happens.
Response SLAs range from 24 hours to two hours, based on your selected retainer and service level.
Yes. Retainer credits can support readiness activities such as incident response planning, tabletop exercises and assessments, helping teams prepare before an attack occurs.
Yes. Unit 42 is on all major cyber insurance panels and can coordinate with your insurer, breach counsel and internal teams when an incident occurs.