There is a short window of opportunity between the detection of an initial compromise and the ability to prevent an attacker from fulfilling his objectives. This period is sometimes referred to as “breach exposure time” or “dwell time.” Early detection and rapid response are the key requirements to defend against a breach of security. How can organizations address these requirements? One approach is to implement a surge resourcing model using Incident Response (“IR”) retainers as a best practice. This approach provides rapid access to top tier security analysts from RSA who will help reduce dwell time and mitigate the impact. IR Retainers can also help an organization to align with the requirements and incentives offered by cybersecurity insurance providers.