It's not hard to see that many organizations struggle with responding to breaches, just take a look at the news. A common response of organizations has been to sign up for incident response services or retainers which would help with providing emergency breach services at a moments' notcie. This talk will describe how an IR retainer, although a great step towards perparation, is not sufficient alone in helping an organization to prepare for a real incident; that in the absence of other components, adequate response will fail. Case examples will be used to clarify points.