Overview
This catalog contains information about the standardized Proactive & Professional Services that are available with the Incident Management Retainer (IMR) through use of Service Units only.
This catalog contains a wide range of services that include development of Incident Response / Incident Management capabilities and sustainment services to help reduce the risks and impacts of cyber incidents as well as those designed to enhance the effectiveness of the Taegis platform. The scope for each service is fixed (Secureworks-defined standard scope) and includes defined outcomes; however, Secureworks can work with you to reasonably customize the scope if needed, at the discretion of Secureworks. Depending on your needs, recommendations from Secureworks, available personnel, and other considerations, the services may be conducted remotely or on-site. Any deviations from this Service Catalog shall require a change order.
The Service Unit values listed in this catalog are based on your organizational or network infrastructure size and are subject to adjustment based on the specific engagement objectives and desired outcome.
All services in this catalog, including related communication and documentation, are delivered in English. Local language options may be available; ask your Secureworks Incident Response point of contact.
Initiating Proactive Services
To initiate any of the Proactive Services listed in this catalog, use one of the following options:
Send an email to secureworks_services@secureworks.com
Create a ticket in the Ticketing System; see the IMR Ticketing Guidance for instructions
If you do not have sufficient Service Units to initiate a proactive service listed in the catalog, or you want to purchase Service Units, then send an email to secureworks_services@secureworks.com for assistance. You acknowledge and agree that receipt of such email will be from a representative of your organization authorized to commit to your organization to the purchase of additional Service Units and email notification is binding upon your organization.
If you need Emergency Incident Response services, then contact your Secureworks representative to discuss exchanging Service Units for Emergency Incident Response services.
NOTICE: If you purchased the Incident Management Retainer through a Secureworks partner, then you must contact that partner for all purchases including Service Units.
Initiating Proactive Services
To initiate a request for any of the Professional Services listed in this catalog, send an email to secureworks_services@secureworks.com.
If you do not have sufficient Service Units to initiate a proactive service listed in the catalog or you want to purchase Service Units, contact your Customer Success Manager or Secureworks Account Manager.
NOTICE: If you purchased the Incident Management Retainer through a Secureworks partner, then you must contact that partner for all purchases including Service Units.
Scheduling and Billing
If you purchased the Essential or the Essential Plus IMR, then the initial Proactive Services Roadmap and the schedule for delivering services that are listed in this catalog are defined during the IMR Planning Workshop. If you purchased other IMR tiers, then you can use the process explained above to purchase and schedule delivery of services.
For the services listed in this catalog, you will be billed according to the Billing Terms indicated in your Statement of Work. See Service Scheduling and Billing and Utilization of Resources for more information.
Services
Listed in the tables below are Proactive Services and the number of Service Units required. Many Proactive Services have sizes, which represent the fixed scope efforts: small (S), medium (M), and large (L). In addition, Secureworks can provide the following:
- Programs: Ransomware Preparedness Program: helps your organization understand your level of exposure; evaluate and exercise your ability to detect and respond to a ransomware attack
- Technical Assistance Services: fixed-scope technical requests with structured outcomes
Incident Readiness Services
| Service Name | Service Units Required |
|---|---|
| Incident Response Plan Development | S:12, M:16, L:24 |
| Incident Response Plan Review | S:8, M:16, L:20 |
| Incident Response Playbook Development | Between 4 and 8 depending on subject of playbook and amount of pre-existing planning |
Testing and Validation Services
Application Security
| Service Name | Service Units Required |
|---|---|
| Custom Application Security Assessment | S:16, L:24 |
| Mobile Application Security Assessment | 8 |
| Secure Code Analysis | S:10, M:16, L:22 |
| Web Application Security Assessment | S:8, M:12, L:16 |
| Web Service/API Test | S:8, M:12, L:16 |
Penetration Testing
| Service Name | Service Units Required |
|---|---|
| Cloud Penetration Test | 10 |
| External Penetration Test | S:8, M:16, L:32 |
| Internal Penetration Test | S:8, M:16, L:32 |
| Physical Security Testing | 16 |
| Wireless Network Penetration Test | 8 |
Specialized Testing
| Service Name | Service Units Required |
|---|---|
| Device Penetration Test | 16 |
| Laptop Penetration Test | 8 |
| Medical Device Test | 16 |
| SAP Penetration Test | 16 |
Security Awareness
| Service Name | Service Units Required |
|---|---|
| Phishing Drill – Click and Log | S:8; M:16 |
| Phishing Drill – Credential Capture | S:16; M:24 |
| Vishing Drill | S:8; M:16 |
Security Assessments
| Service Name | Service Units Required |
|---|---|
| Active Directory Security Assessment | S:10; M:20; L:40 |
| Entra ID Security Assessment | 12 |
| Password Cracking and Analysis Assessment | 4 |
| Threat Hunting Assessment | S:10; M:18; L:24 |
| Vulnerability Assessment | S:4; M:8; L:12 |
Threat Intelligence Services
| Service Name | Service Units Required |
|---|---|
| EBS Info Brief | 8 |
| Threat Landscape Brief | 4 |
| Threat Intelligence Support Services | Varies depending on selection |
Workshops and Exercises
Secureworks Adversary Group-led Exercises
| Service Name | Service Units Required |
|---|---|
| Collaborative Adversary Exercise | Lite: 4; Standard: 8; Immersive: 16; Replay: 4 |
| Adversary Emulation Exercise | Lite: 16; Standard: 36; Extra Time: 8 per week |
| Adversary Simulation Exercise | Lite: 16; Standard: 36; Extra Time (1 week): 8; Physical security attacks (1 location): 16; Wireless (1 location): 8 |
See the Adversary Exercises page for more information.
Incident Response-led Exercises
| Service Name | Service Units Required |
|---|---|
| Functional Exercise | S:16; M:24 |
| Incident Response Fundamentals Training | Varies depending on selection |
| Incident Response Tabletop Exercise | 8 |
Professional Services
| Service Name | Required Service Units |
|---|---|
| Taegis Health Check | 5 |
| Taegis Enablement: Core | 5 |
| Taegis Enablement: Plus | 15 |
| Taegis Training | 2 |
| Data Collection & Integration | 12 |
| Customization Services | Please speak to your Customer Success Manger or Account Manager for scoping |
See the Professional Services page for more information.
Secureworks. (n.d.). Incident Management Retainer Services Catalog Overview – Secureworks adversary group-led exercises. Retrieved February 24, 2026, from https://docs.taegis.secureworks.com/services/incident-response/imr-services-catalog/imr-services-catalog-overview/#secureworks-adversary-group-led-exercises