Escalations & Hours
Four response layers, one escalation matrix, every hour accounted for.
1
AI SOC
24/7 triage, investigation and policy-bound containment
2
Named Vault engineer
Business hours 7am–5pm PT + on call; approves actions
3
Unit 42 retainer
Incident response and proactive services (125 hrs/yr)
4
Vault Elastic Support
U.S.-persons engineers, billed hourly via Arrow once retainer hours are exhausted
Unit 42 retainer · Year 1 (125 hrs) burn-down
Tabletop exercise
Nov 2026 · 16 hrs planned
Compromise assessment
Feb 2027 · 12 hrs planned
IR plan review
May 2027 · 12 hrs planned
Balances
Retainer used18 hrs
Planned proactive40 hrs
Available67 hrs
Elastic Support (this quarter)3.5 hrs
Escalation matrix
| P1 | Critical, confirmed compromise or CUI impact | Engineer joins in 15 min · Unit 42 engaged |
| P2 | High, contained or likely | Engineer within 1 hour |
| P3 | Medium / needs business context | Next business day |
| P4 | Low / hygiene | Weekly review |
Escalation log
| Time | ID | Incident | Layer | By | Note |
|---|---|---|---|---|---|
| Oct 7, 19:30:00 PT | ESC-0192 | XDR-4799 | Unit 42 retainer | D. Mercer (Vault) | Scoping engagement, 6 hrs estimated |
| Oct 5, 07:30:00 PT | ESC-0188 | XDR-4760 | Vault engineer | AI SOC | P2 page — resolved in 38 min |
| Sep 29, 07:30:00 PT | ESC-0181 | MDO-1101 | Vault Elastic Support | D. Mercer (Vault) | Mail flow forensics, 3.5 hrs via Arrow |