Cisco Talos Incident Response retainer part numbers

The Talos IR retainer in brief

A Cisco Talos Incident Response (IR) retainer is a block of hours with Cisco Talos, Cisco's threat intelligence and incident response group, delivered under Cisco's service description. The hours can go on emergency response to a cyber incident or on proactive work such as readiness assessments, plan and playbook reviews and tabletop exercises. For what Talos IR involves, see Cisco Talos Incident Response (opens in a new tab) and Cisco Talos (opens in a new tab) on our Cisco security site. This page covers the part numbers and how the hours work.

How Talos retainer licensing works

Cisco publishes the Talos IR retainer as attach codes that are added to an order for another Cisco product. There are three:

• Sizing: on Duo and ISE orders Cisco suggests a retainer size from the licence quantity. The retainer is optional and can be removed, or chosen by hand. The Duo guide gives the hours for each size; ISE sizes are confirmed at quote.
• Firewall orders: Cisco's Network Security guide lists only the Small retainer for firewall orders. CTIR-NGFW-S= is the orderable code; its service code, CON-CTIR-NGFW, is added with it and is not ordered on its own. Cisco attaches the retainer to certain Secure Firewall appliance bundles, and we confirm the retainer options for your firewall order at quote.
• Using the hours: hours are drawn down as Cisco Talos delivers work. When they run out, additional hours can be purchased.
• Planning proactive work: Cisco needs at least 50 hours left on the retainer to schedule proactive services, and asks for them to be requested and scheduled at least 90 days before the subscription ends. Unused hours expire at the end of the subscription term, so it pays to plan readiness work early in the term.

Sources: Cisco Duo Ordering Guide (opens in a new tab), Cisco ISE Licensing Guide (opens in a new tab), Cisco Network Security Ordering Guide (opens in a new tab) and Cisco Talos Incident Response Retainer service description (opens in a new tab).

Cisco Talos part numbers

Talos IR retainer codes are added to a Duo, ISE or Secure Firewall order. For Secure Firewall, CTIR-NGFW-S= is ordered with its service code CON-CTIR-NGFW.

Part numbers from Cisco Duo Ordering Guide, updated 7 Jul 2026 (opens in a new tab); Cisco ISE Licensing Guide, updated 7 Jul 2026 (opens in a new tab); Cisco Network Security Ordering Guide, updated 15 Oct 2026 (opens in a new tab), checked 2026-11-08. Add the licences you need to your basket and request a quote: we confirm the right part numbers, quantities and terms when we quote.

Talos threat hunting

Cisco also runs Talos Threat Hunting, a service that hunts for attacker behaviour in eligible Cisco security telemetry. Cisco's current ordering guide for Talos Threat Hunting limits it to US customers, so ask us and we can check availability for your organisation. Endpoint threat hunting by Cisco Talos is included with Secure Endpoint Premier, with no separate code; see Cisco Secure Endpoint.

Sources: Cisco Talos Threat Hunting Program Ordering Guide (opens in a new tab) and Cisco Security Ordering Guide for Providers (opens in a new tab).

How we help

We can quote a Talos IR retainer with a new Duo, ISE or Secure Firewall order, or alongside your existing Cisco subscriptions, and help you choose a size that fits how you plan to use the hours. Cisco Talos delivers the service; we can keep the order, the renewal date and any changes on one account with your other Cisco subscriptions. You can add the codes below to your basket and send them with your enquiry, or simply contact us.

For other ways to arrange incident response cover, see incident response retainers (opens in a new tab) on our managed security site, or browse other EDR, XDR and MDR products we supply.