I have lost count of the post-incident reviews where the most painful conversation was not about the breach itself. It was about the retainer.