Managed security for a small or mid-sized US business typically runs from about $2,000 to $25,000 per month, and large enterprise packages can climb past $25,000 and up to $100,000 monthly. Where you land depends on how many people and endpoints you have, how much of the work the provider takes on, and what the contract leaves out. Below you'll find the price ranges, the pricing models behind them, the fees that surprise buyers, and a worked example you can adapt to your own headcount.
TL;DR
- Full managed security bundles averaged $45 per endpoint per month for basic and $73 for premium in a 2024 MSSP survey.
- Monitoring-only MDR costs far less per endpoint than a full bundle, because it excludes help desk, compliance work and incident response hours.
- Budget for onboarding (often $0 to $5,000 or more), 12-month terms, data retention and incident response fees, not only the monthly line.
- Ask every provider for a flat monthly price that states what is excluded. Compare quotes on scope, not on the headline number.
Table of Contents
- What "managed security" actually covers
- How much managed security costs in the US
- What MDR and SOC-as-a-service cost
- The pricing models you will be offered
- Why two quotes for the same company differ so much
- Fees and terms outside the monthly price
- How to estimate and compare your total cost
- Our view on pricing managed security
- Getting a flat-rate quote from us
- FAQ
- Sources
What "managed security" actually covers
The phrase stretches across very different products, which is why quotes for the same company can differ by a factor of ten. Three tiers show up most often:
- Monitoring and detection (MDR or SOC-as-a-service). A provider's analysts watch your endpoints, cloud accounts and logs around the clock, investigate alerts and tell you what to do or contain the threat for you.
- Managed security bundle (MSSP). Detection plus vulnerability scanning, patching coordination, email and identity protection, firewall management and regular reporting.
- Fully consolidated IT and security. The bundle plus help desk, cloud management, backup, compliance evidence and a single contract and SLA.
A quote that covers the first tier only is not comparable to a quote for the third. Start every comparison by writing down which of these you are actually buying.
How much managed security costs in the US
The published ranges cluster around a few reference points. Treat them as orientation, not as a quote.
| Buyer | Typical monthly range | What drives it |
|---|---|---|
| Small to mid-sized business | $2,000 to $25,000 | Headcount, endpoints, scope |
| Large enterprise | $25,000 to $100,000+ | Multiple sites, cloud estates, compliance load |
| Per endpoint, basic bundle | $45 average | 2024 MSSP survey |
| Per endpoint, premium bundle | $73 average | 2024 MSSP survey |
The spread inside "small to mid-sized" is wide for a simple reason. A 15-person office with laptops and a single cloud suite needs a fraction of what a 400-person company running AWS, Azure and a regulated data store needs. Where you sit in that range is mostly a question of scope.
A worked example
Take a 50-person company with 60 endpoints (laptops, desktops and a few servers). At the survey averages above, a basic bundle comes to 60 x $45 = $2,700 per month, or $32,400 a year. A premium bundle comes to 60 x $73 = $4,380 per month, or $52,560 a year. These are arithmetic on survey averages, not a price from us or any provider, but they show how quickly the per-endpoint figure turns into an annual budget line.
Now set that against the downside. IBM's 2025 report put the average US data breach at a record $10.22 million, though that average is skewed by large incidents and a small business will rarely see that number. The useful point is the ratio: a managed program costs tens of thousands a year, while a serious incident can cost many multiples of that in downtime, recovery and regulatory exposure.
What MDR and SOC-as-a-service cost
MDR and SOC-as-a-service are the cheapest slice of managed security per endpoint, because they sell detection and response and little else. One public price tracker lists most MDR offerings at $8 to $35 per endpoint per month, with many providers publishing no price at all and quoting by custom proposal. Some price per user, some per endpoint and some by cloud resource, so convert everything to the same unit before you compare.
That low per-endpoint figure hides three things worth asking about:
- Who responds. Some MDR services only alert you. Others isolate hosts and kill processes on your behalf. The second costs more and is worth more.
- What it watches. Endpoint-only coverage is cheaper than coverage that also ingests identity, email, firewall and cloud logs.
- Hours of response included. A deep investigation after a real incident is often billed separately unless it is built into the contract.
If you want to see what a well-specified MDR service should include, including coverage hours and the metrics worth holding a provider to, our guide to 24/7 MDR security and SOC coverage walks through it.
The pricing models you will be offered
Most providers use one of four models, sometimes in combination.
| Model | How it works | Best for | Watch for |
|---|---|---|---|
| Per user | A fixed fee per employee per month | Office-based teams with a few devices each | Charges for contractors and shared accounts |
| Per endpoint | A fee per protected device | Device-heavy or server-heavy environments | Growth in device count, IoT and test machines |
| Tiered bundle | Good, better, best packages at fixed prices | Buyers who want a simple menu | Features you need sitting only in the top tier |
| Flat fee for scope | One monthly price for a defined environment | Mid-sized firms with stable infrastructure | Scope creep clauses and re-pricing at renewal |
None of these is inherently better. Per-endpoint pricing is transparent but moves with your device count. A flat fee is predictable but only as honest as its scope document. Whatever you choose, the price should be stated as a monthly figure you can put in a budget.
Why two quotes for the same company differ so much
When quotes diverge, the cause is almost always one of these:
- Environment size. Users, endpoints, servers, cloud accounts and sites.
- Coverage hours. Business hours is cheaper than true 24/7 with analysts on shift overnight.
- Response depth. Alert-only, guided response or hands-on containment.
- Compliance load. Evidence collection for SOC 2, HIPAA, PCI-DSS or ISO 27001 adds recurring work. If you handle patient data, the HIPAA requirements shape what you need to monitor and keep.
- Tooling ownership. One analyst view is that a vendor-owned agent versus a customer-owned license model is a pricing nuance buyers often overlook. With vendor-owned tooling, you may lose the software and its history if you leave. With customer-owned licenses, you pay for the software separately but keep control.
- Contract length. Longer terms usually lower the monthly rate and raise the cost of changing your mind.
Fees and terms outside the monthly price
The monthly figure is where most comparisons stop, and where most disputes start. Before you sign, check each of these:
- Onboarding or setup. One-time fees commonly range from $0 to $5,000 or more. Ask whether agent deployment, log source integration and policy tuning are included.
- Data retention. Log storage beyond a default window is often billed separately. If a regulator or insurer expects a year of logs, price that in.
- Incident response. Confirm whether response hours are included, capped or billed at an emergency hourly rate.
- Term and renewal. Industry guidance flags 12-month or longer terms and renewal pricing as items to read closely. Ask what the price becomes in year two and how much notice you must give to cancel.
- Exit terms. Who owns the data, the configurations and the license keys when the contract ends?
Onboarding costs you can control
Some of the one-time cost is yours to reduce. A provider cannot enroll devices that are unmanaged, unencrypted or running under shared admin logins without extra labour, and that labour shows up on your invoice. Sorting out device setup with admin accounts, encryption and MDM enrollment before the provider starts shortens deployment and keeps the onboarding fee closer to the low end.
Incident response is its own line
Even a strong monitoring contract can leave you paying emergency rates the day something goes wrong. A prepaid retainer turns that into a known cost. We cover the economics in our piece on an incident response retainer, and the first hours of a ransomware event in our ransomware response guide.
How to estimate and compare your total cost
Use this sequence to get quotes you can actually line up side by side.
- Count what needs protection. Users, endpoints, servers, cloud accounts, offices and SaaS apps. Include contractors with access.
- List the outcomes you need. 24/7 detection, containment, vulnerability management, compliance evidence, backup and recovery, help desk.
- Request the same scope from each provider. Give every vendor the same inventory and the same outcome list.
- Ask for a first-year total. Monthly fee x 12, plus onboarding, retention, response hours and any license costs you carry.
- Ask for the year-two price in writing. This is where cheap first-year quotes often unwind.
- Price the vendors you would otherwise need. If you buy monitoring from one firm, compliance from another and IT from a third, add all three and compare with a single consolidated quote. Consolidation also removes the gaps between contracts, where incidents tend to get dropped.
- Check what insurers expect. Cyber insurance carriers increasingly ask for MFA, EDR and tested backups. Our guide to cyber insurance requirements lists them, and a managed program that already covers them can offset some of its own cost.
A common rule of thumb says a small or mid-sized firm should spend a modest slice of its overall IT budget on security. Treat any such percentage as a sanity check for your own planning, not a target, because your data, regulation and risk set the real figure.
Our view on pricing managed security
We see the same pattern again and again. A company buys detection from one provider, a firewall from another, compliance help from a consultant and backup from a fourth. Each contract looks reasonable alone. Together they leave gaps nobody owns, four renewal dates, four invoices and four people to call at 2 a.m.
That is why we sell consolidated IT and security under one SLA with one point of accountability, and why we price it as a flat monthly fee. Our rule is simple: a price is only useful if the buyer can predict the year. That means no surprise invoices, a clear statement of what is in scope and a straight answer on what happens at renewal.
Our advice to any buyer is to compare scope first and price second. The cheapest quote is rarely the cheapest outcome if it leaves out response hours, retention or the compliance evidence your auditor will ask for. If you are a small business with a modest budget, start with monitoring and the basics that insurers and auditors expect, then add services as you grow. If you are larger, consolidating vendors is usually where the saving is.
— Nick - Sr. Executive
Getting a flat-rate quote from us
We cover 24/7 threat detection and monitoring, incident response, vulnerability management, cloud management across AWS, Azure and Google Cloud, managed IT, compliance assessments for SOC 2, HIPAA, PCI-DSS and ISO 27001, and backup and disaster recovery. These can be bundled or bought standalone on a monthly contract. We do not publish prices, because they depend on your environment, so the quickest route to a real number is to tell us your headcount, endpoints and compliance needs. See everything we offer on our IT and cybersecurity services page.
If you are still weighing the case for outsourcing, our overview of the benefits of managed security for SMBs and our small business playbook for reducing cyber risk without an IT team cover the reasoning in more detail.
FAQ
How much does managed security cost per month for a small business?
Small and mid-sized US businesses commonly see $2,000 to $25,000 per month, depending on scope and headcount. A 50-person firm buying a basic bundle at the survey average of $45 per endpoint would land near $2,700 for 60 endpoints. Ask each provider for a first-year total, not just the monthly rate.
How much does MDR cost?
Public price trackers list most MDR services at $8 to $35 per endpoint per month, and many providers quote only on request. The number depends on whether the service alerts you or actually contains threats, and on how many data sources it watches. Compare MDR quotes on response actions included, not on the per-endpoint rate alone.
Is SOC-as-a-service cheaper than building an in-house SOC?
For almost every small and mid-sized company, yes. An in-house 24/7 SOC needs several analysts across shifts, plus tooling, which is far beyond what a monthly managed fee costs. Outsourcing gives you round-the-clock coverage without hiring and retaining that team.
What hidden costs should I look for in a managed security contract?
Check onboarding fees, which can run from $0 to $5,000 or more, plus data retention charges, incident response billing, minimum terms and renewal pricing. Also confirm who owns the tooling and data if you leave. Get these items in writing before you sign.
Should I pay per user or per endpoint?
Per user suits office teams where each person has one or two devices. Per endpoint suits environments with many servers, shared machines or devices that outnumber staff. Whichever you pick, model your growth over the next 12 months, since that is when the contract will first reprice.
Sources
- MSSP Pricing 2026: What Managed Security Services Cost
- Managed Security Services (MSSP): What You Get and Cost
- MDR pricing 2026: cost per endpoint and SOC-as-a-Service rates
- Cost of Data Breach in US Rises to $10.22 Million, Says Latest IBM Report