Managed cyber security service types and how they are priced
What each managed security service does, the usual pricing unit, who it fits and what to watch for.
This table compares service types, not providers. Many proposals bundle several rows, so use it to split a bundled quote into its parts and check each one. The price units are the common ways these services are charged; the dollar figures in the guides are illustrative ranges, not market prices. Read across a row to see what a service is good for and where the gaps usually are.
Select a column header to sort.
| Service type | What it does | Usual pricing unit | Good fit for | Watch out for |
|---|---|---|---|---|
| Managed endpoint security (EDR plus patching) | Installs and manages endpoint detection and response software and keeps operating systems and applications patched | Per endpoint or per user per month | Small offices without dedicated IT security staff | Alerts may only be reviewed in business hours; servers often priced separately |
| Managed email security | Filters phishing and malware, adds link and attachment checks, sometimes user training | Per mailbox per month | Every business using email for invoices and payments | Does not stop payment-redirection fraud on its own; check impersonation controls |
| Managed firewall / SASE | Configures and monitors firewalls or a cloud-delivered network security service | Per device or site per month, or per user for cloud services | Multi-site businesses and businesses with remote staff | Hardware purchase or lease and replacement cycles may be extra |
| MDR (managed detection and response) | 24/7 monitoring of endpoint and often identity alerts, with the provider containing threats | Per endpoint or per user per month | Businesses that need overnight cover without building a team | Response may stop at containment; full incident response billed separately |
| SOC-as-a-service / managed SIEM | Collects logs from many sources, correlates them and has analysts watch and escalate | Per GB of log data ingested, per log source, or tiered by events per second, plus a platform fee | Businesses with servers, cloud workloads, compliance logging needs | Log volumes grow; ask what happens to the price above the tier |
| vCISO (virtual chief information security officer) | Part-time security leadership: risk register, policies, board reporting, roadmap | Monthly retainer for set days, or day rate | Businesses needing governance and an Essential Eight plan | Advice only; implementation is extra |
| Penetration testing | Authorised simulated attacks on networks, web apps or cloud to find weaknesses | Fixed price per scope, built from tester days | Before a major launch, yearly assurance, insurer or customer requirements | Scope drives price; retest and remediation are often extra |
| Essential Eight uplift | Assess current maturity and implement controls to reach a target maturity level | Fixed-price assessment plus project fee, or time and materials | Businesses asked by customers, insurers or government contracts to show maturity | Ongoing upkeep after the project is not included |
| Incident-response retainer | Pre-agreed access to responders, with response times and rates set before an incident | Annual fee, often converted to prepaid hours | Every business that cannot afford to search for help during an incident | Unused hours may expire; check insurer panel rules |
All pricing units are typical patterns, not rules; providers combine and rename them. Dollar ranges elsewhere on this site are illustrative and exclude GST unless stated. Check the official guidance before relying on a provider's compliance claims: ASD's Australian Cyber Security Centre at cyber.gov.au for the Essential Eight, the OAIC for privacy and data breaches, and the Department of Home Affairs for the Cyber Security Act 2024 reporting obligations.