How each type of managed security service is priced, what drives the number, and the Australian laws that apply in 2026.
This section explains what you are paying for when you buy managed cyber security, and which Australian rules set the minimum you need to get right. Start with the pricing overview, which maps every service type to its usual pricing unit: per user, per endpoint, per gigabyte of logs, per device, per day or per retainer.
The service guides then go one level deeper: MDR and SOC-as-a-service, managed endpoint, email and firewall, vCISO retainers, penetration testing and Essential Eight uplift. Two guides cover the law: the Privacy Act, APP 11 and the Notifiable Data Breaches scheme, and the Cyber Security Act 2024 ransomware payment reporting rules and the SOCI Act.
Every price on this site is an illustrative range built to show how the arithmetic works. It is not a market survey and not a quote from any provider. Use the ranges to sanity-check proposals and to ask better questions, then replace them with the figures in your own written quotes.
Prices, cost drivers and 2026 rules
Who must report a ransomware or cyber extortion payment within 72 hours, how the $3m turnover test works, what the report contains, enforcement in 2026 and SOCI Act incident reporting.
Prices, cost drivers and 2026 rules
What the ASD Essential Eight strategies and maturity levels are, how assessments and uplift projects are priced, an illustrative 40-person budget and the upkeep costs.
Prices, cost drivers and 2026 rules
How Australian MSSP, MDR, SOC, vCISO, pen-test and Essential Eight services are priced, what drives the cost, illustrative ranges and the 2026 rules to check.
Prices, cost drivers and 2026 rules
What managed EDR and patching, email security and managed firewall services include, how per-device and per-mailbox pricing works, and an 18-person example.
Prices, cost drivers and 2026 rules
How managed detection and response and SOC-as-a-service are priced in Australia, what log-volume tiers mean, and an illustrative costing for a 60-endpoint business.
Prices, cost drivers and 2026 rules
How pen-test quotes are built from tester days, what external, internal, web app and cloud tests cover, an illustrative scoping example and how to compare quotes fairly.
Prices, cost drivers and 2026 rules
When the Privacy Act applies to an Australian small business, what APP 11 requires, the 30-day breach assessment, who to notify, penalties and what to ask your provider.
Prices, cost drivers and 2026 rules
How virtual CISO services are priced (monthly retainers, day rates, fixed programs), typical deliverables, an illustrative 12-month budget and how to avoid paying for reports.
