Prices, cost drivers and 2026 rules
Managed cybersecurity service pricing in Australia: models, cost drivers and 2026 rules
How Australian MSSP, MDR, SOC, vCISO, pen-test and Essential Eight services are priced, what drives the cost, illustrative ranges and the 2026 rules to check.
Managed cybersecurity for an Australian small or mid-sized business is usually priced per user or per endpoint each month for protection and monitoring, by log volume for SOC or SIEM services, by retainer or day rate for advisory work such as a vCISO, and per engagement for penetration tests and Essential Eight uplift projects. What you pay depends far more on scope (how many devices, servers, cloud accounts and log sources), monitoring hours (business hours or 24/7) and how much response work is included than on the provider's brand. In the illustrative example below, a 40-person business pays about $45,000 a year ex GST, or roughly $94 per user a month, for a reasonably complete package.
This is the pillar guide for prices and rules. Each service type has its own deeper guide, linked in the sections below. All dollar figures on this page are illustrative ranges to show how the arithmetic works. They are not quotes and not a market survey. Replace them with figures from your own written proposals.
The pricing units you will see
Providers combine several units in one proposal. Splitting a quote back into these units is the first step to comparing it.
| Unit | Typical services | What makes it go up |
|---|---|---|
| Per endpoint per month | Managed EDR, patching, MDR | Number of laptops, desktops and servers; servers often cost more |
| Per user per month | Bundles, email security, identity monitoring, awareness training | Number of people with accounts, including part-timers and contractors |
| Per device or site per month | Managed firewall, SD-WAN, SASE | Number of sites, firewall model, high-availability pairs |
| Per GB of logs or per log source | SOC-as-a-service, managed SIEM | Data ingested each day, retention period, number of sources |
| Monthly retainer or day rate | vCISO, compliance support, Essential Eight advice | Days per month, seniority, board reporting |
| Fixed price per scope | Penetration tests, maturity assessments | Number of IP addresses, applications, user roles, test type |
| Annual retainer or prepaid hours | Incident response | Guaranteed response time, hours included, after-hours rates |
A per-user bundle looks simple, but it often hides the same components. Ask the provider to show what is inside the bundle and what would cost extra: servers, cloud workloads, a second site, additional log sources, or incident response beyond containment.
Illustrative price ranges by service type
The ranges below are illustrative, ex GST, for a small or mid-sized Australian business. They are deliberately wide because scope varies so much.
| Service | Illustrative range | Deeper guide |
|---|---|---|
| Managed endpoint (EDR and patching) | $8–$25 per endpoint a month | Endpoint, email and firewall |
| Managed email security | $3–$10 per mailbox a month | Same guide |
| Managed firewall | $80–$350 per firewall a month | Same guide |
| MDR with 24/7 monitoring | $12–$35 per endpoint a month | MDR and SOC |
| SOC-as-a-service / managed SIEM | $1,500–$6,000 a month for a small environment, rising with log volume | Same guide |
| vCISO | $2,500–$9,000 a month for 2–6 days | vCISO retainers |
| Penetration test | $8,000–$30,000 per engagement for a typical SMB scope | Pen-test cost and scope |
| Essential Eight assessment and uplift | $5,000–$20,000 to assess; $20,000–$120,000 to uplift | Essential Eight uplift |
| Incident-response retainer | $5,000–$30,000 a year | IR retainers |
The main cost drivers
- Scope. Every device, server, cloud tenant and log source in scope adds cost. Anything left out is unprotected, so cheaper is not better if it means a smaller scope.
- Monitoring hours. Business-hours monitoring is cheaper, but most ransomware is launched outside business hours. A "24/7" label needs checking: who actually looks at an alert at 2 am on a Sunday? See 24/7 monitoring gaps.
- Response authority. A provider allowed to isolate a laptop or disable an account immediately costs more than one that only emails you. It is usually worth it.
- Log volume and retention. SOC pricing scales with data. Keeping logs for 12 months instead of 90 days can multiply storage charges.
- Tool licensing. Some providers include the security software; others expect you to buy licences (for example through your Microsoft 365 plan) and charge only for management. Two quotes can differ by this alone.
- Compliance requirements. Customers, insurers or government contracts that ask for a specific Essential Eight maturity level, ISO/IEC 27001 alignment or onshore data handling narrow the field and raise the price.
- Contract term. Multi-year terms often come with a lower monthly rate but a longer lock-in. Model the renewal uplift before signing.
Worked example: a 40-person business (illustrative)
A 40-person professional services firm has 45 endpoints, 3 servers, one firewall, Microsoft 365 and a mix of office and remote staff. All figures ex GST and illustrative.
| Line | Calculation | Annual |
|---|---|---|
| MDR on endpoints | 45 × $20 × 12 | $10,800 |
| Server monitoring | 3 × $60 × 12 | $2,160 |
| Email security | 40 × $6 × 12 | $2,880 |
| Managed firewall | 1 × $150 × 12 | $1,800 |
| Identity (account) monitoring | 40 × $5 × 12 | $2,400 |
| vCISO, one day a quarter | 4 × $1,800 | $7,200 |
| Annual external and internal pen test | Fixed scope | $12,000 |
| Incident-response retainer | Annual | $6,000 |
| Total | $45,240 |
Per user, that is $45,240 ÷ 40 ÷ 12 = $94.25 a month. Adding 10% GST gives $49,764 for cash-flow planning; a GST-registered business can usually claim the $4,524 GST back. You can reproduce the core of this with the cost estimator, and the 25-person worked example builds a full three-year view.
Australian rules that shape what you buy in 2026
- Privacy Act 1988, APP 11. If the Act applies to you, you must take reasonable steps, including technical and organisational measures, to protect personal information. Most businesses with turnover of $3 million or less are exempt, with important exceptions. See the Privacy Act and NDB guide.
- Notifiable Data Breaches scheme. A suspected eligible data breach must be assessed within 30 days, and an eligible breach notified to the OAIC and affected individuals. Your provider's forensics support matters here.
- Cyber Security Act 2024. Businesses with turnover above $3 million must report a ransomware payment within 72 hours. See the ransomware reporting guide.
- SOCI Act 2018. Responsible entities for critical infrastructure assets have mandatory cyber incident reporting (12 hours for critical incidents, 72 hours for others). Most SMBs are not covered directly, but suppliers to them may face contract requirements.
- Criminal Code Part 10.7. Penetration testing needs proper authorisation. See pen-test authorisation.
- GST and unfair contract terms. GST of 10% applies to most services, and one-sided terms in standard-form small business contracts can be unfair and attract penalties.
Frequently asked questions
What is a reasonable per-user price for managed security?
It depends on the bundle. In the illustrative ranges on this site, basic managed endpoint and email security sits around $15–$35 per user a month, MDR bundles around $30–$70 and full managed security with SOC log monitoring around $60–$140. Compare the scope, not just the number.
Why do two quotes for the same business differ so much?
Usually because of scope, monitoring hours, response authority and whether software licences are included. Normalise quotes line by line before comparing; the selection guide shows how.
Are prices quoted with or without GST?
Business quotes are normally ex GST. Check every quote and invoice, and use the GST and uplift calculator to add 10%.
Can I start small?
Yes. Many businesses start with managed endpoint and email security plus MFA and backups, then add MDR and log monitoring. Prioritise the controls that cover the most common attacks; the Essential Eight is a good map.
Sources
- ASD's Australian Cyber Security Centre — Essential Eight, small business guidance, reporting
- Office of the Australian Information Commissioner — APP 11 and the Notifiable Data Breaches scheme
- Department of Home Affairs — Cyber Security Act 2024 and ransomware payment reporting
- Federal Register of Legislation — Privacy Act 1988, Cyber Security Act 2024, Criminal Code
- business.gov.au — cyber security checklists and support for small business
