Prices, cost drivers and 2026 rules
Managed endpoint, email security and firewall pricing for small businesses
What managed EDR and patching, email security and managed firewall services include, how per-device and per-mailbox pricing works, and an 18-person example.
Managed endpoint security is normally priced per device (endpoint) each month, managed email security per mailbox each month, and a managed firewall per firewall or per site each month, sometimes with the hardware bought or leased separately. For a small office these three services are the foundation: they cover the devices people use, the inbox where most attacks start, and the connection to the internet. In the illustrative 18-person example below, the three together cost about $6,900 a year ex GST, or around $32 per user a month, before any 24/7 monitoring.
This guide is part of the pricing overview. If you need round-the-clock detection and response, read MDR and SOC pricing next. All figures are illustrative, ex GST.
Managed endpoint security: what you are paying for
"Managed endpoint" covers a range of services. Ask which of these are included:
| Component | What it does | Why it matters |
|---|---|---|
| EDR or next-generation antivirus agent | Detects and blocks malicious files and behaviour on the device | The last line of defence when a user clicks something |
| Patch management for the operating system | Applies Windows, macOS and Linux updates on a schedule | Patching operating systems is one of the Essential Eight strategies |
| Patch management for applications | Updates browsers, PDF readers, Office and common apps | Also an Essential Eight strategy; often weaker than OS patching |
| Device configuration (hardening) | Applies baseline settings, disables risky features | Reduces the attack surface |
| Disk encryption management | Ensures laptops are encrypted and keys escrowed | Limits harm if a laptop is lost, relevant to privacy obligations |
| Alert handling | Someone reviews and acts on alerts | Check hours: business hours only is common at this level |
The agent software may be included in the provider's price or licensed by you (some Microsoft 365 business plans include endpoint and email security features, for example). Two quotes can differ by the licence alone, so ask each provider to show licence and management as separate lines.
Servers usually cost more per device than laptops, because they need more careful patching windows and monitoring. Mobile phones and tablets may be covered by a separate mobile device management fee.
Managed email security
Email security services filter incoming mail for phishing, malware and spoofing, rewrite or check links, sandbox attachments and sometimes add a banner on external messages. Pricing is per mailbox per month, with shared mailboxes sometimes free and sometimes charged.
What email filtering cannot do on its own is stop payment redirection fraud, where a real supplier's mailbox is compromised and genuine-looking bank detail changes arrive. That needs process controls: call-back verification on a known number before changing any payee details, and dual approval for payments. Ask the provider whether the service checks for lookalike domains and display-name impersonation, and whether it helps you set up SPF, DKIM and DMARC records for your own domain.
Security awareness training and simulated phishing are often sold alongside email security, per user per month or per year.
Managed firewall and network security
| Model | How it is priced | Watch out for |
|---|---|---|
| Firewall bought outright, provider manages it | One-off hardware cost plus monthly management fee per device | Subscription licences for threat feeds, renewal every 1–3 years |
| Firewall leased as a service | Monthly fee covering hardware, licences and management | Minimum term; what happens to the device at the end |
| Cloud-delivered network security (SASE, secure web gateway) | Per user per month | Suits remote staff; check coverage of office devices without users (printers, cameras) |
A managed firewall fee typically covers configuration changes, firmware updates, monitoring for outages and sometimes log review. Check how many change requests a month are included and the charge for more.
Illustrative costing: an 18-person office
| Line | Calculation | Monthly | Annual |
|---|---|---|---|
| Managed EDR and patching | 22 endpoints × $14 | $308 | $3,696 |
| Email security | 18 mailboxes × $5 | $90 | $1,080 |
| Managed firewall | 1 × $120 | $120 | $1,440 |
| Awareness training and phishing simulation | 18 × $3 | $54 | $648 |
| Recurring total | $572 | $6,864 |
Per user that is $572 ÷ 18 = $31.78 a month. If the firewall hardware is bought outright for an illustrative $2,400, spread over a four-year life it adds $600 a year, or about $2.78 per user a month. With GST of 10%, the annual recurring cost is $7,550.40 for cash flow; a GST-registered business can usually claim the GST back.
Use the cost estimator with the "managed endpoint and email security" band to run your own head count.
Where these services fall short
These services lower the chance of a successful attack, but they leave gaps that cause real incidents:
- No one watching overnight. If alerts are reviewed only in business hours, a Friday night intrusion may run until Monday. See 24/7 monitoring gaps.
- Accounts, not devices, are attacked. Stolen Microsoft 365 credentials do not touch the endpoint. MFA and identity monitoring matter as much as EDR.
- Backups. Regular, tested backups, including an offline or immutable copy, are an Essential Eight strategy and are often outside a "managed security" scope. Ask who tests restores and how often.
- Unmanaged devices. Personal devices, a reception PC or a warehouse tablet left off the list are common entry points.
Frequently asked questions
Is per-device or per-user pricing better?
Per device suits businesses where several staff share devices; per user suits businesses where each person has a laptop and a phone. Convert both to a yearly figure for your actual counts.
Do I still need email security if I use Microsoft 365 or Google Workspace?
Both platforms include filtering, and some plans include advanced features. A managed service may add configuration, monitoring and impersonation controls. Check what your plan already includes before paying twice.
How often should patching happen?
The Essential Eight maturity model sets time frames that tighten at higher maturity levels, with faster patching where a vulnerability is critical or being exploited. Ask your provider which maturity level its patching schedule targets.
Can a provider manage a firewall I already own?
Usually yes, if the model and its licences are supported. Expect an onboarding fee to review and document the current configuration.
Sources
- ASD's Australian Cyber Security Centre — Essential Eight patching and hardening guidance, small business resources
- Scamwatch — business email compromise and payment redirection scams
- business.gov.au — cyber security checklist for small business
