Worked costings and choosing a provider
Managed security cost worked example: a 25-person office over three years
A line-by-line illustrative costing of MDR, firewall, pen testing and an IR retainer for a 25-person Australian office, with renewal uplift, growth, GST and a cheaper alternative.
For an illustrative 25-person Australian professional office, a managed security package built around 24/7 MDR costs about $36,100 ex GST in year one and about $107,000 over three years, once you include server cover, a managed firewall, an annual penetration test, an incident-response retainer, a 5% yearly renewal uplift and three extra staff from year two. That averages roughly $110 per user a month. A cheaper business-hours-only package saves $7,500 a year on the subscription line but leaves nights and weekends uncovered. The example shows how to build the numbers so you can repeat them with your own quotes; none of the prices come from a real provider.
This guide supports the selection method. The core of year one matches the default in the cost estimator. All figures are illustrative, ex GST unless stated.
The business
- 25 staff in one office in a capital city, some working from home two days a week.
- 25 laptops, 2 servers (file and line-of-business application), Microsoft 365, one firewall.
- Holds client personal and financial information; turnover about $5 million, so the Privacy Act applies and a ransomware payment would be reportable.
- An external IT support company handles help desk and projects in business hours.
- Its professional indemnity insurer and two larger clients have asked about MFA, backups and incident response.
Year one, line by line
| Line | Calculation | Year 1 |
|---|---|---|
| MDR bundle (EDR, 24/7 monitoring, identity alerts, email security) | 25 users × $50 × 12 | $15,000 |
| Server MDR | 2 × $55 × 12 | $1,320 |
| Managed firewall | 1 × $150 × 12 | $1,800 |
| Onboarding (one-off) | Fixed | $4,000 |
| Annual penetration test (external and internal) | Fixed scope | $9,000 |
| Incident-response retainer | Annual | $5,000 |
| Year-one total | $36,120 |
Check against the estimator: 25 users × $600 a year ($50 × 12) + $18,000 fixed extras (onboarding, pen test, retainer) = $33,000, plus the server and firewall lines of $3,120 = $36,120.
Years two and three
Assumptions: the provider applies a 5% renewal uplift on recurring fees each year, and the business grows to 28 users at the start of year two. Onboarding is not repeated; the pen test and retainer stay at the same price.
| Line | Year 2 | Year 3 |
|---|---|---|
| Recurring fees after 5% uplift | $18,120 × 1.05 = $19,026.00 | ($19,026.00 + $1,890.00) × 1.05 = $21,961.80 |
| 3 added users at the new price | 3 × $52.50 × 12 = $1,890.00 | Included above |
| Pen test | $9,000 | $9,000 |
| IR retainer | $5,000 | $5,000 |
| Year total | $34,916.00 | $35,961.80 |
Three-year total: $36,120 + $34,916 + $35,961.80 = $106,997.80 ex GST. GST adds $10,699.78 for cash-flow purposes, which a GST-registered business can usually claim back. Average users over the three years are (25 + 28 + 28) ÷ 3 = 27, so the average cost is $106,997.80 ÷ 36 months ÷ 27 users ≈ $110 per user a month.
To model your own renewal, use the uplift calculator and the renewal guide.
The cheaper alternative and what it leaves out
A business-hours managed endpoint and email package at an illustrative $25 per user a month instead of $50:
| MDR package | Business-hours package | |
|---|---|---|
| Subscription line, year 1 | $15,000 | $7,500 |
| Year-one total | $36,120 | $28,620 |
| Who reviews a 2 am Saturday alert | Provider's analyst, with authority to isolate the device | Nobody until Monday unless an automated rule blocks it |
| Identity (Microsoft 365 sign-in) alerts | Included | Often not included |
The $7,500 saving is real. The question is whether the business can accept an attack running for a weekend. For a firm holding client financial data with insurer and client questions to answer, the 24/7 option is likely the better fit; for a small business with little sensitive data and good backups, the cheaper option plus strong MFA and tested backups may be reasonable. Document the choice either way.
Costs that are easy to miss
- Internal time. Someone has to run onboarding, approve changes and read monthly reports. Budget a few hours a month.
- Remediation. The pen test finds issues; your IT company charges to fix them.
- Licence changes. If the MDR relies on a particular Microsoft 365 plan, upgrading licences is a separate cost.
- Incident costs beyond the retainer. Five thousand dollars of retainer may cover the first days of a serious incident. Know the hourly rate after that. See IR retainers.
- Backup. If backups are not in scope, add managed backup with immutable copies and regular restore tests.
Turning the example into your budget
- Replace the counts with yours.
- Replace each unit price with the figures in your written quotes.
- Add any lines your quotes include that are not shown here, and any gaps they leave out.
- Apply the renewal rule from each contract, not a guess.
- Compare the three-year totals and the cover side by side, then score them using the selection method.
Frequently asked questions
Is $110 per user a month typical?
It is an illustrative figure from this example, not a market average. Your figure depends on your scope, hours, response and extras. Use it to see the structure, not as a benchmark.
Should the pen test be in the managed security contract?
It can be bought separately, and an independent tester often gives more credible results. See pen-test cost and scope.
Can I deduct these costs?
Managed security fees are generally business expenses. Ask your tax agent about timing, especially for prepaid annual contracts.
What if we shrink?
Check whether the contract lets you reduce users at renewal or during the term. Many have minimum counts.
Sources
- ASD's Australian Cyber Security Centre — small business guidance and the Essential Eight
- Office of the Australian Information Commissioner — Privacy Act obligations for businesses over $3 million turnover
- business.gov.au — budgeting and cyber security resources
- Australian Taxation Office — GST credits and business deductions
