How Much Does Managed Cybersecurity Cost?

Managed cybersecurity costs $2,000 to $10,000 or more a month for a full program, or about $9 to $50 per endpoint for 24/7 detection and response. Software is the small part of the bill. People are the rest.

Ask three providers what managed cybersecurity costs and you can get three answers that don't overlap. $25 a user. $200 a user. A calendar link. All three can be honest, because they're quoting different things.

Consilien's managed cybersecurity in Los Angeles is priced around one decision, and so is every number below. The watching part got cheap. Endpoint software that cost real money a decade ago now lists for a few dollars a device. What you pay for is a person looking at an alert at 2 a.m., deciding it's real, and having the authority to pull a laptop off the network before payroll gets wired somewhere it shouldn't. That's the decision.

What does managed cybersecurity cost per month?

A full managed security program runs $2,000 to $10,000 or more a month, endpoint-only detection and response costs roughly $9 to $50 per device, and compliance work like CMMC or SOC 2 gets quoted on its own.

Managed cybersecurity is an outside team that monitors your devices, accounts, email, and network around the clock and responds when something looks like an attack. You're renting the software, the analysts, and the playbook together, and the monthly price depends mostly on how much of your environment they watch and whether they act or just send you an email.

The floor has dropped further than people expect. Microsoft lists Defender for Business at $3 per user per month, and it's already inside Microsoft 365 Business Premium at $22. Huntress publishes its Managed EDR at $8.99 per endpoint, and that price includes a human-led security operations center (SOC) working around the clock to throw attackers off the machine. EDR, short for endpoint detection and response, is the software on each laptop and server that spots attacker behavior, and the SOC is the people reading what it finds. Ten years ago? Fantasy.

Turn the program range into per-user math and it lands between $40 and $200 per user for a 50-person company. That's the 5x spread you'll see in cybersecurity pricing across proposals. Nobody's lying. They're selling different hours.

Where does the money go, software or people?

For a 50-person company, the security software works out to about $923 a month at list price, under a fifth of a mid-range $5,000 quote. Analysts, coverage hours, and tuning the alerts to your business make up the rest.

Here's a 50-person company with 60 endpoints, priced out at public list rates with no discount and no provider in the middle.

ITDR stands for identity threat detection and response. It watches sign-ins to Microsoft 365 and similar accounts for the moment someone's password gets used from a place it shouldn't be. A SIEM, short for security information and event management, collects the logs from your firewall, email, and servers in one place so an analyst can see an attack that touches all three. A data source is just one of those feeds.

So call it $923 a month for the stack. Hold that against the $2,000 to $10,000 range above. Even at the bottom of it, the tools are under half the bill, and the rest is people, process, and the hours nobody wants to work, meaning nights, weekends, and the Sunday before a holiday when somebody signs in as your controller from another country.

Is that a ripoff? Not really. It's the expensive part, and it should be.

Software doesn't know your business. A rule that flags a sign-in from Mexico is noise if your CFO spends every March in Cabo, and a real attack if your controller has never left Ohio and is asleep in Columbus when it fires. Somebody has to learn those patterns, write them down, and keep updating them when you open an office or switch banks. That tuning work is invisible in a proposal, and it's most of what separates a provider that pages you about the same harmless backup job for a year from one that calls you twice, about real things.

Some companies can skip the full program. A 30-person firm with a sharp internal IT lead who reads the console every morning, picks up the phone at night, and has a written plan for what to do can run something close to that $923 stack and be in decent shape. If that's you, buy the tools and spend the difference on a tested backup.

Why does one quote come in at 5x another?

Scope and response authority. Two quotes can name the same software and still differ by thousands a month because one provider watches the laptop and emails you, and the other watches everything and acts.

Roughly in order of how much they move the number:

• Who acts. An MSSP (managed security service provider) traditionally monitors and alerts, and your own team investigates and fixes, per CrowdStrike's breakdown of MDR vs. MSSP. An MDR provider investigates and contains. Our comparison of MDR, MSSP, and SIEM walks through where each one stops.
• Hours. There are 8,760 hours in a year. Business-hours coverage watches about 2,000 of them. The rest go unwatched.
• What gets watched besides the laptop. Email, Microsoft 365 sign-ins, firewall, cloud apps, servers. More feeds, more analyst time.
• Log volume, if the SIEM is billed by the gigabyte. A chatty firewall can push the bill well past the quote.
• The pricing model itself. I like per-user pricing for offices. It falls apart on a warehouse floor, where the dock PC and two scanners belong to nobody and quietly drop off the count. Per-endpoint fixes that, then charges full freight for every server in the closet. And log pricing by data source? Four bucks a feed sounds like nothing, right up until IT connects the ERP (the system that runs orders, inventory, and invoicing), both branch firewalls, and payroll, and the bill climbs every time without anybody signing a change order.
• Pre-approved actions. Can the provider disable an account or isolate a server without calling you first? Faster, and priced accordingly.

That last one gets skipped in sales calls, and it's the one that decides how a Saturday night goes. If you're still sorting out the labels, MSP vs. MSSP and EDR vs. MDR vs. XDR cover the vocabulary without the sales gloss.

Per user, per endpoint, or per data source: which pricing model is cheaper?

None. Each model just shoves the extra cost onto a different line, which is why every proposal needs boiling down to one per-user, per-month number first.

Say a 50-person company gets these two:

On paper, B saves $1,510 a month. But B doesn't watch Microsoft 365 sign-ins, and that's the door the most common loss walks through. Find out what closing that gap costs before you call B the cheaper quote.

What isn't in the monthly price?

Setup fees, for starters. Then incident response past the first few hours, rebuilding machines, pen tests (paid, controlled break-in attempts), a vCISO (a part-time, outsourced security leader), and compliance, any of which can land on a separate invoice.

Go down this list with every provider:

• Onboarding. Some providers charge a one-time setup fee to install the monitoring software on each machine, connect logs, and tune alerts. Others spread it over the first few months.
• Incident response hours. Containment is in the rate. A two-week forensic investigation after a breach often isn't.
• Remediation. Who wipes and reinstalls the 14 infected laptops, and is that billed hourly?
• Log retention past 90 days, which some cyber insurers and auditors now ask about.
• Penetration testing, almost always billed as its own annual or one-time project.
• Security leadership. A vCISO typically runs $3,000 to $20,000 a month and is its own line.
• Training beyond the basics. Phishing simulations are cheap, but security awareness training costs climb with custom content and reporting.

Compliance is its own service. Getting audit-ready for CMMC, PCI, or SOC 2 means gap assessments, policies, and evidence. Paperwork, mostly. None of that is what a monitoring team does at night. At Consilien it's scoped separately, as described in what compliance services include. Any quote that folds it into a monitoring rate deserves a second read.

What would it cost to build this in-house?

One around-the-clock analyst seat costs about $775,000 a year in pay and benefits before any software. Covering all 8,760 hours of the year takes roughly 4.2 full-time people.

The math is short. The BLS puts the median information security analyst at $129,180 as of May 2025. Wages make up 70.0% of private-sector employee compensation, per the BLS employer cost survey for June 2026, so a loaded analyst costs about $184,500. Multiply by 4.2 to keep one chair filled through nights, weekends, vacations, and the flu, and you're at roughly $775,000. One hire covers less than a quarter of the hours in a year. Barely the day shift.

And that's if you can find them. ISC2's 2025 workforce study found 95% of security teams report at least one skills need, with 59% calling theirs critical or significant. Good analysts have options.

With a security lead and two analysts already on staff, you aren't buying a program. You're buying nights and weekends, and you should price it exactly that way. The full math on staffing an operations center is in in-house SOC vs. SOC-as-a-Service cost.

Does managed cybersecurity cost more in California?

A little. Less than you'd guess, though. BLS puts the median security analyst at $138,570 statewide, about 7% above the national figure, but the Los Angeles metro sits at $129,630, almost exactly the national median. And because a 24/7 operations center isn't tied to your zip code (Consilien's runs out of multiple U.S. locations), a California address moves MSSP cost a lot less than it moves a local hire's salary. What moves California quotes is scope, things like multi-site operations, defense supply chain work, or payment data. If you're comparing local options, our ranking of the top cybersecurity service providers in Los Angeles lists who does what.

What are you actually paying to avoid?

Mostly email fraud, not Hollywood ransomware. Price your coverage against the loss you're most likely to have, then check it against the one that would hurt most.

Coalition's 2026 Cyber Claims Report found business email compromise and funds transfer fraud made up 58% of the incidents its policyholders reported in 2025. Business email compromise is when someone gets into, or convincingly fakes, an email account and uses it to redirect money, usually by changing the bank details on a real invoice the same week it's due. Funds transfer fraud is the wire that goes out because of it. Coalition says 52% of those started in an inbox. The FBI counted $3.05 billion in reported business email compromise losses in 2025. That's just what got reported.

Ransomware is rarer and nastier. Coalition puts the average ransomware claim at $269,000, against $116,000 across all claims. And for the worst case, IBM's 2026 Cost of a Data Breach Report puts the average U.S. breach at $11.5 million. Treat that as a ceiling. It isn't a forecast for a 50-person firm.

Plenty of proposals are heavy on endpoint protection, which is ransomware defense, and thin on account and email monitoring, which is where the frequent loss starts. That's backward for a company whose accounts payable team moves six figures a week by email. Shifting money to the right line does more than adding it, and the cyber insurance requirements checklist is a decent map of which lines underwriters already check. The real cost of a ransomware attack covers the other side.

How do you tell if a quote is too cheap?

Ask five questions. If the provider can't answer them in plain language, the low price is missing scope, not overhead.

• When an analyst sees a live attack at 2 a.m., what can they do without calling me?
• Which of my systems send logs to you, and which don't?
• Is Microsoft 365 sign-in monitoring included, or an add-on?
• What happens after containment, and what does it cost by the hour?
• How do I leave, and do I keep my logs and configurations when I do?

Alert-only providers aren't wrong. Just different. They need a team on your side ready to act on those alerts at any hour. If that team doesn't exist, look at managed detection and response instead.

Turning the range into your number

Ranges are as far as a pricing article goes, because it can't count your endpoints, see which systems already send logs, or tell whether your accounts payable team approves wires over email.

Consilien is a managed IT and cybersecurity provider headquartered in Torrance, California, working with businesses nationwide. Its IC24 Managed Cybersecurity service covers managed SIEM, a 24/7 U.S.-based security operations center, and threat detection and response, with compliance sold as its own service. Getting from this range to a real quote starts with a look at your environment, and our breakdown of what a cybersecurity assessment costs covers what a full assessment includes. If you'd rather start by walking through what you're paying now, speak to a cybersecurity expert.