A fair amount of what materially reduces risk costs nothing but attention. Knowing which parts those are is the difference between spending well and spending a lot.
Cybersecurity pricing is opaque because the honest answer depends on what you already have. What follows is what actually drives the number, and which parts of it are free.
What costs nothing but time
Genuinely nothing. These are configuration changes to things you already pay for:
- SPF, DKIM and DMARC — DNS records that stop your domain being forged.
- Enforcing MFA, and blocking legacy authentication so nothing bypasses it.
- Removing local administrator rights from everyday accounts.
- Restricting who can consent to third-party apps reading company mail.
- Turning on unified audit logging, so an investigation has something to read.
- Removing accounts belonging to people who left.
If a provider quotes you a security project and none of the above is in it, ask why. This is the cheapest risk reduction available and it is frequently skipped because it is not billable hardware.
What genuinely costs money
- Licensing — some controls need a higher Microsoft 365 tier. Business Premium covers a great deal that businesses already own and do not use.
- Endpoint detection and response, per device per month.
- Backup with retention and immutability, per user per month.
- Security awareness training, per user per year.
- A business-grade firewall, if what you have is a consumer router, plus its ongoing licence.
- The engineering time to configure and maintain all of it.
What drives your number up or down
| Factor | Effect |
|---|---|
| Number of staff and devices | Most costs are per user or per device |
| Microsoft 365 tier you already hold | Business Premium removes several separate purchases |
| Legacy systems on the network | An unsupported server is the single most expensive thing to work around |
| Regulatory obligations | HIPAA or PCI adds evidence and documentation work |
| Cyber insurance requirements | Sets a floor on controls, whatever your own appetite |
| Whether anyone has done the basics | Starting from a clean Microsoft 365 tenant is far cheaper than untangling one |
Where we would start
An assessment first — not because it is billable, but because spending before you know what is already exposed is how businesses end up with expensive tools and an unenforced MFA policy.
Almost every assessment we run finds several controls the business is already paying for and has never switched on. That part of the work pays for itself immediately, and it is worth insisting on before anybody sells you anything.
Frequently asked
Why will nobody publish prices?
Because a number without knowing your environment is a guess, and the guess is always wrong in one direction or the other. What a provider should be willing to do is tell you plainly what drives the cost — which is what this page does — and give a firm number after looking.
Is there a minimum worth doing?
Yes. MFA enforced, email authentication published, backups that have been restore-tested, and no local admin rights on everyday accounts. That combination removes most of the risk a small business actually faces, and most of it is configuration rather than purchase.
Can we do this ourselves?
Parts of it, genuinely. The DNS records and the MFA enforcement are within reach of a technically confident owner, and we would rather you did them than left them undone. Conditional Access design and incident readiness are where experience earns its money.