What small business cybersecurity really costs, line by line

The short answer

As of 2026, most small businesses spend somewhere between a few dollars and a few hundred dollars per user per month on cybersecurity, depending on whether they buy tools and run them in-house or pay a provider to manage them. Digacore’s 2026 budget guide, written by a managed security provider, puts managed security at roughly $50 to $250 per user per month for most small businesses (more for a very broad scope), and suggests total budgets of about $500 to $2,500 a month for 1 to 25 employees and $2,500 to $10,000 a month for 26 to 100 employees.

Datapath’s 2026 guide prices security-forward managed IT, which bundles help desk with endpoint detection, backup validation and identity controls, at about $200 to $400 per user per month. Both guides come from providers, so treat the figures as a sanity check, not a quote. The rest of this article breaks the number into line items and shows what to buy first.

What you are actually paying for

Security spending is not one product. It is a handful of line items, and most quotes are some combination of these.

1. Identity protection. Multi-factor authentication (MFA), conditional access and single sign-on. Often included in your Microsoft 365 or Google Workspace plan, but only if you buy the right tier.
2. Endpoint protection. Next-generation antivirus plus endpoint detection and response (EDR) on every laptop, desktop and server.
3. Email security. Filtering for phishing and malicious attachments, link scanning and impersonation protection.
4. Backups. Copies of Microsoft 365 or Google data, file shares and servers, kept somewhere ransomware cannot reach, with restores tested.
5. Patching and device management. Keeping Windows, macOS, browsers and business apps updated, and being able to lock or wipe a lost laptop.
6. Password management. A business password manager so staff stop reusing passwords.
7. Security awareness training. Short lessons and phishing simulations.
8. Monitoring and response. Someone who watches alerts and acts on them. This is the most expensive line, because it is labor.
9. Policies and paperwork. A written incident response plan, access reviews and help with cyber insurance questionnaires.

Real list prices for core tools

Vendor list prices give you a floor. These are published prices as of 2026 for widely used small business tools.

• Microsoft Defender for Business (EDR and next-generation antivirus): $3.00 per user per month standalone, covering up to five devices per user, according to Microsoft’s product page.
• Microsoft 365 Business Premium: $22.00 per user per month with Teams. Microsoft says it includes Defender for Business and Intune for device management, so many offices already pay for EDR without knowing it.
• Bitwarden Teams password manager: $4 per user per month billed annually, with Enterprise at $6, per Bitwarden’s pricing page.

Software alone for a 30-person office can therefore start in the low hundreds of dollars a month. The gap between that and the managed ranges above is the cost of people: setting tools up correctly, watching alerts, patching, testing restores and responding when something happens.

A worked example: a 30-person office

Take a 30-person professional services firm on Microsoft 365 Business Standard with laptops, one office and no servers. Here is how a realistic budget builds up, using the list prices above.

• Moving to Business Premium adds the difference between the two plans per user and brings EDR, device management and conditional access with it.
• A password manager at $4 per user adds about $120 a month.
• Cloud backup for Microsoft 365 data adds a per-user fee that varies by vendor and retention.
• Training and phishing simulations add a small per-user fee, or come bundled with a managed plan.
• Someone to configure, patch, monitor and respond is the largest line. At Digacore’s 26 to 100 employee range, the total lands somewhere between $2,500 and $10,000 a month.

The firm’s actual number depends on how much of that labor it already covers with its own staff and how much monitoring it wants outside business hours.

What pushes your number up or down

• Headcount and devices. Most security is priced per user or per endpoint.
• Regulated data. Health records, financial data and client legal files bring extra controls and documentation. Digacore’s guide prices compliance add-ons at $25 to $100 per user per month.
• Monitoring hours. Business-hours monitoring costs less than round-the-clock managed detection and response (MDR).
• Servers and old systems. On-premises servers, end-of-life Windows machines and custom software take more work to protect.
• Starting point. A tidy Microsoft 365 tenant with MFA already enforced costs less to secure than one with shared logins, old admin accounts and no backups.
• Insurance requirements. Your cyber insurer may require specific controls, such as EDR and tested backups, before it will renew.

Not sure which of these you already have? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your cybersecurity, business continuity and technology spending, including licenses you pay for but do not use, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

What to buy first

If the budget is tight, spend in this order. Each step closes a common way attackers get in.

1. Enforce MFA everywhere, starting with email, remote access and admin accounts. Usually no extra cost.
2. Back up and test a restore. The 2026 Verizon Data Breach Investigations Report, as summarized by the Cyber Readiness Institute, found 69 percent of small and midsize victims refused to pay ransoms, largely because they had reliable backups. See our backup and disaster recovery guide.
3. Put EDR on every device and turn on automatic updates.
4. Lock down email: filtering, external-sender tags and SPF, DKIM and DMARC records.
5. Roll out a password manager and remove leavers the same day.
6. Train staff with short sessions and phishing simulations.
7. Add monitoring once the basics are in place, so alerts actually reach a person.

Is it worth the money?

Compare the monthly cost with the price of an incident. Sophos’s State of Ransomware 2026 report, which surveyed organizations with 100 to 5,000 employees, put the average cost to recover from an attack at $1.7 million per incident. Smaller firms will usually see smaller numbers, but downtime, lost billing and rebuild costs add up quickly.

Email fraud is the bigger risk for many offices. The FBI’s 2025 Internet Crime Report recorded about $3.05 billion in business email compromise losses from 24,768 complaints, an average of over $120,000 each. One stopped wire transfer can pay for years of security.

How to compare security quotes

1. Ask each provider to list every tool by name and say whether its license is included.
2. Ask who watches alerts, during which hours, and what they do without calling you first.
3. Ask how often backups are test-restored and whether you get the results in writing.
4. Ask what happens during an incident: is response included, billed hourly or excluded?
5. Ask for the one-time onboarding cost separately from the monthly fee.

JLB USA provides cybersecurity services for businesses with roughly 25 to 100 employees, priced on users, locations, systems and support needs. If you are also weighing broader IT support, our guide to managed IT costs explains how those quotes are built.

Keep reading

• Cybersecurity checklist for small business: 30 items in priority order
• How to protect against ransomware: the controls that work for small businesses
• Google Workspace security best practices for small businesses
• HIPAA IT requirements for small medical practices in 2026

Related services

• Cybersecurity services
• Free Technology Health Assessment
• Cyber insurance requirements in 2026
• Managed IT services