Public pricing. The way it should be.

It depends on what you buy: monitoring and endpoint protection on their own, or 24/7 detection and response with people behind it. Ours is on this page: Protect Autonomous is $25 per user per month: AI-powered monitoring with AccuSights SOC engineers on duty 5 days a week, 10 hours a day, and for emergencies any time. Protect Guided adds guided remediation with your IT provider and a monthly review for $35; Protect Always-On puts engineers on around the clock for $50. Every plan includes an engineer call on any critical finding. Minimum ten users.

Per-user pricing bundles monitoring, endpoint protection and response into one flat monthly fee, sometimes with compliance as an add-on. Some providers price per device instead, which suits shared workstations or many servers. Ask what is excluded: incident response hours, compliance evidence and training are the common gaps. Ours includes a named Cyber Success Engineer.

The audit fee alone is $7,500 to $15,000 for a Type 1 and $12,000 to $20,000 for a Type 2 at a small company, rising to $50,000 or more for complex environments. A realistic first-year total including readiness work, tooling and staff time is $20,000 to $35,000 for most small SaaS firms. Renewal audits cost less because the groundwork is done.

A third-party HIPAA security risk analysis runs $2,000 to $10,000 for a small practice in 2026, with solo and small dental or medical offices often at $1,500 to $6,000. The HHS SRA Tool is free, but you do the work and own the result. A full program (policies, training, business associate agreements, ongoing monitoring) adds $3,500 to $18,000 a year for practices with 1 to 50 staff.

For Level 2, the third-party (C3PAO) assessment fee alone is $25,000 to $60,000 for a small, well-scoped environment and $60,000 to $120,000 or more for larger ones in 2026. Total first-cycle cost including remediation, tooling and enclave setup averaged about $138,000 for small businesses. Level 1 is self-assessed and costs a fraction of that. Third-party assessments are paused as of July 13, 2026 pending a DoD review; self-assessment and SPRS scoring still apply. Our gap readiness package starts at $6,000.

The median ransom demand in the 2026 DBIR was $139,875, before downtime, recovery, legal costs and lost customers. A year of managed security for a 20-person firm costs less than one incident, and insurers now charge two to three times more, or decline cover, for businesses without basics like multi-factor login and endpoint detection. Security is the cheaper option.

Yes. Monthly per-user plans are standard for small business security, and many providers discount an annual commitment. Watch for onboarding fees, minimum user counts and what happens to your logs and evidence if you leave. Every package starts with something free that gives you real information back.