Public pricing. The way it should be.

Most small businesses in 2026 pay $50 to $250 per user per month for managed security. $100 to $150 buys monitoring, patching and endpoint protection; $225 to $350 buys full 24/7 detection and response. That is roughly $1,500 to $8,000 a month for a 10 to 50 person firm. Our Protect tiers are on this page: $25, $35 and $50 per user per month, minimum ten users.

Per-user pricing bundles monitoring, endpoint protection and response into one flat monthly fee, usually $50 to $250 per user in 2026, with compliance add-ons of $25 to $100 per user. Some providers price per device instead, $10 to $30 a month, which suits shared workstations or many servers. Ask what is excluded: incident response hours, compliance evidence and training are the common gaps. Ours includes a named Cyber Success Engineer.

The audit fee alone is $7,500 to $15,000 for a Type 1 and $12,000 to $20,000 for a Type 2 at a small company, rising to $50,000 or more for complex environments. A realistic first-year total including readiness work, tooling and staff time is $20,000 to $35,000 for most small SaaS firms. Renewal audits cost less because the groundwork is done.

A third-party HIPAA security risk analysis runs $2,000 to $10,000 for a small practice in 2026, with solo and small dental or medical offices often at $1,500 to $6,000. The HHS SRA Tool is free, but you do the work and own the result. A full program (policies, training, business associate agreements, ongoing monitoring) adds $3,500 to $18,000 a year for practices with 1 to 50 staff.

For Level 2, the third-party (C3PAO) assessment fee alone is $25,000 to $60,000 for a small, well-scoped environment and $60,000 to $120,000 or more for larger ones in 2026. Total first-cycle cost including remediation, tooling and enclave setup averaged about $138,000 for small businesses. Level 1 is self-assessed and costs a fraction of that. Third-party assessments are paused as of July 13, 2026 pending a DoD review; self-assessment and SPRS scoring still apply. Our gap readiness package starts at $6,000.

The median ransom demand in the 2026 DBIR was $139,875, before downtime, recovery, legal costs and lost customers. A year of managed security for a 20-person firm costs less than one incident, and insurers now charge two to three times more, or decline cover, for businesses without basics like multi-factor login and endpoint detection. Security is the cheaper option.

Yes. Monthly per-user plans are standard for small business security, and many providers discount an annual commitment. Watch for onboarding fees, minimum user counts and what happens to your logs and evidence if you leave. Every package starts with something free that gives you real information back.