Rs 25.5 crore is the average cost of a data breach in India in 2026, according to IBM, and 1.53 million dollars is what Sophos found ransomware recovery cost on average in 2025, before any ransom. Against those numbers, cyber security services are priced in four ways: per user per month, per device per month, per project, or as a managed monthly fee, and public price lists are rare, so small businesses should collect three written quotes and compare them line by line.
This guide explains how each service is priced and which numbers are solid. Before you ask for quotes, read the small business cyber security plan and the market map of cyber security companies.
How Are Cyber Security Services Priced?
| Service | Usual pricing unit | What drives the price |
|---|---|---|
| Password manager and MFA | Per user per month | Number of users, admin features |
| Endpoint protection | Per device per month | Detection level, managed or not |
| Email security | Per mailbox per month | Volume and filtering depth |
| Backup and recovery | Per GB or per device per month | Data size, retention, immutability |
| Security awareness training | Per user per year | Content, phishing drills, reporting |
| Managed detection and response | Per endpoint or per user per month | Hours covered, response actions |
| Penetration test | Per project | Scope, number of systems, depth |
| Security audit or compliance help | Per project or per day | Standard (such as ISO 27001), size |
| Cyber insurance | Annual premium | Revenue, controls, claims history |
Notice what is missing: rupee amounts. Prices change often, depend on volume and are negotiated. Treat any website that lists a single price for “cyber security” with suspicion.
What Does a Small Business Actually Need to Buy?
Most small firms need six things (our small business cyber security audit guide helps you check which you already have): multi-factor authentication, a password manager, endpoint protection, email filtering, tested backups and some training. Many of these are bundled into suites you may already pay for, so check your existing subscriptions before buying again.
A managed service becomes sensible when no one can watch alerts daily. Ransomware is a major loss to plan for, as set out in protecting your business from ransomware. A penetration test makes sense once you have the basics running, because testing a business with no multi-factor authentication only confirms what you already know. IBM’s 2026 India figures give the case for testing: offensive security work was the largest single cost reducer, at Rs 2.47 crore per breach on average.
How Do You Compare Quotes Fairly?
| Check | What to ask |
|---|---|
| Unit | Is the price per user, per device or per project? Convert all quotes to a yearly total |
| Scope | Which devices, users and locations are covered? |
| Hours | Is monitoring 24 hours or office hours only? |
| Response | What is the guaranteed response time, and is it in writing? |
| Set-up | Is there a one-time onboarding fee? |
| Term | What is the minimum contract, and what is the renewal rate? |
| Exit | Can you export your data and leave without a penalty? |
| Extras | What is excluded, and what does each add-on cost? |
Ask each supplier to quote the same fictional office, for example 15 staff, 18 laptops, one cloud email system and one file server. Equal inputs make unequal quotes visible.
What Do Cyber Security Costs Look Like Beside the Cost of an Attack?
A simple comparison keeps budgets honest. The example below uses made-up numbers for illustration, not market prices: if a firm spends Rs 6 lakh a year on prevention and the chance of a serious incident falls from 10 percent to 4 percent, and a serious incident would cost Rs 1 crore, the expected loss drops by Rs 6 lakh, which equals the spending, before counting the benefit of faster recovery. Use your own estimates and be conservative.
The real-world anchors are larger. Sophos found a 1.53 million dollar average recovery cost, and IBM’s India average is Rs 25.5 crore, although averages include far bigger firms than yours. Your own downtime cost per day is the figure to know, and our data breach response guide shows which costs to count.
Where Do Hidden Costs Appear?
• Onboarding and migration fees, which can exceed the first month’s service cost.
• Minimum terms of 12 to 36 months with automatic renewal.
• Response tiers, where faster response costs extra.
• Add-ons, such as extra log retention or additional mailboxes.
• Staff time, because even managed tools need someone inside to approve actions.
• Compliance work that the vendor says it supports but does not perform.
India adds one more point: CERT-In rules require reporting certain incidents within six hours, so ask any provider whether it will help you meet that deadline.
How Can You Spend Less Without Spending Badly?
1. Fix free and cheap basics first: updates, multi-factor authentication, backups, access reviews.
2. Use what you already own. Many business email and office suites include security features that are switched off.
3. Buy managed services only for the tasks you cannot staff.
4. Pay yearly for tools you will keep, if the discount is real and the exit terms are fair.
5. Review the stack every year and remove tools nobody uses. See the SaaS security best practices for a cloud-focused checklist.
