How Much Does Cybersecurity Cost for a Small Business?

“How much should we spend on security?” is one of the hardest questions a small business owner can ask, because the honest answer is “it depends.” But “it depends” doesn’t help you write a budget.

This guide breaks cybersecurity spending into 3 buckets you can actually price: tools, services and training. It explains how each one is usually billed, shows real list prices where vendors publish them and gives you a template to estimate your own number. Prices change often, so treat every figure here as a starting point and check current vendor pages before you buy.

What drives the cost of cybersecurity

Before you look at prices, understand the 5 factors that move your number up or down:

• Headcount and devices. Most security tools are billed per user or per device, so a 5-person office and a 50-person office have very different bills.
• The data you hold. Payment card data, health information, tax records and customer financial data raise both your risk and your compliance obligations.
• Compliance requirements. Rules such as the FTC Safeguards Rule for many financial businesses, HIPAA for health data and PCI DSS for card payments can require specific controls, documentation and testing.
• Do-it-yourself vs outsourced. Doing it yourself costs less cash but more of your time. Managed providers cost more but bring expertise and monitoring.
• What you already pay for. Many business software subscriptions already include security features you may not be using.

The last point matters more than most owners realize. Your first budget step should be finding what’s already included.

Bucket 1: security tools

Tools are the software and hardware that do the protecting. Most are subscriptions.

Endpoint protection

Endpoint protection (antivirus plus detection and response) runs on every laptop and desktop. Windows includes Microsoft Defender Antivirus at no extra charge. Business-grade products add central management, alerts and response tools. As an example of list pricing, Microsoft lists Defender for Business as a standalone product at $3.00 per user per month, paid yearly.

Productivity suites with security built in

Your email and office suite may already cover several tools. Microsoft 365 Business Premium, listed at $22.00 per user per month on an annual plan, includes Defender for Business and Intune Plan 1 device management. If you’re already paying for a lower tier, upgrading can be cheaper than buying separate tools. Google Workspace plans also include security controls that vary by tier.

Password managers

A business password manager is one of the best-value tools you can buy. Published list prices for business plans, billed annually, include Bitwarden Teams at $4 and Enterprise at $6 per user per month, and 1Password Business at $8.99 per user per month. Smaller team bundles are sometimes available.

Backup

Backups are your recovery plan for ransomware and hardware failure. Pricing models include per computer, per user or per terabyte stored. For example, Backblaze lists its Business Backup at $99 per computer per year. Backups for Microsoft 365 or Google Workspace data, servers and line-of-business apps are usually priced separately.

Network security

Your firewall may be the router you already have, or a dedicated business firewall bought as hardware plus an annual subscription for updates and security features. Replacing an unsupported router or firewall is a common one-time cost. Our guide to what a firewall is explains what a small office actually needs.

Free tools worth using

Some valuable security tools cost nothing:

• Multifactor authentication built into email, banking and cloud apps
• Device encryption such as BitLocker or Device Encryption on Windows and FileVault on Mac
• Automatic updates in every major operating system
• CISA’s free Cyber Hygiene Services, including vulnerability scanning for eligible organizations
• Free guidance from CISA, the FTC and NIST

Bucket 2: security services

Services are the people who set up, watch and fix your security. This is often the largest line in the budget, and the most variable.

Vendors rarely publish standard prices for these services because scope varies so much. Get at least 2 or 3 written quotes, and ask each provider exactly which tools, hours and response times are included. Our guide to choosing a managed IT service provider lists the questions to ask, and weighing IT outsourcing against in-house staff helps you decide whether to hire.

Bucket 3: training

People are part of your security system. Training costs come in 3 forms:

• Security awareness platforms billed per user per year, which include short lessons and simulated phishing emails.
• Free materials from CISA, the FTC and others that you deliver yourself.
• Staff time. Even 15 minutes a month per employee is a real cost, and the most important one to plan for.

You don’t need an expensive platform to start. A simple monthly lesson plus quarterly phishing tests can be very effective. Our guide to security awareness training shows how to run a year-round program.

Key takeaway: Start by maximizing what you already pay for, then spend on the controls that prevent the most common attacks: MFA, a password manager, endpoint protection, tested backups and staff training. Expensive services make more sense once those basics are in place.

A sample budget for a 10-person office

Here is an illustrative tools budget using the published list prices above for a 10-person business that handles the IT itself. Your actual costs will vary by vendor, plan, discounts and taxes.

Add to that:

• Training: a platform subscription or the cost of your own time using free materials.
• Services: quotes from an MSP or MSSP if you outsource management or monitoring.
• Hardware: a replacement firewall or router if yours is out of support.
• Cyber insurance: premiums vary by industry, revenue, coverage limits and the controls you have in place.

If you already pay for Microsoft 365 Business Premium, endpoint protection and device management are included in that subscription, so you wouldn’t buy them twice.

What it costs to do nothing

The cost side of the ledger is only half the picture. The FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025 with reported losses of about $20.9 billion, a 26% increase over 2024. Business email compromise alone accounted for about $3.05 billion in reported losses. The FBI notes that these figures understate actual losses because many victims don’t report.

For a small business, an incident can mean lost revenue during downtime, recovery and legal costs, customer notification, higher insurance premiums and lost trust. Strong basics also matter when you buy insurance: carriers commonly ask about controls such as MFA and backups before quoting. See what cyber insurance companies require.

Where to start: build your budget in 5 steps

1. Inventory users, devices and subscriptions. Count how many people and devices need protection, and list every software subscription you pay for.
2. Find what’s included. Check your email and office suite plan for built-in security, device management and backup features.
3. Fill the essential gaps. Price MFA (usually free), a password manager, endpoint protection and backup using the per-user model.
4. Decide what to outsource. Get 2 or 3 quotes for managed IT or monitoring if you don’t have the time or skills in-house.
5. Add training and a reserve. Budget for training time and set aside money for hardware replacement and incident response.

Then work through our small business cybersecurity checklist to make sure the tools you buy are actually configured.

Conclusion

There is no single right number for small business cybersecurity, but there is a reliable way to find yours. Price the 3 buckets separately: tools on a per-user basis, services by quote and training by time. Start with what you already own, cover the essentials that stop the most common attacks and add managed services as your risk and size grow. A modest, well-spent budget protects far better than an expensive tool nobody configures.

Sources

• Microsoft: Defender for Business — standalone list price and inclusion in Microsoft 365 Business Premium
• Bitwarden: Business pricing — Teams and Enterprise list prices
• 1Password: Business pricing — Business plan list price
• Backblaze: Computer Backup pricing — Business Backup price per computer
• FBI IC3: 2025 Internet Crime Report — 2025 complaint counts, total losses and business email compromise losses
• CISA: Small and Medium-Sized Business Resources — free tools and Cyber Hygiene Services