Managed security services pricing: models, cost drivers and how to compare quotes
Group COO & CISO
Operational excellence, governance, and information security. Aligns technology, risk, and business outcomes in complex IT environments
Managed security services pricing usually follows one of four models: per user, per device or endpoint, by log volume, or tiered packages, plus one-off onboarding fees. What you pay depends on how many users and log sources are covered, whether the provider only alerts or also responds 24/7, how long data is retained and what compliance reporting you need.
Key takeaways
- Compare quotes on the same scope: identical users, endpoints, log sources, retention and response level. Most "cheap" quotes cover less.
- Log volume is the cost driver most buyers underestimate. SIEM platforms such as Microsoft Sentinel and threat detection services such as Amazon GuardDuty bill by data analysed, and providers pass that on.
- The biggest price differences come from response: an alert-only service costs far less than MDR that contains threats at night.
- Ask what is excluded: incident response beyond a set number of hours, forensics, new integrations, penetration testing and extra retention are common extras.
- Weigh the price against the cost of an incident. IBM puts the 2025 global average cost of a data breach at USD 4.44 million.
What are you paying for?
A managed security service bundles three things into one fee: people (a 24/7 security operations centre), platforms (SIEM, EDR/XDR, vulnerability scanning) and process (runbooks, reporting, service management). How a provider splits and charges for these explains most of the price differences you will see.
| Service level | What it includes | Who responds | Relative cost |
|---|---|---|---|
| Monitoring and alerting | Log collection, correlation, alert triage, notification | Your team | Lowest |
| Managed SIEM / SOC as a service | Provider runs and tunes your SIEM, investigates alerts, reports | Shared | Medium |
| Managed detection and response (MDR) | 24/7 detection, threat hunting, remote containment | Provider, within agreed rules | Medium to high |
| Fully managed security | MDR plus vulnerability management, device management, compliance reporting, service management | Provider | Highest |
Common pricing models for managed security services
Per user
A monthly fee for each employee or account, covering all their devices. It is simple and fits hybrid work where people use a laptop, phone and tablet. Check the fair-use limit on devices per user, and how shared workstations, kiosks and service accounts are counted.
Per device or endpoint
A fee per protected asset, often with different rates for workstations, servers, network devices and cloud workloads. It suits stable estates with good asset inventories. It is harder to apply with BYOD and autoscaling cloud resources, which is why fewer providers now use pure per-device pricing.
By log volume
Common for managed SIEM. The fee scales with the gigabytes per day (or events per second) the SOC ingests. The underlying platforms price this way: Microsoft offers Microsoft Sentinel as pay-as-you-go or as commitment tiers reserving 100 GB to 50,000 GB of daily ingestion, and AWS prices Amazon GuardDuty on the volume of logs, events and workloads analysed. Volume pricing is fair but can surprise you when a new firewall or verbose application doubles your logs.
Tiered packages
Bronze/silver/gold-style bundles with increasing coverage and response. They make comparison easy within one provider and hard across providers, because tier contents differ. Check the detail of each tier against your list of needs.
Hybrid and add-on pricing
Most real contracts combine a base fee (per user or device) with volume charges for logs, plus add-ons: incident response retainers in hours, penetration tests, security awareness training, and compliance reporting.
| Model | Best for | Advantages | Watch-outs |
|---|---|---|---|
| Per user | Office and hybrid workforces | Predictable, easy to budget, scales with headcount | Device limits; servers and cloud often priced separately |
| Per device | Stable, well-inventoried estates | Transparent per-asset cost | BYOD, autoscaling and IoT are hard to count |
| Log volume | Managed SIEM, cloud-heavy estates | Pays for what is monitored | Costs grow with noisy sources; needs log filtering |
| Tiered package | Smaller companies wanting a bundle | Simple to buy, clear upgrade path | May pay for services you don't need |
| Hybrid | Mid-size and enterprise | Fits complex estates | Harder to compare; ask for a total for your volumes |
What drives the price up or down?
- Scope: number of users, endpoints, servers, cloud accounts, SaaS tenants and network devices.
- Log sources and volume: identity, endpoint and cloud control-plane logs give the most value per GB; verbose network and application logs cost the most.
- Retention: how long logs stay searchable and archived. Investigations and audits may need months to years.
- Coverage hours and response: business hours versus 24/7, alert-only versus containment, and contracted response times.
- Tooling: whether EDR, SIEM and scanner licences are included or you bring your own.
- Compliance reporting: evidence packs for NIS2, ISO/IEC 27001, SOC 2, PCI DSS or sector rules take analyst time.
- Language, location and data residency: local-language analysts or EU-only data processing can cost more.
- Contract length: multi-year terms usually lower the monthly fee but reduce flexibility.
Costs that are easy to miss
Onboarding and integration
Deploying agents, connecting log sources, tuning detection rules and writing runbooks usually takes weeks and is often a separate one-off fee. Ask what is included and what a typical onboarding looks like for an estate your size.
Incident response
Many services include triage and remote containment but charge for full incident response, forensics or on-site work. Check whether a retainer is included and how many hours it covers.
Changes and new integrations
Adding a new cloud account, SaaS application or firewall may be billed as professional services. Ask for a rate card and the process.
Your own effort
Someone in your team still has to manage the provider, approve actions and fix root causes. Budget internal time, especially in a co-managed model.
Training and testing
Security awareness training, phishing simulations and penetration tests are often priced separately. They are worth having, so include them in the comparison rather than adding them later.
How to compare managed security quotes
Send every provider the same scope sheet and ask them to price against it. Then compare like for like:
| Line item | Ask each provider |
|---|---|
| Coverage | Which of our listed users, devices, cloud accounts and log sources are included? |
| Data volume | What daily log volume is assumed, and what does each extra GB cost? |
| Retention | How long are logs searchable and archived, and at what cost to extend? |
| Response | Contracted triage and response times per severity; which containment actions are included? |
| Incident response | Retainer hours included; hourly rate beyond that |
| Licences | Which tool licences are included, and who owns them at exit? |
| Onboarding | One-off fee, duration and deliverables |
| Reporting | Monthly report contents; compliance evidence included |
| Term and exit | Contract length, price changes, data return on exit |
Ask for a three-year total cost for your volumes, including expected growth. That number, not the headline monthly rate, is what to compare.
Is it worth it? Measuring value
Compare the annual cost of the service with what it would cost to staff a 24/7 SOC in-house (at least several analysts to cover shifts, holidays and turnover, plus tools) and with the cost of incidents. According to IBM's Cost of a Data Breach Report 2025, the global average breach cost USD 4.44 million and took 241 days to identify and contain, and organisations using security AI and automation extensively saved an average of USD 1.9 million per breach. Verizon's 2025 Data Breach Investigations Report found ransomware present in 44% of breaches, with a median ransom payment of USD 115,000.
Track these metrics once the service runs:
- Mean time to detect and mean time to respond, by severity.
- Share of critical log sources actually connected.
- False positive rate and number of escalations to your team.
- Time to close critical vulnerabilities.
- Audit findings related to monitoring and incident handling.
Negotiation tips
- Filter low-value logs before they reach the SIEM; it lowers volume charges without losing detection.
- Bring your own licences if you already own EDR or SIEM capacity, and ask for the price without them.
- Trade contract length for price, but keep a termination right if SLAs are missed repeatedly.
- Agree price review rules for growth, so adding 20 users does not trigger a new negotiation.
- Put service credits for missed response times in the contract.
How Opsio helps
Opsio offers managed security services and managed detection and response for AWS and Azure estates, including managed Microsoft Sentinel. Send us the scope sheet above and we can quote against it, so you can compare like for like. For typical cost questions, see our short answer on how much an MSSP costs.
For Opus Bilprovning, one of Sweden's largest vehicle inspection companies with nearly 100 stations, Opsio's managed security team handles proactive monitoring, change management and continuous security hardening as part of 24/7 managed operations on AWS. Read the Opus Bilprovning case.
Frequently asked questions
How much do managed security services cost?
It depends on users, devices, log volume, coverage hours, response level and compliance needs, so published price lists vary widely. Get quotes against the same written scope and compare three-year totals rather than headline monthly rates.
What is the most common MSSP pricing model?
Per-user and tiered packages are common for small and mid-sized companies; larger estates usually get a hybrid of a base fee plus charges for log volume and add-ons such as incident response retainers.
What hidden costs should I look for in an MSSP contract?
Onboarding fees, incident response beyond included hours, forensics, extra log volume or retention, new integrations, tool licences and exit costs such as data export.
How do compliance requirements affect managed security services pricing?
Frameworks such as NIS2, ISO/IEC 27001, SOC 2 and PCI DSS add longer log retention, more log sources and evidence reporting, all of which add analyst time and storage cost.
Is an MSSP cheaper than an in-house SOC?
For most small and mid-sized companies, yes, because 24/7 cover needs several analysts plus tools. Large enterprises often run a hybrid: an internal team for strategy and response with an MSSP for round-the-clock monitoring.
Related reading: What Is Cloud Pricing Model.
Related reading: We Simplify Managed Security Services Pricing for Operational Efficiency.
Related Articles
About the Author
Group COO & CISO
Fredrik is the Group Chief Operating Officer and Chief Information Security Officer at Opsio. He focuses on operational excellence, governance, and information security, working closely with delivery and leadership teams to align technology, risk, and business outcomes in complex IT environments. He leads Opsio's security practice including SOC services, penetration testing, and compliance frameworks.
Editorial standards: This article was written by a certified practitioner, named in the byline above. We revise it when the technology or regulation it covers changes; the dates above show the latest update. Opsio maintains editorial independence — we recommend solutions on technical merit, not commercial relationships.
