Managed cybersecurity services compared by type
Types of managed security service compared by what they include, how they are usually priced, who they tend to fit and what to watch for, without rankings or vendor prices.
This table compares types of service, not providers. Where a product or company is named, it is only an example of a category; it is not a recommendation, ranking or score, and we quote no vendor prices. Read across a row to see what the service usually includes and how it is priced, then test two or three providers of the types that fit you using the best-fit method and the due-diligence checklist.
Select a column header to sort.
| Service type | What it usually includes | How it is usually priced | Tends to fit | Watch out for |
|---|---|---|---|---|
| Managed antivirus or EDR | Agent on each device (e.g. platforms such as Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne or Indian vendors), policy setup, alert review | Per endpoint per month or year; servers often dearer | Small offices that need better than free antivirus | Alerts may only be reviewed in office hours; response may be advice, not action |
| Managed firewall / UTM | Firewall at each site, rule changes, firmware updates, VPN, basic log review | Per device per month, often with hardware rental or purchase plus a yearly subscription | Businesses with one or more offices or plants | Rule-change limits per month, hardware refresh cost, logs kept for a short period |
| MDR (managed detection and response) | EDR plus 24×7 analysts who investigate and can isolate devices or kill processes | Per endpoint or per user, tiered by response scope | MSMEs without night-time IT staff | Exactly what the analyst may do without your approval; coverage of cloud and email |
| SOC-as-a-service with SIEM | Collection of firewall, server, cloud and SaaS logs, correlation, 24×7 monitoring, incident tickets | Per endpoint equivalent, per GB a day or per events per second, plus retention tiers | Firms with several log sources or a customer or regulator asking for a SOC | Log volume overruns, retention shorter than 180 days, connectors billed separately |
| Full MSSP bundle | Some mix of EDR, firewall, email security, SOC, patching and reporting | Bundle per user or per endpoint, annual contract | Businesses that want one throat to choke | Bundled items you do not need, lock-in to one provider's tools |
| Virtual CISO (vCISO) | Part-time security leadership: policies, risk register, audit readiness, board reporting | Monthly retainer for a set number of days or hours | Firms facing customer security questionnaires or audits | Deliverables vague; vCISO selling the same firm's other services |
| VAPT | Vulnerability scanning and manual penetration testing of networks, web and mobile apps; report and retest | Per engagement, scaled by IPs, apps and test days | Any business with internet-facing systems, or when a customer or regulator asks | Whether a CERT-In empanelled auditor is needed; retest included or extra |
| Incident-response retainer | Pre-agreed hours for forensics and recovery, with a response time | Yearly retainer; unused hours may or may not roll over | Firms that cannot afford to look for help during an attack | Response time is remote first; on-site travel extra; overlap with cyber insurance panels |
All service descriptions are general and simplified; providers define their tiers differently. Prices on this site are illustrative ranges, not quotes. Check the CERT-In Directions of 28 April 2022 and the list of CERT-In empanelled auditors on CERT-In, data protection rules on MeitY and the e-Gazette, and GST on CBIC GST. Regulated entities should start from RBI or SEBI requirements.