Managed Security Costs, Price Drivers and 2026 Rules
Managed cybersecurity service pricing in India: what drives the cost in 2026
How managed security services are priced for Indian MSMEs — endpoints, users, log volume, hours, response scope, contracts, GST — with illustrative rupee ranges and 2026 rules.
Managed cybersecurity in India is usually priced per endpoint or per user per month, with extra charges for log volume sent to a SIEM, devices such as firewalls, and one-time work such as onboarding and VAPT, on an annual contract plus 18% GST. As an illustrative range only, a 50-endpoint MSME might see anything from about ₹1.5 lakh a year for managed EDR watched in office hours to ₹7 lakh or more for a 24×7 MDR or SOC service with a managed firewall and yearly testing. The spread is wide because the products are different: what you pay for is how many assets are watched, for how many hours, and what the provider is allowed to do when something goes wrong. This guide explains each price driver and links to every guide in this section.
The six things a managed security price is made of
| Price driver | What it measures | Why it moves the price |
|---|---|---|
| Assets covered | Endpoints (laptops, desktops, servers), users, firewalls, cloud accounts | Each needs an agent or connector and adds alerts to review |
| Log volume | GB per day or events per second sent to a SIEM | Storage and processing cost; retention multiplies it |
| Monitoring hours | Business hours, extended hours or 24×7×365 | Round-the-clock cover needs at least five people on rotation |
| Response scope | Alert only, guided response, or hands-on containment | Analysts who isolate devices need more skill and carry more liability |
| One-time and periodic work | Onboarding, policy setup, VAPT, audits, tabletop exercises | Charged per engagement or spread over the contract |
| Contract terms | Term length, billing cycle, uplift, currency, exit | Longer terms lower the yearly price but raise lock-in |
The detail of each model is in managed security pricing models. What each service type includes is in MSSP, MDR and SOC-as-a-service explained.
Illustrative ranges by service type
These bands are written to show how the arithmetic works for an Indian MSME. They are not market data.
| Service | Typical pricing unit | Illustrative range (before GST) |
|---|---|---|
| Managed EDR, business hours | Per endpoint per year | ₹1,500–₹4,000 |
| MDR, 24×7 with containment | Per endpoint per year | ₹3,500–₹9,000 |
| SOC-as-a-service with SIEM | Per endpoint equivalent or per GB/day | ₹5,000–₹15,000 per endpoint equivalent |
| Managed firewall | Per device per year, plus hardware | ₹40,000–₹2,00,000 per site |
| Virtual CISO | Monthly retainer | ₹50,000–₹3,00,000 a month |
| VAPT | Per engagement | ₹75,000–₹6,00,000 per scope |
| Incident-response retainer | Per year, for pre-agreed hours | ₹1,50,000–₹10,00,000 |
Each line has its own guide: managed firewall and EDR, virtual CISO fees, VAPT and CERT-In empanelled auditors, and incident-response retainers.
Worked example (illustrative)
A 50-person trading company with 50 laptops, 2 servers and one office:
- MDR at an illustrative ₹6,000 per endpoint a year: 52 × ₹6,000 = ₹3,12,000 (servers counted as endpoints here; many providers charge more for them)
- Managed firewall subscription: ₹80,000
- Annual VAPT of the website and office network: ₹1,20,000
- Onboarding of ₹90,000 spread over a 3-year contract: ₹30,000 a year
Total: ₹3,12,000 + ₹80,000 + ₹1,20,000 + ₹30,000 = ₹5,42,000 a year before GST. With 18% GST (₹97,560) the cash cost is ₹6,39,560. If the company is GST-registered and uses the service for taxable supplies, the GST is normally available as input tax credit.
Try your own figures in the managed security cost estimator and see the effect of tax with the GST-inclusive price calculator.
Rules that shape what you must buy in 2026
Price is only half the story. Some requirements apply whether or not you outsource:
- CERT-In Directions of 28 April 2022 under section 70B(6) of the Information Technology Act, 2000: report specified cyber incidents within 6 hours of noticing them, keep logs of ICT systems for a rolling 180 days within Indian jurisdiction, synchronise clocks to NTP servers of NIC or NPL (or traceable to them), and name a point of contact for CERT-In. A managed service that keeps logs for 30 days does not meet the logging expectation on its own. See the CERT-In Directions guide.
- IT Act, 2000: section 43A (compensation for failing to protect sensitive personal data) still applies until the DPDP Act provision that omits it commences; sections 43, 66 and 72A deal with unauthorised access and disclosure.
- DPDP Act, 2023 and DPDP Rules, 2025: reasonable security safeguards (section 8(5)) and breach intimation (section 8(6)) are being phased in, with most business obligations from 13 May 2027. See DPDP and the IT Act.
- Tax: 18% GST, reverse charge on foreign platforms and possible TDS. See GST, TDS and dollar pricing.
- Sector rules for banks, NBFCs and market intermediaries are covered briefly in RBI and SEBI cyber rules.
How to read a quote
- List what is covered by name and count. "Up to 50 endpoints" and "50 users" are different numbers.
- Find the hours. 24×7 should mean every day of the year, including Sundays and festival holidays.
- Read the response clause. "We will notify you" is not "we will isolate the device".
- Check log retention. Ask for 180 days at minimum and where the copy is stored.
- Separate one-time and recurring costs. Onboarding fees and VAPT should be visible.
- Note the renewal uplift and currency. A platform billed in US dollars carries exchange-rate risk. Use the renewal uplift calculator.
FAQ
Is per-user or per-endpoint pricing cheaper?
Neither, by default. Per-user suits firms where each person has a laptop and a phone; per-endpoint suits shared desktops and plants. Convert both quotes into cost per person and cost per device and compare.
Can a small business get a 24×7 SOC?
Yes. Many providers sell shared SOC capacity to MSMEs. The question is the scope of what is monitored and whether the provider can act at night.
Does managed security make us compliant with CERT-In?
No service makes you compliant by itself. The business remains responsible for reporting and logs; the contract should make the provider help you meet each requirement.
Sources
- CERT-In — Directions of 28 April 2022, FAQs, incident reporting and the empanelled auditor list
- MeitY — IT Act, DPDP Act and DPDP Rules
- e-Gazette of India — official text of notifications, including the DPDP Rules (G.S.R. 846(E), 13 November 2025)
- CBIC GST — GST rates and reverse charge
