Managed Security Costs, Price Drivers and 2026 Rules
Managed firewall and EDR pricing in India: hardware, subscriptions and monitoring
What managed firewall and managed EDR services cost Indian MSMEs — buy vs rent hardware, subscriptions, rule changes, agent licences and monitoring hours — with illustrative rupee sums.
A managed firewall costs the firewall itself (bought or rented), a yearly security subscription for updates and threat feeds, and a management fee for rule changes, VPN users, monitoring and reports. Managed EDR costs a licence per endpoint plus a monitoring fee that rises steeply when you move from office-hours review to 24×7 response. For a single-office MSME, illustrative totals are often in the range of ₹40,000 to ₹2 lakh a year per firewall site and ₹1,500 to ₹9,000 per endpoint a year for EDR, depending on hours and response. This guide breaks both down, and is part of the managed security pricing overview.
Managed firewall: the cost parts
| Part | What it is | How it is charged |
|---|---|---|
| Appliance | The firewall or UTM box, sized by throughput and users | One-time purchase, or rented in a monthly fee |
| Security subscription | Signatures, web filtering, sandboxing, support from the maker | Yearly, often 1, 3 or 5 years prepaid |
| Management | Rule changes, VPN set-up, firmware updates, backups of configuration | Monthly or yearly per device |
| Monitoring and logs | Alert review, log storage, reports | Included at a basic level; longer retention or SOC review extra |
| On-site support | Replacement or visit when the box fails | Included in metros, travel extra elsewhere is common |
Buy or rent? (illustrative)
A 40-user office needs a mid-range firewall.
- Buy: appliance ₹1,20,000 + 3-year subscription ₹1,50,000 + management ₹3,000 a month × 36 = ₹1,08,000. Three-year cost = ₹3,78,000, or ₹1,26,000 a year.
- Rent: all-inclusive ₹11,500 a month × 36 = ₹4,14,000, or ₹1,38,000 a year.
Buying is ₹36,000 cheaper over three years here, but renting includes hardware replacement and keeps cash in the business. At the end of a purchase term you own a box that may need a new subscription; at the end of a rental the provider takes it back. Check which model includes a hardware refresh if the appliance reaches end of support during the term.
Questions for a firewall quote
- How many rule changes a month are included, and how fast are they done?
- Who keeps the configuration backup and the admin password?
- Are firewall logs kept for 180 days, and where? (CERT-In expects ICT logs for a rolling 180 days within India; see the CERT-In Directions guide.)
- Is the clock synchronised to NTP servers of NIC or NPL, or to a source traceable to them?
- What happens on a hardware failure at 9 p.m. on a Saturday?
Managed EDR: the cost parts
| Part | What it is | How it is charged |
|---|---|---|
| EDR licence | The agent on each device | Per endpoint or per user per year; sometimes already in your office-suite plan |
| Deployment | Rolling out agents, removing old antivirus | One-time, or included |
| Policy management | Exclusions, device control, updates | Included in management fee |
| Monitoring | Who reads the alerts and when | Business hours, extended hours or 24×7 |
| Response | Isolate device, kill process, remove file, disable account | Basic, guided, or full containment by tier |
Business hours vs 24×7 (illustrative)
60 endpoints.
| Option | Per endpoint per year | Annual cost |
|---|---|---|
| Licence only, your IT reads alerts | ₹1,800 | ₹1,08,000 |
| Managed EDR, provider reviews in business hours | ₹3,200 | ₹1,92,000 |
| MDR, 24×7 with containment | ₹7,000 | ₹4,20,000 |
The step from business hours to 24×7 here is ₹2,28,000 a year. Whether it is worth it depends on when attacks are likely to start (ransomware often runs at night and on holidays), whether anyone in your team can act out of hours, and what a day of downtime costs you. A rough rule: if one day of full stoppage would cost more than the yearly difference, round-the-clock response is worth pricing seriously.
Licences you may already own
Many office-suite business plans include endpoint protection, email filtering or identity protection at some level. Before you pay a provider for licences, list what your current plans include and ask the provider whether it can manage those tools instead of selling new ones. This can lower the per-endpoint price to the management and monitoring part only.
Mobile devices and remote workers
Phones and tablets used for work mail are endpoints too. Mobile device management (MDM) and mobile threat defence are often priced separately. For remote staff, check that the EDR agent reports from home networks and that the firewall's VPN licence covers the number of people who connect at the same time.
Estimate a full mix in the managed security cost estimator, and compare service types on the comparison page.
FAQ
Is a free antivirus enough for a small office?
For a very small office it is better than nothing, but it gives no central view, no investigation and no one to act at night. Managed EDR addresses those gaps.
Can the same provider manage our firewall and EDR?
Yes, and many do. One provider for both makes investigation easier; it also concentrates dependence. Make sure configurations and logs are handed over if you leave.
How long does a firewall last?
Makers publish end-of-sale and end-of-support dates for each model. Ask the provider for those dates before you buy.
Sources
- CERT-In — Directions on logs and NTP, security advisories and vulnerability notes
- National Physical Laboratory — Indian Standard Time and time dissemination
- National Informatics Centre — government NTP and IT infrastructure
- CBIC GST — GST on goods (hardware) and services
