Managed Security Costs, Price Drivers and 2026 Rules
Managed security pricing models: per user, per endpoint, log volume, tiers and annual contracts
How Indian managed security providers price — per endpoint, per user, per GB of logs, tiers, bundles, annual and multi-year contracts — and how to convert quotes to compare them.
Managed security providers in India price in five main ways: per endpoint, per user, per volume of logs (GB a day or events per second), per device or site (for firewalls), and fixed tiers or bundles, usually on an annual contract paid yearly or quarterly in advance. The same service can look cheap under one model and dear under another, so the only fair comparison is to convert every quote into the same unit for your own estate. This guide explains each model with illustrative numbers, shows how to convert between them, and is part of the managed security pricing overview.
Model 1: per endpoint
You pay for each device with an agent: laptops, desktops and servers.
- Good for: businesses with shared desktops (shop floors, branches, call centres) where many people use few devices.
- Watch for: servers priced at two to five times a laptop, virtual machines counted separately, a minimum commitment ("billed for at least 50 endpoints"), and true-up clauses that bill the peak count of the year.
Illustrative example. 80 laptops and 6 servers. Laptop rate ₹5,000 a year, server rate ₹15,000. Cost = 80 × ₹5,000 + 6 × ₹15,000 = ₹4,00,000 + ₹90,000 = ₹4,90,000 before GST.
Model 2: per user
You pay for each named person, usually covering a set number of devices per user (for example up to three: laptop, phone, tablet) and often their mailbox and identity.
- Good for: office businesses where each person has a laptop and phone and uses Microsoft 365 or Google Workspace.
- Watch for: service accounts and shared mailboxes counted as users, contractors left out, and device caps per user.
Illustrative example. 60 users at ₹7,500 a year each = ₹4,50,000, covering 60 laptops, 60 phones and 60 mailboxes. Per device, that is ₹4,50,000 ÷ 120 = ₹3,750.
Model 3: log volume
SOC-as-a-service and SIEM platforms often charge by GB of logs ingested per day or by events per second (EPS), with separate prices for retention.
| Element | What drives it | How to control it |
|---|---|---|
| Ingest (GB/day) | Firewalls, domain controllers and cloud audit logs are the largest | Send only useful log types; filter noisy debug logs |
| Hot retention | Days of fast searchable storage | Keep 30–90 days hot, the rest in archive |
| Archive retention | Months of cheap storage | Make sure 180 days is covered for CERT-In purposes |
| Overages | Volume above the plan | Ask for monthly averaging, not daily peaks |
Illustrative example. A plan of 10 GB/day at ₹2,500 per GB/day per month = ₹25,000 a month, ₹3,00,000 a year. Adding a new firewall that sends 4 GB/day pushes you to 14 GB/day: ₹35,000 a month, ₹4,20,000 a year. Ask for the price of the next tier before you sign.
Model 4: per device or site
Managed firewalls, UTM appliances and secure web gateways are priced per box or per site, often with a choice of buying the hardware (plus a yearly subscription for updates and support) or renting it inside the monthly fee. See managed firewall and EDR pricing.
Model 5: tiers and bundles
Providers often publish Bronze/Silver/Gold or Essential/Advanced/Complete tiers. Higher tiers usually add 24×7 cover, containment, more log sources, threat hunting and a named account manager. Bundles can be good value if you need most of what is in them; they are poor value if you are paying for email security your office suite already includes.
Contract terms that change the yearly price
| Term | Typical effect | Question to ask |
|---|---|---|
| Annual prepaid | Lower than monthly; cash out early | Is there a quarterly option? |
| Multi-year (2–3 years) | Further discount; renewal uplift may be capped | Can we reduce endpoints mid-term? |
| Minimum commitment | Floor on billable units | What if headcount falls? |
| True-up | Bill for growth during the year | Average or peak count? |
| Renewal uplift | Annual increase at renewal | Is there a written cap? |
| Currency | INR or USD | Who bears the exchange-rate risk? |
Model an uplift with the renewal uplift calculator.
How to convert quotes to one basis
- Count your estate: users, laptops/desktops, servers, firewalls, cloud accounts, average log volume.
- For each quote, calculate the annual cost for your exact estate, including minimums and server rates.
- Add one-time costs divided by the contract years.
- Add mandatory add-ons for anything excluded but needed (for example 180-day archive retention).
- Divide by users and by endpoints to see both unit costs.
Illustrative comparison.
| Quote A (per endpoint) | Quote B (per user) | Quote C (log volume) | |
|---|---|---|---|
| Recurring | ₹4,90,000 | ₹4,50,000 | ₹3,00,000 |
| Missing item needed | None | Server cover: ₹90,000 | EDR on laptops: ₹2,40,000 |
| Onboarding ÷ 3 years | ₹30,000 | ₹20,000 | ₹50,000 |
| Annual total | ₹5,20,000 | ₹5,60,000 | ₹5,90,000 |
The lowest headline (Quote C) becomes the highest once the scope is equal. All figures are illustrative.
FAQ
Why do servers cost more?
They usually generate more alerts and logs, are more critical, and response on them needs more care. Some providers treat one server as several endpoint units.
Can we pay monthly?
Some providers offer monthly billing at a higher rate. Annual prepaid is common for MSME contracts; quarterly in advance is a frequent compromise.
What is a fair minimum commitment?
There is no rule. A minimum close to your current count, with the right to reduce by a set percentage a year, is easier to live with than one far above it.
