Cost Estimates, Best-Fit Selection and Checklists
Managed security cost for a 40-person services firm in India: a worked estimate
An illustrative 3-year managed cybersecurity budget for a 40-person Indian consulting or IT services firm on Microsoft 365 — MDR, email security, VAPT, vCISO, GST and options.
For a typical 40-person professional services firm in India that works from one office and lives in Microsoft 365 or Google Workspace, an illustrative managed security core (24×7 MDR on laptops, monitoring of cloud identity and email logs, a managed firewall and phone protection) is about ₹4.4 lakh a year before GST. Add a yearly VAPT of the client portal and vCISO days to answer client security questionnaires and the run-rate becomes about ₹6.8 lakh a year, with a heavier first year of about ₹9.4 lakh. Over three years, with onboarding and an 8% uplift, that comes to about ₹24 lakh before GST. This guide builds the estimate line by line so you can swap in your own numbers. It belongs to the best-fit selection method.
The firm
- 40 staff (consultants, accounts, admin), each with a laptop and a phone used for work mail
- No on-premises servers; files in the cloud; one small office in Bengaluru with a firewall
- A client portal hosted in an Indian cloud region
- Clients include two foreign companies that send yearly security questionnaires and ask for a VAPT report
- Holds client personal data (names, contact details, some identity documents)
Risks that set the scope
| Risk | Why it matters here | Service that addresses it |
|---|---|---|
| Phishing and stolen Microsoft 365 passwords | Most work is in email and cloud files | Identity and email monitoring, MFA policy |
| Ransomware on laptops | Consultants travel and work from home | MDR with containment |
| Portal compromise | Client data and reputation | VAPT, web application firewall, log monitoring |
| Questionnaire failure | Lost client renewals | vCISO support, documented policies |
| CERT-In reporting | Body corporate under the April 2022 Directions | Provider support, 180-day logs |
Line-by-line estimate (illustrative, before GST)
| Line | Basis | Year 1 | Years 2–3 each |
|---|---|---|---|
| MDR on 40 laptops, 24×7 with containment | 40 × ₹6,500 | ₹2,60,000 | ₹2,60,000 |
| Cloud identity and email log monitoring | Flat add-on | ₹72,000 | ₹72,000 |
| Managed firewall (rented, all-inclusive) | ₹6,000 × 12 | ₹72,000 | ₹72,000 |
| Phone protection (MDM) | 40 × ₹900 | ₹36,000 | ₹36,000 |
| VAPT of the client portal, with retest | Per engagement | ₹1,40,000 | ₹1,40,000 |
| vCISO, 1 day a month | 12 × ₹25,000 | ₹3,00,000 | — |
| vCISO, 1 day a quarter after year 1 | 4 × ₹25,000 | — | ₹1,00,000 |
| Onboarding (one-time) | Fixed | ₹60,000 | — |
| Total | ₹9,40,000 | ₹6,80,000 |
Year 1 is higher because of onboarding and a full year of vCISO work to set up policies. From year 2 the run-rate is ₹6,80,000 before uplift.
With uplift and GST
- Year 2 with an 8% uplift on the recurring managed lines (MDR, monitoring, firewall, MDM: ₹4,40,000): + ₹35,200 → ₹7,15,200
- Year 3 with another 8% on those lines (₹4,75,200 × 8% = ₹38,016): ₹7,53,216
Three-year total = ₹9,40,000 + ₹7,15,200 + ₹7,53,216 = ₹24,08,416 before GST, or about ₹28.4 lakh with 18% GST. As a registered firm making taxable supplies, it would normally recover the GST as input tax credit.
Most of the difference between the core and the total is the vCISO and the yearly VAPT. The managed core alone (MDR, monitoring, firewall, MDM) is ₹4,40,000 a year, about ₹11,000 per employee.
Check the renewal sums in the renewal uplift calculator, and the GST in the GST-inclusive price calculator.
Three ways to trim the budget
- Use security features you already license. If your office suite plan includes endpoint protection, ask the provider to manage it instead of supplying a new EDR. In this example that could lower the MDR line by an illustrative ₹1,500 per laptop, ₹60,000 a year.
- Test smarter. An external scan each quarter and a full manual VAPT every year after major releases, rather than two full tests a year.
- Front-load the vCISO. A focused three-month project to write policies and a questionnaire answer pack, then a small retainer.
What not to cut
- 24×7 response on laptops. Most ransomware runs when nobody is watching.
- 180-day log retention for identity, email and firewall logs, which CERT-In expects.
- A tested incident procedure with the provider, including who calls CERT-In within six hours. See the CERT-In Directions guide.
How this compares with doing it in-house
One in-house security person at an illustrative ₹12–18 lakh a year could manage tools in office hours but could not cover nights, holidays or leave. For a firm this size, a managed service plus a small vCISO allowance gives more coverage for less. See in-house SOC versus managed and the manufacturer example for a larger estate.
FAQ
Is ₹11,000 per employee a year normal?
It is the illustrative figure from this example only. Your number depends on scope, hours and response. Build your own with the cost estimator.
Do we need a SIEM?
Not necessarily. For a cloud-first firm without servers, MDR plus identity and email log monitoring may cover most needs, as long as logs are kept 180 days.
Can the VAPT be skipped in a quiet year?
Clients that ask for a yearly report will notice. If the portal does not change, a lighter retest may be acceptable to them; ask.
