Managed cybersecurity cost for a dental or medical practice

A 10-person dental or medical practice pays Obsidian Ridge $250 per month for Ridge Core or $500 per month for Ridge Plus, before separate business onboarding. Obsidian Ridge's Ridge Core includes endpoint MDR and Microsoft 365 or Google Workspace ITDR at $25 per person per month, month-to-month with no minimum and business onboarding separate. Huntress's SOC monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States. Ridge Plus costs $50 per person per month on an annual term, billed monthly, with no minimum. It adds staff training, email-security configuration and a secure browser to Ridge Core; business onboarding is separate.

These are the current Ridge Core and Ridge Plus offers on our pricing page. Prices are per counted person, not per dentist, treatment chair or office. The table is an illustration of our published service, not a survey of what all practices pay.

What do 5, 10 and 20 people cost?

The table is calculated from the same price data as the current tiers. Business onboarding is $500 for up to 25 machines, or $1,000 for 26 to 100. More than 100 machines needs a scoped quote. These are recurring service totals before that one-time work and any separately agreed services. There is no seat minimum.

A shared computer with no named user counts as one person. List staff and shared computers before using the table: a practice with ten employees and additional unassigned shared machines may have more than ten counted people. Keep the machine inventory too, because setup is sized by machines.

What does each tier cover?

Core combines endpoint detection and response with Microsoft 365 or Google Workspace identity monitoring. Plus adds training, configured and monitored email protection, and a secure browser for work apps. It does not turn the security service into a help desk for imaging equipment, printers or clinical applications.

For endpoint-only coverage, Ridge Watch business MDR costs $15 per device per month, month-to-month with no minimum, plus business onboarding. Count devices for that option. A ten-person practice does not automatically have ten devices. The MDR cost guide explains that distinction and the direct-vendor purchase floor.

Ridge Reserve costs $70 per person per month on an annual term, billed monthly, with no minimum and onboarding separate. It adds an incident-response plan and annual tabletop, quarterly admin-access review, monthly patch reporting and an annual questionnaire refresh to Ridge Plus. A Readiness Sprint is separate: The Readiness Sprint costs $1,500 to $3,500 once for a 7-business-day engagement. The deliverable is the same at each scope: a signed evidence pack and a record of controls and gaps. It is not credited against the monthly subscription.

What makes a practice's total cost change?

Start with these scope questions before comparing two proposals:

• People and machines: include reception, billing, remote workers, servers and shared workstations. Ask how each provider counts them.
• Accounts: identify Microsoft 365 or Google Workspace, administrator access and supported identity response. Do not assume an endpoint agent sees cloud-account activity.
• Clinical systems: identify the vendor that supports the practice-management system and approves disruptive maintenance.
• Logs: decide which systems need searchable or archived evidence. Obsidian Ridge's Ridge Log managed SIEM add-on costs $8 per data source per month, with no minimum. The add-on contract term is not published; confirm it, source coverage and retention in the quote. Huntress's SOC monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States.
• Backup and recovery: identify who runs backups and tests restores. Obsidian Ridge does not sell managed backup in these tiers.
• Evidence work: separate recurring monitoring from a risk analysis, policy work and the one-time insurance evidence pack.

Use the same inventory in every quote. Otherwise a low headline price may simply cover fewer systems or leave more work with the practice.

What does HIPAA change about the purchase?

HHS describes a Security Rule programme that includes risk analysis, assigned responsibility, workforce training, activity review and contingency planning. Monitoring is one part of that programme. A product logo or a monitoring invoice does not prove the rest is operating. HHS Security Rule summary.

Ask a provider to identify the controls it operates, the records it can produce and the work that remains with the practice. For a dental office, use the dental service scope, provider comparison and renewal checklist together.

When is a full-service MSP the better buy?

A full-service IT provider is the better fit when the unresolved problem is everyday support: unreliable Wi-Fi, broken workstations, backup operations, new-user setup or clinical software updates. Ask whether that provider also supplies a managed security service and how responsibilities are divided. Compare the combined scope and total bill, not just an MDR line item.

If your IT support already works and you need someone to operate security around it, a separate security service can fit. Start with free application help, the questionnaire worksheet, or talk with us about the inventory and the gaps.

Sources

• Obsidian Ridge pricing: current rates, counted units, contracts and service boundaries, confirmed October 1, 2026.
• HHS Security Rule summary: programme requirements, fetched October 2, 2026.