Pricing

Three concrete tiers, no middleman markup.

Foundation gets you managed endpoint coverage with no contract. Protected adds identity and training. Complete adds SIEM and audit-grade log retention. Pick the tier that matches your risk — not the salesperson's commission.

For your business

Managed cybersecurity tiers

Prices in USD · per agent or per user

Tier 01 · Foundation

Foundation

$15/ agent / mo

Month-to-month · no minimum

Always-on protection for the computers your practice depends on, watched 24/7 by a real security team.

What's included

Always-on protection on every computer in your practice.MDR / EDR: suspicious activity on workstations is watched 24/7 by a real security team, so one compromised laptop is less likely to interrupt client work.
Human review before alerts reach you.SOC triage: a real analyst reviews suspicious activity first, so your team is not expected to interpret raw security alerts during a busy day.
Quarterly review of how your security is holding up.Posture review: we look at what changed, what improved, and what still needs attention before small gaps become expensive problems.
Direct email support from a senior practitioner.Security advisory: a person to ask when something feels off, not a generic ticket queue.
Add or remove devices at any time.Agent-based deployment: coverage can follow the computers your practice actually uses without locking you into unused seats.

Replaces or complements

Antivirus subscriptions that flag everything and stop nothing
Generic IT-installed protection with no one reviewing alerts
Monthly log review your team never finds time for

Not included by default

Identity threat detection (Microsoft 365 / Google Workspace) — that's Protected
Security awareness training and phishing simulation — that's Protected
SIEM, log retention, or audit-grade evidence packaging — that's Complete
Quarterly tabletop exercise — that's Complete
Reserved practitioner hours — that's Complete

Cyber insurance baselineSOC 2 readinessHIPAA Security Rule

Start with Foundation

Most common

Tier 02 · Protected

Protected

$32/ user / mo

Annual term · billed monthly

Adds monitoring of the email and Microsoft 365 / Google Workspace accounts attackers actually target — plus the documentation your insurer asks for.

Everything in Foundation, plus

Email and cloud account monitoring.ITDR: Microsoft 365 or Google Workspace accounts are watched for break-in attempts and identity-based attacks.
Security training for staff.security awareness training: short lessons and realistic phishing simulations help your team recognize common attacks before they become an incident.
Training records for audits and insurance.Compliance evidence: you have documentation ready when HIPAA, SOC 2, ISO 27001, client questionnaires, or insurers ask what your staff received.
Monthly security summary in plain English.Executive reporting: you see what was watched, what was investigated, and what needs a decision without learning another dashboard.
Senior practitioner included.Security advisory: the same email channel as Foundation, scoped for the wider Protected program.

Replaces or complements

Standalone antivirus or endpoint subscriptions
Separate phishing-training tools you bought and forgot to roll out
One-off compliance gap assessments with no follow-through

Not included by default

SIEM and 90-day searchable log retention — that's Complete
Quarterly tabletop exercise and incident-response drill — that's Complete
Reserved practitioner hours each month — that's Complete
Annual framework-alignment audit (NIST CSF, SOC 2, HIPAA evidence pack) — that's Complete
Deep incident response retainers and major architecture redesigns (scoped separately)

Cyber insurance baselineSOC 2 readinessHIPAA · add-on

Get Protected pricing

Tier 03 · Complete

Complete

from$55/ user / mo

Scoped · log sources priced separately

Full program plus audit-ready logs and quarterly drills. For practices that already feel the weight of compliance and want it handled.

Everything in Protected, plus

Audit-ready security records.SIEM: logs from your devices, accounts, firewall, and cloud tools are collected so insurance, HIPAA, SOC 2, PCI-DSS, and client questionnaires are easier to answer.
Searchable evidence for 90 days.Log retention: when someone asks what happened, we can investigate from stored security records instead of piecing together screenshots after the fact.
Quarterly practice drill.Tabletop exercise: we walk through what your team would do if a real incident hit, before the pressure is real.
Senior practitioner — 4 hrs/mo reserved.Practitioner hours: security questions, policy decisions, vendor reviews, audit prep.
Annual security assessment and audit-prep support.Framework alignment: we turn the year of security work into a clearer story for insurers, auditors, clients, and leadership.

Replaces or complements

Separate logging and alerting tools no one reads
Advisory retainers with no monitoring behind them
A patchwork of security tools that don’t talk to each other

Not included by default

Full SOC 2 Type II audit fieldwork (scoped separately, ~$25K–$60K)
Multi-entity HIPAA Security Rule program for a parent + 5+ subsidiaries (scoped separately)
Incident response retainers beyond included practitioner hours (block-billed at $500/hr)
Hardware procurement, network architecture redesigns, or M&A IT integration
Help-desk, end-user support, or general IT services — we don't sell those

Cyber insurance baselineSOC 2 Type IIHIPAA · PCI-DSS

Talk to a practitioner

From $15 / agent / moStart with Foundation

Request pricing

Foundation lists per agent because EDR runs on devices. Protected and Complete list per user because identity and training are people-based. Real numbers and term options come back in the proposal within one business day.

The math owners miss

A lot of what you spend here comes back.

The controls in every tier — MFA, managed EDR, identity monitoring, tested backups, staff training — are the same ones cyber-insurance carriers now require, and weigh when they set your premium. Carrying them doesn't just cut your risk; it can lower what you pay and keep you eligible for coverage carriers increasingly deny to applicants who can't show these controls. For many small businesses, a real share of this spend comes back as a smaller premium — security that partly pays for itself.

See what carriers check →

Add-ons & sprints

Fixed-fee work, no surprises in the proposal

Onboarding

$500 flat (≤25 agents)

$1,000 for 26–100 agents

Discovery, agent deployment, identity baseline
Alert routing and escalation paths
30-day check-in

Cyber Insurance Sprint

from $1,500 / 7 business days

Ready for renewal or new application

Gap assessment against insurer control questionnaire
Remediation plan with prioritized fixes
Application support and evidence package

Scope a sprint

Incident Response

$500 /hour, 5-hour blocks

When something has already happened

Same-day response within business hours
Containment, root-cause, remediation plan
Post-incident debrief and hardening guidance

Get help now

SOC 2 Type II foundation programs and HIPAA Security Rule alignment are scoped per environment — typical engagements run $25K–$60K depending on entity count and existing controls. Get a fixed-fee proposal in the briefing.

Other audiences

If you're not a growing business

Individuals & families

$199 one-time

to $89 / month for ongoing protection

Foundation, Protected, and Family plans for personal cybersecurity
Direct purchase available — no enterprise sales motion
Incident help available even without a subscription

See individual plans

Enterprise

Custom scope

Assessment, architecture, response, advisory.

Project and advisory engagements scoped to objectives
No generic seat-based pricing assumptions
Best fit for teams with existing internal capability

Start an enterprise discussion

FAQ

Pricing questions that come up often

Why these prices?

Each tier reflects the cost of the managed security platform we operate plus a senior practitioner's time. The platform is pass-through-priced at the same rate you'd pay buying direct. No middleman markup, no shelfware bundles, no hidden onboarding fee surprises.

Is there a contract?

Foundation runs month-to-month — install and uninstall agents at any time. Protected and Complete tiers are typically scoped on annual terms because identity coverage, training cadence, and SIEM data sources benefit from continuity. There is never silent auto-renewal; renewal terms are opt-in every year.

What is included in onboarding?

Discovery, agent deployment, identity baseline, alert routing, and a 30-day check-in. Onboarding is a flat fee disclosed in the proposal — $500 for under 25 agents, $1,000 for 26–100. Above 100 agents, we scope a custom onboarding window.

What is not included by default?

Major architecture transformations, deep incident response retainers, multi-entity SOC 2 Type II audit fieldwork, hardware procurement, and general IT/help-desk are scoped separately or are out of scope entirely. Each tier card shows the explicit exclusions so you don't pay for hours you don't need.

Can I start with a single product instead of a bundle?

Yes. Foundation is EDR-only and a fine starting point. Identity (ITDR) and training (SAT) can be added when you're ready — most clients add identity coverage within 60 days of starting once they see the first phishing simulation result or an ITDR alert come in on the demo tenant.

Do you sell only the underlying tools without the managed service?

No. The value is in the practitioner who deploys correctly, watches the alerts that matter beyond the SOC's automatic triage, and tells you what to do when something happens. If you only want a bare license, buy direct from the vendor. We don't compete with the vendor's own channel — we operate the platform end-to-end and add the program around it.

Can we switch tiers later?

Yes. Tier upgrades are immediate and prorated. Tier downgrades take effect at the next renewal so identity-coverage history and SIEM retention aren't lost mid-cycle. There are no upgrade fees or downgrade penalties.

Is there a minimum seat count?

Foundation has no minimum — start with one agent if that's what you have. Protected and Complete are designed for organizations with at least 5 users; below that, the per-user pricing carries fixed overhead that we'd rather route to Foundation + bolt-on advisory hours instead.

How does billing work for partial months when we add or remove agents mid-cycle?

Adds are prorated from the day the agent comes online. Removes credit the next invoice, prorated to the day the agent goes offline. This is how the platform's billing flows through — we don't add a separate proration policy on top.

Next step

Not sure which tier fits?

Briefings are free and we tell you when you don't need us. 30 minutes, real answers, no follow-up sales sequence.

Book a 30-min briefing

Tier 03 · Complete

Complete

from$55/ user / mo

Scoped · log sources priced separately

Full program plus audit-ready logs and quarterly drills. For practices that already feel the weight of compliance and want it handled.

Everything in Protected, plus

Audit-ready security records.SIEM: logs from your devices, accounts, firewall, and cloud tools are collected so insurance, HIPAA, SOC 2, PCI-DSS, and client questionnaires are easier to answer.
Searchable evidence for 90 days.Log retention: when someone asks what happened, we can investigate from stored security records instead of piecing together screenshots after the fact.
Quarterly practice drill.Tabletop exercise: we walk through what your team would do if a real incident hit, before the pressure is real.
Senior practitioner — 4 hrs/mo reserved.Practitioner hours: security questions, policy decisions, vendor reviews, audit prep.
Annual security assessment and audit-prep support.Framework alignment: we turn the year of security work into a clearer story for insurers, auditors, clients, and leadership.

Replaces or complements

Separate logging and alerting tools no one reads
Advisory retainers with no monitoring behind them
A patchwork of security tools that don’t talk to each other

Not included by default

Full SOC 2 Type II audit fieldwork (scoped separately, ~$25K–$60K)
Multi-entity HIPAA Security Rule program for a parent + 5+ subsidiaries (scoped separately)
Incident response retainers beyond included practitioner hours (block-billed at $500/hr)
Hardware procurement, network architecture redesigns, or M&A IT integration
Help-desk, end-user support, or general IT services — we don't sell those

Cyber insurance baselineSOC 2 Type IIHIPAA · PCI-DSS

Talk to a practitioner

A lot of what you spend here comes back.