MSSP pricing in 2026: what managed security services cost

Managed security service providers (MSSPs) typically charge about $6 to $35 per device or user per month, depending on whether you buy alert monitoring, 24/7 detection and response, or a full managed security bundle, with premium deals that bundle tooling reaching about $45. In annual terms that is roughly $7K–$25K for a 50-person company, $29K–$108K at 250 employees, and $86K–$360K at 1,000 employees, before onboarding fees and contract minimums (SecurityBudget estimates, worked below).

This page covers MSSP contracts specifically. For a side-by-side of every outsourced service, including pentests, vCISO and IR retainers, see our cybersecurity services pricing overview.

The five MSSP pricing models

Model	Billing unit	Published example	Watch for
Per device	Each endpoint, server or appliance	Huntress Managed EDR: $8.99 / endpoint / mo (MSRP)	Servers and firewalls cost more than laptops
Per user	Each employee	Blumira: $12, $16 or $21 / employee / mo	How “user” is defined (contractors, shared mailboxes)
Per log source or data volume	Data source, GB/day or events per second	Huntress Managed SIEM: $4.00 / data source / mo	Ingest overages and retention fees
Tiered package	A band of devices	Security Arsenal: $1,500 / mo up to 50 devices; $7,012 / mo up to 250	Price jumps between bands
Flat monthly retainer	The whole environment	Quote-only	Vague scope and change-order fees

Per device is the most common unit for endpoint-centric services, and servers cost more. On AWS Marketplace, Sophos lists an MDR license at $239.64 per 12 months and the server version at $390.72, about 60% more. Firewalls are priced per appliance: one white-label provider that sells to MSPs lists managed firewall administration at $75 per device per month, before any reseller markup.

Per user suits companies where each person has several devices. In Blumira’s published editions, only the $16 and $21 tiers include 24/7 incident support.

Per log source or volume is how SIEM-based MSSPs bill. The service fee is often the smaller part of the bill; ingest and retention drive the rest, as covered in the hidden costs of SIEM.

Tiered packages make invoices predictable but charge for headroom. Flat retainers are common for mixed environments (firewalls, cloud, OT) and are almost always quote-only.

What each tier includes

Tier names vary by provider. This table maps what you get to what it typically costs.

Tier	SecurityBudget estimate	Typically includes	Typically excludes	Public reference points
Monitoring and alerting	~$6–$10 / device / mo	24/7 alert intake and triage, escalation to your team, monthly report	Containment, remediation, threat hunting	Huntress Managed EDR, $8.99 MSRP
Managed detection and response	~$12–$20 / device / mo	24/7 SOC, threat hunting, remote isolation, guided remediation	Firewall changes, vulnerability management, compliance reports	Arctic Wolf ~$15.20
Full managed security	~$25–$35 / device / mo (up to ~$45 with bundled tooling)	MDR plus log monitoring, firewall management, vulnerability scanning, compliance reporting	Major incident response, pentests, hardware	Security Arsenal ~$28–$30 per device

How the reference points were derived: Arctic Wolf’s AWS Marketplace listing prices Aurora Managed Endpoint Defense, which includes 24x7 SOC monitoring, at $18,240 per 12 months for up to 100 devices ($18,240 ÷ 100 ÷ 12 = $15.20). Security Arsenal’s published SOC plans work out to $1,500 ÷ 50 = $30 and $7,012 ÷ 250 = $28.05 per device per month, with network devices covered on top.

These are list prices for smaller deployments. Our MDR pricing guide puts MDR at $3–$45 per endpoint per month, about $6 typical for mid-market volume after discounts.

MSP vs MSSP vs MDR vs SOC-as-a-service

Service	Main job	Usual billing	Cost reference	What it usually doesn’t do
MSP	Runs IT: help desk, patching, backups	Per user or device	22% of MSPs surveyed by Kaseya charge $50–$100 / user / mo for ongoing IT support	24/7 security monitoring
MSSP	Runs security controls and monitoring	Per device, user, log source or tier	~$6–$35 / device / mo (SecurityBudget estimate)	Help desk; some only alert rather than respond
MDR	24/7 detection and response, endpoint-first	Per endpoint	$3–$45 / endpoint / mo, ~$6 typical	Firewall or SIEM administration, compliance work
SOC-as-a-service	Analysts watch your SIEM and log data	Per log source, GB/day or employee	Blumira Respond: $16 / employee / mo with 24/7 incident support	You often keep the SIEM license and the remediation work

The lines blur: many MSPs resell MDR, and many MSSPs wrap a third-party MDR. The Kaseya figure comes from its 2023 survey of 1,091 providers. N-able estimates security-inclusive MSP bundles at $200–$275 per user per month, but that is a vendor estimate with no survey cited, and it includes help desk, so don’t compare it directly with MSSP rates.

Worked annual examples

Assumptions: endpoints = employees × 1.2 (one workstation per person plus about 20% for servers, VMs and shared devices). Per-device rates fall as volume rises. Totals exclude onboarding, incident response hours, unbundled tool licenses and tax.

Company	Endpoints	Monitoring	MDR-class	Full managed security
~50 employees	60	60 × $10 × 12 = $7,200	60 × $20 × 12 = $14,400	60 × $35 × 12 = $25,200
~250 employees	300	300 × $8 × 12 = $28,800	300 × $16 × 12 = $57,600	300 × $30 × 12 = $108,000
~1,000 employees	1,200	1,200 × $6 × 12 = $86,400	1,200 × $12 × 12 = $172,800	1,200 × $25 × 12 = $360,000

At 50 employees, minimums decide the price. The Arctic Wolf listing above is priced for up to 100 devices, so using 60 of them works out to $18,240 ÷ 60 ÷ 12 = $25.33 per device per month. On Security Arsenal’s published tiers, 60 devices falls past the 50-device plan into the next tier, $3,506 a month for up to 125 devices ($42,072 a year).

At 250 employees, compare quotes against Vendr’s Arctic Wolf data, which showed a median buyer paying $79,740 a year (range $24,469–$315,023) when we checked in November 2026. For MDR-only totals at this size, see our MDR cost for 100–250 employees.

At 1,000 employees, volume and term length matter more than the list rate.

Onboarding and setup fees

Expect a one-time fee for agent deployment, log source onboarding and runbook setup. Blumira charges a required $250 onboarding fee on its Detect edition and $500 on Respond, and includes it on Automate. One MSP’s published rule of thumb is that onboarding costs about one month of the service plan.

For full-scope MSSP contracts with SIEM and firewall onboarding, budget one to two months of the recurring fee (SecurityBudget estimate), plus your own staff’s time for access, approvals and tuning.

Contract terms and minimums

• Seat minimums. Huntress applies a 50-seat minimum per product on direct and reseller purchases, with no Huntress-required minimum when bought through an MSP.
• Term length. Arctic Wolf’s AWS listing offers 12-, 24- and 36-month terms, and Vendr reports that 60% of Arctic Wolf deals start as one-year contracts with renewal options.
• Discounts. Vendr reports 15–25% off list for single-year or smaller deals, and 20–35% for multi-year terms with 500+ endpoints.
• Month-to-month. Less common, but it exists: Security Arsenal offers month-to-month with 30 days’ notice, and a reduced rate for annual commitments.

What drives MSSP price

1. Device count and mix. Servers and firewalls cost more than laptops.
2. Response authority. Alert-only is cheapest; an MSSP that can isolate hosts and disable accounts costs more.
3. Log volume and retention. Thirty days of searchable logs and a year of retention are priced very differently.
4. Scope of managed controls. Each added control raises the rate: firewall, SIEM, vulnerability scanning, cloud, identity.
5. Compliance reporting. HIPAA, PCI DSS or CMMC evidence packs add analyst time.
6. Bundled tooling. Some quotes include EDR licenses; others assume you own them. Premium managed tiers are often quote-only; CrowdStrike’s pricing page lists Falcon Complete as “Contact sales”.
7. Term and volume. Multi-year and higher counts lower the unit rate.

Red flags in an MSSP quote

• A per-device price with no definition of “device”.
• “24/7 monitoring” with no response SLA or authority to contain.
• SIEM ingest or retention billed separately with no cap.
• Auto-renewal with an uncapped uplift.
• No commitment to return logs, detections and case history if you leave.
• Bundled licenses with no line-item breakout.

Questions to ask every MSSP

• What counts as a billable device, user or log source, and when are counts trued up?
• Can your analysts isolate a host or disable an account without calling us first?
• What is the contractual response time for a critical alert?
• Which log sources are included, at what daily volume, and what does retention cost?
• How many incident response hours are included, and what is the overage rate?
• What is the onboarding fee and timeline?
• What renewal increase is capped in the contract?
• What data do we get back at exit, and in what format?

When MSSP vs in-house makes sense

Round-the-clock coverage drives the math. A 24/7 in-house SOC needs 8–12 security FTEs; at about $168K loaded per FTE (BLS median wage plus overhead), that is $1.34M–$2.02M a year before tooling. The full managed security tier for a 1,000-person company is $360K in the example above.

An MSSP makes sense for most organizations under a few thousand employees, and for anyone without staff for nights and weekends. In-house or co-managed makes more sense if you already run a SIEM with engineers, operate specialized environments such as OT, have strict data-residency rules, or are large enough to staff shifts. Either way, keep one in-house owner for the contract, escalations and risk decisions.

To see where an MSSP fits against EDR, SIEM and staffing for your size, run the cybersecurity budget calculator or read the MDR cost guide.

FAQ

How much does an MSSP cost per month?

For most buyers, about $6–$35 per device or user per month. That is roughly $600–$2,100 a month for a 50-person company (60 devices), or $2,400–$9,000 for 250 employees (300 devices), based on the SecurityBudget estimates above. Small accounts often pay a minimum regardless of count.

What is the average cost of cybersecurity services for a small business?

There is no single published average, because services are billed in different units. For a 50-person company, managed security runs about $7K–$25K a year in our estimates. Project work is extra; penetration tests typically cost $5K–$50K each. See cybersecurity services pricing for the full list.

Is MSSP pricing per user or per device?

Both are common. Per device suits server-heavy or shared-device environments; per user suits staff with several devices each. Ask for both and compare the annual total for your actual counts.

What does MSSP platform pricing mean?

It usually refers to the tools an MSP uses to deliver security. That partner pricing is mostly unpublished. Huntress publishes MSRP but routes partner pricing to sales, and Blumira states that MSP pricing differs from its published editions. If a quote shows a separate “platform fee”, ask what it covers.