How much does cyber security cost for a small business in the UK?

Quick Answer

For a UK small business, the cost of cyber security depends on the size of the business and the level of protection required. Systems Secure currently starts from £35 per month for a sole trader, with packages from £204 per month for businesses with 1–9 people and £710 per month for businesses with 10 or more people.

For businesses that also need senior cyber security leadership, governance and strategic oversight, QuantumCare CISO starts from £1,200 per month.

The difference in price reflects what is included — from essential protection and visibility, through to managed monitoring, staff training, wider security support and, at the CISO level, leadership and governance.

Prices are correct at the time of writing and may change. Check the Systems Secure website for the latest packages and pricing.

The honest caveat: that range is wide because "cyber security" covers everything from basic protection on a handful of laptops to round-the-clock monitoring with staff training and certification. What follows is what you get at each end, so you can work out where you actually sit.

Why won't anyone tell me the price?

Cyber security prices vary because different businesses need different levels of protection. A sole trader with one laptop and Microsoft 365 is a very different job from a 30-person company handling sensitive client data, multiple systems and remote staff.

The price usually depends on things like how many people and devices need protecting, what systems you use, how much monitoring is required, whether staff training is included, and whether you need help with things such as Cyber Essentials or security questionnaires.

Some providers therefore prefer to quote after speaking to you first. That can be completely reasonable, but you should still be able to get a clear idea of the starting price and what is included before committing to a sales call.

A useful question to ask is:

“What is your cheapest package, what does it cost, and exactly what is included?”

A good provider should be able to answer that clearly.What am I paying for at the low end?

What do I get for £35 a month?

Systems Secure’s entry-level Sole Trader package starts at £35 per computer, per month. It is designed for someone running a business on their own who wants proper protection without paying for services intended for a larger organisation.

For £35 per computer, the package currently includes:

• 24/7 endpoint protection and threat detection

• Security monitoring

• Patch management to help keep software and security updates under control

• Web and DNS filtering to help block malicious and unsafe websites

• Annual security awareness training

• Direct access to ask the security team questions

• Setup and onboarding with no separate setup fee

This is more than basic consumer antivirus. The aim is to protect the computer, keep it patched, monitor for suspicious activity and block common threats before they become a bigger problem.

There are also clear limits. The Sole Trader package does not include things such as cloud backup, identity protection, continuous vulnerability assessment, proactive Microsoft 365 hardening or a monthly security report. Those are included in the higher-level packages where a business has employees and a wider security requirement.

For a one-person business, though, it gives you a sensible starting point without paying for a full managed security service you may not need.

What do I get from £204 a month?

Systems Secure’s Micro Business package is designed for businesses with 1–9 people using Microsoft 365 or Google Workspace. Pricing starts from £204 per month on a 12-month agreement, or £206 per month on a rolling monthly basis for one account.

The price is made up of a fixed £170 monthly security essentials programme, plus £34 per Microsoft 365 or Google account on a 12-month agreement, or £36 per account on a rolling monthly basis. All prices exclude VAT, there is no setup fee, and both options are paid monthly.

The Micro Business package currently includes:

• 24/7 endpoint protection and threat detection

• Patch management

• Identity threat detection and response

• Identity security posture management

• Security monitoring

• Cloud backup and recovery

• Web and DNS filtering

• Continuous security awareness training

• Continuous vulnerability scanning

• External vulnerability and attack-surface assessments

• Proactive hardening of computers and Microsoft 365

• Cyber Essentials and insurance readiness

• A monthly security report in plain English

• Direct access by phone, WhatsApp and email

The important difference from the Sole Trader package is that Micro Business protects not just the computers, but also the user accounts, identities and cloud services that small businesses increasingly depend on.

It does not include the higher-level governance services found in Business Pro, such as vCISO access, quarterly business reviews, policy packs, firewall and network-device protection or DMARC email-domain protection.

For a small team using Microsoft 365 or Google Workspace, this is the point where cyber security becomes a broader managed service rather than simply protecting individual computers.

What do I get from £710 a month?

Systems Secure’s Business Pro package is designed for businesses with 10 or more Microsoft 365 or Google Workspace accounts. Pricing starts from £710 per month on a 12-month agreement for 10 accounts. Rolling monthly is also available at a slightly higher per-account rate. All prices exclude VAT.

The price is made up of a fixed £370 monthly security programme, plus a per-account charge for each licensed user. On a 12-month agreement, the per-account rate is £34; on rolling monthly, it is £36. The first email domain is included, with additional domains charged separately.

Business Pro includes everything in the Micro Business package, plus:

• A named security lead

• Information security policy pack

• Quarterly business reviews

• Direct security line

• Cyber Essentials and insurance readiness

• Email domain protection using DMARC, SPF and DKIM

• External vulnerability assessment

• Network and attack-surface scanning

• Firewall and network-device protection

• Proactive hardening of computers, networks and cloud services

• 24/7 endpoint protection and threat detection

• Identity threat detection and response

• Security monitoring

• Cloud backup and recovery

• Continuous staff security awareness training

• Continuous vulnerability scanning

The main difference at this level is that you are no longer just buying security tools. You are also getting security leadership, governance and someone actively responsible for helping manage the organisation’s cyber security programme.

For a business with 10 or more people, especially one handling sensitive data, dealing with client security questionnaires, working towards Cyber Essentials or needing stronger oversight, Business Pro is the more complete managed security option.

Yes — we should add a fourth price section for QuantumCare CISO, but make it very clear that it is leadership, not a bigger software package. Your comparison page says exactly that, and notes that many CISO clients use one of the managed packages alongside it.

Paste this in:

What do I get from £1,200 a month?

Systems Secure’s QuantumCare CISO service starts from £1,200 per month and is designed for businesses with 10 to 250 employees that need someone to take ownership of cyber security at a senior level. It is priced by headcount and runs on a rolling monthly basis.

This is different from the other QuantumCare packages. There is no antivirus, monitoring, backup or protection software included. Instead, you are paying for a named, qualified Chief Information Security Officer to provide security leadership, governance and planning.

QuantumCare CISO currently includes:

• A named CISO

• Committed days each month

• A live risk register

• A costed 12-month security roadmap

• Information security policies

• Quarterly security reviews

• Customer security questionnaire support

• Cyber Essentials and Cyber Essentials Plus readiness

• ISO 27001 groundwork

• Cyber insurance renewal support

• Supplier and third-party security reviews

• Board-level reporting and security advice

• Direct access to your CISO during business hours

Pricing is based on the size of the business:

• 10–20 employees: £1,200 per month

• 21–50 employees: £2,000 per month

• 51–100 employees: £3,200 per month

• 101–150 employees: £4,000 per month

• 151–250 employees: £4,800 per month

All prices exclude VAT. There is no setup fee, nothing to pay upfront, and the service runs monthly with 30 days’ notice.

The important distinction is that Business Pro protects and monitors the business, while QuantumCare CISO provides the leadership and governance above it. A business may therefore use Business Pro and QuantumCare CISO together rather than choosing one or the other. Existing Business Pro clients only pay for the additional CISO work rather than paying twice for overlapping services.

For businesses larger than around 250 people, Systems Secure’s guidance is that it may make more sense to employ a full-time CISO rather than continue with a fractional service.

Which level of cyber security do I actually need?

The right level depends on your risk, the data you hold and how badly an incident would affect the business — not just the number of people you employ.

As a rough guide:

• Sole Trader is a sensible starting point if you work alone and mainly need your computer protected, patched and monitored.

• Micro Business is better suited to small teams that rely on Microsoft 365 or Google Workspace and need protection around user accounts, cloud services, staff training and vulnerability management.

• Business Pro makes more sense when security is becoming a bigger business issue — for example, you hold sensitive client data, need Cyber Essentials, complete customer security questionnaires or cannot afford significant downtime.

• QuantumCare CISO is for businesses that need senior security leadership, governance, policies, risk management and board-level guidance. It can sit alongside Business Pro rather than replacing it.

You should consider moving to a higher level of support if any of these apply:

• You hold sensitive client, financial, legal, medical or HR information.

• Customers or insurers regularly ask you to prove how you manage cyber security.

• A day offline would cause serious financial or operational problems.

• You have already had a cyber incident or a serious near miss.

• You need Cyber Essentials or other security assurance for contracts and tenders.

• Senior management needs someone to take ownership of cyber security rather than leaving it between IT, management and external suppliers.

The aim is not to buy the biggest package available. It is to choose the level of protection and support that matches the risk your business actually faces.

What else should I budget for?

There are a few costs that may sit outside the monthly cyber security service itself, so it is worth checking these before you compare providers.

Cyber Essentials certification.
Cyber Essentials certification has its own fee, paid to the certification body. Some cyber security providers include the preparation and support within their monthly service, while others charge separately.

Cyber insurance.
Cyber insurance is priced separately and will depend on things like your business size, sector and level of cover. Policies often come with security requirements, such as multi-factor authentication, tested backups, patching and staff training. If those conditions are not met, an insurer may question, reduce or refuse a claim.

One-off project work.
Some work may fall outside the normal monthly service, such as a larger security review, remediation after inheriting poorly configured systems, a Microsoft 365 migration or other project work. This should be quoted separately and clearly before the work starts.

The important thing is to ask what is included in the monthly price and what is not. A lower monthly fee can look attractive until you discover that important work, certification support or project costs are charged separately.

What should I watch out for in a cyber security quote?

Before you sign anything, there are four things worth checking carefully.

How long am I committed for?
Check the minimum term and notice period rather than looking only at the monthly price. Some providers offer a lower price in return for a longer commitment. Systems Secure offers both rolling monthly and 12-month options on some packages, so you can choose the arrangement that suits your business.

What happens if the service isn't right for me?
Look at the cancellation terms and whether there is any guarantee or trial period. Systems Secure offers a three-month money-back guarantee, giving you time to decide whether the service is right for you.

Who will actually look after my business?
Find out whether you will have a named person who understands your business or whether you will simply deal with whoever picks up the next ticket. Systems Secure deliberately limits the number of managed security clients it works with so that clients receive a more personal service.

How is the price calculated?
Check whether the quote is fixed, charged per user, per device, or made up of a base fee plus additional users. Per-user pricing will naturally increase as your team grows, so make sure you understand how adding staff will affect the monthly cost.

The cheapest quote is not always the best value. Compare what is included, who is responsible for it, how quickly someone will act when something goes wrong, and what additional charges you might face later.

In short

• Small business cyber security can start from £35 per month for a sole trader, with managed packages increasing as the size of the business and level of protection grows.

• Micro Business starts from £204 per month, while Business Pro starts from £710 per month.

• Businesses that need senior security leadership can add QuantumCare CISO from £1,200 per month.

• Choose the level of service based on your risk, the data you hold and the impact an incident would have on the business, not simply headcount.

• Check what is included in the monthly fee and whether things such as Cyber Essentials certification, cyber insurance or one-off project work are charged separately.

• Before signing, check the contract term, cancellation terms and how the price changes as your business grows.

• Systems Secure publishes its pricing openly and offers rolling monthly or 12-month options on applicable packages, along with a three-month money-back guarantee.

• Prices can change, so always check the Systems Secure website for the latest packages and pricing.