Small Business Cybersecurity Cost in 2026: What 30 Real Engagements Actually Spend
Alexander Sverdlov
Security Analyst
Key Takeaways
- The floor is not zero. Even a 10-person firm with no compliance exposure and no enterprise customers should plan for $18,000 to $32,000 per year once tooling, identity hardening, backups, training, and a few advisory hours are honestly counted. Anyone quoting $5,000 is leaving out internal time or skipping controls.
- Real costs split into five maturity tiers driven by employee count, regulatory exposure, and customer security demands: Foundation ($18K-$32K), Operating Baseline ($36K-$68K), Customer-Audit Ready ($72K-$130K), Regulated or SOC 2 Active ($140K-$210K), and Multi-Framework or Critical-Industry ($220K-$420K).
- Founders consistently underestimate four cost buckets: internal staff time during readiness, recurring license growth as the team scales, year-two evidence collection, and the gap between "tool deployed" and "tool tuned." Across our sample these four lines add 35 to 60 percent to the original budget.
- The single largest cost lever is scope discipline. Firms that draw a tight boundary around regulated or audited workloads pay 40 to 60 percent less than firms that let the whole business drift into scope.
- Cyber insurance shifts the math two ways. Insurers now mandate specific controls (MFA, EDR, immutable backups, email security), which means a defensible program costs roughly the same with or without a policy. The premium savings from a credible posture run 30 to 55 percent.
- If you have under 50 employees and your only driver is one big customer asking questions, the right pattern is a focused 14-day audit plus a fixed-fee remediation plan, not a full vCISO retainer. Anything heavier is overspend; anything lighter does not close the deal.
Last month a founder forwarded us a thread from a small-business owners' Slack group she belongs to. The thread had 84 replies. Someone had asked, "What is everyone budgeting for cybersecurity this year?" The answers ranged from "I pay $29 a month for antivirus" to "We just signed a $340,000 SOC 2 program." The same question, the same business stage, the same employee count band. A 12x spread in real, posted numbers from people who appeared to know each other.
She forwarded us the thread with one line: "I have 47 employees, a healthcare prospect asking for HIPAA evidence, and a renewal on my cyber insurance in 90 days. None of these numbers feel right for me. What am I supposed to spend?"
This piece is the long answer we sent her. It is built from 30 small-business engagements we have run in the last 18 months across legal, healthcare-adjacent, fintech-adjacent, manufacturing, professional services, and SaaS, plus the cyber insurance application questionnaires and renewal letters our clients have shared with us. The cost ranges are real numbers we have either quoted, negotiated, or observed competing quotes against. The tiers are how those numbers actually cluster, not a marketing taxonomy.
If you are a small business owner trying to budget for security in the next twelve months, this is the conversation we would have if you called us. It will not tell you to spend more than you need; in two of the five tiers it will tell you to spend less than the typical first quote.
Section One
The Honest Floor for Small Business Cybersecurity
Every quarter we get the same call from a founder who has been told that cybersecurity for a small business "should cost around $500 a month." The number is plausible enough that it survives in folk wisdom and trade-press articles. It is also wrong by a factor of three to ten once you count the work honestly.
There are three reasons the headline number is too low. First, the antivirus and email filtering line is what most people picture when they think of "cybersecurity spend," but that line is now a small fraction of a defensible program. Second, the internal time required to operate even a minimal program (running access reviews, responding to phishing reports, patching, reading the SIEM, doing tabletop exercises) is real labor that someone in the company is doing or failing to do. Third, the moment you have a single enterprise customer, a regulated industry exposure, or a cyber insurance policy, the controls catalogue expands sharply, and so does the cost.
A useful way to think about the floor is the cost of operating a credible program at 10 to 15 employees with no compliance pressure and no enterprise customer asking questions. Even at that scale, an honest accounting includes:
- Identity and email hardening. Microsoft 365 Business Premium or Google Workspace Business Plus, conditional access, MFA across the board, DMARC at p=reject, audit logging on. Roughly $25 to $35 per user per month, plus eight to twelve hours of one-time setup if done well.
- Endpoint protection (EDR). Real EDR, not legacy antivirus. SentinelOne, CrowdStrike Falcon Go, Microsoft Defender for Business, or similar. Roughly $5 to $11 per endpoint per month.
- Backups with tested recovery. Datto, Veeam, Acronis, or native cloud immutable backup. $1,500 to $5,000 per year for a small environment plus the quarterly half-day to actually test the restore.
- Security awareness training. KnowBe4, Hoxhunt, or equivalent, with monthly phishing simulations. $2 to $4 per user per month.
- Password manager. 1Password, Bitwarden Teams, Dashlane. Roughly $3 to $8 per user per month.
- Initial audit and a written program. A one-time outside review with a remediation plan, a written information security policy, an acceptable use policy, an incident response plan. Roughly $5,000 to $12,000 the first year.
- Advisory hours. A few hours a month with a senior practitioner to handle the things tools cannot decide on their own: vendor reviews, incident triage, the occasional customer questionnaire. Roughly $300 to $800 a month.
- Internal time. Whoever owns IT in the business, even on a fractional basis, spends 30 to 80 hours a year on security-specific work. Costed at $50 to $120 an hour, that is $1,500 to $9,600 of labor that gets buried in payroll instead of in the security line.
Add it up at a 12-person company and you land between $18,000 and $32,000 per year all-in. That is the honest floor in 2026 for a small business that wants to operate a defensible program. Anything less is either an incomplete picture or a program that will fail under examination by a serious customer, an insurer, or an attacker.
Section Two
The Five Tiers: What Each Buys and Who Belongs There
Across 30 engagements the cost numbers cluster cleanly into five tiers. The tier you belong in is driven by three variables: employee count, the security expectations your customers are flowing down, and any regulatory framework that is in scope. Tooling choices matter less than people assume; the same SentinelOne licence costs the same at every tier. What changes is the depth of operations, the documentation overhead, and the frequency of third-party assurance.
Tier 1 · Foundation
$18,000 to $32,000 per year
Who belongs here: 5 to 25 employees. No regulated industry exposure. No enterprise customers sending security questionnaires. No cyber insurance policy with required controls. Typical examples: a 12-person professional services firm, a 9-person early-stage SaaS pre-paying-customer, a 20-person retail or e-commerce business.
What it buys: Microsoft 365 Business Premium or Google Workspace Business Plus, EDR on every endpoint, immutable backups with quarterly recovery tests, security awareness training with monthly phishing simulations, a password manager, a written information security policy and incident response plan, and four to six hours a month of senior advisory.
What it does not buy: SOC 2 readiness, penetration testing on a regular cadence, a SIEM or managed detection and response, a vCISO retainer with named accountability, or formal customer audit support.
Tier 2 · Operating Baseline
$36,000 to $68,000 per year
Who belongs here: 25 to 60 employees. Possibly one or two enterprise customers who have sent a short security questionnaire. May or may not carry cyber insurance. No active SOC 2 or HIPAA program. Typical examples: a 40-person agency with two Fortune 1000 clients, a 50-person staffing firm with healthcare-adjacent placements, a 35-person SaaS company in the year before their first SOC 2 push.
What it adds over Tier 1: A real annual external security audit (not a self-assessment), an annual external vulnerability assessment, a managed detection and response option layered onto the EDR, vendor management workflow with documented reviews, a real access-review cadence, and a 6-month vCISO retainer averaging two days a month.
What it does not buy: A finished SOC 2 Type 2 report, an annual penetration test report bound for an enterprise customer's procurement, or a 24/7 SOC engagement.
Tier 3 · Customer-Audit Ready
$72,000 to $130,000 per year
Who belongs here: 40 to 100 employees. Three or more enterprise customers actively reviewing your security posture. Procurement teams asking for SIG Lite or CAIQ responses. Cyber insurance with a multi-page controls questionnaire. Typical examples: a 60-person legal services firm, a 75-person fintech-adjacent platform, an 80-person managed service provider with healthcare and financial clients.
What it adds over Tier 2: A trust portal with eight to twelve maintained documents, an annual external penetration test with a customer-shareable report, SOC 2 Type 1 readiness work in flight (or a Third-Party Security Attestation Letter as the bridge), an active vendor risk program with a documented register, the first wave of policy automation (drift detection on identity, IaC scanning), and a vCISO retainer with named accountability and four to eight hours a week.
What it does not buy: A finished SOC 2 Type 2 or ISO 27001 certificate, regulator-grade documentation, or HIPAA risk analysis depth.
Tier 4 · Regulated or SOC 2 Active
$140,000 to $210,000 per year
Who belongs here: 50 to 150 employees with at least one of: an active SOC 2 Type 2 program, HIPAA covered-entity or business-associate obligations, PCI DSS scope, state breach notification laws regularly invoked (e.g., NY DFS, California, Massachusetts), or contractual cybersecurity requirements from a major financial customer. Typical examples: a 90-person health-tech SaaS in SOC 2 + HIPAA, a 120-person fintech with state money transmitter licences, a 70-person law firm with high-value M&A clientele.
What it adds over Tier 3: A full SOC 2 Type 2 audit cycle in motion, formal evidence collection with a platform like Vanta or Drata layered with human judgment, an annual penetration test plus an interim re-test of remediations, quarterly tabletop exercises, a real BCDR program with tested annual exercises, third-party application security review on critical platforms, and a vCISO retainer with full named-individual accountability.
What it does not buy: Multi-framework simultaneous certification, dedicated 24/7 SOC, or red-team-style adversarial testing on a fixed cadence.
Tier 5 · Multi-Framework or Critical-Industry
$220,000 to $420,000+ per year
Who belongs here: 100 to 250 employees and at least two of: SOC 2 + HIPAA + ISO 27001 simultaneously, CMMC Level 2 or NIST 800-171 with a DoD prime relationship, NYDFS Part 500 obligations, healthcare with PHI volume that triggers OCR scrutiny, or fintech operating in regulated jurisdictions with banking-supervision flowdown. Typical examples: a 130-person defense subcontractor, a 180-person digital health firm, a 200-person regtech SaaS serving banks.
What it adds over Tier 4: Multi-framework readiness and audit calendar, a finished CMMC assessment or its equivalent, dedicated MDR or co-managed SOC, threat-intelligence subscriptions and quarterly purple-team exercises, dedicated security engineer time or a small in-house team, and a vCISO arrangement that approaches a part-time CISO function with board reporting.
What it does not buy yet: A full-time CISO hire. Most firms in this tier still find a senior vCISO with an implementation pod more cost-effective than a single in-house hire.
Two notes on the ranges. First, the bottom of each tier is achievable with disciplined scope and a senior-led provider; the top of each tier is what you pay when you let scope drift, choose the most expensive tools at every line, or hire the most prestigious firm in each category. Second, the jumps between tiers are large enough that founders sometimes ask whether they can "skip" a tier. They cannot; what changes is how quickly they move through one and whether they buy what they need for the next.
Section Three
Where the Money Actually Goes
Most small business owners look at cybersecurity cost as a single line. The reality is closer to seven buckets. The proportions change as you move up the tiers, but the buckets stay the same. Knowing them helps you push back on a vendor quote that loads everything into one mystery line item.
| Cost bucket | What it covers | Tier 2 typical | Tier 4 typical |
|---|---|---|---|
| Identity and email platform | M365 Business Premium or Workspace Business Plus, conditional access, DMARC enforcement, audit logs | $14K to $22K | $30K to $54K |
| Endpoint (EDR + MDR option) | CrowdStrike Falcon Go, SentinelOne, or Defender for Business plus optional MDR | $3K to $8K | $14K to $32K |
| Backups, BCDR, recovery testing | Immutable cloud backup plus an annual restore exercise | $2K to $6K | $8K to $18K |
| Awareness training and phishing | KnowBe4, Hoxhunt, or equivalent with monthly simulations | $1.5K to $4K | $4K to $9K |
| Audit and assurance | External annual audit, penetration test, SOC 2 / HIPAA / PCI / Attestation Letter | $8K to $18K | $45K to $95K |
| vCISO and advisory | Named senior practitioner, charter, vendor reviews, customer questionnaires | $6K to $18K | $36K to $72K |
| Internal staff time (loaded) | IT lead, office manager, founder time on access reviews, phishing reports, tabletops | $8K to $16K | $22K to $48K |
If your vendor quote does not show these seven buckets separately, ask for them separated. The quote that hides internal time is the quote that bills surprise hours in month seven. The quote that lumps audit and vCISO into "advisory" is the quote that runs out of audit budget before the customer questionnaire response is due.
Section Four
Which Tier Are You Actually In
Founders frequently misplace themselves by a tier in either direction. The most common error is sitting in Tier 3 cost but spending Tier 2 dollars; the second most common is buying Tier 4 services when Tier 2 would defend the same revenue. The decision tree below is the same one we walk through on a first call.
Section Five
Five Mistakes That Double the Bill
1. Buying tools before knowing the controls catalogue
A panicked founder buys a SIEM, an MDR, a vulnerability scanner, and a posture-management tool in the same quarter because every vendor demo promised SOC 2 readiness. Six months later half the tools are unconfigured, one duplicates another, and the SOC 2 program still has not started. The right order is: read the controls catalogue, decide what control each tool implements, then buy. Across our sample this single mistake adds $24K to $60K of recurring spend on tools that produce no evidence in the eventual audit.
2. Confusing automation with operations
Vanta, Drata, or Secureframe will collect evidence and track configuration. They will not run your access reviews, write your incident response, decide your risk appetite, or sit with your customer's CISO when the questionnaire comes back. Companies that buy the platform and skip the human end up with a green dashboard and a real audit finding. Plan for two-thirds tool and one-third human at Tier 3 and above.
3. Letting scope drift across the whole business
If your regulated workload sits in a single application and a small enclave of users, your SOC 2 or HIPAA scope can stay tight. If you let the entire production network, the entire sales laptop fleet, and every contractor's home VPN into scope, you have just doubled your audit cost and tripled your evidence collection burden. Across our sample, scope discipline is the single highest-leverage cost decision in Tier 4.
4. Hiring the wrong shape of consultant
A 40-person business does not need a 200-person consulting firm with a partner-led overhead, and a 90-person regulated business does not need a solo independent who has never been in a SOC 2 audit room. Match the shape of the consultant to the shape of your business: senior practitioner with a small implementation pod for most small businesses, mid-market specialist for the regulated 100-plus, big firm only when the board wants the logo.
5. Forgetting cyber insurance is now part of the controls catalogue
Insurers will not write you a policy without MFA, EDR, immutable backups, an email security gateway, and an incident response retainer. If your renewal is in 90 days and your controls do not match, your premium goes up by 30 to 70 percent or your application is declined. Build to the insurer questionnaire as a free dry run for any future audit; the controls overlap with SOC 2 and ISO 27001 by 60 to 80 percent.
Section Six
The First 90 Days: What to Buy, In What Order
For a small business starting from a low baseline, the order of operations matters more than the headline budget. Done in the right order, the program defends itself against the most likely incident scenarios in the first 30 days, satisfies the basic insurer questionnaire by day 60, and is ready to answer an enterprise customer questionnaire by day 90. Done in the wrong order, the same dollars produce a posture that fails at any of those gates.
A practical implication: if your vendor's proposal does not start with identity, MFA, and EDR in the first 30 days, ask them why. There are valid reasons (e.g., you already have those in place), but if they are leading with a SIEM or a SOC 2 platform while your sales team still shares passwords in Slack, the project will produce slides not safety.
Section Seven
Cyber Insurance Changes the Math
In 2026 a small business cyber insurance policy is no longer a passive line item on the renewal binder. Underwriters now require specific controls, run external scans on your perimeter before quoting, and price the premium against your answers to a 25- to 60-question controls assessment. A poorly-prepared application produces a premium 30 to 70 percent above market, a sub-limit on ransomware, or a flat decline.
The five questions every credible insurer now asks, in roughly this order:
- MFA on every privileged account, email account, and remote access. "Yes everywhere" is the only answer that does not trigger a follow-up. "Yes on admin only" is now a finding.
- EDR with managed detection on every endpoint and server. Legacy antivirus is no longer credited. Some carriers explicitly require named EDR vendors.
- Immutable, off-network backups tested at least annually. The 3-2-1 backup pattern with a documented restore test is the minimum bar.
- Email security with DMARC at p=reject and impersonation protection. Business email compromise is the modal claim. Insurers price it explicitly.
- An incident response retainer or a documented IR plan with tested phone numbers. If your plan says "call our IT guy" with no out-of-hours number, that is a flag.
A defensible Tier 2 program covers all five answers cleanly. The premium difference between a credible answer set and a poor one, for a typical 50-person business with $10M revenue, runs $8K to $22K per year. That is meaningful relative to the cost delta between Tier 2 and Tier 3, and is often the cheapest argument for moving a Tier 1 firm into Tier 2.
Frequently Asked
FAQ
What is the absolute minimum a 10-person business should spend?
All-in, $18,000 to $22,000 per year if internal time is honestly counted. About $12,000 in licences and tools, $5,000 to $7,000 in advisory and a one-time audit, and $1,500 to $3,500 in loaded internal labor. Going lower than this means either skipping internal time (which is dishonest accounting) or skipping a control your insurer or a future customer will eventually require.
Can I skip SOC 2 and use the Third-Party Security Attestation Letter instead?
For one or two customers, yes. The Attestation Letter is a credible bridge for procurement teams that need a third-party signal but cannot wait twelve months for SOC 2 Type 2. Beyond two or three enterprise customers, the attestation pattern starts to fail because procurement teams begin asking for the actual SOC 2 report or its ISO 27001 equivalent. We use the attestation for Tier 2 firms with one big customer and a 90-day deadline; we recommend committing to SOC 2 once the third enterprise customer hits the pipeline.
How much should I budget for the customer questionnaire response cycle?
For a 40- to 80-person firm answering one significant questionnaire every six to eight weeks, plan for 12 to 24 hours of internal time per response, plus 4 to 8 hours of senior advisory if the questionnaire touches HIPAA, PCI, or regulated finance language you do not handle in-house. That works out to $8,000 to $18,000 per year of pure questionnaire-response capacity at Tier 3. A maintained trust portal cuts that by 50 to 70 percent within the first six months.
Is a vCISO really worth it at our size?
A vCISO is worth it from Tier 2 upwards if the role is real, the named individual is senior, and there is an implementation pod behind the name. Below 25 employees, advisory hours are usually enough; above 25 employees, the vCISO frame is what produces the deliverables an insurer or customer will accept. We tell early-stage founders not to buy a vCISO retainer if all they want is monthly office hours; we tell 50-person firms with three enterprise customers that a retainer at $4,000 to $8,000 a month is cheaper than the alternative cost of failing a procurement review.
When does it make sense to hire a full-time security person?
In our data, the inflection point sits around 120 employees with a Tier 4 or Tier 5 profile, two or more frameworks in flight, and quarterly board reporting on security. Below that, a senior vCISO with a small implementation team produces more output per dollar than a single junior-to-mid hire. Above that, a senior in-house security engineer plus a vCISO oversight relationship is usually the next stop, not a full-time CISO yet.
My MSP says they handle security. Is that enough?
For Tier 1, often yes, provided the MSP genuinely delivers MFA, EDR, backup, and patching with documented results. For Tier 2 and above the gap opens quickly: an MSP does not write your incident response plan, run your tabletop, fight your insurer on the controls questionnaire, or sit with a customer's procurement team. The pattern that works for Tier 2 to Tier 4 firms is to keep the MSP doing IT operations and add a separate cybersecurity consultancy that handles governance, audit readiness, and customer-facing security work. The two roles are not the same.
Get a realistic budget on a call
Fixed-fee audit. Honest tier placement. No multi-year retainer to learn the answer.
If you are looking at three different vendor quotes spanning $30K to $240K and they all sound plausible, that is exactly the conversation we have most often. The first call includes a written read of which tier you are actually in, what to cut from the highest quote, and what is missing from the lowest one. If we are not the right fit, we will say so on the call.
Book a 30-minute call
Alexander Sverdlov
Founder of Atlant Security. Author of 2 information security books, cybersecurity speaker at the largest cybersecurity conferences in Asia and a United Nations conference panelist. Former Microsoft security consulting team member, external cybersecurity consultant at the Emirates Nuclear Energy Corporation.