How much does managed cyber security cost a small UK business?

With us, managed cyber security for a small business costs from £6 to £23 per user per month, excluding VAT, depending on how much monitoring and response you want. Protection with a 24/7 team of security analysts (MDR) is £13 per user per month: £195 a month for a 15-person business, before VAT. Servers are priced separately.

Prices vary between providers, and many don't publish them at all. Ours are below, with worked examples, so you can compare like for like.

Our prices

Every level runs on the same Sophos platform and the same monthly invoice. Each includes everything in the level below it.

All prices exclude VAT. Servers cost more than laptops because they run critical systems and need protection tuned for them; our server protection page explains what's included. If you're not sure which level you need, our guide to MDR vs EDR vs XDR explains the difference.

Worked examples

Here's what that comes to each month for three typical small businesses, excluding VAT:

For your own numbers, use the price calculator on our security page. It uses the same prices we bill.

What else you might add

Device protection is where most businesses start. Depending on how you work, you might add some of these, each priced per user per month unless shown otherwise:

• Email security: from £4. Filters phishing and impersonation before it reaches your team.
• Phishing simulation and training: from £4.
• Identity threat detection: from £8. Spots stolen passwords and suspicious Microsoft 365 sign-ins.
• Disk encryption: from £2.
• Mobile device protection: from £3.
• Firewall: from £22 per device per month, plus the hardware.

You don't need all of them. Most small businesses start with device protection at the right level, then add email security, because that's where most attacks begin.

What isn't in the monthly price

We'd rather you knew now than found out later:

• Installation, if you want us to do it. You or your IT provider can deploy the protection yourselves. If you'd rather we did it, we quote it at our standard day rate and agree it with you before any work starts.
• Hardware, such as a firewall, if you need one.
• Incident response below MDR Plus. If you're attacked, emergency response is quoted for the incident. MDR Plus includes it with no hourly cap.

There's no management fee on top and no minimum contract: we bill monthly.

Is it worth it?

In the government's Cyber Security Breaches Survey 2025/26, 46% of small businesses reported a cyber breach or attack in the previous 12 months. Phishing was the most disruptive kind for 69% of businesses that had one. The survey also found that most incidents cost little, while a minority are repeated or have extremely high costs.

That's the case for protection in a nutshell: you're paying to make sure you aren't in that minority. A ransomware attack that stops a small business for a week costs far more than a year of protection, before counting lost data, lost clients or the time it takes to recover.

The other comparison is with doing it yourself. Watching for attacks around the clock takes a team working in shifts, which almost no small business can afford. MDR shares a specialist team across thousands of organisations, which is why it costs a few pounds per person rather than several salaries.

Questions to ask any provider

Whoever you choose, ask these before you sign:

1. What exactly is included in the per-user price? Antivirus only, or investigation and 24/7 monitoring too?
2. Who looks at the alerts at 2am on a Sunday? If the answer is "you get an email", that's antivirus, not managed security.
3. Is there a minimum term, a setup fee or a management fee?
4. What happens, and what does it cost, if we're attacked?
5. How are servers priced? They're often charged separately, and at a higher rate.

If you'd like a quote for your exact setup, tell us a bit about your business or get started online.

< Back to Guides