This market bundles security into its marketing and prices it separately in its contracts, which is why a single per-seat number for managed IT plus security almost never exists. The lines are quoted on different units: a seat for endpoint cover, a log source or a data volume for monitoring, an endpoint for detection and response, and a day rate or a monthly retainer for the advisory piece. Averaging them into one figure produces a number that describes nothing, so they are read and reported apart here.
What each IT security solutions for business line is priced per
Endpoint protection and management are usually inside the per-seat managed fee, or a small addition to it. Monitoring priced as a service is quoted per log source, per endpoint or per gigabyte ingested, which is why two quotes for the same building can differ by a multiple. Detection and response is normally per endpoint per month. The advisory line, sold as a fractional security officer, is a monthly retainer for a stated number of days rather than a per-seat charge.
Why the bundle hides the number, and what IT support pricing should be read as
A provider that sells security as part of the managed contract has a commercial reason not to line-item it, and a buyer who accepts the bundle cannot tell whether they are paying for a staffed operation or for a dashboard nobody watches. Ask for the security line priced separately even if you intend to buy it bundled. If a provider will not separate it, that is itself information about how much of it there is.
What to ask before comparing two security quotes
Ask who reads the alerts and at what hours, because the difference between a tool and a service is a human being at three in the morning. Ask what the provider does when something is found rather than only what it detects, since containment is the expensive half and is often out of scope. Ask what data is retained and for how long, and what happens to it when the contract ends. Those three answers explain most of the spread between quotes.
Where cyber security managed services sit against the base contract
Of the 29 IT support providers read for this record on 10 September 2026, seven publish a per-seat figure for the base managed contract at all, and none of them publishes a separate figure for the security line. That is the finding rather than an omission: the part of the contract most often sold on fear is the part this market is least willing to price in public, so a buyer has to ask for it as a line and refuse a single blended number.
Questions people ask about managed security service provider pricing
Is security included in a managed IT contract, or is a cybersecurity services provider separate?
Endpoint protection and patching usually are. Monitoring, detection and response, and the advisory line are usually separate, and they are the expensive ones.
What is SOC-as-a-service pricing based on?
Commonly per log source, per endpoint or per gigabyte of data ingested. The unit matters more than the rate, because the same building produces very different counts under each.
How does CISO-as-a-service pricing work?
It is quoted as a monthly retainer for a stated number of days rather than per seat. Ask what the days are spent on and what is delivered, in writing.
Do any providers publish security or SOC pricing?
None of the 29 read for this record publishes a separate figure for the security line, though seven publish one for the base managed contract.