What Cybersecurity Costs

Let me ask you a question.

When you shop for health insurance, do you look at the monthly premium and say: I do not need emergency room coverage – I will just drive to urgent care after an accident. I do not need the root canal rider – I will deal with it if it happens. I do not need the higher coverage tier – I will take my chances and save the $200 a month.

You do not. Because those are the things that protect you when everything goes wrong. You do not shop for health insurance by removing the coverage you hope you never need.

Cybersecurity works exactly the same way. And the conversation about what it costs only makes sense once you understand what you are actually buying.

The Conversation That Kills the Budget Discussion

When business owners ask what cybersecurity costs, the conversation is almost always dead before it starts. A number gets put on the table, it does not fit the mental budget they walked in with, and the meeting ends with a polite “let me think about it.”

What never gets discussed is what the alternative actually costs. And we covered that in detail when we talked about the True Downtime Cost framework – two payroll cycles, regulatory fines, identity protection for every customer in your database, hardware replacement, software rebuilding, and the cyber insurance policy that in all likelihood will not pay out.

The question is not whether you can afford cybersecurity. The question is whether you could afford 30 days with the doors locked.

With that framing in place, here is what a real security stack actually costs for a 50-person organization.

The Real Numbers

This is not a vague range pulled from a vendor website. These are real products at real prices.

| Product | What It Does | Annual Cost (50 Users) |
|—|—|—|
| Microsoft 365 Business Premium | Email, identity, encryption, MFA | $13,200 |
| SentinelOne Core or CrowdStrike Falcon Go | Next-gen EDR / endpoint protection | $3,000 – $4,000 |
| Cisco Meraki or Fortinet Firewall License | Perimeter security and encrypted VPN | $400 – $700 |
| Veeam or Datto SaaS Backup | Cloud data backup and recovery | $1,800 – $2,400 |
| 1Password Business or Bitwarden | Password management | $2,400 – $3,000 |
| Total Annual Run Rate | | $20,800 – $23,300 |

One note on the firewall: the figures above reflect the annual software and licensing cost only. The physical hardware is a one-time purchase of roughly $500 to $900.

For a 50-person organization, that works out to roughly $415 to $465 per employee per year – or just over a dollar a day per person to protect the entire operation.

What You Are Actually Buying – In Order of Priority

The number only makes sense when you understand what each layer does and why the sequence matters. Here is how I stack rank these for every client, and why.

1. Microsoft 365 Business Premium – $13,200/year

This is the foundation everything else sits on. It handles company email, user identities, and data encryption. But the reason it is first on the list is simpler than any of that: it gives you Multi-Factor Authentication.

If an attacker steals an employee password – and password theft is one of the most common entry points in any attack – MFA is the single strongest line of defense stopping them from walking into your systems. One stolen password should not hand over the keys to your payroll platform, your customer database, or your digital records. MFA breaks that chain.

Start here. Everything else builds on top of this.

2. SentinelOne Core or CrowdStrike Falcon Go – $3,000–$4,000/year

Traditional antivirus does not catch modern ransomware. It was not built to. An Endpoint Detection and Response tool – EDR – is an active guard on the device itself, watching behavior in real time rather than scanning for known threats from a list.

Think about what your operation actually looks like. Employees on laptops in the field. Tablets connecting to customer Wi-Fi networks or cellular hotspots. Remote workers logging in from home. Every one of those devices is a potential entry point. If someone clicks a bad link while they are out on a job, the EDR isolates that device instantly – before the infection can travel back through the network and reach everything else.

3. Cisco Meraki or Fortinet Firewall License – $400–$700/year

This protects the perimeter of your physical location and handles encrypted VPN connections for anyone accessing the network remotely. It is the hardened front door on your digital operation – ensuring that the internet connection feeding your office is not an open invitation and that remote connections back to your systems are completely locked down.

At $400 to $700 a year, this is the most cost-effective item on the list relative to what it protects.

4. 1Password Business or Bitwarden – $2,400–$3,000/year

Human behavior is one of the largest security vulnerabilities in any organization. Without a password manager, employees will reuse the same passwords across every platform they touch – payroll software, dispatch systems, supplier portals, email. One compromised account on one platform becomes access to all of them.

A password manager forces unique, complex passwords for every system. It removes the human variable from one of the most exploited entry points attackers use.

5. Veeam or Datto SaaS Backup – $1,800–$2,400/year

Backup is last on this list not because it is least important – it is not – but because the first four items are designed to prevent an attack from succeeding. Backup is what you reach for when prevention was not enough.

Microsoft keeps your cloud data live and accessible. What they do not do is protect you if an employee accidentally or intentionally deletes years of records, or if ransomware encrypts your files before the platform can respond. A proper backup solution means you can restore everything from a clean point in time without negotiating with an attacker.

This is your safety net. You want it there. You just want to need it as rarely as possible.

The Roadmap Conversation

When a business owner sees $20,800 and says they cannot afford it, the conversation is not over. It is just starting.

Nobody builds a complete security stack in a single budget cycle. The layered approach exists precisely because we know that. We start with the highest-impact items first – Microsoft 365 and EDR – and we build toward the full stack as fast as the budget realistically allows.

The honest answer to “how long will this take?” is: we need to be there as fast as possible. Not because it makes a good sales pitch. Because the threat is not waiting for your budget cycle to close.

Most business owners, when they understand the layered approach and the reasoning behind the sequence, do not walk away. They ask if they can spread it over the next 12 to 24 months. And that is a real conversation with a real path forward.

The Number in Context

Here is what $23,300 a year actually looks like next to the alternative.

Two payroll cycles during a 30-day outage. FTC fines and breach notification costs. Identity protection for every customer in your database for a minimum of one year. Hardware replacement across every device on the network. Weeks of software rebuilding and system migration. And the cyber insurance payout you were counting on that will not come through because the application did not reflect what was actually in place.

That is not a cybersecurity expense. That is a business-ending event disguised as a line item.

Nobody removes the emergency room coverage from their health insurance to save $200 a month. The math does not work, and somewhere underneath the objection, most people already know it.

The conversation about what cybersecurity costs is really a conversation about what you are worth protecting.

—

Kelly Hansen is the author of The IT Dilemma: Why Good Businesses Fail During Cyberattacks, Outages, and Technology Disasters – and How to Prevent It. Have a question about your own environment? Reach out: Contact, or connect with me on LinkedIn.