Managed security service provider pricing follows four models, and knowing which one a quote uses matters more than the headline figure, because each model scales against a different fact about your organisation. Per-user pricing bills each person, whatever they use; per-device bills each protected machine; data-volume pricing bills the telemetry the provider ingests, common where a security monitoring platform sits underneath; and flat tiers bundle a size band into one monthly number. Underneath every model sits tooling the provider licenses or you bring: for scale, CrowdStrike Falcon Go lists at $59.99 per device billed annually and Microsoft Defender for Business at $3.00 per user per month paid yearly, both licensed list prices read for these guides, and provider fees stack watching and response on top of tooling in that range. This guide walks each model's arithmetic, the quiet cost drivers quotes omit, and the worksheet-style questions that make two quotes comparable.
The four models and their arithmetic
Per user: one price times headcount, covering each person's devices to a stated limit; scales with hiring, kind to device-heavy people, cruel to shared-workstation shops. Per device: one price times protected machines, servers frequently priced higher; kind to lean teams, punishing for organisations with a machine surplus. Data volume: a platform fee driven by gigabytes of logs ingested; predictable only after a baseline month, and the model where a chatty firewall can double a bill. Flat tier: one number for up-to-N people; simplest to budget, and the model where reading what is excluded matters most, because the tier's economics depend on most clients not using everything.
The quiet cost drivers
Five lines move real-world totals more than the base rate: onboarding, often a month's fees or more, sometimes waived against a longer term; after-hours response, included in some contracts, billed hourly in others, and the difference appears at the worst moment; incident work beyond a stated cap, where the retainer's hours run out mid-crisis; tooling ownership, whether the endpoint licences are yours or the provider's, which decides exit cost; and term length, with monthly flexibility priced meaningfully above annual commitment. Ask each of the five explicitly; a quote silent on any of them is cheaper than it will be.
Making two quotes comparable
Normalise both quotes to a year, all-in: base fees times twelve, plus onboarding, plus the after-hours and incident assumptions written as scenarios, one overnight incident, one weekend response, priced under each contract. Then divide by your headcount for a per-person-per-year figure, which is the number that survives growth. Finally, subtract the tooling you already pay for: an organisation already licensing endpoint protection at the list prices above should see that reflected, not re-billed. The policy sheet on this site prices your own drafting hours the same honest way, and walking into a pricing conversation with your written programme shortens the scoping the provider would otherwise bill for.
Questions people ask about managed security service provider pricing
How do managed security service providers price?
Four models: per user per month, per device per month, by data volume ingested, or flat size-band tiers. Provider fees stack on tooling with list prices like $3.00 per user per month (Microsoft Defender for Business) to $59.99 per device per year (CrowdStrike Falcon Go).
What costs do MSSP quotes leave out?
Onboarding, after-hours response, incident hours beyond the retainer cap, who owns the tool licences at exit, and the premium for monthly over annual terms. Ask all five; the differences dwarf base-rate differences.
How do I compare two MSSP quotes fairly?
Annualise everything including onboarding, price the same two incident scenarios under each contract, divide by headcount, and credit tooling you already license. The result is one per-person-per-year figure per quote, which is comparable.