Cyber Security Services for Business: What's Included and What They Cost in the UK
Quick answer
Cyber security services for business cover eight things: endpoint protection, email security, identity and MFA, patching and vulnerability management, backup and recovery, staff awareness training, security monitoring (SIEM or MDR) and certification such as Cyber Essentials. Certification has published prices (the IASME assessment fee is £320–£600 + VAT by organisation size; our managed Cyber Essentials package is from £103 per month ex VAT). Monitoring and response services are quoted per business.
Get my Cyber Essentials quote → Fixed price within 1 working day
"Cyber security services" is a broad label. Some providers mean a certificate, some mean software on your laptops, and some mean a 24/7 team watching your network. This guide sets out what each service actually does, who needs it, and what it costs in the UK, using published prices where they exist and saying plainly where a price has to be quoted.
What Cyber Security Services Include
Most UK businesses need the first six services below. Monitoring and response services matter once you hold sensitive data, work in a regulated sector or have grown past the point where one person can watch everything.
| Service | What it does | Who needs it | How it is priced |
|---|---|---|---|
| Endpoint protection (antivirus / EDR) | Blocks malware on laptops, desktops and servers; EDR adds detection of suspicious behaviour and the ability to isolate a device | Every business | Per device or per user, usually inside a managed IT package |
| Email security | Filters phishing, spoofed senders and malicious attachments before they reach staff; SPF, DKIM and DMARC stop others sending as you | Every business using email | Per mailbox; DNS records are configuration work |
| Identity and multi-factor authentication | MFA on every account, sensible password policy, conditional access, and prompt removal of leavers | Every business | Included in Microsoft 365 business plans; setup is project or managed work |
| Patching and vulnerability management | Applies operating system and third-party updates within days, and scans for weaknesses that remain | Every business | Per device inside managed IT; continuous scanning as an add-on |
| Backup and recovery | Automated, tested copies of servers, files and Microsoft 365 data, with a documented recovery plan | Every business | Per user or per GB |
| Security awareness training | Short modules and phishing simulations so staff recognise attacks | Every business with staff who use email | Per user per year; bundled with certification packages |
| Security monitoring (SIEM) and managed detection and response (MDR) | Collects and correlates logs, or watches every endpoint 24/7, with a team that investigates and responds | Regulated businesses, sensitive data, larger estates | Quoted per business on log sources or endpoints |
| Certification and compliance (Cyber Essentials, Cyber Essentials Plus) | Independent proof that the five baseline controls are in place; required by many public-sector and enterprise buyers | Suppliers to government, the NHS, enterprise and anyone asked by an insurer | Published fees by organisation size (see below) |
What Cyber Security Services Cost in the UK
Only some of these services have published prices. Here is what can be stated with confidence, and where you will need a quote.
- Cyber Essentials assessment fee (IASME, ex VAT): £320 for micro organisations (0–9 staff), £440 for small (10–49), £500 for medium (50–249) and £600 for large (250+). This is the certification fee only; the work to meet the five controls is extra. Figures from IASME's published fee structure, checked September 2026.
- Cyber Essentials Plus audit: quoted by the certification body on the size and complexity of your network. Standalone audits for UK SMEs typically run into the low thousands of pounds plus VAT.
- Our managed Cyber Essentials package: from £103 per month ex VAT for 1–9 users, rising by user band to £475 per month for 100–249 users. It includes the IASME fee, a compliance agent on up to five devices per user, third-party patching, awareness training, policy templates and the £25k cyber-liability insurance that comes with certification.
- Our Cyber Essentials Plus package: from £272 per month ex VAT for 1–9 users, adding the independent audit, 70+ training modules with phishing simulation and GDPR tools. Continuous vulnerability scanning is an optional add-on from £18.50 per month. Full bands are on the cyber security packages page.
- Managed IT with security built in: our fully managed IT packages, which include device monitoring, automated patching, antivirus management and threat response, commonly fall around £55–£65 per user per month. Essential and co-managed scopes are quoted per business.
- SIEM monitoring, managed detection and response, penetration testing: quoted per business or per project, because the price depends on log sources, endpoints and scope.
When you compare quotes, insist on the same basis: per user or per device, which devices are in scope, whether servers are included, and which services are excluded. A cheap monthly figure that leaves out backup, MFA setup or leaver management is not cheap.
Managed Service or Standalone Services?
You can buy each service separately, from separate suppliers, and many businesses do by accident: antivirus from one, backup from another, a certificate from a consultant. The result is nobody owning the whole picture. The alternative is a managed service where one provider runs monitoring, patching, endpoint protection and backup as part of business IT support, and adds certification and monitoring services as required.
Standalone makes sense when you already have competent in-house IT and only need one gap filled, most often certification. A managed service makes sense when nobody is looking after devices day to day, or when your IT person is stretched and needs monitoring and threat-response cover, which is what co-managed IT support provides.
Want security handled as part of your IT support?
Tell us your user count and whether you have IT staff, and we will quote a managed IT package with the security services itemised.
Get my managed IT quote →How to Choose a Cyber Security Services Provider
- Ask what they hold themselves. A provider selling Cyber Essentials should be certified; check the certificate on the IASME register using our Cyber Essentials checker guide.
- Ask who responds, and when. Monitoring without a person who acts on alerts is a dashboard. For MDR and SIEM, ask about hours of cover and response targets.
- Get the scope in writing. Devices, users, servers, cloud services and what happens when a new starter joins or a laptop is replaced.
- Check the reporting. Monthly reports on patch status, threats blocked and backup tests turn security from a promise into evidence.
- Look at renewal. Certificates last 12 months. Ask who owns the renewal and what it costs.
Where to Start
For most small and medium businesses the order is: multi-factor authentication and patching first, because they stop the majority of attacks; then tested backups; then Cyber Essentials to prove it; then awareness training for staff. Add monitoring and response once you hold data that would cause real harm if leaked, or once a customer or regulator requires it. Our cyber security for small business guide walks through each step.
Frequently Asked Questions
What cyber security services does a small business need?
At minimum: endpoint protection on every device, email filtering, multi-factor authentication on every account, prompt patching, tested backups and basic staff awareness training. Cyber Essentials certification covers the technical baseline and is increasingly asked for by customers and insurers.
How much do cyber security services cost for a business?
Cyber Essentials certification has a published IASME fee of £320–£600 + VAT depending on organisation size, and our managed Cyber Essentials package costs from £103 per month ex VAT. Managed IT packages that include monitoring, patching and threat response commonly cost £55–£65 per user per month. Monitoring services such as SIEM and MDR are quoted per business.
What is the difference between SIEM and MDR?
SIEM collects and correlates logs from across your network so unusual patterns can be spotted. MDR focuses on endpoints: an agent on every device watched by a security team that isolates threats. Many businesses start with MDR because it directly targets ransomware.
Is Cyber Essentials a cyber security service?
It is a certification that proves five baseline controls are in place: firewalls, secure configuration, access control, malware protection and patch management. A managed Cyber Essentials service does the technical work and the annual renewal for you as well as submitting the assessment.
Do I need a security operations centre?
A dedicated SOC is rarely justified for businesses under 100 users. A managed SIEM or MDR service gives you the same monitoring and response capability on a shared basis, quoted on your log sources or endpoints.
Can cyber security services be bundled with IT support?
Yes. Our managed IT packages include device monitoring, patching, antivirus management and threat response, and Cyber Essentials or Cyber Essentials Plus can be added to the same contract.
