The price usually depends on three pillars. Below you can see which ones.
The price scales with what needs to be monitored. A workstation is a laptop or PC. A server weighs more heavily: it often runs more services, sends in more logs, and anyone who gets in there can usually do more damage. That is why a server costs more than a workstation.
The number of employees counts separately, because every user account is monitored separately. To an antivirus scanner, an attacker who logs in with a stolen password looks like an ordinary colleague.
A consultancy of twelve people that runs everything in Microsoft 365 will therefore pay a lot less than a manufacturing company with thirty staff and three servers in the utility cupboard. The number of employees and systems is one of the things that determines the costs.
This is where the biggest price difference lies. Prevention, such as MFA, a password manager and updates, is cheap or often already included in your licences. Detection and response cost more, because there is a whole team behind it keeping an eye on your business.
Within detection and response, the biggest cybersecurity costs lie in monitoring outside office hours. Someone who picks up an alert at two in the morning costs money. You can see this in our two MDR packages: Essentials works on a best-effort basis, Premium responds within 15 minutes of detection, also outside office hours.
Since 15 August 2026, the Cyberbeveiligingswet (the Dutch Cybersecurity Act) has applied: the Dutch implementation of NIS2. According to RVO (the Netherlands Enterprise Agency), whether you fall under it depends on your sector, your services and the size of your organisation, spread across 18 sectors. If you do, you have to be able to demonstrate what you do: logging, reports, in other words a reporting obligation. Demonstrating this takes time and sometimes an extra service. You can read more about NIS2 in our NIS2 checklist.
Even without a legal obligation, the bar is rising. A large client sends a security questionnaire, and your cyber insurer may want to see MFA and security monitoring. If you supply healthcare, government or the financial sector, you will get those questions sooner.
Requirements from legislation, auditors or insurers do not have to mean that cybersecurity costs suddenly skyrocket, but they can mean you need to invest more in cybersecurity than you otherwise might have.
We can only give indicative prices for our own services. We think it is important to be transparent about them, even if the company around the corner turns out to be cheaper. It often also depends on the security company and how they put their packages together.
What cybersecurity costs for an SME differs per service. At Peakproteqt, SOC-as-a-Service costs €15.72 per workstation, €15.72 per employee and €60.62 per server per month, excluding VAT. A one-off consulting engagement starts at €2,495. MDR Essentials, for companies with up to 25 employees, is cheaper. We do not charge an entry fee; Premium does involve one-off project costs for onboarding.
If you want to know even more precisely what our service costs for your business, you can work it out yourself with the price calculator.
MDR stands for Managed Detection & Response: specialists watch your environment during and outside office hours and step in when something goes wrong. MDR costs are a monthly amount per employee and per device. For that you get malware and ransomware detection, Microsoft 365 monitoring, dark web monitoring and a report every month.
We offer our service in two packages: MDR Essentials and MDR Premium. MDR Essentials is intended for companies with around 25 employees or fewer and works on a best-effort basis. MDR Premium suits companies from 26 employees and responds to critical incidents within 15 minutes. Help with an actual incident is billed afterwards in both packages; with Essentials that help is more limited, because we then have less capacity allocated to your business.
We have already mentioned above what companies pay for MDR Premium, but not yet for Essentials. For workstations and employees you pay €6.58, and for server protection €26.23. With MDR Essentials, vulnerability management costs extra: €3.50 for workstations and €9.59 for servers. With MDR Premium, vulnerability management is included as standard.
With us, SOC-as-a-Service falls under MDR Premium: an external security team (SOC, Security Operations Centre) that monitors your environment as if it were your own team. For SOC-as-a-Service there is also no minimum purchase with us.
Let's work it out for 30 employees, each with a laptop, and 2 servers:
Per year that is €12,773, excluding VAT. Compare that with a cyberattack that succeeds for the hackers, after which you pay an average of €270,000 to repair the damage (ESET, 2022). Suddenly the investment looks a lot smaller.
Consulting is not a subscription. It is a one-off engagement from €2,495, at a fixed price that you know in advance. A consulting engagement, again depending on the size of the company, often takes one to two weeks. You get a risk report and a roadmap in which every measure has an owner and a deadline. You can resolve these points together with your IT provider or with us.
It suits companies of roughly 10 to 250 employees without their own IT department. Or anyone who has a questionnaire from their insurer lying on their desk.
A year has 8,760 hours. After holidays, sickness and training, a full-time employee is available for around 1,500 hours a year. If you want someone watching at all times, you need almost six people for one seat.
In this example we assume €65,000 to €70,000 per SOC analyst per year, including employer costs. Add a team lead, a security engineer, tooling, licences and training, and an in-house SOC costs €400,000 to €700,000 per year. On top of that come one-off start-up costs of €200,000 to €500,000.
Doing it yourself is not a problem in itself, but monitoring is where it starts to chafe. If you suddenly require your employees to work on-call shifts and train in security, that will cause friction. Building an entire team also costs a lot of money and time.
From experience we can tell you that we once spoke with a company that wanted to set up security monitoring and was considering outsourcing it. In the end they decided to do it all themselves. We were still able to help that company with some other projects, and during that time we saw that a team of 3 to 4 people had to handle everything themselves during critical incidents.
That is like having to be ready 24/7 for an alert that something is wrong. Most people can keep that up for a few months, but after that it stops.
Want to know exactly what you hand over and what stays with you? Then read our piece on outsourcing cybersecurity.
How much cybersecurity budget an SME needs depends less on size than on order. Our advice is to look first at what you already have and take steps from there.
Want to see how those steps come together in one approach? Take a look at how we set up cybersecurity for SMEs, or get in touch right away.
