Managed cybersecurity service types compared
What each managed security service usually includes, how it is commonly priced, who it fits and what to watch for, with illustrative CAD ranges.
This table compares service types, not providers. Prices are illustrative ranges chosen to show the order of magnitude and the pricing basis; they are not survey data and not any provider's price. Many providers bundle several rows into one per-user price, so check which rows a quote actually includes. Read it together with managed cybersecurity service pricing in Canada and MSSP vs MDR vs SOC-as-a-service.
Select a column header to sort.
| Service type | What it usually includes | Common pricing basis (illustrative CAD) | Good fit for | Watch out for |
|---|---|---|---|---|
| Managed endpoint protection | Antivirus/EDR agent, policy management, patching, device health reports | Per endpoint per month, about $8–$25 | Small offices without IT staff | Alerts may be reviewed in business hours only; response may be limited to automatic blocking |
| Managed detection and response (MDR) | 24/7 monitoring of endpoint (and often identity and cloud) alerts, investigation, remote containment | Per endpoint or per user per month, about $12–$35 per endpoint | Businesses that need 24/7 response without hiring | What the provider may do without asking you; which data sources are included |
| SOC-as-a-service / managed SIEM | Log collection from many sources, correlation, monitoring, retention, compliance reports | Per GB of daily log volume or per event volume, plus retention; about $120–$350 per GB/day per month | Regulated or multi-site businesses with many systems | Log volume growth, retention charges, and whether analysts respond or only notify |
| Fully managed security (MSSP bundle) | Endpoint, email security, firewall, monitoring, awareness training, reporting | Per user per month in tiers, about $40–$110 | SMEs that want one provider and one invoice | Tier names hide differences; tools may be locked to the provider |
| Managed firewall / network security | Firewall configuration, firmware updates, VPN, monitoring, rule changes | Per device per month, about $100–$500, plus hardware or subscription | Offices and branches with on-site networks | Who owns the device and the configuration at exit; change request limits |
| vCISO (fractional security leader) | Risk assessment, policies, roadmap, board and insurer reporting, vendor reviews | Monthly retainer, about $2,000–$10,000, or by the day or hour | Growing businesses facing client, insurer or regulatory questions | Unclear deliverables; hours that expire unused |
| Penetration testing | Authorised simulated attack on a defined scope, report with findings and retest | Fixed fee per engagement, about $5,000–$40,000 depending on scope | Annual assurance, client or insurer requests, after major changes | Scope too narrow to be meaningful; missing written authorisation |
| Incident-response retainer | Guaranteed response time, prepaid or pre-negotiated hours, forensics, readiness work | Annual retainer with prepaid hours at about $250–$450 an hour, or a low-fee standby agreement | Any business that cannot afford days of searching for help mid-incident | Unused hours expiring; insurer panel requirements |
All ranges are illustrative and exclude GST/HST, QST and any provincial sales tax. Real prices vary with scope, coverage hours, response authority, log retention, minimum commitments and currency. Check the rules at the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the Canadian Centre for Cyber Security and the Canada Revenue Agency.