Cost Estimates, Worked Examples and Best-Fit Checklists
Managed firewall, endpoint and EDR pricing: hardware, subscriptions and management fees
How managed firewall, endpoint and EDR services are priced: hardware versus firewall-as-a-service, licences, patching and examples.
Managed firewall and managed endpoint services are priced in two layers: the technology (the firewall appliance and its security subscriptions, or the EDR and antivirus licence on each device) and the management fee for someone to configure, update, patch and watch it. Firewalls are usually charged per device per month, sometimes with hardware bought up front or bundled into a lease. Endpoint services are charged per endpoint per month, with servers often at a higher rate. To compare quotes, split each into hardware, licences and management, check who owns what, and confirm whether alerts are acted on around the clock or only during business hours.
This guide is part of how to choose a managed security provider. All prices are illustrative.
Managed firewall: the three ways to pay
| Model | How it works | Illustrative cost | Watch out for |
|---|---|---|---|
| Buy hardware + subscriptions + management | You own the appliance; you renew threat-protection subscriptions; provider manages | Hardware $1,500–$8,000 per office device; subscriptions yearly; management $100–$300 a month | Subscription renewals that lapse; end-of-life hardware |
| Firewall-as-a-service (bundled) | Provider supplies hardware and subscriptions in a monthly fee | $200–$500 per device per month | Hardware returned at exit; long minimum terms |
| Cloud-delivered network security | Traffic routed through a provider's cloud security service | Per user per month | Covers remote staff well; may still need on-site device |
What management should include: initial configuration, firmware updates, rule changes up to a monthly limit, VPN set-up, monitoring of availability and security events, configuration backups and a quarterly rule review. Ask for the change-request limit and the price of extra changes.
Managed endpoint and EDR
| Service level | Typical inclusions | Illustrative cost per endpoint per month |
|---|---|---|
| Managed antivirus and patching | Next-generation antivirus, operating-system and common application patching, device health reports | $8–$15 |
| Managed EDR | EDR agent, policy tuning, alert triage in business hours | $12–$25 |
| MDR on endpoints | EDR plus 24/7 monitoring and remote containment | $15–$35 |
| Server add-on | Higher-tier agent and careful patching windows | Often 1.5–3 × the workstation price |
Licence pass-through. Some providers include the EDR licence; others bill it separately, at cost or with a margin. If you already own licences, ask whether the provider will manage them, and at what discount. Check who owns the tenant or console: if it is the provider's, you may need to reinstall agents when you leave; see exit and offboarding.
Patching scope. "Patching" may mean the operating system only, or also browsers, office suites, PDF readers and line-of-business software. The Cyber Centre's baseline controls include automatically patching operating systems and applications; ask the provider which applications are covered and how fast critical patches are applied.
Worked example (illustrative)
A 25-person dental clinic group in Winnipeg has 2 sites, 28 workstations, 2 servers and 2 firewalls.
| Line | Calculation | Monthly | Yearly |
|---|---|---|---|
| Managed EDR, workstations | 28 × $18 | $504 | $6,048 |
| Managed EDR, servers | 2 × $45 | $90 | $1,080 |
| Firewall-as-a-service | 2 × $320 | $640 | $7,680 |
| Total before tax | $1,234 | $14,808 |
Alternative: buy two firewalls at $3,000 each, subscriptions at $900 each a year, management at $150 a month each.
| Line | Year 1 | Years 2–5 (each) |
|---|---|---|
| Hardware | $6,000 | $0 |
| Subscriptions | $1,800 | $1,800 |
| Management | $3,600 | $3,600 |
| Firewall total | $11,400 | $5,400 |
Over five years the owned option costs $11,400 + 4 × $5,400 = $33,000, compared with 5 × $7,680 = $38,400 for firewall-as-a-service, if the hardware lasts five years and prices stay flat. The bundled option shifts the risk of hardware failure and replacement to the provider. In Manitoba, check whether retail sales tax applies to hardware and software parts of the invoice; see GST/HST and QST.
Questions specific to these services
- Who responds to an endpoint alert at night, and what are they allowed to do?
- Which applications are patched, and what is the time to apply a critical patch?
- Who owns the firewall configuration and the EDR console?
- How many firewall change requests are included each month?
- What happens when a device is lost or stolen: remote wipe, account lock-out, record for breach assessment?
- Are mobile phones included, and with what controls?
- How are offline devices counted for billing?
Bring these to the SLA and contract questions and the due-diligence checklist. For full-budget examples see managed security cost examples, and for how per-device and per-user pricing compare see pricing models.
Frequently asked questions
Is a firewall still needed if everyone works remotely?
An office firewall protects on-site networks. Remote staff need endpoint protection, MFA and possibly cloud-delivered network security. Many businesses need both.
Can my internet provider's router do the job?
Basic routers filter traffic but often lack threat-protection features, logging and managed updates. Check what your insurer and clients expect.
Is antivirus enough?
Antivirus blocks known threats. EDR records device activity so that suspicious behaviour can be investigated and stopped, which matters for intrusions that do not use known malware.
What if I already have EDR licences?
Ask for a management-only price and make sure the provider can work in your console.
Sources
- Canadian Centre for Cyber Security — baseline controls on patching, security software and perimeter defences
- Canada Revenue Agency — GST on equipment and services
- Government of Manitoba — retail sales tax bulletins
