Managed security cost examples for Canadian SMEs: 12, 60 and 180 employees worked through

For a small Canadian business, a realistic managed security budget is built from a few lines: a per-user or per-endpoint monitoring fee, any device-based services such as a managed firewall, one-off items such as onboarding and a penetration test, advisory time if you need it, and sales tax. The three invented, illustrative businesses below show how those lines add up for 12, 60 and 180 employees. The prices are not market data or any provider's rates. They are round numbers chosen so you can follow the arithmetic and replace them with the figures in your own quotes, using the managed security cost estimator.

This guide is part of how to choose a managed security provider.

Example 1: a 12-person accounting practice in Moncton

Profile. 12 staff, 14 laptops, Microsoft 365, no on-site server, a small office firewall supplied by the internet provider. Client tax files make confidentiality the main concern. The insurer's questionnaire asks about MFA, EDR and backups.

Choice. MDR on endpoints and Microsoft 365 identity, with a minimum of 15 units, plus a vCISO half-day each quarter to write policies and answer the insurer.

Line	Calculation (illustrative)	Year 1
MDR, minimum 15 units	15 × $30 × 12	$5,400
Microsoft 365 backup	12 × $4 × 12	$576
Onboarding	one-time	$1,500
vCISO, four half-days	4 × $1,000	$4,000
Subtotal before tax		$11,476
HST 15% (New Brunswick)	$11,476 × 15%	$1,721.40
Invoice total		$13,197.40

The HST is usually recoverable for a registrant. The practice skips a pen test in year one and spends on phishing-resistant MFA and staff training instead, which its vCISO recommends.

Example 2: a 60-person manufacturer near Kitchener

Profile. 60 staff, 45 office endpoints, 15 shop-floor terminals, 4 servers, 2 firewalls, an ERP system and some production equipment on a separate network. The largest customer requires incident notice within 48 hours.

Choice. A fully managed security bundle per user for office staff, per-endpoint MDR for shop-floor terminals, managed firewalls, and an annual external and internal pen test.

Line	Calculation (illustrative)	Year 1
Managed security bundle, 45 users	45 × $75 × 12	$40,500
MDR, shop-floor terminals and servers	19 × $25 × 12	$5,700
Managed firewalls	2 × $250 × 12	$6,000
Onboarding	one-time	$6,000
Pen test (external + internal)	per engagement	$18,000
Subtotal before tax		$76,200
HST 13% (Ontario)	$76,200 × 13%	$9,906
Invoice total		$86,106

Year 2, without onboarding and before renewal increases: $40,500 + $5,700 + $6,000 + $18,000 = $70,200. The contract must commit the provider to notify the manufacturer quickly enough for it to meet its customer's 48-hour clause; see SLA questions.

Example 3: a 180-person multi-site services company in Quebec and Ontario

Profile. 180 staff across Montreal and Toronto offices, 200 endpoints, 20 servers, 4 firewalls, several cloud applications. It handles personal information of Quebec clients and must keep an incident register. Management wants French-language reporting and searchable logs for 12 months.

Choice. SOC-as-a-service with SIEM, MDR on endpoints, managed firewalls, a monthly vCISO retainer, an incident-response retainer and a yearly pen test.

Line	Calculation (illustrative)	Year 1
SIEM monitoring, 25 GB/day, 12-month retention	25 × $240 × 12	$72,000
MDR on endpoints and servers	220 × $18 × 12	$47,520
Managed firewalls	4 × $300 × 12	$14,400
vCISO retainer	$5,000 × 12	$60,000
IR retainer, 40 prepaid hours	40 × $300	$12,000
Pen test, external, internal and web application	per engagement	$32,000
Onboarding	one-time	$15,000
Subtotal before tax		$252,920

Taxes depend on where each supply is made: the Montreal portion at 14.975% (GST + QST) and the Toronto portion at 13% HST, under the place-of-supply rules. Before signing, the company completes a privacy impact assessment because some log data will be stored outside Quebec; see SOC data residency.

Comparing the three on a per-person basis

Business	Year 1 before tax	Per employee per year	Per employee per month
Moncton practice (12)	$11,476	$956	$80
Kitchener manufacturer (60)	$76,200	$1,270	$106
Multi-site company (180)	$252,920	$1,405	$117

Per-employee costs often rise with complexity, not just headcount: more servers, more sites, longer retention and more evidence. They are a sanity check, not a benchmark.

Sensitivity: what changes the total most

Using Example 2 (year-two base $70,200):

10 more office users at $75: +10 × $75 × 12 = +$9,000.
A 7% renewal increase on recurring services ($52,200): +$3,654.
USD-priced MDR line with a 5% weaker Canadian dollar: $5,700 × 5% = +$285.
Dropping the internal pen test (illustratively $8,000 of the $18,000): −$8,000.

Model renewals and currency with the renewal and FX buffer calculator and read renewal uplifts and USD pricing. If you are considering hiring instead, use in-house versus outsourced cost. For component pricing, see managed firewall and EDR, vCISO retainers and penetration testing.

Frequently asked questions

Are these typical prices?

No. They are invented round numbers that show the method. Use quotes from providers for real decisions.

What is the most common budget mistake?

Leaving out one-off and growth items: onboarding, pen tests, IR hours, added users and log growth.

Should a 12-person business buy a SIEM?

Usually not first. MDR on endpoints and identity, backups and MFA tend to address the most common attacks at lower cost.

How do I budget the second year?

Remove one-time items, add expected growth and a renewal buffer, and re-check the scope.

Sources

Canadian Centre for Cyber Security — baseline controls for small and medium organizations
Canada Revenue Agency — HST rates by province
Revenu Québec — QST
Commission d'accès à l'information du Québec — incident register and assessments