Pricing Models, Comparisons and 2026 Rules
Managed cybersecurity service pricing in Canada: cost lines, pricing models and what drives the bill
How managed cybersecurity is priced in Canada: per user, per endpoint, log volume and retainers, with illustrative CAD ranges and rules.
Managed cybersecurity services in Canada are usually priced as a monthly fee per user, per endpoint or per device, sometimes with a charge based on the volume of logs you send to a monitoring platform, plus a one-time onboarding fee and separate prices for project work such as penetration tests, vCISO advice or incident response. There is no standard price list. Two quotes that look similar per user can differ widely once you check what is monitored, whether the provider is allowed to act on a threat, how long logs are kept and which tool licences are included. The way to compare them is to break each quote into the same cost lines, convert everything to a yearly Canadian-dollar figure, and add sales tax and expected growth.
This is the overview for the pricing models, comparisons and 2026 rules section. Every price below is an illustrative example, not market data or any provider's price.
The cost lines in a managed security quote
| Cost line | What it pays for | Typical basis | Questions to ask |
|---|---|---|---|
| Core monitoring or management fee | The service you are buying: endpoint management, MDR, SOC monitoring or a full bundle | Per user, per endpoint or per device, per month | What exactly is covered for that unit? |
| Log ingestion and retention | Collecting and storing logs in a SIEM or data lake | Per GB per day, per events per second, or a tier | What happens if volume grows? How long are logs kept? |
| Tool licences | EDR agent, email security, backup, vulnerability scanner | Included, or passed through at cost or with a margin | Who owns the licences and the tenant? |
| Onboarding | Agent rollout, log source connection, baselining, runbooks | One-time fee | Is it refundable if onboarding is not completed? |
| Incident response | Investigation and recovery beyond containment | Included hours, retainer, or hourly rate | How many hours are included, and the rate after that? |
| Advisory | vCISO, policy writing, insurer questionnaires, board reporting | Monthly retainer, days or hours | What deliverables, and do unused hours roll over? |
| Testing | Penetration tests, phishing simulations, vulnerability assessments | Per engagement or per year | Scope, retest, written authorisation |
| Taxes | GST/HST, QST, any PST | Percentage of the fee | Which rate, and can you claim it back? |
A quote that only shows the first line is not comparable with one that shows all eight. Ask each provider to fill in the same grid.
The main pricing models
Per user. Common for bundles that protect a person's laptop, phone, email and cloud identity together. It is simple to budget, but check how the provider counts shared mailboxes, part-time staff and service accounts. More detail in per-user, per-endpoint and tiered pricing models.
Per endpoint or per device. Common for endpoint protection, MDR and managed firewalls. Servers often cost more than laptops, and network devices are priced separately.
Per log volume. Common for SOC-as-a-service and managed SIEM. Pricing may be per gigabyte ingested per day, by events per second, or in tiers. It is the line most likely to grow without warning. See SIEM and log-volume pricing.
Tiers. Bronze/silver/gold or essentials/advanced packages. Tiers are useful only once you list what each one includes in the same columns.
Retainers. Used for vCISO services and incident response. You pay a fixed amount for a reserved capacity or a guaranteed response time. See incident-response retainer pricing.
Illustrative ranges, and how to read them
The ranges below are illustrative. They show the order of magnitude and the unit, so you can sanity-check a quote with the managed security cost estimator. They are not averages and not anyone's price list.
| Service | Illustrative range (CAD, before tax) | Unit |
|---|---|---|
| Managed endpoint protection and patching | $8–$25 | per endpoint per month |
| MDR with 24/7 monitoring and response | $12–$35 | per endpoint per month |
| Fully managed security bundle | $40–$110 | per user per month |
| Managed firewall | $100–$500 | per device per month |
| SOC / managed SIEM | $120–$350 | per GB of daily log volume per month |
| vCISO retainer | $2,000–$10,000 | per month |
| Penetration test | $5,000–$40,000 | per engagement |
| Onboarding | $1,000–$15,000 | one-time |
Illustrative example. A 40-person Halifax professional firm receives a bundle quote of $70 per user per month, $4,000 onboarding and an annual external pen test at $8,000. Year one: 40 × $70 × 12 = $33,600, plus $4,000 + $8,000 = $45,600 before tax. With Nova Scotia HST at 14%, the invoices total $45,600 × 1.14 = $51,984, and a registrant can usually recover the $6,384 of HST as input tax credits. Year two, without onboarding: $33,600 + $8,000 = $41,600 before any renewal increase.
What drives the price up or down
- Coverage hours. 24/7 monitoring with humans on shift costs more than business-hours review.
- Response authority. A provider that can isolate a laptop or disable an account immediately carries more responsibility than one that only emails you an alert.
- Data sources. Endpoints only is cheaper than endpoints plus Microsoft 365 or Google Workspace, firewalls, cloud workloads and servers.
- Log retention. Keeping searchable logs for 12 months costs more than 30 or 90 days.
- Compliance reporting. Reports for insurers, clients or regulators take analyst time.
- Language and location. French-language service, Canadian-only analysts or Canadian data storage may cost more.
- Minimums and term. A 36-month term may lower the monthly price but raises exit cost.
- Currency. Services priced in US dollars move with the exchange rate. See renewal uplifts and USD pricing.
Canadian rules that affect the cost
Some costs come from obligations, not features. Under PIPEDA, an organisation must report breaches of security safeguards that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada, notify affected individuals and keep a record of every breach for 24 months; your provider's reporting and log retention must support that. Quebec's Law 25 requires notice of confidentiality incidents to the Commission d'accès à l'information and an incident register. Alberta's PIPA requires notice to its Commissioner. These are covered in breach reporting under PIPEDA, Law 25 and Alberta PIPA.
Federally regulated critical-infrastructure operators face the Critical Cyber Systems Protection Act enacted by Bill C-8; see the status of Bill C-8. Sales tax is in GST/HST and QST on managed security services. To understand which service type you actually need, read MSSP vs MDR vs SOC-as-a-service.
Frequently asked questions
Why do two per-user quotes differ so much?
Usually because they cover different things: hours of coverage, whether the provider responds or only alerts, data sources, log retention and included tool licences. Put both quotes into the cost-line grid above before comparing.
Should I pay monthly or annually?
Annual prepayment may lower the price but increases the amount at risk if the service disappoints. A monthly or quarterly billing with a 12-month term is a middle ground.
Are prices negotiable?
Often, especially onboarding fees, term length, renewal caps and the price of added users. Ask for any discount to be written into the order form, including what happens at renewal.
Is the cheapest option enough for insurance?
Not necessarily. Insurers often ask about specific controls such as MFA, EDR and backups. See cyber-insurance security requirements.
Sources
- Office of the Privacy Commissioner of Canada — PIPEDA breach reporting and record-keeping
- Canadian Centre for Cyber Security — guidance for small and medium organizations
- Justice Laws Website — PIPEDA and the Breach of Security Safeguards Regulations
- Canada Revenue Agency — GST/HST rates and input tax credits
- Commission d'accès à l'information du Québec — confidentiality incidents under Law 25
