Per-user, per-endpoint and tiered pricing for managed security: how to count and compare

Per-user pricing charges for each person protected, usually covering that person's laptop, phone, mailbox and cloud identity. Per-endpoint pricing charges for each device with an agent, often with a higher rate for servers. Tiered pricing groups features into packages at different prices. None is cheaper by nature. Which one costs you less depends on your ratio of devices to people, how many servers and shared accounts you have, and the minimum commitments in the contract. The reliable way to compare is to count your environment once, apply each provider's counting rules, and convert every offer into a yearly cost for the same scope.

This guide belongs to managed cybersecurity service pricing in Canada. All prices are illustrative.

Count your environment before asking for quotes

Build one inventory and give it to every provider:

Item	Why it matters for price	Example count
Staff with a mailbox and login	Basis for per-user pricing	45
Part-time, seasonal and contractor accounts	May or may not count as users	8
Shared and service mailboxes	Some providers charge, some do not	6
Laptops and desktops	Basis for per-endpoint pricing	52
Phones and tablets under management	Sometimes included per user, sometimes extra	40
Physical and virtual servers	Often priced higher than workstations	5
Cloud workloads (virtual machines, containers)	May be priced per workload or by consumption	4
Firewalls and other network devices	Priced per device	2
Cloud tenants (Microsoft 365, Google Workspace, other SaaS)	Identity and email monitoring add-ons	1

Counts change over the year. Record the date of the inventory and ask each provider how they true up: monthly by actual count, quarterly, or at renewal.

How each pricing basis behaves

Per user. Predictable when headcount is stable. Watch for: definition of a user (licensed mailbox, active account, or employee on payroll), whether a user's second and third devices are included, and whether contractors count.

Per endpoint. Fair when people share devices, such as shift workers on shop-floor terminals. Watch for: servers at a multiple of the workstation price, charges for devices that are offline for months, and whether mobile devices count.

Per device for network gear. Firewalls, switches and wireless controllers priced individually, often by model size. Watch for: hardware ownership and whether firmware subscriptions are included.

Tiers. Packages such as essentials, standard and premium. Watch for: the one feature you need (for example 24/7 response or identity monitoring) sitting only in the top tier.

Minimums. A minimum monthly fee or a minimum number of units. A 12-person office may pay for 20 units.

Converting offers into one number

Illustrative example. A 45-person Montreal design studio (52 laptops, 5 servers, 2 firewalls) receives three offers, all invented for illustration:

Offer	Pricing	Calculation	Monthly
X	$68 per user, servers included, firewall extra $180 each	45 × $68 + 2 × $180	$3,420
Y	$24 per workstation, $60 per server, firewall $220 each, identity monitoring $4 per user	52 × $24 + 5 × $60 + 2 × $220 + 45 × $4	$2,168
Z	Tier "advanced", minimum 60 units at $45	60 × $45	$2,700

Before deciding, put the scope next to the price. Offer Y is cheapest per month but excludes awareness training and email filtering, which X includes. Offer Z covers 60 units, more than the studio needs today, which is useful only if growth is planned. Yearly before tax: X $41,040; Y $26,016; Z $32,400. Quebec businesses add GST and QST (14.975% combined), usually recoverable as input tax credits and input tax refunds by registrants; see GST/HST and QST on managed security services.

Then add the missing pieces to Y at illustrative prices (email filtering $3 per user and training $2 per user per month = 45 × $5 = $225 a month). Y becomes $2,393 a month, or $28,716 a year, still the lowest, but now the comparison is like for like.

Tier comparison grid

When a provider offers tiers, rewrite them into this grid:

Feature	Tier 1	Tier 2	Tier 3
Endpoint protection and patching
24/7 human monitoring
Remote containment without asking
Identity and email monitoring
Log retention (days)
Incident-response hours included
Awareness training and phishing simulation
Monthly report and quarterly review
Price per unit per month

A tier that you would need to "top up" with two add-ons is often more expensive than the next tier.

Mid-term changes and true-ups

Adding staff. Ask for the same unit price for additions during the term, written into the order form.
Removing staff. Many contracts allow increases but not decreases until renewal. Negotiate a reduction allowance (for example up to 10%) if headcount is seasonal.
Mergers and new sites. Ask how a new office is onboarded and priced.
Offboarding devices. Make sure retired devices are removed from billing; ask for a monthly count report.

These points also feed the renewal and FX budgeting guide. For services billed by data volume instead of by unit, read SIEM and log-volume pricing; for a full example across several services see worked cost examples.

Frequently asked questions

Which is cheaper, per user or per endpoint?

Per user tends to favour businesses where each person has several devices; per endpoint tends to favour shared devices. Run your own inventory through both with the cost estimator.

Do servers really cost more?

Often yes, because they hold more data and need more careful response. Ask how a server is defined, including virtual machines.

Can I exclude some devices to save money?

You can, but unmonitored devices are a common path for attackers. If you exclude anything, document the decision and the compensating control. See scope gaps.

What is a fair minimum commitment?

There is no rule. A minimum close to your current count with a growth allowance is easier to justify than one far above it.

Sources

Canadian Centre for Cyber Security — baseline controls and asset management guidance
Revenu Québec — QST on services supplied in Quebec
Canada Revenue Agency — GST/HST input tax credits