How much does cyber security cost for a small business?

“How much do we need to spend on cyber security?” is the right question, and it deserves a straight answer. Here are the figures we can stand behind, and what moves the rest.

The short answer: for a small business the cost sits in four places: the Microsoft 365 licences you already pay for (the security features depend on the plan), someone to set up and watch your security, a backup, and Cyber Essentials if you certify, which starts at £320 + VAT a year for a micro business. Our own cyber security comes as part of our IT services: IT support is priced per user, Microsoft licences are on top, and projects are quoted separately. See our pricing for figures.

Where the money goes

What	What it costs	What to know
Microsoft 365 licences	Per user, per month; check Microsoft’s current UK price	Business Premium includes Defender for Business, with endpoint detection and response, and sensitivity labels to encrypt files. Cheaper plans leave these out.
Setting it up and watching it	From an IT or security provider, usually monthly	The features in your licence do nothing until they’re switched on and configured, and someone acts on the alerts.
Microsoft 365 backup	Per user from most providers; Microsoft’s own is billed by the amount of data protected	Your licences don’t include one. See why Microsoft 365 needs a backup.
Cyber Essentials	From £320 + VAT for 0 to 9 staff, rising with size (IASME)	Plus adds an assessor’s fee, priced on the size and complexity of your network. Renewed every year. A first certificate costs £80 to £125 + VAT under the First Step Fund, until March 2027 or until the money runs out.

Checked November 2026. Microsoft changes its UK prices from time to time, so check the current plan prices rather than trusting a figure in an article.

What moves the price

Four things, mostly:

• How many people and devices you have. Most security is priced per user or per device, so it grows with you.
• Which Microsoft 365 plan you’re on. Moving from a basic plan to Business Premium often replaces separate antivirus and device-management products you were paying for.
• Whether anyone watches at night. Monitoring around the clock costs more than alerts that wait for Monday morning.
• What you already have. A business starting from scratch pays more up front; one with good basics in place spends less.

Your obligations matter too. If a customer or a contract requires Cyber Essentials Plus, that sets a floor.

The cost that isn’t money

Nothing for nothing. Multi-factor authentication adds a few seconds to every sign-in. Certification means fixing what the assessment finds, usually in the first month, and that takes some of your team’s time. Old PCs that no longer get security updates have to be replaced, and that’s a real bill.

What doing nothing costs

Vodafone’s 2025 research with WPI Strategy put the average loss at £3,398 for a UK small business affected by a cyber attack. It found Scottish SMEs among the more likely to be attacked, losing 29.75 business hours per successful attack. Set the cost of protection against nearly four working days with no email and no files.

When you don’t need a managed service

If you’re a two- or three-person business, you probably don’t need us. Microsoft 365 Business Premium, set up properly with multi-factor authentication on every account, plus a backup and Cyber Essentials, covers most of what matters. For a very small team, a managed service is often more than the risk justifies.

How Jera can help

We look after cyber security for businesses of 15 to 250 people across Edinburgh, Glasgow and Aberdeenshire, with security monitoring around the clock by an external security operations centre. Book a call, tell us what you have now, and we’ll tell you what closing the gaps would cost.