Ransomware-as-a-service did not disappear. It changed what small and midsize businesses have to buy from a managed service provider.
The old security add-on was easy to quote: antivirus per device, a backup plan, and occasional help after an alert. The current threat model reaches endpoints, cloud identities, remote access tools, third-party connections, and recovery systems at the same time. A provider that only installs software is leaving the customer to manage the hardest part.
That gap has created a separate managed-security tier. It sits above basic IT support and charges for continuous detection, human response, identity monitoring, security hardening, and incident readiness.
The Ransomware Bill Starts Before the Ransom
The 2026 Verizon Data Breach Investigations Report found that ransomware was involved in 48% of breaches. Software vulnerability exploitation became the leading initial access route at 31%, overtaking stolen credentials.
Coveware’s first-quarter 2026 incident data shows why the managed-service scope has widened. The average ransom payment reached $680,081, while the median fell to $300,750. Only 23% of Coveware-managed cases resulted in payment, yet business interruption remained the strongest pressure behind those decisions.
https://www.youtube.com/watch?v=Jb3isBWN6ZY
Two-thirds of the victims observed by Coveware had between 11 and 1,000 employees. Lateral movement appeared in 79% of cases, exfiltration in 73%, and impact activity in 58%.
That pattern is difficult to price as an antivirus license. The provider has to detect a legitimate-looking login, notice privilege changes, contain movement across the environment, preserve evidence, help restore operations, and support the legal and executive response.
Verizon’s 2026 SMB breach infographic puts the financial risk in business terms. In the most severe 2.5% of small and midsize business cases, breach losses exceeded 7% of annual revenue.
The New Tier Is Visible in Public Pricing
Huntress now publishes separate prices for managed endpoint, identity, SIEM, training, and posture services.
https://www.youtube.com/watch?v=hsIs9z1yD3k
An illustrative 50-person company with 50 endpoints, 50 cloud identities, 50 learners, 50 identity-posture licenses, and 10 SIEM data sources would produce this monthly list-price stack:
| Managed layer | Public unit price | Illustrative monthly cost |
| Managed EDR | $8.99 per endpoint | $449.50 |
| Managed ITDR | $4.80 per identity | $240 |
| Security awareness training | $2.08 per learner | $104 |
| Identity posture management | $4 per identity | $200 |
| Managed SIEM | $4 per source | $40 |
| Total | $1,033.50 |
The figures come from Huntress’ current public pricing. They work out to roughly $20.67 per employee each month, or $12,402 annually.
That still is not the final managed-service quote. Huntress states that its prices include the 24/7 security operations center but exclude deployment, integration, daily operations, and portal management performed by partners.
Buyers reviewing DesignRush’s IT services listings should separate the product cost from the work required to configure it, investigate alerts, coordinate containment, and rebuild systems. A low per-endpoint figure may cover the agent while leaving most of the incident on the customer’s desk.
https://www.youtube.com/watch?v=lgGK5x3AGmA
At the higher end, Arctic Wolf’s AWS Marketplace listing prices an MDR Basic package for up to 100 users at $44,000 for 12 months. Its scope is not directly comparable with the componentized Huntress example, but it shows how far managed detection has moved from a small software add-on.
Customers Are Paying for Five Operational Promises
The premium tier makes sense only when the contract changes what happens during an incident.
Someone responds at 2 a.m. A dashboard that sends alerts to an unstaffed inbox is still self-service security. ConnectWise says its Managed EDR service addresses verified incidents within 15 minutes, with a global 24/7 security operations center making containment decisions.
https://www.youtube.com/watch?v=fORQSXy06FA
Identity is covered alongside endpoints. Coveware reports that remote access compromise increasingly involves SSO, OAuth grants, SaaS administration, and identity-recovery workflows. Endpoint monitoring cannot see every account takeover or malicious policy change.
Patch ownership is defined. The DBIR found that critical vulnerabilities took a median 43 days to reach full resolution. A serious managed agreement should state who identifies exposure, who approves the fix, and what happens when a system cannot be patched quickly.
Recovery is tested before the incident. Backup status is not the same as recovery readiness. The service should include restore testing, named decision-makers, isolation procedures, and a documented path from containment to business operation.
The provider can support the business response. Executives need incident records, insurer-ready evidence, regulatory timelines, and clear communication. Arctic Wolf’s security operations warranty offers up to $3 million in financial assistance under qualifying bundles and terms, showing how some providers now attach risk support to the service itself.
The Quote Should Separate Tools From Human Work
A useful proposal shows where the money goes.
The technology layer may be billed by endpoint, identity, data source, learner, cloud workload, or protected tenant. The service layer covers onboarding, policy design, alert investigation, threat hunting, containment, reporting, recovery planning, and account reviews.
Those two layers should not be hidden inside one vague “cybersecurity” line.
The latest public IBM Cost of a Data Breach Report pust the global average breach cost at $4.44 million and associated extensive use of security AI and automation with $1.9 million in savings compared with organizations that did not use those tools.
Automation can reduce investigation time. It does not replace decision authority, business context, or a responder who knows which system can be isolated without shutting down the company.
The 2026 SANS cybersecurity workforce report makes a related point: skills gaps now matter more than raw headcount. Managed-security pricing increasingly reflects access to those scarce skills, not just another agent installed on a laptop.
The MSP Has to Survive the Same Test
Outsourcing security introduces another trusted party with privileged access.
CyberSmart’s 2026 survey of 350 MSP and MSSP leaders in the UK and Ireland found that 75% had suffered at least one breach during the prior year. More than half, 54%, reported two or more.
Before signing the premium tier, a customer should ask how the provider protects its own remote-management tools, administrator accounts, backups, and support desk. The contract should explain notification deadlines, evidence retention, subcontractors, cyber insurance, and the customer’s exit path.
The key pricing question is simple: what can the provider do without waiting for permission when ransomware activity appears?
A cheap plan often detects and advises. A real managed-security tier can investigate, contain, and guide recovery under pre-agreed authority.
The criminal service model remains active. Managed providers have simply moved past selling ransomware defense as a small add-on to general IT.
For a 50-person business, the public technology floor can already cross $1,000 a month before partner operations are added. The higher price is defensible when it buys faster containment, protected identities, tested recovery, and a team that is already in the room when the incident starts.
