The smallest useful engagement.
Essentials
$11per user / month
Endpoint detection and a plain awareness program.
- Managed EDR on work computers and servers
- Security awareness training and phishing simulations
- A monthly letter in plain language
Pricing
Proposed prices, with the arithmetic showing.
Proposed — pending validation of hosting and staffing cost. There is no payment on this site. A proposal, after an assessment, is the price that matters. These figures let a firm compare us with a published list before that conversation.
Anchor: Huntress public list prices as recorded on 2026-10-06 from their pricing page. We do not resell Huntress, we are not a partner, and their staffed SOC is not our coverage. Our hours are on the home page.
The proposal we expect to write first for a Microsoft 365 firm.
Pro
$20per user / month
Essentials, plus identity monitoring and a Microsoft 365 baseline.
- Everything in Essentials
- Managed ITDR for Microsoft 365 or Google Workspace
- M365 security posture reviews against our written baseline
- A named contact and a written responsibility matrix
Pro, plus log sources that are not already covered.
Complete
$20per user / month, plus $4 per log source
Identity, endpoints, posture, and log monitoring priced per source.
- Everything in Pro
- Managed SIEM for log sources beyond the endpoint agent and the identity watch
- Retention for the period named in the order. Planning figure: 90 days searchable.
- Correlation across those sources, written up in the monthly letter
Estimate a Microsoft 365 firm
This calculator uses the proposed bundle math. It does not apply taxes, discounts, or a minimum. Log sources are feeds beyond endpoints and beyond the identity watch.
Component anchors
One user in the common case is one endpoint, one identity, and one learner. SIEM is not folded into the user price, because a 25-person firm rarely has 25 extra log sources.
| Component | Unit | Proposed monthly | Anchor |
|---|---|---|---|
| Managed EDR | per endpoint | $8.99 | Huntress Managed EDR list, $8.99 per endpoint |
| Managed ITDR | per identity | $4.80 | Huntress Managed ITDR list, $4.80 per identity |
| M365 security posture | per identity | $4.00 | Huntress Managed ISPM list, $4.00 per identity |
| Managed SIEM | per log source | $4.00 | Huntress Managed SIEM list, $4.00 per data source |
| Security awareness training | per learner | $2.08 | Huntress Managed SAT list, $2.08 per learner |
- Essentials is $11.07 before rounding, proposed at $11.
- Pro is $19.87 before rounding, proposed at $20. That assumes Microsoft 365, so the posture checklist is included.
- Google Workspace only, with no Microsoft 365 checklist: Essentials plus ITDR is $15.87 before rounding, proposed at $16 per user. We do not add the $4 posture line.
- A flat $24 per user would be the sum of every anchor, including one SIEM source per person ($23.87 before rounding). We will not quote that flat number unless the source count is actually in that range. Complete is Pro plus $4 per extra log source.
A 25-person law firm on Microsoft 365
Twenty-five people, twenty-five computers, twenty-five mailboxes, one firewall. Endpoints are not billed again as SIEM sources. The tenant is already covered by ITDR, so it is not a second SIEM fee unless the order asks for separate SIEM retention of that tenant.
- Essentials
- $275 / month
- Pro
- $500 / month
- Complete
- $504 / month
- Same shape at the public list anchors
- $500.75 / month
- Monthly, in arrears, is the shape we expect to propose. Annual prepay is not offered yet.
- No setup fee is printed here because we have not measured onboarding time on a real client. The first proposals may include a one-time onboarding line once we know the hours. It will be written, not invented after the invoice.
- Firms under about 10 people may cost more to onboard than the monthly fee covers. We may set a minimum later. There is no minimum on this page.
- Prices exclude taxes. They also exclude the firm’s own Microsoft or Google licenses, backups, and IT provider.
A proposal comes after the assessment.
Bring the seat count, whether you are on Microsoft 365 or Google Workspace, and whether a firewall or VPN should be a log source. We will not ask for a card.