Buyer's guide · Monthly pricing
Managed cybersecurity in India is bought monthly, and the honest answer to what it costs depends almost entirely on headcount and on whether you need someone watching alerts at 3am. For an Indian SME the working bands are roughly ₹15,000-30,000 per month under 25 staff, ₹30,000-80,000 at around 50, ₹80,000-2,00,000 between 100 and 250, and ₹1.5-5 lakh per month at 500-plus users on a full 24×7 SOC. Those figures cover the service; endpoint licences underneath typically add ₹1,200-5,800 per endpoint per year depending on whether you are buying basic antivirus or managed XDR. Below is what each tier actually includes, which providers serve which end of the market, and the three questions that move a quote more than anything else.
Under 25 staff · endpoint protection, patching and business-hours response
The entry tier is not a SOC and should not be sold as one. It covers managed endpoint protection across every laptop and server, operating-system and third-party patching on a schedule, centrally enforced policy, and someone who answers when something is flagged during business hours. Underlying licences at this level are typically Trend Micro Worry-Free Standard or Advanced at ₹1,200-1,800 per endpoint per year, which for 25 endpoints is ₹30,000-45,000 annually on top of the service fee. This is the right starting point for most Indian businesses under 25 people, and it closes the failure modes that actually cause incidents at that size — unpatched machines and unmanaged endpoints.
Pros
Cons
Best for: Indian businesses under 25 people who currently have unmanaged antivirus and no patching discipline. The largest single improvement available for the money.
25-100 staff · EDR/XDR, log monitoring and SLA-backed response
The step that matters. You move from antivirus that blocks known malware to EDR or XDR that records endpoint behaviour and lets someone reconstruct what actually happened, plus log collection from firewall, endpoints and cloud applications with alerting on top. Response carries a contractual SLA rather than goodwill. Licences here are typically Worry-Free XDR at ₹2,400 per endpoint per year or Vision One Foundation at ₹3,200, so a 50-endpoint deployment is ₹1.2-1.6 lakh annually in licences plus the monthly service. For a fifty-person Indian company the all-in figure lands in the ₹30,000-80,000 per month band, with the spread driven by whether monitoring is business-hours or 24×7.
Pros
Cons
Best for: Growing Indian companies of 25-100 people, anyone holding customer data at scale, and businesses whose enterprise clients have started sending security questionnaires.
100-250 staff · round-the-clock monitoring, threat hunting, managed detection and response
At this tier you are buying people as much as technology: analysts watching a SIEM around the clock, proactive threat hunting rather than pure alert response, and MDR where the provider is contractually able to contain a compromised host at 2am without waiting for you. Licences move to managed XDR — Trend Micro Vision One with MXDR runs around ₹5,800 per endpoint per year — and the SIEM itself becomes a real line item, priced on log volume. This is the tier where the provider takes genuine operational responsibility rather than sending you alerts.
Pros
Cons
Best for: Companies of 100-250 with regulatory exposure, BFSI and healthcare, and any business where a day of downtime costs more than a year of the service.
500+ users · dedicated analysts, custom detections, full incident-response retainer
At 500 users and beyond the model changes again: named analysts who know your environment, detection rules written for your applications rather than generic signatures, an incident-response retainer with forensic capability, and integration into your own security team's workflow rather than a portal you check. Costs range widely — ₹1.5-5 lakh per month is typical, and large or log-heavy environments go well beyond it. The variable that dominates pricing at this scale is log volume, not headcount.
Pros
Cons
Best for: Large Indian enterprises, regulated institutions, and organisations designated or likely to be designated Significant Data Fiduciaries under the DPDP framework.
Our own offer, stated plainly so you can compare it
We build managed security for Indian SMEs on the tiers above, using Trend Micro as the primary endpoint and XDR platform, with Versa for SASE where remote access is the pressing problem and Scrut where the driver is SOC 2 or ISO 27001 certification rather than threat detection. We invoice in INR with a GST invoice, work to CERT-In's six-hour incident-reporting requirement, and hold the escalation with the vendor rather than handing you a support portal. Where a specialist MDR provider genuinely fits better than we do — typically above 250 users or in heavily regulated environments — we will tell you that rather than stretch to reach it.
Pros
Cons
Best for: Indian businesses from 10 to 250 people who want one accountable partner across endpoint, backup, network and compliance rather than four vendors.
Tata Communications, Securonix, Eventus and the Indian MSSP market
Above the SME tiers, India has a genuine specialist MSSP market. Tata Communications operates managed detection and response at carrier scale with strong BFSI credentials. Securonix and comparable platforms bring analytics-led detection for organisations with large, complex log estates. A number of Indian pure-play MSSPs compete hard on 24×7 SOC delivery. What separates them is rarely the technology — it is analyst quality, how many hours a real incident takes to escalate, and whether the contract lets them act without you. Ask for those three specifics, in writing, before comparing rates.
Pros
Cons
Best for: Organisations above roughly 250 users, regulated institutions, and anyone who needs a contractual 24×7 SOC rather than extended-hours monitoring.
Roughly ₹15,000-30,000 per month under 25 staff for managed endpoint protection and patching, ₹30,000-80,000 at around 50 staff once you add EDR/XDR and log monitoring with SLA-backed response, and ₹80,000-2,00,000 between 100 and 250 with 24×7 coverage. Above 500 users on a full SOC, ₹1.5-5 lakh per month is typical. Endpoint licences sit on top at ₹1,200-5,800 per endpoint per year depending on tier, and 18% GST applies to all of it and is normally reclaimable.
Three things, in this order. Coverage hours — moving from business-hours to genuine 24×7 roughly doubles the service component, because it is a staffing cost. Log volume — if a SIEM is involved, ingestion is usually priced per gigabyte per day, and a chatty firewall can cost more than the endpoints. Scope — endpoints only is one price; endpoints plus network, plus cloud, plus email, plus identity is a different one. Headcount matters less than most buyers expect. Ask for the quote broken out along those three axes rather than as one monthly figure.
Business-hours is a defensible choice for most Indian SMEs under about 100 people, and it is roughly half the cost. The honest trade-off is this: ransomware operators deliberately encrypt on Friday nights and during festivals, so business-hours monitoring means a worst-case detection gap of two or three days. If that gap would be survivable — you have tested offline backups and can rebuild — business-hours is rational. If it would not, buy 24×7 and cut scope elsewhere to afford it.
An MSSP manages security tools and sends you alerts; MDR takes responsibility for detecting and responding to threats, including containing a compromised machine without waiting for your approval. The distinction is contractual, not technical, and it matters enormously at 2am. Many providers use the terms loosely, so the question to ask is simply: are you contractually permitted to isolate a host without calling me first, and what is the SLA on doing it?
It covers a substantial part of both. CERT-In directions require incident reporting within six hours and log retention for 180 days in India, and a managed provider handles the log infrastructure and reporting mechanics that most SMEs otherwise cannot. DPDP obligations around reasonable security safeguards and breach notification are considerably easier to demonstrate with monitoring, logging and documented response in place. Managed security is not the same thing as a compliance programme — you still need policies, consent handling and data mapping — but it supplies the technical evidence those programmes are assessed against.
Sometimes, and it is worth asking. Providers can generally ingest logs from most mainstream endpoint products, so if you recently bought three-year licences you may not need to discard them. The limitation is depth: traditional antivirus reports detections, while EDR records process behaviour, and a monitoring service built on detection events alone can only see what the antivirus already blocked. Where budget is tight, keeping existing licences for a year while adding log monitoring is a reasonable interim step.
Two to four weeks to deploy agents and start collecting data, then four to eight weeks of tuning before alert quality is genuinely useful. That tuning period is real work and the most common cause of disappointment — early alerts are noisy, and both sides have to invest in refining them. Full 24×7 SOC onboarding at enterprise scale runs two to three months. Be sceptical of anyone promising meaningful detection in the first fortnight.
Managed endpoint protection with enforced patching, every time. The overwhelming majority of incidents at Indian SMEs start with an unpatched machine or an unmanaged laptop, not with a sophisticated adversary who would need a SOC to catch. The essential tier at ₹15,000-30,000 per month closes more real risk per rupee than anything else on this page. Buy that, verify your backups actually restore, and then consider monitoring.
Send your headcount, endpoint count and whether you need 24×7 to +91 98119 98370, and we will send a monthly figure broken out into service, licences and GST — not a single number.