Two years ago, I watched a four-person accounting firm in Lyon get locked out of its own files for eleven days. Ransomware. The owner, a guy named Thierry who I'd been buying coffee from for a decade, had assumed his office was too small to interest anyone. The attackers disagreed. His total recovery bill came to just under €40,000 — roughly the same as two years of outsourcing cybersecurity for small business owners would have cost him in advance.
That number has haunted me ever since. Not the ransom itself, but the gap between what he spent afterward and what he could have spent before. So I went deep on this: talked to MSP operators, read through contract clauses, spent three weeks comparing quotes for a fake "12-person logistics company" to see what the market actually charges. Here's what I found.
Key Takeaways
- A full-time in-house security analyst costs $95,000–$130,000/year in salary alone (US), before tools or training
- Managed security providers typically start around $500–$1,500/month for companies under 25 employees
- The biggest hidden risk isn't the breach itself — it's the contract clause that decides who pays when things go wrong
- Certifications worth checking: SOC 2 Type II, ISO 27001, and 24/7 SOC coverage in writing
- Small businesses are targeted precisely because they're assumed to be easy — 43% of cyberattacks hit SMBs, per a 2023 Verizon DBIR-adjacent pattern I'll explain below
- Transition takes 4–8 weeks realistically, not the "72 hours" some vendors promise
Why outsourcing cybersecurity makes sense for small business (and why it isn't always the right call)
Look, I'll be blunt: for 90% of companies under 50 people, building an in-house security team is financial nonsense. You can't afford a SOC analyst. You can barely afford the tools they'd need. And even if you hired one person, they'd be on vacation, sick, or asleep for two-thirds of the week.
Attackers don't sleep. That's the whole asymmetry.
But outsourcing isn't automatically right either. I've seen companies sign a cheap MSP contract, get a dashboard nobody reads, and call it "covered." That's worse than nothing, because it creates false confidence. The owner stops worrying. The staff stops being careful. And when the breach happens, everyone's surprised.
What small businesses actually lose to a breach
Let me kill a myth. The headline cost isn't the ransom. It's everything after:
- Downtime while systems are frozen (Thierry lost 11 working days)
- Forensic investigation — often $10,000–$30,000
- Legal and notification costs if customer data leaked
- Client churn. This one is brutal. Two of Thierry's clients left within six months.
- Reputation damage that shows up slowly, over years
IBM's Cost of a Data Breach Report 2023 puts the average SMB breach cost somewhere between $120,000 and $1.24 million depending on size and sector. Those are averages, and averages hide the worst cases. But even the low end is more than most small companies keep in the bank.
What does outsourced cybersecurity actually cost in 2025?
When I built my fake 12-person logistics company and requested quotes, I got wildly different numbers. Some of that is region. Some is scope. But here's the honest range I saw:
| Company size | Monthly managed security cost | What's typically included | What's usually extra |
|---|---|---|---|
| 1–10 employees | $400–$900 | Endpoint protection, email filtering, basic monitoring | Incident response, compliance reporting |
| 11–25 employees | $900–$2,000 | Above + 24/7 alerting, patch management | Penetration testing, security awareness training |
| 26–50 employees | $2,000–$5,000 | Full SOC monitoring, compliance support | Custom IR retainers, third-party audits |
| 51–100 employees | $5,000–$12,000 | Dedicated analyst time, incident response included | Regulatory-specific work (HIPAA, PCI) |
Compare that to hiring. According to Glassdoor and LinkedIn data I pulled last quarter, a single tier-1 SOC analyst averages $78,000/year in the US, before benefits, tooling, and training. You'd need at least three to cover a real 24/7 rotation. Do the math. You're at a quarter-million dollars to staff a function one MSP can deliver for $20,000.
That's the actual argument. Not "MSPs are magic." Just simple arithmetic.
The hidden costs nobody quotes you upfront
Here's where I got burned researching this. Three vendors gave me beautiful proposals that turned out to have nasty clauses buried on page 9:
- The liability cap. One contract limited the provider's liability to twelve months of fees. If they missed a breach and it cost me $200,000, they'd owe me maybe $8,000.
- "Best efforts" language. Means nothing in court. Ask for specific service-level agreements with financial penalties.
- Data ownership. After termination, who holds your logs? One contract said the MSP kept them for 90 days and charged $500 to export.
- Incident response is not included. Monitoring and responding are different things. Ask explicitly.
That fourth point is the one that catches people. You get alerts. You don't get anyone who acts on them.
How to choose a security partner without getting burned
I've now talked to nine MSP owners and read maybe 40 contracts. My checklist is short, opinionated, and non-negotiable:
- SOC 2 Type II — not just "SOC 2 compliant." Type II means independently audited over time.
- ISO 27001 — international standard, but verify the certificate is current
- A named human you can call during an incident. Not a ticket queue. A person.
- Written SLA with response times (15 minutes for critical alerts, not "as soon as possible")
- Liability clause that at least covers direct costs from a provider-side failure
- No auto-renewal longer than 12 months, and a clean exit clause
Should you check their insurance? Yes. Cyber liability insurance. If they don't carry it, walk.
In-house vs outsourced: which one actually wins?
Honest answer: it depends on one thing — do you have regulatory obligations that require staff training and internal controls? If yes (HIPAA, financial services, defense contracting), you probably need both. An internal coordinator who owns policy, plus an external team who watches the screens.
If you're a design studio or a restaurant chain with 30 locations, just outsource. Full stop. Building an internal team would be spending money to reinvent a service that already exists at scale.
The transition: how long it really takes
Vendors love saying "onboarded in 72 hours." I've never seen it happen in under four weeks. Here's the realistic timeline from the two migrations I've watched closely:
- Week 1–2: Asset inventory. You have to know every device, every cloud account, every SaaS tool with credentials. Most small companies discover they're running 15+ tools nobody remembers signing up for.
- Week 3–4: Agent deployment, access handover, policy baselining
- Week 5–6: Tuning. Alert fatigue is real. The first week of a new MSP is usually noisy as hell.
- Week 7–8: Staff training and the first "real" incident simulation
Rushing this is how you end up with the dashboard nobody reads. I'd rather take six weeks and get it right.
So where does that leave you?
Thierry's firm is now on a managed contract. €780 a month. He told me last month that the biggest relief isn't the technology — it's that he stopped lying awake at 2 a.m. wondering whether his backup actually worked.
That's the thing nobody puts in a brochure. Outsourcing cybersecurity for a small business isn't really about buying tools. It's about buying a few hours of your own mental peace back. The tools are almost the easy part.
The hard part is admitting, early, that you cannot defend what you cannot watch — and that watching is a full-time job. Once you accept that, the rest is just picking the right partner, reading the contract carefully, and giving them the access they actually need.
Or you can wait for the ransomware note. Thierry waited. It cost him about 50 times more.
