In short
- ✓Independent cyber security consultants outside London typically charge around £430–£660 a day, with a median of about £550.
- ✓Cyber Essentials certification costs £320–£600 + VAT from IASME; with help and fixes, most small businesses spend roughly £1,000–£4,000 in total.
- ✓A penetration test of a small website or external network typically costs £2,500–£6,000.
- ✓A part-time virtual CISO typically costs £500–£2,000 a month for businesses of 1–50 staff.
- ✓Most small businesses get the biggest risk reduction from a few low-cost basics: multi-factor authentication, updates, backups and staff training.
Typical UK prices for small business cyber security
These are typical UK market ranges for businesses of 1–50 staff in 2026, drawn from published industry pricing and contract rate data. They're a guide to budgeting, not a quote: the actual cost depends on how many people and devices you have and how much needs fixing.
| Service | Typical UK cost | What drives the price |
|---|---|---|
| Cyber Essentials certificate (IASME fee) | £320–£600 + VAT | Set by organisation size: £320 for 0–9 staff, £440 for 10–49, £500 for 50–249, £600 for 250+ |
| Cyber Essentials with consultant help | About £1,000–£4,000 total | How many fixes are needed, e.g. MFA, updates, replacing old devices |
| Cyber Essentials Plus | Commonly £2,000–£8,000 total | Number of devices sampled in the assessor's audit, plus any fixes |
| Cyber security audit / risk assessment | About £1,000–£3,000 | Number of staff, sites and systems; typically 2–5 consultant days |
| Microsoft 365 or Google Workspace hardening | About £500–£1,800 | Number of users and how much is already configured; typically 1–3 days |
| Email security (SPF, DKIM, DMARC) | About £300–£1,200 | How many services send email as you; DMARC monitoring tools may add a small monthly fee |
| Staff awareness training | About £300–£800 a year | Number of staff, workshops vs online, and whether phishing simulations are included |
| Backup and ransomware resilience review | About £500–£1,800 | Systems to review and test; backup software is a separate subscription |
| Vulnerability scanning | From about £500 per scan | Number of internet-facing systems; often run quarterly |
| Penetration test (small website or external network) | About £2,500–£6,000 | Scope: web application, external network or both |
| Virtual CISO (ongoing) | About £500–£2,000 a month | Business size and how much involvement you need: roughly £500–£800 for 1–10 staff, £1,000–£2,000 for 10–50 |
| Incident response | Retainers about £300–£1,000 a month, or day rates when needed | Speed of response promised and out-of-hours cover |
Day-rate figures: ITJobsWatch median cybersecurity consultant contract rate, UK excluding London, six months to October 2026. Other ranges: IASME, Cloudswitched, JUMPSEC and Pyralink published pricing; estimates for consultant-led work are based on typical days × day rate.
What a typical small business actually spends
For a 10-person firm starting from scratch, a sensible first year usually looks like Cyber Essentials with consultant help, a Microsoft 365 security review and a staff training session. Using the ranges above, that's typically in the region of £2,000–£4,500 in the first year, then much less in following years, mainly for recertification and refresher training.
Firms with bigger customers, contract requirements or regulated data, such as law firms, accountants and estate agents, often add Cyber Essentials Plus, a penetration test or a virtual CISO as they grow.
How to keep costs down
- Turn on multi-factor authentication yourself: it's free in Microsoft 365 and Google Workspace and blocks most account takeovers.
- Use the security features you already pay for before buying new tools.
- Replace devices and software that no longer get security updates, as they're the most common reason for failing Cyber Essentials.
- Fix the basics before paying for a penetration test, so the test finds real issues rather than easy ones.
- Ask for a fixed price agreed up front, so you know the cost before work starts.
What does it cost not to?
In the government's Cyber Security Breaches Survey 2026, 43% of UK businesses reported a breach or attack in the previous 12 months. The cost of a single successful invoice fraud or ransomware attack can easily exceed several years of prevention, before counting downtime and lost trust. Certifying your whole organisation for Cyber Essentials through IASME also lets UK businesses with turnover under £20m opt in to £25,000 of cyber liability insurance at no extra cost.
Questions
How much should a small business spend on cyber security?
Most small UK businesses can cover the essentials, Cyber Essentials with help, Microsoft 365 security and staff training, for roughly £2,000–£4,500 in the first year, then less each year after.
Is Cyber Essentials worth the cost?
For most small businesses, yes. The certificate fee is £320–£600 + VAT, it's required for many government contracts, increasingly asked for by customers and insurers, and UK businesses with turnover under £20m can opt in to £25,000 of included cyber insurance.
Why do cyber security prices vary so much?
Mainly because of scope: the number of staff, devices and systems, how much needs fixing, and how quickly the provider must respond. Always ask for a fixed price agreed before work starts.