Office Stack GuidePlain-English guides to the software and IT services small businesses actually use.

Endpoint Security for Small Business: Costs, Tiers, How to Choose

By Office Stack Guide Editors · Updated 2026-11-12

In cyber insurer At-Bay's 2026 claims data, 60% of businesses hit by the Akira ransomware group had a leading endpoint detection and response (EDR) tool and were breached anyway. A small office should therefore buy EDR with a person watching it 24/7, not EDR alone. At-Bay also found that in 2025, ransomware claims at firms under $25 million in revenue rose 21% in frequency and 40% in severity, to $422,000.

An office manager reviewing a laptop at a desk in a small daylit office, with staff working in the background.

As of 2026, EDR starts at $3 per user per month. Round-the-clock monitoring adds roughly $3 to $15 per endpoint per month.

At a glance

Tier Cost per device per month (2026) What it catches Who responds when it fires Source
1. Built-in antivirus (Microsoft Defender Antivirus in Windows) $0 Malware files on that one PC The person at the PC sees a pop-up. Nobody else knows. Microsoft, 2026
2. Business antivirus (NGAV) (CrowdStrike Falcon Go, $59.99, or Falcon Pro, $99.99 per device per year) About $5 to $8.33 The same malware blocking, plus one console and USB device control Whoever checks the console CrowdStrike, 2026
3. EDR (Defender for Business, $3 per user; CrowdStrike Falcon Enterprise, $184.99 per device per year) $3 per user; about $15.42 per device Suspicious behavior, such as an intruder using stolen logins. It can cut a device off the network. Automatic actions, then whoever reads the alerts Microsoft; CrowdStrike, 2026
4. MDR (Huntress Managed EDR at $8.99 per endpoint list price; CrowdStrike Falcon Complete or an MSP service by quote) Roughly $3 to $15 per endpoint The same sensors, plus analysts who separate real attacks from noise A 24/7 security team that isolates devices and calls you Huntress; MSP pricing guides, 2026

NGAV means "next-generation antivirus." It blocks malware by its behavior as well as by known signatures. CrowdStrike lists EDR only from Falcon Enterprise up, so Falcon Go and Falcon Pro are antivirus tiers. The MDR range is how MSP pricing guides quote managed monitoring; Huntress's $8.99 list price sits inside it. Get written quotes.

What each tier catches, what it misses and who watches the alerts

An "endpoint" is any device your staff use: laptops, desktops, phones, tablets and servers. NIST's CSF 2.0 Small Business Quick-Start Guide sorts security work into six functions, including protect, detect and respond. Built-in antivirus covers protect. Each rung above it adds more detection and response.

Blocking malware is close to a commodity. In AV-TEST's February 2026 business test, centrally managed Microsoft Defender Antivirus scored 6 of 6 for protection, performance and usability. It was one of 13 products named "Top Product." AV-TEST tested Defender run from a central console, which is the tier 2 setup, not the copy each PC runs on its own. The lesson is that malware-blocking scores no longer separate the paid tiers.

What you pay for is response. At-Bay sells MDR as well as insurance. Its key findings state that "not a single At-Bay MDR customer filed an Akira claim in 2025." Insurance Business reported this as only firms with EDR plus 24/7 MDR avoiding full encryption. Akira accounted for more than 40% of At-Bay's 2025 ransomware claims.

At-Bay does not publish three things: how many MDR customers it has, what share of all its policyholders run EDR, or the yearly odds of a claim. Read these figures as a strong signal from one insurer's book of business, not a controlled study.

At-Bay's numbers describe a pattern:

  1. The intruder logs in remotely. Where the entry point was known, 73% of the ransomware attacks in At-Bay's report started through VPN access. A VPN is the remote-access gateway, usually on your firewall.
  2. They act like an administrator. Normal admin tools give file-scanning antivirus nothing to block. EDR watches behavior, so it flags this activity.
  3. The alert fires after hours. At-Bay found that two-thirds of Akira attacks came at night or on weekends.
  4. Nobody reads it. The alert sits in an inbox until Monday, and by then the shared files are encrypted.

MDR (managed detection and response) closes the gap at step 4. A security operations center, which is a team of analysts working in shifts, reads the alert and isolates the device. Huntress says its MDR includes managed Microsoft Defender Antivirus, so the 24/7 human can sit on top of Microsoft's antivirus. Huntress lists Managed EDR at $8.99 per endpoint per month. Buying direct or through a reseller carries a 50-endpoint minimum, so a 15-person office would buy it through a managed service provider (MSP), meaning an outside IT firm, which has no minimum.

Verizon's 2025 Data Breach Investigations Report found ransomware in 88% of small-business breaches, against 39% at larger organizations. Sources: Verizon's SMB snapshot and Infosecurity Magazine. That figure is the share of breaches that involved ransomware. It is not the odds of being attacked.

Endpoint security cost: what a 15-person office pays per year

This example assumes 15 users, 15 Windows laptops, 15 phones and no on-site server. All figures are 2026 list prices, paid yearly.

Option Math Per year What you get
Built-in Defender only Included $0 Malware blocking on each PC, no central view
Defender for Business standalone 15 × $3 × 12 $540 EDR on laptops and phones (up to 5 devices per user)
Business Standard ($14) to Premium ($22) 15 × $8 × 12 $1,440 extra Defender for Business plus Intune device management
Defender for Business + Intune Plan 1, bought separately 15 × ($3 + $8) × 12 $1,980 The same two tools, for more money
CrowdStrike Falcon Enterprise 15 × $184.99 About $2,775 EDR on 15 laptops; phones count as extra devices
MDR through an MSP 15 × $3 to $15 × 12 About $540 to $2,700 24/7 human monitoring

Here is the trade:

The Register reported that Microsoft's prices changed on July 1, 2026. Business Basic rose from $6 to $7 and Business Standard from $12.50 to $14. Premium stayed at $22, so the upgrade gap shrank from $9.50 to $8.

Microsoft's own Defender for Business page lists Premium at $22, or $18.79 without Teams. Some third-party sites quote higher figures. Existing customers pay new prices at renewal, so confirm the current price on Microsoft's page before you budget.

What changes the price

Laptops, phones and servers: covering every device your staff use

An attacker needs only one unprotected device. Count every device before you buy.

What cyber insurers expect from your endpoints

An IT technician looking at security alerts on a laptop screen in a small office.

Insurance broker Marsh McLennan publishes 12 key cyber controls that it says insurers commonly require. The list includes EDR, MFA for remote and administrator access, tested backups, patching and replacing end-of-life systems. Marsh's 2023 research named EDR among the five most effective controls.

The CISA #StopRansomware Guide (September 2023) says: "Use application allowlisting and/or endpoint detection and response (EDR) solutions on all assets."

Here is how each tier answers two questions that appear on many applications:

Your tier "EDR on all endpoints?" "Alerts monitored 24/7?"
Built-in antivirus No No
Business antivirus (e.g., Falcon Go or Falcon Pro) No. Neither includes EDR. No
EDR (Defender for Business, Falcon Enterprise) Yes, if every device has the agent No, unless someone is on call
MDR Yes Yes

Requirements vary by carrier and by revenue band. Read your own application and policy wording, and ask your broker about any question you are unsure how to answer.

How to choose and hire

Decide who answers the 2 a.m. alert first, then pick the license:

Ask any vendor or MSP these questions, and get the answers in writing:

  1. Which product and tier are you quoting, and does it include EDR by name?
  2. Who watches alerts at 2 a.m. on a Saturday, and can they isolate a device without reaching me first?
  3. What is your written response time for a critical alert?
  4. Are phones, Macs and servers included, or extra?
  5. Does the quote cover patching our firewall and VPN, and testing backup restores?

Get at least two written quotes so you can compare them line by line.

Red flags and common mistakes

FAQ

Is the free Microsoft Defender in Windows enough for a small office?

For blocking malware on a single PC, it is a capable product. The perfect AV-TEST score belongs to centrally managed Defender, though, not to copies running unmanaged on each PC. Built-in Defender also gives you no central view, no record of attacker activity and no "yes" on an insurer's EDR question.

Should I buy direct from the vendor or through an MSP?

Buying direct gives you the lowest license cost. Someone still has to set it up, read alerts and keep every device enrolled, and an office with no IT staff pays an MSP for that labor. Ask the MSP who owns the licenses and the console if you part ways.

How do I switch from consumer antivirus without leaving gaps?

An employee reading work email on a smartphone beside an open laptop at an office desk.

Install the new agent on every device and confirm that the console count matches your device list. Only then remove the old antivirus and cancel it. Running two real-time scanners at once slows PCs down and causes conflicts.

Does turning on Business Premium protect everything automatically?

No. Premium includes Defender for Business and Intune, but someone has to enroll devices and configure policies. Ask for a report showing every device and when it last checked in.

Does EDR make an old Windows 10 PC safe?

No. Windows 10 reached end of support on October 14, 2025, and no endpoint tool fixes an unsupported operating system. Marsh lists replacing end-of-life systems as a key control. Check Microsoft's Extended Security Updates page for current terms.

Key takeaways

The bottom line

First, inventory your devices and read your cyber insurance application. Next, get two written MDR quotes, and confirm current license prices on Microsoft's and CrowdStrike's own pages. Small-firm ransomware claims are rising, Business Premium is holding at $22 for now, and At-Bay's claims data shows that EDR without a human did not save most of its buyers. The question to settle before your next renewal is who watches your console at 2 a.m., and what that costs.

Sources