Cybersecurity has a strange pricing problem: the cheaper option often looks almost identical to the expensive one.
Both might include endpoint protection, email filtering, vulnerability scanning and a dashboard sprinkled with reassuring green ticks. One costs about the same as a streaming subscription. The other costs considerably more.
So what are you actually paying for?
Usually, it is not another shiny security product. It is what happens when a product notices something odd at 2:13 on a Sunday morning.
The Australian cybercrime clock
84,700 reports
Australian law enforcement received about one cybercrime report every six minutes during 2024-25.
$56,600
The average self-reported cybercrime cost for a small business.
Why the numbers matter
Behind the totals are interrupted businesses, locked accounts, urgent phone calls and people trying to work out what happened.
59 per cent
of data-breach notifications involved malicious or criminal attacks.
Welcome to the cybersecurity supermarket
Buying cyber tools can feel like pushing a trolley through a very technical supermarket. Endpoint detection? Into the trolley. Email security? Add two. Dark-web monitoring? Sounds useful. Vulnerability scanning? Better grab that too.
Every item may solve a genuine problem. But a trolley full of ingredients is not dinner, and a stack of licences is not automatically a security operation.
Tools generate signals. Someone still has to decide which signals matter, what they mean together and what should happen next.
It is 2:13 am. A laptop starts behaving strangely.
The Managing Director’s laptop launches suspicious PowerShell commands. The security product raises an alert. Excellent. The software has done its job.
But the alert cannot tell the Managing Director whether to go back to sleep.
What happens next?
- Verify: decide whether it is approved work, a badly behaved application or an intruder.
- Investigate: check identity, email, endpoint and cloud activity for a wider pattern.
- Contain: isolate the device or revoke sessions before the incident spreads.
- Communicate: explain what happened, what was done and what the business needs to do next.
Who or what is actually watching?
This is where much of the price difference lives. Monitoring can be performed by automation, qualified analysts, a general service desk, or nobody until someone checks the dashboard on Monday.
Automation can work quickly and consistently. It can correlate events, remove noise and take tightly defined actions. It still needs good integrations, sensible rules and clear authority.
Human analysts bring judgement. They can test competing explanations, recognise business context and choose a proportionate response. Genuine around-the-clock human capability also requires enough trained people to cover nights, weekends, leave and busy incidents.
Neither model is automatically better. The useful question is whether the operating model matches the risk and expectations of the business.
The software may be identical. The service may not be.
Two providers can supply the same security product and still deliver fundamentally different outcomes. One may install it, configure baseline policies and send alerts to an inbox. Another may continuously monitor it, investigate signals and coordinate containment.
The little green tick on the screen does not reveal which operating model sits behind it.
Seven questions that make pricing easier to understand
- Who reviews an alert? An analyst, automation, the general service desk, or the customer?
- When is monitoring active? Continuously, during business hours or only during periodic reviews?
- How is an event investigated? Can the service connect identity, email, endpoint, cloud and network evidence?
- What can be contained? Can it isolate a device, revoke sessions or disable an account?
- Who communicates with the business? What are the escalation path and expected response times?
- What happens after containment? Is remediation, recovery and review included?
- Where does responsibility stop? What must the customer or another provider still do?
These questions are more revealing than counting product logos.
So, is cybersecurity expensive?
Sometimes. But “expensive” is difficult to judge when two prices describe different things.
A software licence has a price. So does the infrastructure that collects events, the automation that interprets them, the people who investigate them, the authority to contain a threat and the work required to help a business recover.
The fairest comparison starts with the products, then looks behind them.
When an alert appears at 2:13 am, who notices, and what happens next?
If the answer is clear, the price is easier to understand. If the answer is “someone probably gets an email”, the dashboard may be doing more reassuring than protecting.
Sources: ASD Annual Cyber Threat Report 2024-25 and OAIC Notifiable Data Breaches Report, January to June 2025. This article provides general information, not a recommendation for a particular product or operating model.
