How much should you spend on cybersecurity? A 20–200-employee benchmark, with the math

The 5-minute answer

For most professional-services firms with 20–200 employees, the right cybersecurity spend in 2026 is between $50 and $200 per user per month — $2,000 to $10,000 per month, or roughly 0.8% to 2.5% of revenue. The right number for your firm depends on three things: regulatory regime, current cyber-insurance premium, and how much risk you're willing to leave uncovered. The full in-house alternative — a security analyst plus tooling — runs $300,000 to $500,000 a year. For 20–200-employee firms, managed delivers stronger coverage at a fraction of the in-house cost in almost every scenario we model.

This article is the math. We'll cover the three frames operators use to think about cybersecurity spend, the per-employee and per-revenue benchmarks, what you actually buy at the low, middle, and high spend tiers, the in-house vs. outsourced comparison, the cyber-insurance premium-reduction angle, and the specific scenarios where DIY costs more than outsourced.

Score your security in 5 minutes → — get a tailored estimate.

Three ways operators frame cybersecurity spend

Before benchmarks, the frame matters. Operators use one of three lenses, and each gives a different number. The right answer is to triangulate across all three.

Frame 1: Percent of revenue. The Gartner-derived ballpark for IT security spend in mid-market is 5–10% of total IT budget, which itself is typically 2–4% of revenue for non-tech companies. That puts cybersecurity at roughly 0.1–0.4% of revenue — except this number is misleading for SMBs because it averages a lot of large enterprises into the denominator. Practical SMB benchmark: 0.8% to 2.5% of revenue for professional-services firms with material data sensitivity (law, healthcare, accounting, insurance). Manufacturing and lighter-data businesses often sit at the lower end; healthcare and law usually sit at the higher end.

Frame 2: Per-user per-month. This is the cleanest frame for budgeting against headcount and the standard MSP/MSSP pricing model. The 2026 range for managed cybersecurity, including monitoring, EDR, email security, backup, identity, and basic compliance, is $50 to $200 per user per month. Variation comes from regulatory complexity, stack maturity, and required reporting cadence.

Frame 3: Total monthly retainer. This is the frame most owners actually feel. For a 20–200-employee firm, the total monthly cybersecurity spend (managed) usually lands between $2,000 and $10,000 per month. Below $2,000/month at this firm size, you're either uncovered in critical areas or paying a vendor who is. Above $10,000/month for a 200-employee firm, you're either heavily regulated or paying for capabilities (vCISO, SOC 2 audit) that should be priced separately.

Triangulating across all three is how you sanity-check a quote. If a vendor is at $35/user/month, $1,800/month total, and 0.4% of revenue for a 50-employee law firm, the quote is too low for the regulatory exposure. If another vendor is at $250/user/month, $12,500/month total, and 3% of revenue for the same firm, the quote includes capabilities the firm probably doesn't yet need.

The 20–200-employee benchmark with the math

Here's the spread, by firm size, for managed cybersecurity in 2026. Numbers below are typical mid-points; specific firms can sit ±30% depending on regulatory load and stack complexity.

20–49 employees. $50–$120/user/month. $2,000–$4,500/month total. Annual: $24,000–$54,000. This tier covers monitoring, EDR, email security, backup, MFA enforcement, and basic compliance mapping for one regulatory regime (HIPAA, NAIC WISP, IRS 4557, etc.). It does not include a named security executive or a full audit-defense package.

50–99 employees. $80–$160/user/month. $4,500–$10,000/month total. Annual: $54,000–$120,000. Adds vCISO governance, quarterly tabletop exercises, monthly board-ready reporting, vendor risk reviews, and named-human incident command. This is the tier where the firm gets a documented security program rather than a managed stack.

100–200 employees. $120–$200/user/month. $10,000–$30,000/month total. Annual: $120,000–$360,000. Adds heavier compliance lifting (SOC 2 readiness, CMMC L2, multi-jurisdiction NAIC), expanded SIEM/SOC capability, more frequent tabletops, and typically a dedicated client success manager. At the upper end, this tier overlaps with what some firms achieve in-house — but with more coverage and fewer dependencies on a single hire.

If your current spend is more than 30% below the lower bound for your firm size, you're almost certainly under-covered. If it's more than 30% above the upper bound, you should be getting capabilities (vCISO, SOC 2, multi-framework compliance) that justify the gap.

Score your security in 5 minutes → — the output includes a benchmark comparison against firms your size.

What each spend tier actually buys

The benchmark numbers are useless without knowing what they cover. Here's what's actually inside each tier.

Low tier ($50–$80/user/month): the basics. 24/7 endpoint monitoring with EDR, email security gateway, MFA enforcement on email and remote access, basic patching, encrypted backups with retention, helpdesk for user issues. Compliance mapping at the awareness level — your provider can tell you what HIPAA or NAIC WISP requires, but they're not delivering the WISP. This tier is appropriate for firms with no current regulatory exposure and modest data sensitivity. Manufacturing operations, B2B service firms without protected data, smaller distributors. Not appropriate for HIPAA-covered entities, insurance producers in NAIC-adopted states, CPA firms under IRS Pub 4557, or any firm with cyber-insurance underwriter demands.

Middle tier ($80–$160/user/month): the operating practice. Everything in the low tier, plus a named vCISO or security lead, monthly board-ready security reporting, quarterly tabletop exercises, documented compliance program for one to two frameworks, vendor risk review program, named-human incident commander on retainer. This tier is appropriate for most professional-services firms in the 30–150-employee range. Law firms, CPA firms, insurance agencies, healthcare practices, and small manufacturers with light DoD exposure. The sweet spot for Evolv's typical engagement.

High tier ($160–$200+/user/month): the audited program. Everything in the middle tier, plus heavier compliance lifting (CMMC L2, SOC 2 Type II readiness, multi-jurisdictional NAIC), expanded SIEM/SOC capability, dedicated client success manager, custom reporting cadence aligned to your firm's audit calendar, possibly a fractional CISO with named time per week. This tier is appropriate for firms in heavily regulated verticals (multi-state insurance, federal contractors, regulated finance) or firms approaching $50M+ revenue where the security function needs to scale with the audit and renewal calendar.

The in-house vs. outsourced math

The recurring operator question: "Should we just hire a security person instead?" The math says no for most firms in the 20–200-employee range.

In-house option. A mid-level information security analyst's median annual base salary in 2024 was $124,910 (US Bureau of Labor Statistics). Add 30% for benefits and payroll tax, and you're at $162,000 fully loaded. That's one person. The tooling stack — EDR licenses, SIEM, email security, vulnerability scanning, identity, backup — adds another $40,000–$80,000 per year for a 100-employee firm. You also need a backup for vacation, illness, and on-call coverage. Realistic minimum for an in-house program with one analyst plus tooling: $200,000–$250,000 per year.

But one analyst isn't a security program. They cannot run 24/7 monitoring, cover incident response off-hours, attend audits, write the WISP, and own vendor risk. Most firms that hire one in-house security person discover within six months that they need a second one (or a manager) plus expanded tooling. Building an actual in-house security operations center for a small or mid-sized firm is $300,000–$500,000+ per year for even a small team — and that's without the audit-prep capability.

Outsourced option. $54,000–$120,000 per year for a 50–99-employee firm with full middle-tier coverage. Includes named vCISO, monthly reporting, quarterly tabletops, audit attendance, and incident command — the things one in-house analyst structurally cannot deliver alone.

The arithmetic is straightforward. For 20–200-employee firms, outsourced delivers more coverage at one-third to one-half the cost. The tipping point where in-house starts to make economic sense is somewhere around 300–500 employees, depending on data sensitivity and regulatory load. 48% of organizations now choose to outsource security as their preferred approach — the math drives this, not preference.

The cyber-insurance premium-reduction angle

This is the spend-justification frame most firm leaders find most convincing. Cyber-insurance underwriters in 2026 increasingly demand documented controls, not self-attestation. Firms with documented controls — MFA coverage at 100%, EDR deployment at 100%, tested backup restore in the last 12 months, named incident commander, written security policy, written WISP — get materially lower premiums and broader coverage at renewal.

The math operates in two directions.

Direction 1: Premium reduction. Underwriters underwriting documented programs typically offer 10–25% premium reductions versus the same firm at the prior renewal cycle without those controls in place. For a firm paying $25,000/year in cyber-insurance premiums, that's $2,500–$6,250 in annual savings — recovering 5–15% of the cybersecurity spend in insurance economics alone.

Direction 2: Coverage expansion. Underwriters are increasingly excluding firms without documented controls from coverage entirely, or imposing sub-limits and exclusions that effectively neuter the policy. The post-WannaCry, post-MOVEit, post-Change-Healthcare reality is that "we have a policy" no longer means "we are covered." A firm without documented MFA or EDR may have a policy that won't pay out on a ransomware claim. The cybersecurity spend buys you the actual coverage your premium is supposed to deliver.

Net economic story: a 50-employee professional-services firm spending $7,000/month ($84,000/year) on managed cybersecurity is offsetting some combination of $5,000–$15,000 in premium reduction, $50,000–$200,000 in deductible/sub-limit avoidance during an incident, and the catastrophic "60% of breached small companies close within 6 months of being hacked" tail risk. The spend is not a cost center. It is risk-priced insurance with operational benefits.

When DIY costs more than outsourced

Three scenarios where the in-house or DIY path actually costs more than buying the managed service.

Scenario 1: You're already a year behind on compliance. A firm trying to stand up a NAIC WISP or HIPAA program from scratch internally typically takes 4–9 months and consumes 200–400 hours of partner or executive time. Outsourcing the same delivery (Evolv's WISP product is 28 days for a 10–100-employee insurance agency) usually costs less than the executive-hour opportunity cost alone.

Scenario 2: Your team is tracking five or more SaaS security tools. If your firm has separate vendors for endpoint, email, backup, MFA, password manager, vulnerability scanning, and one or two compliance platforms, the operational overhead of managing those vendors typically exceeds the differential cost of consolidated managed delivery. Add the time spent on renewals, license-count audits, and integration debugging, and DIY is the more expensive option even before you factor in coverage gaps.

Scenario 3: You've had a near-miss in the last 12 months. A near-miss — a phishing attempt that almost got through, a backup that failed but you caught it, a credential-stuffing attempt against an admin account — is a leading indicator. Firms that act on near-misses save approximately 60–80% of the cost of the actual incident they would have suffered. Continuing to DIY after a near-miss usually means the next attempt isn't a near-miss.

How Evolv approaches this

Our typical engagement for a 20–200-employee professional-services firm starts with the Scorecard, lands at the middle tier, and includes a named vCISO, monthly board-ready reporting, quarterly tabletops, and the compliance program for whichever framework applies. We publish a monthly report you can hand to your board, your auditor, or your insurance underwriter without translation. The cost is documented in the engagement letter; there are no surprise renewals.

Two ways to start.

Option 1: Run the Cyber Scorecard. Five minutes. Output is a tailored spend estimate against your firm size, industry, and current stack — plus a list of the gaps the spend would close.

Option 2: Book a 20-minute scoping call. A named member of our team responds within four business hours. We walk through your current spend, your insurance renewal calendar, and what a phased program would look like for your firm specifically.