Network security pricing explained line by line

A network security quote has a hardware line and a subscription line. The hardware is paid once. The subscription is paid every year and decides which features stay on.

Figures below are illustrative in US dollars, drawn from published list prices and typical reseller quotes for a 25-person office. Your reseller's numbers will differ by month, by region and by volume. The structure will not.

What to take away

The invoice, line by line

Hardware, $600 to $2,500 one time. A firewall or router sized by throughput and port count. A 25-person office with a 1 Gbps fibre handoff typically lands on a desktop-class appliance in the $700 to $1,200 range.

Add a switch at $300 to $900 and access points at $150 to $400 each. This line is paid once and forgotten, which is why resellers lead with it.

Subscription, $400 to $1,800 per box per year. Sold as security services, threat protection or advanced licensing. It funds the parts that need updating: intrusion signatures, URL category lists, reputation feeds, sometimes cloud management. A three-year prepay usually discounts 15 to 25 percent. This is the line that rises at renewal.

Per-device, per-user, per-site or per-throughput. Four bases, and they grow differently. Per-device at $8 to $25 per device per year counts printers and cameras, which is where small businesses get surprised.

Per-user at $30 to $90 per user per year counts people, which is predictable. Per-site is flat until you open a second office. Per-throughput is a tier you outgrow silently.

Feature licenses, $100 to $600 each per year. Content filtering, VPN client counts above the included number, a second unit for failover, longer log retention. Each is its own line with its own renewal date.

Support, $150 to $900 per year. The tier that decides how fast a replacement ships when the box dies. Next-business-day and best-effort differ by hundreds of dollars and by days of downtime.

That number belongs in the same conversation as the recovery time question in backup and recovery.

The United States National Institute of Standards and Technology's contingency planning guide for federal information systems calls it a recovery time objective, and the support tier is that number priced.

Cloud management, $0 to $300 per year. Sometimes bundled, sometimes a separate per-device charge. Usually required for the multi-site view, and on some products required for anything at all.

Installation and configuration, $500 to $3,000 one time. A professional services line if a reseller does the setup. Ask what is included. The drawing of who talks to whom is often not, and that is the part that matters.

What switches off when you stop paying

Put this question in writing before signing. The honest answer ranges from nothing to almost everything.

At one end, the box keeps routing, segmenting and filtering by your own rules. Only the updated feeds stop.

At the other, the management console locks and the configuration cannot be changed. On some products the box stops passing traffic.

The common case sits between them: the box keeps working, but you can no longer change it. A lapse becomes an emergency the day a rule needs editing. Get the answer for the specific model in the vendor's own words and keep it with the quote.

The costs that are not on the quote

The pricing bases side by side

Comparing two quotes

Put both options in the same shape: three years, every feature you intend to use switched on, and the support tier you actually need. Use the users and devices you will have in year three, not today. State the renewal price now, not later, then add the hours.

Quotes that looked far apart often converge. The cheaper one usually got there by leaving the subscription line for year two. The features that justify the subscription at all are set out in network security features. If you will not switch them on, the cheaper hardware without the subscription is the honest buy.

Common questions

Is a subscription always necessary?

No. Segmentation, a guest network, an inbound list of zero and name filtering through a free resolver need no subscription on most business-grade equipment. The subscription buys updated feeds and inspection, which are worth paying for only when someone will act on what they produce.

Should we pay three years up front for the discount?

Only if the model will still be supported for those three years and the business will still be the same size. Ask for the end-of-support date before deciding. A 20 percent discount on a box that leaves support in year three is not a discount.

What about a managed provider that bundles everything?

Then the price is made of the same parts plus their hours, and the question becomes what they do without calling you. The alternatives, including that one, are laid out in network security alongside the case for doing less and doing it well.

Why do renewal prices rise?

Because the first-year price was a sale. Ask for the renewal figure in writing before signing. A vendor who will not give one has told you something.