What does a cybersecurity check for SMEs cost?
Updated: 2026-11
The cost of a cybersecurity check depends on company size and number of sites, the complexity of cloud and Microsoft 365, the number of internet-facing systems, statutory reporting duties and existing documentation. Penetration tests are a separate item and not always the first step.
Security is often bought as products. The most effective first steps are usually organisational, though: knowing which systems exist, who decides during an incident and whether backups can actually be restored.
A fixed-scope check creates this overview and shows where investment makes the biggest difference. It does not replace a pentest but makes clear where one makes sense.
What drives the cost
Size and sites
More employees, sites and devices mean more configuration to review.
Cloud and Microsoft 365
Several tenants, cloud accounts and third-party apps increase review effort.
Attack surface
The number of domains, subdomains and public services drives the inventory effort.
Reporting duties
Critical infrastructure operators or companies with EU exposure need a more detailed duty analysis.
Existing documentation
A current network and system inventory shortens the check considerably.
Pentest need
Penetration tests are quoted separately with specialised partners where they make sense.
How we price
- 01
Fixed-scope package
Cyber readiness check by company size, including plan and exercise.
- 02
Implementation support
Help closing the gaps found, on a time basis or as a package.
- 03
Repetition
Annual exercise and update of inventory and plan.
We deliberately publish no online prices: every case differs. After a short first conversation you receive a binding fixed price or clear frame.
Parent service: Cyber readiness & IT security
Matching offers
Cyber readiness check
The cyber readiness check establishes whether your company detects an attack in time, responds correctly and reports on time: review of reporting duties under the ISA, FADP and NIS2 where relevant, inventory of the attack surface, review of cloud and Microsoft 365 baseline configuration, backup recoverability, an incident response plan and a tabletop exercise.
Data breach readiness: playbook, notification process and drill
Data breach readiness gives you a ready-to-use playbook: named roles and emergency contacts, a decision matrix per system for notification duties under the FADP and GDPR, templates for authorities, data subjects and customers, an incident register and a guided drill. In an emergency you decide in minutes instead of hours.
SaaS security & RLS audit
A SaaS security audit targets tenant isolation specifically: is row-level security watertight, does access control hold, are typical Supabase pitfalls (service role in the client, missing RLS) avoided? The output is a finding with concrete fixes.
FAQ
Do SMEs need a check at all?
SMEs especially, because they rarely have a security team and attackers deliberately look for weakly protected companies.
Which is cheaper, a check or a pentest?
The check, and it usually comes first. A pentest examines a defined scope in depth; defining that scope sensibly requires the overview from the check.
Does insurance cover the cost?
It depends on the policy. Some cyber insurers even require such basics as a precondition.