Content reviewed and updated 24 September 2026.
You’re paying for more than software
Two security quotes can list the same products and still buy very different services. One supplies the software. Another also investigates alerts, coordinates containment and helps the business recover.
A licence is one ingredient. The useful comparison is who does the work, when they do it and where their responsibility stops. A dashboard full of green ticks cannot answer those questions.
Average self-reported cost per small-business cybercrime report.
ASD · Australia, FY2024-25Cybercrime reports to ReportCyber in one year.
ASD · Australia, FY2024-25Average time between ReportCyber reports.
ASD · Australia, FY2024-25These figures describe reported cybercrime, not the price of a security service or the cost of every incident.
It is 2:13 am. Who responds?
Imagine a laptop running suspicious commands overnight. The product raises an alert. Now someone must determine whether this is approved work, a faulty application or an intruder.
The next steps may include checking related identity and cloud activity, isolating a device, revoking access and explaining the impact to the business. This is an illustrative scenario, not a claimed customer incident.
Automation can act quickly within defined rules. People add context and judgement. Ask how both are used, and whether the agreed coverage includes nights, weekends and recovery.
Seven questions to compare security quotes
1–2. People and hours
Who reviews alerts, and when is the service active?
What to check
Distinguish automated notifications, business-hours support and around-the-clock investigation. Ask who owns escalation during leave or a major incident.
3–4. Investigation and action
Which systems can be investigated, and what can the provider contain?
What to check
Ask about identity, email, endpoint and cloud evidence. Confirm permissions to isolate devices or revoke sessions, rather than assuming every tool includes an operated response service.
5–7. Communication and recovery
Who contacts you, what happens after containment, and where does responsibility end?
What to check
Check response targets, restoration work, exclusions, additional incident fees and dependencies on other suppliers. Ask for the boundaries in writing.
Sources & further reading
Need a clearer view of your security costs?
For Sydney businesses comparing options, start with your users, critical systems and the response you need, then review the service scope.
