How much does business antivirus cost?

Why there is no simple price

Search results for antivirus prices tend to show consumer products or vendors' list prices for small bundles. For a business, those numbers are rarely useful, because the cost of protecting your estate depends on how many of which devices you have, what each one needs and how you want to pay. Two quotes for the same headline product can differ simply because one includes servers or EDR and the other does not.

This page explains each cost driver in turn, using the vendors we supply as examples. It deliberately contains no figures: prices change, depend on quantity and term, and are confirmed when we quote. What it gives you is a checklist for comparing any quotes you receive, ours included.

1. The licence unit: per device or per user

The biggest structural difference between products is what they count.

Per user tends to cost less where people have several computers; per device tends to suit shared machines and one-laptop-per-person teams. Our licensing site explains per-user vs per-device licensing in more depth.

2. Servers

Servers are where like-for-like comparisons most often go wrong:

• Separate server licences: Sophos licenses servers separately from users; ThreatDown counts Endpoint Protection for Servers separately from workstations.
• Server tiers: Trend Micro's Pro tier is the server tier, adding server intrusion prevention, integrity monitoring and log inspection.
• Same as workstations: CrowdStrike and SentinelOne count a server as one endpoint, like any laptop.
• Thresholds: if servers make up more than a tenth of your endpoints, WatchGuard requires an additional server licence for the extra ones.

Count physical servers, virtual machines and cloud servers separately from workstations before you compare. See server antivirus for why servers are treated differently.

3. Edition or tier

Most vendors sell several editions on the same agent, and the step from basic protection to detection and response is usually the largest price jump:

• CrowdStrike bundles we supply: Falcon Defend (next-gen antivirus with device control and firewall management), Advanced Defend (adds threat hunting) and Complete Defend (adds CrowdStrike's managed detection and response).
• SentinelOne: Singularity Control, then Complete with EDR, then larger packages. See Singularity Control vs Complete.
• ThreatDown: Core, Advanced, Elite and Ultimate bundles when bought direct; through us, modules are switched on per endpoint. See Malwarebytes for business pricing.
• Trend Micro: Core, Essentials and Pro tiers of TrendAI Vision One Endpoint Security, or the Worry-Free editions.
• WatchGuard: Basic, Prime, 360 and Elite. See WatchGuard Endpoint Security.
• Check Point: Basic, Advanced, Complete and Elite editions of Check Point Endpoint Security (formerly Harmony Endpoint), with MDR as an option.

Buy the edition that matches what you will use. If no one will look at EDR alerts, paying for EDR without a managed service may not be good value; our EPP vs EDR page helps with that decision.

4. Add-ons

Add-ons can change the scope of a quote considerably, so list them explicitly. Common ones include:

• Detection and response (EDR or XDR), where it is not in the edition already. For the wider topic, see EDR, XDR and MDR guidance on endpointsecurity.uk.
• Managed detection and response, run by the vendor's own analysts (for example CrowdStrike's Falcon Complete, Sophos MDR, ThreatDown MDR or WatchGuard Core MDR). See managed antivirus.
• Patch management, offered as a module by Bitdefender, WatchGuard and others.
• Disk encryption management, such as Bitdefender Full Disk Encryption and Sophos Device Encryption.
• DNS or web filtering, such as Webroot DNS Protection or ThreatDown DNS Filtering.
• Mobile protection, covered on our mobile antivirus page.
• Dedicated anti-ransomware, such as the Halcyon Pro Platform, which runs beside existing antivirus.

An add-on that replaces a tool you already pay for can reduce your total spend, even if it adds to this line of the quote.

5. Term and billing model

How you pay changes both the price and your flexibility:

• Monthly billing on usage: through us, several vendors are billed monthly on what you actually protect. ThreatDown modules are billed monthly per endpoint from our OneView console; Bitdefender GravityZone Cloud MSP Security is monthly consumption with, Bitdefender says, no minimum commitment; Trend Micro Vision One is billed monthly in arrears. New devices appear on the next invoice and retired ones drop off.
• Fixed terms: some products can also be bought on a fixed term, which may suit a stable estate. Sophos is available monthly or on a fixed term through us, and SentinelOne monthly or annually.
• How inactive devices count: Sophos, for example, stops counting a device that has been offline for more than 30 days while it is inactive.

Our licensing site compares monthly vs annual licences in general terms. The terms available for your products are confirmed at quote.

6. Quantity and the rest of the cost

Quantity affects the unit price with most vendors, and quantity is not as obvious as it looks: count every device that needs protecting, including spare laptops, shared PCs, virtual machines and servers in the cloud.

Then there is the cost that is not on the licence line: your time. A cheaper product that needs an on-site management server, manual updates or someone to triage every alert can cost more overall than a product with a cloud console and a vendor-run service. Our licensing site has a general guide to software licence cost, and compares endpoint protection software across the wider market.

Free and built-in antivirus are not free to run

Two options look as if they cost nothing: free antivirus and the protection built into the operating system. Both have a place, but neither removes cost altogether.

• Free antivirus products are usually designed for home use, and many restrict commercial use in their licence terms, so check the licence before relying on one at work. They also lack the central console, server support, policies and reporting a business needs. Our free antivirus for business guide explains what you give up, and which trials are available instead.
• Microsoft Defender Antivirus is built into Windows and is a capable engine. For a business, the gaps are central management and reporting, coverage of Macs, Linux and phones, and detection and response, which Microsoft sells separately. See is Windows Defender enough? for an honest look.

In both cases the hidden cost is time: checking devices one by one, chasing updates and having no evidence for an insurer or a Cyber Essentials assessor. That time is part of the comparison.

How to compare quotes fairly

Ask every supplier to state the same things, and line them up:

1. The product name, edition or tier, and what it includes.
2. The licence unit (per device or per user) and how servers, VMs and mobile devices are counted.
3. Each add-on, priced separately.
4. The term, billing frequency and what happens when device numbers change.
5. Who deploys it, who sets policies, and who acts on alerts.
6. What is included at renewal, and any price change at that point.

If a quote is lower, it is usually because one of these differs. For small organisations, our antivirus for small business guide adds criteria that matter at that size.

How we help

Forever Systems quotes business antivirus from the vendors we supply, on the licence model and term that suit you. We can:

• count your devices, users and servers and show per-user and per-device options side by side
• quote editions and add-ons separately so you can see what each one adds
• explain how monthly billing works for the products you choose
• compare against your current renewal like for like

Contact us with your device and server counts and your current product, and ask us for a quote.