Most owners and compliance officers who ask us about RIA cybersecurity cost are in one of two spots. They’re holding proposals they can’t compare, or they’re building a budget with no number to start from. In 2026, we see firms paying about $9,000 to $28,000 a year for 5 people, $18,000 to $40,000 at 10, $25,000 to $75,000 at 25 and $45,000 to $110,000 at 50, on top of the IT provider.
Year 1 adds one-time work of about $3,000 to $13,000 for 5 people, $4,500 to $20,000 at 10, $8,000 to $45,000 at 25 and $11,000 to $65,000 at 50.
The questions behind those numbers sound alike. One prospect’s operations manager told us the firm’s proposals ran from about $7 per user per month for a software platform to $70,000 a year for a full service. An analyst at an 18-person firm asked whether to just pay the IT vendor, check the boxes and trust nothing happens.
This is three bills, and nobody quotes them on the same page. The IT provider sends one, the tools come on a second, and whoever checks that the first two work sends a third. A quote for any one looks cheap or expensive depending on which of the other two you already pay.
These cybersecurity costs and numbers aren’t a survey. They’re what we see firms pay, quotes prospects have shown us, and prices outside firms publish.
What RIA cybersecurity costs at 5, 10, 25 and 50 people
The IT provider is the biggest bill. Most IT providers charge a flat fee per user, in our experience $125 to $200 per user per month in 2026, usually with a 10-user minimum, and anything outside that scope gets billed as project work. Only part of that fee falls under cybersecurity costs, and most IT companies we’ve met aren’t providing everything an RIA needs to meet the SEC’s rules.
The second bill is the security tools. No matter who sells them, there will be a recurring monthly outlay, because most of what a firm puts in place is a cloud service that charges by the month. Some IT providers fold these into the per-user fee and some bill them separately. The license step in the table is cheap for a reason. Microsoft 365 Business Premium already includes Defender for Business, Intune and Entra ID P1 with conditional access, plus archiving, and Google Workspace Business Plus adds Vault, so part of the tools row disappears into an $8 upgrade.
The third bill is oversight, meaning someone checks that the first two are working and writes it down, and it’s the bill the SEC cares about. Regulation S-P requires a written incident response program, customer notice within 30 days of a breach, and due diligence and monitoring of service providers, and smaller advisers have had to comply since June 3, 2026.
The rule doesn’t set a dollar figure. The SEC’s adopting release estimated the written policies and procedures at about $15,445 a year per firm on average, which covers the paperwork and none of the tools, the IT provider or the testing. Past that, the spend is whatever it takes to show the program is real at your size.
Two more lines sit beside those three. Cyber insurance is its own premium, and the first year carries one-time work, meaning an assessment and policy build plus the IT provider’s first round of fixes, which together run about $3,000 to $13,000 at 5 people and $11,000 to $65,000 at 50. We tell new clients to expect that first round of fixes, because more often than not the provider says the first one will take 10 hours.
The table below puts those bills side by side at 5, 10, 25 and 50 people. We’ve left the IT provider out of the total, since most firms already pay it and most of it isn’t for cybersecurity costs. That total sits a little below the straight sum because a good oversight program usually includes the training and scanning, so those dollars aren’t counted twice.
| Annual cost in 2026 | 5 people | 10 people | 25 people | 50 people |
|---|---|---|---|---|
| IT provider at $125 to $200 per user per month (not in the total) | $7,500 to $15,000, since many providers have a 10-user minimum | $15,000 to $24,000 | $37,500 to $60,000 | $75,000 to $120,000 |
| Security tools not in the IT bill | $1,500 to $3,600 | $3,000 to $7,200 | $7,500 to $18,000 | $15,000 to $36,000 |
| License upgrade for security and archiving, at $8 per user per month | $480 | $960 | $2,400 | $4,800 |
| Independent oversight, testing and policies | $7,000 to $22,000 | $15,000 to $30,000 | $15,000 to $42,000 | $24,000 to $60,000 |
| Cyber insurance | $1,000 to $5,000 | $1,000 to $6,000 | $4,000 to $12,000 | $8,000 to $15,000 |
| Ongoing total, excluding the IT provider | $9,000 to $28,000 | $18,000 to $40,000 | $25,000 to $75,000 | $45,000 to $110,000 |
| Year 1 only: assessment and policy build | $2,000 to $10,000 | $3,000 to $15,000 | $5,000 to $35,000 | $6,000 to $50,000 |
| Year 1 only: the IT provider’s first round of fixes | $1,000 to $3,000 | $1,500 to $5,000 | $3,000 to $10,000 | $5,000 to $15,000 |
| Year 1 one-time total | $3,000 to $13,000 | $4,500 to $20,000 | $8,000 to $45,000 | $11,000 to $65,000 |
Per person, the cost falls with size, from about $1,800 to $5,600 a head at 5 people to about $900 to $2,200 at 50. The low end of each range is roughly what checks the box for the SEC. The high end also lowers the odds of a breach, which is a different goal. Schwab’s 2026 RIA Benchmarking Study puts annual cybersecurity spend at about $18,000 for firms with $250 million or more in assets, up roughly $3,000 since 2024, which lands at the low end of the 10-person range.
Many firms that bring us a current bill are spending less than these ranges, and the honest answer is that it goes up.
Our note to one small firm put it this way: “Yes, unfortunately, I think you’re going to increase the amount you’re spending on IT per year if you want to properly secure your systems and comply with the SEC regs. I’m sure there are ways we could get it down a bit lower, but I’m guessing it’s still not going to be as low as you’re hoping.”
What the tools add to RIA cybersecurity cost
The tools are the cheap part of the bill. They’re the same ten as our guide to cybersecurity for RIAs, and your IT provider may already include several.
- Multi-factor authentication (MFA), included with Microsoft 365 and Google Workspace
- A team password manager
- Email security that catches phishing and impersonation
- Endpoint detection and response (EDR)
- Encrypted backups
- Email and messaging archiving
- Security awareness training with simulated phishing
- Vulnerability scanning
- DNS filtering
- 24/7 monitoring / managed detection and response
Many of the good tools aren’t sold to a firm this size directly, so small firms buy them through an IT provider or a security firm. Tenable, Qualys, and Rapid7 have minimums far above five people, Huntress needs 50 seats to buy direct, and SentinelOne sells through partners.
The one tool where going cheap costs you is the vulnerability scanner. Every year or two we test the other scanners, and a lot are junk, with false negatives that miss real vulnerabilities. In our testing, the cheap ones in IT contracts miss about half.
Our rule on cheap scanners is short: “If your goal is don’t get breached, they’re not sufficient. If your goal is to check the box for the SEC, then they’re totally fine.”
Ask which vendors are behind each service. The vendors vary, a lot, and it matters.
What RIA cybersecurity cost quotes look like, and why they vary
The spread in quotes is real, and most of it is scope. If you’ve opened a proposal and felt sticker shock, you have company. One principal told us exactly that, and the harder part was not knowing what the firm wasn’t doing that it should be. The quotes below came from firms of 5 to 50 people who shared them with us.
| Firm size | What they were quoted |
|---|---|
| 5 people | A large IT provider quoted $33,000 one time plus about $1,100 a month. A smaller RIA-focused firm quoted roughly $2,000 a month all in, plus about $2,500 one time |
| 10 people | A $420-a-month contract for three hours of IT support, plus $1,200 to $1,800 a month in overage, on track for about $26,000 a year against a $12,000 budget |
| 18 people | Four IT providers quoted $129, $132, $147 and $258 per user per month, and one also offered a co-managed option at around $15,000 a year |
| 19 people | $80,000 a year for security |
| About 50 people | A $12,000 project to fix the first round of security patches, on top of the monthly contract |
Proposals are hard to compare because they’re priced four different ways. Most IT providers charge per user or per computer, some charge one flat monthly fee for the whole firm, a few publish flat rates for teams under five, and security is either inside that number or its own line. Project work, billed by the hour, sits outside all four, so compare quotes over three years with the project hours priced in.
A flat price doesn’t always mean a fixed bill. Most IT providers charge a flat per-user fee, and some of what a security review asks them to do falls outside that scope, so they come back for project funding. The 10-person firm above had a version of the same problem, where a small monthly contract and overage hours took it to about $26,000 on a $12,000 budget.
The 50-person firm’s $12,000 patching project is the same pattern, and by our reading, most of those items were already covered by the contract.
Some quotes at the high end are just too high. One provider in the 18-person row had a tier that worked out to $333 per user per month. We told the firm that we know IT companies serving Defense Department contractors, with far higher security requirements, that charge about that much.
A very low security line reads the other way. The large provider in the 5-person row charged about $235 a month for “advanced security,” which is cheap because they’re probably not doing very much for it.
Despite the fact that they might pressure you, we wouldn’t sign anything longer than a one-year term, even if they offer you great pricing. We can’t tell you how many firms we’ve run into who signed three-year contracts and then wished they could get out by the ninth month.
Beyond scope, these move the cybersecurity pricing number.
- Headcount and machines. People and computers set most of the bill, and assets under management don’t. About half the RIAs we work with are over $1 billion.
- Microsoft 365 or Google Workspace. The platform changes both the audit and the risk. Coalition’s 2023 mid-year claims report found that “M365 users were more than twice as likely to experience a claim compared to Google Workspace users.”
- Whether you want compliant or secure. If you just want compliance, it’s cheaper, and you can get a lot of the way there with your compliance consultant if this is an area where they have some expertise. In our experience the cheapest services do the minimal amount of work required, and they don’t really get hands on with your systems to ensure they’re truly secure.
- What your IT provider already does. It’s likely you’ll spend more with your IT company based on what a review finds, and that first round is usually billed.
- How much old equipment you keep. A server on extended support that nobody needs is a risk and an expense.
- How many vendors you have. Some clients have five vendors and some have 20, and one competitor priced reviews at $600 a year per vendor.
- What your insurer asks for. Most applications ask about the tools in the list above, EDR in particular.
- AI tools, if your compliance policy requires archiving every conversation. Not every firm reads the rules that way, but if yours does, the logging usually means the vendor’s enterprise plan, and the bill jumps.
Which RIA cybersecurity costs to pay first and which to skip
Order matters more than the total, and this is the order we use for RIA firms of this size.
- Microsoft 365 or Google Workspace settings. We start here because it’s the highest risk target you have, and we can address it quickly and very inexpensively. All but two of our clients’ breaches over the past three years came through Microsoft 365, and most of those firms also had MFA and an outsourced IT firm.
- Strong MFA and EDR. In most of those breaches someone was tricked into giving up an MFA code, so the form of MFA matters.
- Cyber insurance. In the breaches we’ve seen, costs rack up fast enough that it belongs on the go-live list.
- Security awareness training with phishing tests.
- Vulnerability scanning.
- Everything else on the tools list.
- A hired cybersecurity penetration test, last. Good ones are expensive. You want to do these after you’ve done most of the things above, because why should we pay expensive surgeons to find the easy things?
There are three things to skip. We think GRC and compliance software is a waste of money for a firm your size and in your industry. A separate archiving vendor isn’t needed when Google Vault or Microsoft’s archiving covers email, and our clients who have used virtual desktops have been frustrated with latency, video performance, and confusion about where to store files.
When the budget comes down, we drop time-consuming compliance items first, like quarterly reports and end-user tests. We keep the annual Microsoft 365 audit and the vulnerability scans. The shortcut we push back on is leaving some machines out because an unmanaged machine is the one that gets missed.
Assessments you won’t act on make a bad paper trail. With all of those assessments and reviews, you’re generating a big paper trail that shows the firm has security deficiencies, and that would look really bad on an audit. We’d rather focus first on getting good cybersecurity practices in place, and then layer on the testing and auditing if it’s truly needed.
What RIA cybersecurity costs if you hire in-house
Some owners ask whether to hire a security person instead of paying an outside firm. Under 50 people, hiring your own CISO costs several times the whole outside program in the table above. IANS Research and Artico Search’s 2025 compensation survey put CISO pay at companies under $50 million in revenue at “closer to $260,000 in cash,” which is an average and not a median, before benefits. The Bureau of Labor Statistics puts the median wage for information security analysts at $129,180 in May 2025, and an analyst isn’t a CISO. An analyst runs the tools and works the alerts. A CISO decides what the firm fixes, what it accepts and what it tells the examiner, and that judgment is what the outside program is for.
The tools, the license step, and the insurance don’t go away when you hire. At 25 people that puts the annual cost at about $275,000 to $290,000 with a CISO and about $145,000 to $160,000 with an analyst, before benefits, against $25,000 to $75,000 a year for the outside oversight program at the same size.
One hire is a single point of failure, and one person can’t watch alerts all night. In our experience firms start bringing this skill set in-house above 100 to 200 employees. Below that, the oversight line is usually a vCISO.
Five RIA cybersecurity cost questions for your IT provider
It’s important to get the actual names of the products your IT provider uses. A lot of them try to sell very cheap EDR products, and we’ve had clients with a lot of malware in their environment because of this.
Before renewing, ask your provider these five in writing:
- Which product, by name, is behind each security line on the invoice.
- Whose vulnerability scanner it is, and who else reads the results.
- What’s project work and at what hourly rate.
- Whether anyone watches alerts overnight and on weekends, and on which systems.
- The contract term and what it costs to leave.
Good providers answer all five in one email, which makes the next quote comparable.
What RIA cybersecurity costs when it goes wrong
For a small firm, the fine usually isn’t the biggest bill. In our experience a breach at this size costs at least $10,000 to $15,000 out of pocket for forensics and an attorney without insurance, and the firm does nothing else for three to six months while it deals with law enforcement and lawyers.
Fines do happen, and the outer bound for a firm this size is the SEC’s November 2025 order against M Holdings Securities, a $325,000 penalty for gaps that included missing MFA, incident response policies and security awareness training. That firm had 120 branch offices and about $4.1 billion in assets, so read that penalty as a ceiling.
Wire fraud doesn’t wait for an examiner. The FBI’s Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025 and $3,046,598,558 in losses, about $123,000 each by our math.
One firm we work with, about 20 people, nearly lost $80,000 when a staff member approved a wire on a voicemail instead of calling back, and the bank caught it and put a hold on it. Our wire fraud guidance covers the callback rule.
Insurance covers some of this, if the application was accurate. Some competing quotes add an incident response retainer, and in our experience a small RIA doesn’t need a separate one, because the cyber policy assigns the attorney and the forensics firm. The job is knowing who your policy calls before you need them. That attorney also decides whom you have to notify, and if the forensics can’t show what was accessed, that means every client, with the mailing and credit monitoring that follow. Most applications ask about the tools in this post, and a misstated answer gives the insurer a reason not to cover a breach caused by that thing.
Most of these losses start in email, which is why the spending order above does too, and our list of the six top RIA cyberattacks covers how each begins.
Frequently asked questions about RIA cybersecurity cost
Do we need an IT provider and a security firm?
Not always. You’ll need to decide whether to go with a better IT provider, at a higher rate, or none at all, which will be cheaper but more work for you. Honestly either can work, and it’s a question of where you want to spend your time. Who does what between the two is in our post on RIA IT provider oversight. Some of our clients use a local IT person at $75 to $90 an hour for the hands-on work.
What does a vCISO cost for an RIA?
About $7,000 to $60,000 a year by size, in what we see firms pay. Published vCISO price guides put firms under 50 people at $1,500 to $4,000 a month.
Do we need a penetration test?
When the SEC says “external penetration testing,” it usually means external vulnerability scanning, so yes. When a cybersecurity person says it, they usually mean hiring an ethical hacker for $10,000 to $20,000 to try to break in using targeted spearphishing.
Under that definition, no, nor do we think it’s something you’d need, especially at that penetration testing cost. The dated scan report is on our SEC exam document request list.
Can our compliance consultant cover this?
Often, for the compliance half, and compliance alone is cheaper. Someone still has to check the IT provider’s work, which our post on RIA IT provider oversight covers.
How much is cyber insurance for an RIA?
The Coyle Group publishes RIA bands: $4,000 to $8,000 a year at $250 million to $1 billion, and $8,000 to $15,000 at $1 billion to $5 billion. Two small RIAs we’ve seen paid about $1,000 for $1 million of coverage and about $6,000 for $2 million in 2026.
A broker who has placed 405 RIAs told us that 82% of the RIA policies the broker reviews have a meaningful gap, whether an exclusion, a missing entity or too little coverage. Read more on whether you need cybersecurity insurance.
Is RIA cybersecurity priced on AUM?
Usually not. Headcount and machines set the bill, and about half our RIA clients are over $1 billion. Insurance is the exception because those premiums are priced on assets and clients.
How does Adelia Risk price RIA cybersecurity?
By computer count, on the first call, and it doesn’t include the IT provider. Details are on our RIA cybersecurity services page.
What to do with these RIA cybersecurity cost numbers
We wish the answer were a smaller number. For most firms that bring us their current bill, it goes up, and we’d rather tell you that now than after you’ve signed.
The good news is that the expensive mistakes are avoidable. Don’t sign a three-year contract. Don’t pay for a penetration test before the basics are in place. Don’t buy compliance software built for a company ten times your size. And don’t order assessments you aren’t going to act on.
Spend first on the things that stop a breach, in the order above, and add the rest as the budget allows. A firm that does the first three well is in better shape than one that bought everything and configured none of it.
If you’d like a second set of eyes on a quote or a budget, email us. We’ll tell you what we’d keep, what we’d cut, and what we think is missing.
