How much does email security cost a small business?

Email security prices look simple until you multiply them out. A few dollars per user per month becomes a real line item at 25 or 100 mailboxes, while a flat per-domain fee barely moves. This guide shows what drives the cost, uses Microsoft's own list prices as a reference point, and works through three company sizes so you can compare like with like.

What drives the cost of email security?

Five things decide what you'll actually pay:

1. The pricing unit. Most products charge per user (per mailbox or seat). Some charge per domain, and a few by message volume.
2. What's already included. Your mailbox plan may cover more than you think. Every Microsoft 365 plan with cloud mailboxes includes built-in anti-spam, anti-malware and spoof protection.
3. Add-ons and tiers. Advanced features such as link checking at the time of the click, attachment sandboxing, impersonation protection or phishing simulations are often in a higher tier.
4. Billing term. Annual commitments are usually cheaper per month than month-to-month.
5. Admin time. Someone has to set it up, release held mail, handle false positives and read alerts. That time is a real cost even when nobody invoices it.

What does Microsoft charge for email security?

Microsoft's prices are a useful reference because many small businesses already use Microsoft 365. These are US list prices at the time of writing (October 2026), excluding tax. Your price may differ by country, reseller or agreement.

The add-on prices come from Microsoft's Defender for Office 365 page. The suite prices come from Microsoft's price list effective July 1, 2026, which also notes that "existing customers remain on current pricing until renewal". Which plans include Defender is set out in Microsoft's service description.

Moving from Business Standard to Business Premium costs $8.00 more per user per month at list price, but Premium also includes things beyond email, such as Microsoft Defender for Business for devices. Don't judge it on email security alone. Our Defender for Office 365 Plan 1 vs Plan 2 guide explains the features in each tier.

Per-user vs per-domain: a worked example

Here is the same business at three sizes, priced with Microsoft's per-user add-ons and iBlockSpam's per-domain plans. iBlockSpam prices are beta pricing in USD, excluding tax: Protect is $12 per domain/month billed annually ($144/year) or $15 month-to-month; Protect Plus is $19 per domain/month billed annually ($228/year) or $24 month-to-month.

Each example assumes one domain and annual billing.

What the numbers show

• At 5 mailboxes, Plan 1 costs a little less than Protect. Per-user pricing usually wins for very small teams.
• Break-even against Plan 1 is 6 mailboxes for Protect ($12 ÷ $2.00), so Protect costs less from 7 mailboxes. For Protect Plus it's 9.5 ($19 ÷ $2.00), so Plus costs less from 10.
• At 25 and 100 mailboxes, the per-domain price hasn't moved, while per-user pricing has grown with every seat.

What the numbers don't show

This is a pricing comparison, not a like-for-like product comparison. Defender for Office 365 works inside Microsoft 365, including on internal mail and in Teams, SharePoint and OneDrive. An MX-level filter like iBlockSpam checks inbound mail before it reaches your mailboxes, and works across Microsoft 365, Google Workspace, cPanel and Exchange. Many businesses run both. Our Defender vs email gateway comparison explains the difference.

Two limits also matter for per-domain plans. "Unlimited mailboxes" means mailbox count, not unlimited mail: each iBlockSpam domain includes 100,000 inbound messages per month, a 400 MB maximum inbound message size and 500 outbound relay messages. At 100 mailboxes, that's an average of 1,000 inbound messages per mailbox per month, so check your current volume before you choose. And each separate domain is its own subscription, although domain aliases are unlimited.

For more break-even points and a multi-domain example, see per-domain vs per-user pricing.

What are the hidden costs?

The subscription is usually the smallest part of the total. Price these too.

Shared mailboxes and role addresses

Per-user licensing doesn't always stop at people. Microsoft's licensing terms say Defender for Office 365 licenses are needed for "Shared mailboxes that benefit from Defender for Office 365 protections". If Safe Attachments is on for SharePoint, OneDrive or Teams, all users of those services need licenses. Addresses like info@, accounts@ and sales@ can add seats you didn't plan for.

Admin time

Every filter needs someone to release legitimate mail, block repeat offenders and answer "where's my email?" questions. Ask each vendor:

• Can users release their own held mail, or does every request go to an admin?
• Do users get a quarantine digest, or must they log in to check?
• How long does a false-positive fix take, and who makes it?

Self-service quarantine with scheduled digests moves most of that work off the admin's desk. Our guide to false positives covers the rest.

Layering and overlap

Microsoft lists the trade-offs of adding another email security service as "More cost", "More complexity" and a false-positive rate that increases "as more products are added". That doesn't mean you shouldn't layer. It means you should know what each layer does, avoid paying twice for the same feature, and decide which quarantine users check.

Setup, migration and exit

Budget time for DNS changes, connector setup, testing and staff communication. For a gateway, that includes the MX change and, on Microsoft 365, Enhanced Filtering for Connectors. Also check how easily you can leave: notice periods, data export and DNS rollback.

Billing terms

Monthly billing gives flexibility but usually costs more. iBlockSpam Protect is $15 month-to-month against $12 billed annually. Microsoft's Defender add-on prices above are for annual subscriptions. Check for minimum seat counts, too.

What should the price include?

Two quotes at the same price can buy very different things. Before comparing numbers, check that each option answers these questions, and write the answers down:

Microsoft's equivalents are set out in its Defender for Office 365 service description. Ask any other vendor the same questions in writing. A cheaper plan that leaves out outage handling or self-service quarantine can cost more once you count the admin hours and the missed mail.

How do you measure what spam costs you now?

Before you price a fix, measure the problem. The cost of spam is mostly staff time, plus the cost of real mail that gets lost or held. You can estimate both with your own numbers instead of an industry average.

Staff time

Monthly time cost = people affected × minutes per person per workday × workdays per month ÷ 60 × loaded hourly cost

"Loaded" means pay plus employer costs such as benefits. If you don't have your own figure, the US Bureau of Labor Statistics reports that employer compensation costs for private industry workers averaged $46.89 per hour worked in June 2026, of which $32.82 was wages and $14.07 benefits. Your own rate is better.

An illustrative example, with assumed inputs rather than measured ones:

If a new filter cut the time to 2 minutes a day, the time value recovered would be about $688 a month on the same assumptions. That isn't money saved unless people use the time for other work, and it isn't a prediction for any product. Measure the minutes with a one-week diary from a few people instead of guessing: if your staff clear spam in seconds, the number is much smaller.

Wrongly held mail

A filter can create cost too. A held sales inquiry answered two days late, or a missed supplier invoice, costs more than a few minutes of deleting spam. Don't give every held message an invented dollar value. Count verified false positives, the time to recover each one, and any documented business loss.

A before-and-after worksheet

Track the same measures over comparable periods before and after any change:

Judge the change on the net result. If the filter blocks more but staff spend hours digging real mail out of quarantine, it's costing you. The spam filter trial checklist shows how to collect a fair baseline, and our email security metrics guide shows where to find the numbers in Microsoft 365 and Google Workspace.

What does it cost to have no protection?

Price the downside, but use real numbers. The FBI's IC3 2025 Internet Crime Report recorded 24,768 business email compromise complaints and $3,046,598,558 in reported BEC losses in 2025. Those are reported losses across all victims, not an average for a small business, but they show why fake invoices and payment-change requests deserve attention. Our phishing statistics page has more sourced figures, and the BEC prevention guide covers process controls that cost nothing.

How do you build your own estimate?

1. Count mailboxes accurately. Include shared mailboxes, role addresses and leavers' mailboxes you keep.
2. Count domains. Note which are separate domains and which could be aliases.
3. List what you already pay for. Check your Microsoft 365 or Google Workspace plan for included protection.
4. Check your monthly inbound volume, so you know whether volume limits matter.
5. Price two or three options at your real numbers, on the same billing term.
6. Add admin hours per month at an internal hourly rate.
7. Compare a three-year total, including setup and the cost of switching later.

Our spam filter buying checklist lists the questions to ask vendors, and hosted vs on-premise filtering covers the cost of running your own.

Next steps

• Count your mailboxes, shared mailboxes and domains, and note what your mailbox plan already includes.
• Check your current setup with the free Email Health Check, which shows where your MX points and whether SPF and DMARC are in place.
• Compare the per-domain plans on our pricing page, or see how iBlockSpam fits a small business.

Related: free vs paid spam filters and the spam filter trial checklist. To check prices against named products, start with our comparisons, for example the Mimecast alternative page.