Published prices. Defined scope. No surprises.
Each plan covers one company, one Microsoft 365 tenant and up to 50 named users and 50 supported endpoints. Annual agreement, monthly billing, 30 days' notice.
Foundation
“We have an IT provider. We need someone to keep governance moving and check their work monthly.”
- Monthly risk and action review
- Monthly identity and device posture check
- Quarterly external vulnerability scan
- Quarterly staff awareness session
- Monthly management report
Managed Protect
“Nobody owns our alerts. We want someone watching and following up.”
- Everything in Foundation
- Human alert triage, business hours
- Monthly external vulnerability scan
- Quarterly sample backup restore test
- Posture issues followed through to closure
Protect + Trust
“We sell to overseas or enterprise clients. Security questionnaires are holding up deals.”
- Everything in Managed Protect
- One customer questionnaire per month (up to 50 questions)
- Monthly risk and evidence review
- Quarterly management review meeting
Plans start after a Health Check (or an equivalent recent assessment we have reviewed). One-time onboarding — access, telemetry, contacts, workflow tests and your starting report — is quoted separately. Software licences, log and backup storage, 24/7 monitoring, external audit fees and legal advice are never hidden inside a plan. Larger teams are priced on the extra work involved. Annual agreement, monthly billing, 30 days' notice.
Compare what each plan includes
| Included activity | Foundation | Managed Protect | Protect + Trust |
|---|---|---|---|
| Monthly fee | LKR 100,000 | LKR 175,000 | LKR 250,000 |
| Monthly governance | Action review | Action review | Risk & evidence review |
| Identity & endpoint posture | Monthly review | Review & follow-up | Review & follow-up |
| Human alert triage | — Separate service | Staffed business hours | Staffed business hours |
| External vulnerability scan | Quarterly · up to 5 IPs | Monthly · up to 5 IPs | Monthly · up to 5 IPs |
| Staff awareness | Quarterly · 45 min | Quarterly · 45 min | Quarterly · 45 min |
| Sample restore test | — Separate project | Quarterly · 1 data set | Quarterly · 1 data set |
| Customer questionnaire | — Separate project | — Separate project | 1 / month · up to 50 questions |
| Management reporting | Monthly | Monthly | Monthly + quarterly review |
Business-hours triage means 09:00–17:00 Sri Lanka time, Monday to Friday, excluding public holidays. Material changes in volume are handled through a written change order.
One-off work, priced up front
Improvement projects, testing and readiness work are scoped separately with clear deliverables, acceptance criteria and payment milestones.
| Cyber & GRC Health Check | From LKR 150,000 |
|---|---|
| Microsoft 365, identity & cloud security | From LKR 180,000 |
| Managed security operations | From LKR 100,000 / month |
| Vulnerability assessment & penetration testing | From LKR 50,000 |
| Managed GRC & audit readiness | From LKR 75,000 / month |
| Privacy operations & supplier assurance | From LKR 40,000 |
| Business continuity & recovery readiness | From LKR 150,000 |
| Staff awareness & payment-fraud resilience | From LKR 25,000 |
Always quoted separately, never hidden
- Software licences and SIEM / log storage usage
- Backup storage and servers
- Additional tenants, entities or sites
- Routine helpdesk and patch deployment
- Unlimited remediation or major incident recovery
- Manual penetration testing and full recovery exercises
- 24/7 monitoring (available via partner)
- External audit fees and legal advice
Not sure which plan fits?
That is what the Health Check is for. It tells you what ongoing work you genuinely need, and we only recommend a plan where there is real recurring work to do.