Cybersecurity & compliance, quoted three ways.

Per seat, tooling bundled

Which tools. A bundle that names no vendors can be swapped for a cheaper one after signature without breaching a word of the agreement.

Per endpoint EDR

Whether anyone is watching it. Licensed EDR and monitored EDR differ by roughly the cost of the analysts, and both are written 'EDR' on a proposal.

Monitored hours / SOC retainer

The response obligation. A retainer that buys monitoring but not containment leaves the actual incident work on a time-and-materials line you will not read until you need it.

Compliance readiness project fee

Whether the artefacts are produced or merely advised on. A CMMC 'readiness' engagement that hands back a gap list is not the same product as one that writes the System Security Plan.

Is the EDR licensed only, or monitored by named analysts with a stated response time?

Which specific compliance artefacts are delivered — BAA, SSP, POA&M, risk assessment?

Is log retention long enough for our regime, and who pays for the storage?

What is the escalation path at 02:00, and is it inside the monthly fee?

You describe the environment once

Headcount, endpoints, servers, what already lives in the cloud, and any compliance obligation. Two minutes.

We invite three or four providers

MSPs that work your area, your company size, and your regulatory profile. Never more than four, so nobody is cold-calling you.

We normalize what comes back

Per-user, per-device, and flat-rate bids all converted to a common cost per endpoint, with every carve-out and exclusion flagged.

You get the tabulation

One sheet, with contacts. Take the discovery calls you want, ignore the rest. Nothing is owed either way.