37 of 105 security products print a price: the five basics, costed for 100 people

01The 2023 list counted antivirus twice

The original named SecurityScorecard for risk and compliance, Data Resolve inDefend for data loss prevention, ESET and ZoneAlarm for antivirus and firewall, BlackBerry Protect for endpoint security and TitanHQ for email. Three years on, two of those five categories are one purchase. Every vendor in TechBag’s endpoint guide sells antivirus as the prevention tier of the same agent that does detection and response; the price gap between the tiers is the second job, not a second product.¹

The vendors have moved too. BlackBerry no longer owns its endpoint line: Arctic Wolf bought Cylance from BlackBerry, closing on 3 February 2025, and folded the products into its Aurora line.⁶ Our earlier version itself described ZoneAlarm as protection for home and mobile computers. SecurityScorecard gives any organisation a free rating of its own domain and quotes every paid tier by the number of other organisations monitored, which makes it a third-party risk tool rather than a baseline control.⁷

02Endpoint is the one open market, and detection costs three times prevention

Of 36 endpoint products in TechBag’s guide, 23 publish a price, which makes endpoint the only one of the five categories where a buyer can build a budget from public pages.¹ The prices fall into two bands. Prevention, the job antivirus used to do, runs from US$42.20 a device a year for ESET PROTECT Entry to US$59.99 for CrowdStrike Falcon Go. Detection and response, the tier that records what happened and lets a person act on it, starts near US$180: US$179.99 for SentinelOne Singularity Complete at reseller list and US$184.99 for CrowdStrike’s Falcon Insight XDR bundle. On CrowdStrike’s own list, the second job costs 3.1 times the first.¹

03Everywhere else, the price is a conversation

Outside endpoint, list prices thin out. Five of 22 email-security products publish one, two of 18 DLP products, and none of the 13 products in the firewall and network-security guide.^{2 4 5} Vulnerability management is the partial exception, with 7 of 16, including Tenable Vulnerability Management from US$3,700 a year for 100 assets.³

The reasons differ by category. A firewall is an appliance plus a yearly protection bundle sold through the channel, so the price depends on the model and the partner.⁵ Email filters are priced per mailbox but sold in suites whose awareness, DMARC and archiving pieces are separate SKUs.² DLP is quoted because the licence is the small number: the project is deciding what counts as sensitive, and the vendor wants to scope that before it names a figure.⁴

A quote-only market is not a reason to avoid a category, but it changes how you buy it. Without a list price there is no anchor, so the first quote sets the frame for the rest. Ask at least two vendors in the same week for the same scope, written down: the number of mailboxes or users, the channels covered, the retention period and the hosting region. Ask each for the line items, not the total, because the add-ons named in the guides (awareness training, DMARC, archiving, a second console) are where two quotes for “email security” stop being comparable. And ask what the price becomes at renewal, in writing, before you sign the first year.

04Where your security data sits is the other question nobody prints

A security product holds the most sensitive log in the company: who logged in where, which file left, which mail was quarantined. India hosting for that data is documented for a minority. In endpoint, 10 of 36 products document an Indian data centre or an on-premises console, among them SentinelOne and Sophos in Mumbai and Seqrite in India; CrowdStrike announced an in-country cloud in January 2026 that the guide records as announced, not live.¹ In email it is 5 of 22, Proofpoint’s India data centre and Sophos Central in Mumbai.²

“Not documented” is not the same as “not available”. It means the vendor has not said so in writing, and an Indian buyer who needs residency should get it into the order form rather than the sales deck. Two questions settle most cases: which region the console and its telemetry are stored in, and whether support staff outside India can read that telemetry. The second matters as much as the first, and it is the one vendor pages answer least often.

Our view is that the gap between categories is about deployment, not goodwill. Endpoint still offers on-premises consoles (the guide lists Seqrite, ESET PROTECT On-Prem, GravityZone, Check Point and FortiEDR among them), so a buyer who needs the data in India can keep it in the building.¹ Email security has no such fallback outside a few gateway appliances; 17 of the 22 products are marked unverified for India hosting.²

05A 100-person company, priced at list

Take one published product per category for a company of 100 people and 100 devices: ESET PROTECT Advanced for endpoint, Proofpoint Essentials at its Business tier of US$2 a user a month for email, Tenable Vulnerability Management for 100 assets, and Safetica’s DLP at the bottom of its US$72 to US$144 per-user range.^{1 2 3 4} These are not recommendations; they are the products whose prices a buyer can see.

The order we would buy in follows the attack paths and the law, not the price: endpoint and email first, because they are where intrusions start and the cheapest to fix; logs next, because CERT-In requires them; scanning third; DLP last, after someone has written down what the company counts as sensitive. Bought in that order, the expensive line arrives when it can actually be configured.