Practical guide · verified against the real thing
Which security solution do I need? — a decision tool for people, not procurement
In one line: From free consumer basics to MDR and MSSP: six questions, one rung of the ladder, reasoning shown, honest price shapes. Runs on-device, nothing stored.
From free consumer basics to MDR — the honest ladder of “who’s watching.” The security market sells acronyms: AV, EDR, MDR, MSSP, SIEM, zero trust. Underneath, every product answers one question — when something goes wrong at 2am, who notices, and who responds? Six questions place you on the right rung of that ladder, name what it actually buys, and show the price shape (real numbers are quote territory, and we won’t invent them).
The one question every product answers
Who notices, and who responds? Consumer antivirus notices on one machine and tells a human. EDR notices across a fleet and can isolate a machine. MDR adds people: a team watches the alerts around the clock and responds with you. An MSSP wraps that in a broader managed service — firewalls, email, compliance reporting. Zero trust isn’t a product at all; it’s the direction of travel (explained for small teams). The tool asks what you’re protecting, who owns security day-to-day, what you’re most afraid of, whether 2am coverage matters, what compliance you carry, and your budget — because those six answers are the procurement decision, whatever the brochure says.
The rungs, and the shape of their price
| Rung | Who notices at 2am | Price shape (directional) | Start here |
|---|---|---|---|
| Consumer basics | You, on one machine | $0 — built-in tools + free password manager | Security checklist |
| Business AV / EDR | Software, fleet-wide; a human reads the dashboard | Per user/month at list — commonly single digits | EDR vs MDR, explained |
| Training-first | Your people, drilled | Per user/month at list; free drills go far | Five real lures |
| MDR | A provider’s team, around the clock | Hundreds per month, scales with endpoints — quote-based | What MDR buys |
| MSSP / co-managed | Shared: their SOC + your admin | Contract quotes | MSSP vs MDR |
| Website hardening | Your host/CDN absorbs; you configure | $0–low; free tiers are real | DDoS protection for small sites |
Compliance changes the paperwork, not the physics: GDPR, CCPA and Nigeria’s NDPA side by side. And whatever rung you land on, assume breach: a one-page incident response plan is the cheapest security purchase that exists. The whole ladder lives in the cybersecurity cluster.
What this tool deliberately does not do
- It doesn’t rank vendors. Quote two or three providers at your rung; the difference between rungs dwarfs the difference between brands.
- It doesn’t invent prices. MDR and MSSP pricing is genuinely quote-based; anyone quoting you exact figures without your endpoint count is guessing.
- It doesn’t certify compliance. It flags obligations; documented process (not a product) is what satisfies a regulator.
- It doesn’t phone home. No analytics on your answers, no storage, no network calls.
Sources
Next