Threat protection costs small enterprises

Our recent study on messaging management found that the typical small enterprise (up to 1,000 users) spends about $18 per seat per year on anti-virus (AV) and anti-spam (AS) software.

That means that for an enterprise of 300 users, annual expenditures on software alone for AV and AS protection are about $5,500 annually.

Further, small enterprises spend about 77 person-hours per week per 1,000 users managing their AV and AS systems. If we assume a fully burdened labor rate of $65,000 annually for IT staff to manage these systems (including the time spent tuning spam-blocking filters), then the labor cost to manage these systems in a 300-person enterprise would be nearly $38,000. The total cost, therefore, of software and labor to provide AV and AS protection in a small enterprise is $144 annually, or $12 per month. These costs don’t include hardware and other systems necessary to provide this protection.

Clearly, these costs are averages and can vary widely depending upon the AV and AS systems deployed, how much time these systems require to manage, how much time IT staff can devote to the maintenance of the systems, and so forth. However, even with the potential variability between enterprises, this data indicates that for the typical small enterprise, labor is by far the most expensive component of providing AV and AS protection.

Small enterprises face the same threats to their messaging infrastructure from viruses and spam as do larger enterprises, but they have fewer users over which they can spread the costs of protecting themselves, and so their cost per seat can be significantly higher.

Because labor represents nearly 90% of the cost of providing AV and AS protection internally for an enterprise, outsourcing might be a good option to significantly reduce the cost of providing protection from messaging threats while serving to free up IT labor for more critical projects. Another alternative is to use a messaging security appliance that requires lower maintenance than some gateway- or server-based alternatives, such as Mirapoint’s new RazorGate, which has an initial price of about $42 per seat for a 300-user configuration; or BorderWare’s MXtreme MX-200, with an initial price of about $27 per seat for 300 users. This is not to say that a gateway- or server-based approach is necessarily more expensive than outsourcing or an appliance-based approach, but these alternatives can provide lower total cost of ownership.

In short, any enterprise – particularly smaller ones – should carefully evaluate the full cost of providing protection for their messaging system and, if the analysis warrants, seriously consider less expensive alternatives.