# Budget, staff and alert noise (FAQ)

> 25 questions on Budget, staff and alert noise, in plain language: what to check, what NetSenX shows and what a sensor cannot see.

Source page: https://netsenx.com/en/faq/budget

## How much should a small business spend on cyber security?

There is no reliable universal percentage: published rules of thumb disagree widely, so start from your risks and your obligations rather than from a benchmark. Begin with what an incident would cost you: days without systems, lost orders, restoration work, notification duties and contract penalties. Then cover the basics that protect against the most common attacks, many of which cost little: multi-factor authentication, prompt updates, endpoint protection, offline or immutable backups that you test, and a written plan of who to call. Add what customers, insurers or NIS2 ask you to show, such as detection, incident records and reporting. Only then compare tools, and prefer ones that publish their prices so you can budget honestly. Keep part of the budget for people: someone's time to read alerts, and an incident-response firm you can call. NetSenX publishes its plans and has a Free plan, so the cost of network detection is known before you plan.

https://netsenx.com/en/faq/how-much-should-a-small-business-spend-on-cyber-security

## What security spending should a small company never cut?

The items that stop the most common attacks or make recovery possible: multi-factor authentication, updates, endpoint protection, backups you have tested, and the phone number of someone who can help in an incident. These are cheap compared with an outage, and cutting them saves little while removing the controls insurers and customers ask about first. Offline or immutable backups decide whether ransomware is a bad week or the end of the business, and a restore test is the only proof they work. Keep the logs and alert history you would need to answer what happened and when, because evidence cannot be created after the fact. If the budget must shrink, cut tools nobody uses, overlapping licences and features you never switched on, rather than the basics. NetSenX's Free plan keeps core network detection running at no cost, so monitoring does not have to be the line that disappears.

https://netsenx.com/en/faq/what-security-spending-should-a-small-company-never-cut

## How do I calculate the cost of one day of IT downtime?

Add up four things for one working day: lost revenue or margin, wages paid while people cannot work, the cost of recovery, and penalties or knock-on costs. Lost revenue is what you would normally invoice or sell in a day, or the margin on it, for the share of the business that stops without IT. Idle wages are the staff who cannot work, multiplied by their daily cost. Recovery covers overtime, external help, replacement hardware and restoring data. Knock-on costs include late-delivery penalties, overnight shipping to catch up, lost customers and, if personal data is involved, notification work. Do the sum for one day, then ask how many days a ransomware recovery would really take with your current backups. Use your own figures, not industry averages, and write down the assumptions so finance can check them. The result tells you what a week of prevention and detection is worth.

https://netsenx.com/en/faq/how-to-calculate-the-cost-of-one-day-of-it-downtime

## How do I justify a security tool to management?

Speak about business risk, not features: how long an outage would stop the business, what a reportable incident would cost in time and fines, which customers or contracts demand evidence of security, and what you cannot see today. Use your own numbers first, such as revenue per working day, staff idle during an outage and contract penalties, because management trusts those more than industry averages. Where you cite a public figure, name the source and year: IBM's Cost of a Data Breach Report 2025, for example, puts the global average cost of a breach at USD 4.44 million, which says more about large companies than about yours. Then frame the decision: what the tool costs per year, what it shows that you cannot see now, and what it does not do. Finally, show it on your own network: the NetSenX Free plan has no time limit, so management can see real findings before any money is spent.

https://netsenx.com/en/faq/how-to-justify-a-security-tool-to-management

## How much does network detection and response cost for a 50-person company?

With NetSenX it depends on the number of devices you monitor, not on headcount, and for many 50-person companies that number is small. A device is a host running the NetSenX agent, and one agent on a SPAN or TAP port watches a whole network segment and counts as one device. So a typical office with one main switch, plus a few servers you want to watch directly, may fit in the Starter plan at €49 per month for up to 10 devices, or the Pro plan at €99 for up to 25 devices if you need Shadow AI or OT monitoring. Prices exclude VAT, and annual billing costs ten times the monthly price. The Free plan, at €0, covers 3 devices without a time limit, which is enough to test on your own network first. Add the time someone spends reading alerts; that is a real cost too.

https://netsenx.com/en/faq/how-much-does-ndr-cost-for-a-50-person-company

## How much does NDR cost for a 200-person company?

With NetSenX the price depends on the number of devices you monitor, not on headcount: Starter costs €49 per month for up to 10 devices, Pro €99 for up to 25, Business €249 for up to 100, and Enterprise starts at €999 per month (prices exclude VAT; the Free plan costs €0). A device is a host running the NetSenX agent, and one agent on a SPAN or TAP port watches a whole network segment, so a 200-person company does not need 200 devices. Many enterprise NDR vendors publish no price list and quote each deployment individually. There is also Solo, at €19 per month, for exactly one device and one user.

https://netsenx.com/en/faq/how-much-does-ndr-cost-for-a-200-person-company

## Why don't security vendors publish prices?

Usually because each deal is negotiated: the vendor wants to price to your budget, bundle services and keep competitors from comparing. Quote-only pricing is common for enterprise security products, where deployments include hardware, sensors per site, professional services and multi-year discounts. It makes budgeting hard for a small or mid-sized company: you spend weeks in calls before you learn whether the product is even in range, and renewals can rise without warning. When a vendor does not publish prices, ask for the full cost in writing: licence unit, minimum term, hardware, installation, support, training and what happens at renewal. Ask whether adding a site, a segment or a module changes the price. NetSenX publishes its prices for every plan, from the Free plan to Enterprise, from the same plan catalog the product applies, so you know the cost before the first call.

https://netsenx.com/en/faq/why-dont-security-vendors-publish-prices

## Why does the price jump when we add sites, segments or modules?

Because many security products are priced per sensor, per site or per module, so growth that seems small to you means new hardware, licences and services for the vendor. A second office can mean a second appliance, a new segment can mean another sensor licence, and a feature such as encrypted-traffic analysis or OT monitoring can be a separate module with its own price. Before you sign, ask the vendor to price your likely next step: one more site, twice the devices, the module you will probably want next year. Check whether the contract caps renewal increases. With NetSenX, the unit is the device: a host running the agent, where one agent on a SPAN or TAP port counts as one device for the whole segment. Features come with the plan rather than as separate modules, and the plan catalog shows which plan includes what, so the cost of growing is visible in advance.

https://netsenx.com/en/faq/why-does-the-price-jump-when-we-add-sites-or-modules

## What is the total cost of ownership of NDR?

The licence is only one part: add hardware, installation, the staff time to read and tune alerts, training, and what it costs to leave. Hardware means appliances or sensors per site, and their replacement cycle. Installation covers mirror ports or taps on your switches and any professional services. Staff time is often the largest cost: someone has to read alerts every day and investigate the serious ones, and a noisy tool costs more in hours than in licences. Add renewal increases, extra modules you will need later, and data storage if the product keeps traffic records. Finally, consider exit: can you export alerts and evidence when you leave? Compare products over three years, not one. NetSenX has no hardware of its own: one agent on a host connected to a SPAN or TAP port watches a segment, prices are published, and alerts are explained in plain language to keep the time per alert down.

https://netsenx.com/en/faq/what-is-the-total-cost-of-ownership-of-ndr

## How much does MDR cost?

It varies widely, because MDR is priced per endpoint, per user or per site, with very different scopes behind the same name. MDR (managed detection and response) is a service: analysts watch your alerts around the clock and respond. The price depends on how many endpoints or users are covered, which sensors are included, whether the provider responds for you or only notifies, the response time in the contract, and whether incident response after a breach costs extra. Get quotes from two or three providers for the same scope, in writing, and compare what happens at 03:00, not only the monthly figure. Check minimum terms and what you keep if you leave. MDR and network detection are different things: NetSenX is software, not a managed service, and it can sit beside an MDR provider, with alerts by e-mail on every plan, by Slack or webhook from the Pro plan and to a SIEM from the Business plan.

https://netsenx.com/en/faq/how-much-does-mdr-cost

## Is network detection cheaper than hiring a security analyst?

Usually yes in licence cost, but it is not a substitute: a tool detects, a person decides and responds. A security analyst is a salary plus training, holidays and the fact that one person cannot cover nights and weekends alone. Network detection runs at every hour, never takes holidays and watches devices that no one could check by hand, but it cannot judge whether a strange connection is a supplier's maintenance or an intruder, call the right person or restore a server. For most small and mid-sized companies the realistic choice is not tool or analyst, but tool plus the people you already have: your administrator, your IT provider and an incident-response firm on call. Compare honestly with your own salary figures. NetSenX costs from €0 on the Free plan to €249 per month on Business, and it is built so that a generalist can act on its alerts without being a security specialist.

https://netsenx.com/en/faq/is-network-detection-cheaper-than-hiring-a-security-analyst

## What can a security tool do that a part-time admin cannot, and the other way round?

A tool watches every connection at every hour and remembers it; a person understands the business, decides and fixes things. A part-time administrator cannot read network traffic all night, notice that a printer started calling an outside server at 02:00, or compare this week's behaviour of fifty devices with last month's. A detection tool can, and it keeps the record that an investigation or an insurer will ask for. But the tool cannot tell whether that new connection is a supplier's planned maintenance, cannot decide to disconnect the finance server during the year-end close, cannot talk to staff or restore from backup. The combination works when the tool filters and explains, and the person spends minutes a day on what matters. NetSenX is built for that split: alerts explained in plain language on every plan, sent by e-mail, with the decisions and actions kept in the audit log.

https://netsenx.com/en/faq/what-can-a-security-tool-do-that-a-part-time-admin-cannot

## Is there a free plan?

Yes. The Free plan covers up to 3 devices, keeps 30 days of alert history and includes the plain-language explanation on every alert and the NetSenX Math Guarantee. There is no time limit and no credit card is required.

https://netsenx.com/en/faq/is-there-a-free-plan

## Is there a free trial?

There is no separate trial period. Every new account starts on the Free plan — up to 3 devices, no credit card required, no time limit. Free protects the computers the agent is installed on; monitoring a network segment with a SPAN or TAP sensor starts with Starter. Upgrade to a paid plan whenever you need more capacity; plan changes apply immediately.

https://netsenx.com/en/faq/is-there-a-free-trial

## Is annual billing cheaper than monthly, and can we cancel?

Yes: with NetSenX an annual plan costs ten times the monthly price, so you get two months free, and you can cancel at any time without giving a reason. Cancelling is done in the billing section of the dashboard. By default it takes effect at the end of the period you have already paid for: you keep the plan until then, and nothing more is charged. After that, the account continues on the Free plan with its features and limits. Monthly fees are not refunded for the rest of the month. For a first annual subscription, the refund policy allows a pro-rata refund if you ask within a short period after paying; after that period, and on renewals, annual fees are not refunded. Annual renewals are announced by e-mail in advance. Enterprise contracts follow their own order form. Prices exclude VAT; the refund and cancellation policy has the full terms.

https://netsenx.com/en/faq/is-annual-billing-cheaper-and-can-we-cancel

## Is there a non-profit or academic discount?

Yes. Verified non-profits, universities, and accredited research labs receive 50% off Starter and Pro tiers, or extended Free-tier device caps. Email sales@netsenx.com with verification.

https://netsenx.com/en/faq/is-there-a-non-profit-or-academic-discount

## What payment methods do you accept?

Credit and debit cards (Visa, Mastercard, AmEx), SEPA Direct Debit on annual plans, and bank transfer for Business and Enterprise contracts. All processed through EU payment providers that hold PCI-DSS certification; the certification is the provider's, not NetSenX's.

https://netsenx.com/en/faq/what-payment-methods-do-you-accept

## Can I get an invoice instead of card billing?

Annual plans on Business and Enterprise can be invoiced with Net-30 terms. Starter and Pro annual plans can request manual invoicing on approval. Every payment generates a VAT-compliant invoice automatically.

https://netsenx.com/en/faq/can-i-get-an-invoice-instead-of-card-billing

## What is alert fatigue, and how do small teams deal with it?

Alert fatigue is what happens when a team receives more alerts than it can read, so people start ignoring them and the real attack is lost in the noise. It usually comes from tools with default settings that flag every unusual event, duplicate alerts from several products about the same thing, and alerts that do not say why they matter. Small teams deal with it in four ways. Reduce sources: send only meaningful alerts to people and keep the rest as records. Mark recurring normal activity, such as backups and update servers, so it stops alerting. Group alerts that belong to one story. And prefer tools whose alerts explain themselves, so each one takes minutes, not an hour. Review monthly what was closed as harmless. NetSenX explains every alert in plain language on every plan, lets you mark false positives, and reports a false-positive bound only once your own calibration data supports one.

https://netsenx.com/en/faq/what-is-alert-fatigue

## How many security alerts per day is normal?

There is no normal number; what matters is whether your team can read every alert that reaches a person and act on the ones that matter. A tool that sends hundreds of alerts a day to a small team is not more secure, just less read. A useful way to think about it: an alert that reaches a person should, often enough, lead to an action or a decision. If almost none do, the tool needs tuning or the alert level is wrong. If an alert type is always harmless in your network, mark it so, or decide it belongs in a log rather than in someone's inbox. Expect more alerts in the first weeks, while the tool learns your network and you mark normal activity, and fewer later. Measure your own week: alerts received, alerts read, actions taken. NetSenX does not promise a number of alerts; it explains each one so that reading it takes minutes.

https://netsenx.com/en/faq/how-many-security-alerts-per-day-is-normal

## What should every security alert include?

Enough to act without detective work: which host and account, what was seen, when it started, why it is unusual for this host, how confident the tool is, and what to check next. A good alert also says where the evidence is, for example the connections involved, so the reader can confirm it, and which other alerts belong to the same story. An alert that only names a rule or a score sends the analyst back to the raw data, and in a small team that usually means it gets ignored. When you evaluate a tool, ask for three real alerts and give them to the colleague who would read them at 08:00: could they decide in five minutes whether to escalate? Every NetSenX alert carries a plain-language explanation of why it fired and which network features drove its score, on every plan, and the audit log keeps what was done about it and by whom.

https://netsenx.com/en/faq/what-should-every-security-alert-include

## What is a realistic false-positive rate for NDR?

There is no honest single number: it depends on your network, the tuning and how a false positive is counted, and vendor figures are rarely measured independently. A rate measured in a lab, on another company's traffic or over a different alert type tells you little about your Monday morning. Ask three questions of any figure: measured on whose data, over which alerts, and per what unit, such as per day, per host or per alert. The number that matters to you is practical: how many alerts reach a person each week, and what share of them lead to an action. Track that yourself from the first month. NetSenX does not quote a rate. A split-conformal layer bounds false positives among the alerts it surfaces once your own calibration data supports it, from benign traffic your team has labelled; until then the dashboard says so instead of showing a figure it cannot back.

https://netsenx.com/en/faq/what-is-a-realistic-false-positive-rate

## We get too many false positives. How do we tune without missing real attacks?

Tune narrowly and keep a record: exclude a specific known activity on a specific host, never a whole type of alert across the network. Start with the alerts that recur most. For each, confirm what causes it, for example the backup server copying to the storage system every night, and mark that exact behaviour as expected, ideally with the host, destination and time window. Leave the rest of the detection untouched, so the same pattern from any other host still alerts. Write down who decided and why, and review exclusions every few months, because a forgotten exception is a place for an attacker to hide. Test after tuning: run a harmless scan or a test call-out and check that it still raises an alert. In NetSenX you mark false positives on the alerts themselves and every decision is kept in the audit log, and the false-positive bound is shown only once your labelled data supports it.

https://netsenx.com/en/faq/how-to-tune-false-positives-without-missing-real-attacks

## How long until a new security tool stops being noisy?

Expect the first weeks to be the noisiest, and plan time for them; how quickly it settles depends on your network and on how quickly you mark what is normal. A behavioural tool compares each device with its own normal, and that normal takes time to learn: monthly jobs, month-end reports or a quarterly update may only appear after weeks. Meanwhile your own decisions do much of the quieting: every recurring harmless alert you confirm and mark is one that stops returning. Schedule a short daily review in the first weeks and a review of exclusions after the first month. Be wary of any promise that a tool is quiet from day one: it either has very few detections or hides what it is unsure of. NetSenX raises alerts as traffic flows from the start, improves its comparisons as it learns your network, and says plainly when your data does not yet support a false-positive bound.

https://netsenx.com/en/faq/how-long-until-a-new-security-tool-is-quiet

## How much time does a small team need to run NDR?

Plan a short daily review and occasional longer investigations; the exact time depends on how many alerts the tool raises and how well each explains itself. In practice, a small team needs three kinds of time. A daily look at new alerts, so nothing waits a week. A weekly or monthly pass over closed alerts to mark recurring normal activity, such as backup jobs or update servers, so they stop coming back. And, when a serious alert arrives, enough time to investigate, which can mean hours and sometimes help from outside. The first weeks need more attention than later ones, while the tool and your team learn what is normal. Alerts that say in plain words what happened, on which host and why, cut the time per alert. NetSenX explains every alert in plain language on every plan and lets you mark false positives, but it does not remove the need for someone to read them and decide.

https://netsenx.com/en/faq/how-much-time-does-a-small-team-need-to-run-ndr

FAQ: https://netsenx.com/en/faq