What inSUPPORT Includes in the Monthly Fee That Others Quote Separately

Security remediation sits inside the monthly support fee. The audit finds a gap, and closing it is not a separate project quote. inSUPPORT prices support at $68 per user per month for business hours, $100 for extended retail cover and $135 for round the clock, and the remediation from the onboarding audit is inside that number. Cyber insurance, backup and the security awareness platform are not. They are separate lines on the quote, named and priced.

If you sign the invoices, you already know why this matters. The monthly fee arrives on time. Then a quote arrives too, usually after the audit you paid for. The second invoice comes from where the line between them was drawn.

The honest version of that boundary has two columns. Some work is inside the support fee. Some is a separately quoted line, because it is a product in its own right and costs what it costs. Any fee presented as covering the lot would be making a claim about price, and the ACCC expects those to be accurate.

So here is the line itemised, from the published matrix. What sits inside, what is quoted separately, what sits outside both, and where included stops. The general version lives in what a managed IT support fee covers in Australia. This one draws the boundary, so you can hold it against any proposal.

TL;DR: What sits inside the fee

• ✅ Inside the support fee: proactive monitoring, the security remediation the onboarding audit finds, helpdesk, patching and vendor management, with a virtual CIO on the Retail and Complete tiers.
• ✅ Quoted separately: cyber insurance, Compliant Backup, the security awareness platform, Microsoft licensing, Apple Mac support and a password vault. Hardware, software licences and major projects as well.
• ✅ $68, $100 or $135 per user per month. Monitoring and remediation are printed on every tier card. The plainest difference between tiers is when a person answers.
• ✅ The mechanism, not the adjective: a provider whose remediation sits inside the fee is not rewarded with a second project for finding a problem.
• ✅ Included still has an edge. Ask for the inclusions schedule attached to the agreement, then ask what falls outside it.

Contents

• Inside the Fee: the Work That Does Not Come Back as a Quote
• Quoted Separately, and Why Each One Is Its Own Line
• Why Remediation Inside the Fee Changes the Incentive
• Where Included Stops, and the Question That Finds the Edge
• Two Proposals, Two Columns: How to Read Them Side by Side
• Questions finance teams ask about where the fee stops

Inside the Fee: the Work That Does Not Come Back as a Quote

Start with the published matrix, because it is the only version that counts. The IT support pricing page prints proactive monitoring and security remediation on all three tier cards. Vendor management is printed on Business, and a virtual CIO on Retail and Complete. Under the tier cards the same page runs a longer service inclusions list: 24/7 monitoring of critical systems, network and application monitoring, monthly patch management, operating system health checks, multi channel user support, incident and problem management, service level agreements, licensing compliance, line of business application support, roadmap planning, and disaster recovery planning and testing.

That list is where the edge of the fee is really drawn, so it is the part to hold against any other proposal you are weighing up.

inSUPPORT's three tiers are $68, $100 and $135 per user per month. Monitoring and remediation are printed on all three cards, and the plainest difference between them is the clock. Business is weekday business hours, finishing at 5:30pm. Retail carries on until 9:00pm on Thursdays and Fridays and reopens Saturday morning. Complete never closes. The cards differ in other places too, so ask which inclusions the agreement attaches to the tier you are quoted. On monitoring and remediation, the extra money buys a person awake at the hour your business is.

Remediation is the item with the largest practical consequence. When the audit turns up something to fix, the labour of fixing it is covered by the monthly number, instead of turning up later as a proposal of its own. The managed IT services page puts it in a single sentence: the remediation your audit finds is included in your support fee, not billed back as a surprise project.

Quoted Separately, and Why Each One Is Its Own Line

Six extras sit beside the support fee on the same pricing page. Each has a price of its own, which is exactly why none of them is folded into the fee.

• Cyber insurance. Arranged through licensed insurance partners and underwritten by the insurers rather than by your IT provider. Cover is subject to the insurer's assessment. inSUPPORT does not hold an Australian Financial Services Licence and does not underwrite insurance. The line is priced on your own quote.
• Compliant Backup. Backup and disaster recovery built to the Essential 8 backup controls, with the restore itself tested rather than assumed. Verified recovery is infrastructure, and infrastructure has a price.
• Education. A phishing platform that aims its simulated attacks at each individual, tuned by how they went in that fortnight's class. The people who need the practice are the ones who get it.
• Microsoft licensing. Bought under the Microsoft Cloud Services accreditation named on the pricing page, which is where the additional discounts come from.
• Apple Mac support. So the Macs in the business are managed and protected to the same standard as the Windows machines.
• Password vault. For the business whose passwords currently live on a sticky note under the keyboard.

The third column: what sits outside both lists

Then there is a column that sits outside both lists. Hardware, software licences and major project work are quoted separately too, and the FAQ says exactly that about what is not included in the monthly fee. A server purchase is capital, not support labour.

Licences are worth a sentence of their own, because this is where quotes get compared wrongly. Microsoft's own documentation describes a subscription as an agreement with Microsoft charged on a per-user licence fee, with licences assigned to individual user accounts. That cost is Microsoft's, whoever hands you the invoice. So ask whether your provider passes licensing through at cost, marks it up, or leaves you to buy it direct. Each is a fair arrangement, and across a year they produce very different totals on an identical per-user rate.

A quote that prices each of these on its own line is also far easier for a finance team to plan a year around. The ACCC is direct about why it matters: information a business gives about price must be accurate and based on reasonable grounds, a business must not make false claims about exclusions, and silence can mislead where some of the detail is supplied and the part you needed is not. Intent is irrelevant to that. So if a provider will not itemise, ask again, in writing.

Why Remediation Inside the Fee Changes the Incentive

Think about how the money usually flows. You buy an audit. The audit produces findings. The findings produce a second proposal, priced. Nothing about that is improper. Plenty of capable providers work this way, and the good ones say so before you sign.

It does carry a consequence worth naming out loud. Under that model, finding a problem earns the provider more work. You, having already paid for the audit, end up with a costed inventory of everything wrong with your own systems. Nobody set out to design that. It is simply what happens when the finding and the fix are sold separately.

Putting the remediation inside the support fee takes that second reward off the table. There is no extra fee for noticing. You can check that against a published price list instead of taking an adjective on trust, which is why the claim survives a CFO reading it twice.

What remediation actually consists of is unglamorous. Staff accounts holding more privilege than the job calls for. Machines outside any management tool. Former employees whose access was never switched off. Multi factor authentication rolled out to most people and stalled for the rest. Updates that have slipped months behind. Clearing that list is the first job inSUPPORT does for a new client, and under the other model each item would be its own line on a project quote.

Where Included Stops, and the Question That Finds the Edge

Here is the part a straight answer has to include. Included is not unlimited, and no provider should pretend otherwise. The published matrix names the work. The service agreement names the scope. Those are two different documents, and the second one is the one that binds.

So ask to see the inclusions written into the agreement you will sign, as a schedule to it. Then ask the harder half of the question: what falls outside it. Name the big ones specifically. A rebuild after an incident. A network redesign. A server replacement programme. A fleet of new laptops. Ask which side of the line each one sits on, and get the answer in the same document as the inclusions.

Three things are not published anywhere on the site, and it is better to say so than to let you discover it later. The contract term and the notice period are settled in your service agreement rather than printed. The entitlement that attaches to each named tier beyond the published hours is not spelled out either, so ask for that mapping. And no price is published for the audit or for any of the six extras, because each is quoted on your own environment. Ask for all three in writing before you sign anything, here or anywhere else.

The Australian Signals Directorate gives the same instruction in security language. Writing for organisations that engage a managed service provider, it says to state your cyber security expectations upfront, get them into the contract, include incident notification clauses, and know where the boundaries are between you and your provider. That last one is the sentence to keep. A boundary that exists only in somebody's recollection of a sales meeting is not a boundary. It is a disagreement waiting for a bad week.

Two Proposals, Two Columns: How to Read Them Side by Side

Two managed IT support fees can carry the same number and a completely different boundary. So put the quotes next to each other and leave the per-user rate until last, because the rate only means something once the boundary behind it matches. The general guide to what a managed IT support fee covers, linked at the top of this page, runs a full six-question comparison. Three further checks sit right on the boundary, and they apply just as well to the arrangement you have had for years.

1. Monitoring, patching and vendor work. Inside at every tier, or inside at the top tier only? The answer changes what the cheaper option really costs.
2. Exclusions. The list of what is not covered, in the schedule, in writing. If a provider says nothing is ever a project, you have learned something about the provider.
3. Hardware and licences. Which column does a replacement laptop, a new server or a licence renewal land in: inside the fee, a project quote, or a purchase you make yourself? Get the answer item by item before you compare totals.

The framework the schedule should name

One more thing belongs in the comparison: which security framework the schedule names. On 15 October 2026 the Australian Signals Directorate launched the ASD Essentials, an evolution of the Essential 8, with its first three chapters covering enterprise IT, operational technology and cloud. ASD says it will maintain both the Essential 8 and the Essentials during the transition, that it will advise on expectations for the transition in due course, and that organisations should keep meeting their current regulatory obligations until regulators communicate the associated changes. When this was written in October 2026, ASD had set no transition date. The Essentials is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations, and ASD says work already completed under the Essential 8 remains relevant.

So an inclusions schedule that names the framework it works to, and gets reviewed when ASD's guidance changes, is worth a great deal more than one that says security. Check the current ASD guidance before any framework or maturity target goes into a contract, including this one, because this article was written in October 2026 and the guidance is under active revision.

None of this requires you to become technical. It requires one page you can read, attached to a document you can enforce. If your current arrangement has that page, you are in good shape. If every answer lives in somebody's memory of a handshake, the fee is not really the product you bought. The boundary is, and you have not seen it.

Questions finance teams ask about where the fee stops

Is security remediation really included, or only up to a point?

Included, for the remediation the onboarding audit identifies and the plan you then agree with inSUPPORT. That is the published claim. It is not a promise of unlimited work in any direction, and no provider could honour one. The way to settle it for your own business is the inclusions schedule attached to your agreement, plus one direct question about what sits outside it.

How do we read a quote that rolls the extras into one number?

Ask for it to be split before you compare it with anything. The support component should sit on its own per-user line, with insurance, backup, awareness training and licensing each priced beside it. Until that split exists you cannot tell whether a lower total reflects a leaner boundary or simply fewer of the extras, and you have no way to drop one you do not need.

How long before the included remediation is actually done?

Treat any timeframe you are given as a scope question rather than a promise, and get it in writing alongside what it covers. Most of that work tends to land near the start, since no fix has to wait for a separate quote to be approved first. What finishes when depends on what the audit turns up in your environment.

Does included remediation still apply after a security incident?

Ask before you sign rather than after. The published claim covers the remediation the onboarding audit identifies and the plan you agree from it. Recovery after an incident is a different situation from the one that claim describes, so ask which side of the line it sits on and have the answer written into the agreement. If what you need first is a view of your own environment, a Cyber Strength Audit is where that comes from.

Sources

• "False or misleading claims", the ACCC's guidance for business. Any information a business provides about its products or services must be accurate, truthful and based on reasonable grounds, and the list of what that covers opens with information on prices. The rule applies to a quotation as much as to an advertisement, a business must not make false claims about any exclusions on the goods and services, and failing to disclose information can mislead where some detail is given and important details are left out. It makes no difference whether a business intends to mislead. Read 20 October 2026. accc.gov.au
• "ASD Essentials: evolving our approach to cyber security resilience", the Australian Signals Directorate's announcement of the ASD Essentials, an evolution of the Essential 8, with first chapters for enterprise IT, operational technology and cloud. Used above for two statements it makes directly: organisations should continue to meet their current regulatory obligations until regulators communicate associated changes, and ASD will maintain both frameworks during the transition period. Published and last reviewed 15 October 2026. Read 20 October 2026. cyber.gov.au
• "Frequently asked questions", the Australian Signals Directorate's ASD Essentials FAQ. Used above for three statements it makes directly: the Essentials series is written primarily for Commonwealth entities, critical infrastructure owners and operators, and large organisations; ASD will advise on expectations for transitioning to the new framework in due course; and efforts already completed under the Essential Eight remain relevant. Published and last reviewed 15 October 2026. Read 20 October 2026. cyber.gov.au
• "How to manage your security when engaging a managed service provider", the Australian Signals Directorate's guidance for organisations that outsource IT. The lines used above: clearly state cyber security expectations upfront, get security into the contract including incident notification clauses, and know where the boundaries are between you and your provider by identifying which systems the provider can reach and keeping that record current. Published 21 December 2018, last reviewed 5 April 2023. Read 20 October 2026. cyber.gov.au
• "Subscriptions, licenses, accounts, and tenants for Microsoft's cloud offerings", Microsoft's own documentation. A subscription is an agreement with Microsoft for which charges accrue on a per-user licence fee for its software as a service offerings, and administrators assign those licences to individual user accounts. Used above to show why a licence is a separate per-user charge from Microsoft rather than support labour. Read 20 October 2026. learn.microsoft.com

Related Reading

• What Does a Managed IT Support Fee Actually Cover in Australia?
• IT Support Pricing
• Twelve Questions to Ask Your IT Provider Before You Renew
• What Your Provider Should Show You at an Essential 8 Review
• The 6 Step Cyber Strength System

Content reviewed by Probably Genius for accuracy and relevance.

inSUPPORT provides managed IT and cyber security services. It is not an insurer, insurance broker or underwriter and does not hold an Australian Financial Services Licence. Where cyber insurance forms part of a plan, it is arranged through licensed insurance partners and underwritten by the insurer. Cover is subject to the insurer's assessment, the policy terms and the Product Disclosure Statement and Target Market Determination. This article is general information about IT and security practice, not financial product advice, and it does not take account of your objectives, financial situation or needs.