BT cybersecurity buying guide: compare protection, prices and managed services

Last Verified 28/09/2026

BT sells business security in layers, with devices, broadband, cloud apps, leased lines, branch networks and remote users each covered by a separate service that has its own price basis, contract terms and limits. This guide compares the BT products you're most likely to be choosing between, what each one includes (and what it doesn't), how it's priced and who should buy it, so that you can put a shortlist together before asking for a quote.

At Netify we've been an Authorised Partner of BT since 2012, and everything below is based on BT's own product pages, schedules and annexes, linked beside each claim, and where something depends on your order we've said so.

Most businesses need more than one BT security product, as each covers a different layer. Endpoint Threat Protect covers devices, Web Threat Protect and Broadband Ultra cover a broadband connection, Cloud Threat Protect covers browsing, cloud apps and email per user, BTnet Security or a managed firewall covers a leased line, and Meraki or Fortinet SD-WAN covers multiple sites.

• Endpoint Threat Protect
• Cloud Threat Protect
• leased line

There isn't one BT business security platform that covers everything, therefore the quickest way to build a shortlist is to work out what needs protecting (devices, one office connection, several branches, remote staff or cloud email) and match each need to the BT service below. A one-office business on BT broadband might need two or three of these, while a multi-site business would typically compare SD-WAN, SASE and monitoring as well.

Tell us what you need protecting and we'll come back with a shortlist of the BT products that fit, the exclusions you should know about and anything BT needs to confirm, as well as a scoped quotation once eligibility and pricing have been confirmed.

BT publishes prices for three of its business security products, which are Endpoint Threat Protect at £4.99 per device per month, Cloud Threat Protect from £3.30 to £9.50 per user per month excluding VAT, and Security Awareness Training from £1.25 or £1.50 per user per month excluding VAT on a 60-month basis. Everything else is individually quoted.

Pricing clarification: Broadband Ultra also has a published starting price, shown later in this guide. The original sentence above does not include it. Endpoint Threat Protect’s VAT basis still requires confirmation.

• Endpoint Threat Protect
• Cloud Threat Protect
• Security Awareness Training

As a guide, 25 devices on Endpoint Threat Protect would be £124.75 a month before the VAT basis is confirmed, 12 users on Cloud Native £76.80 a month excluding VAT, and 10 users on Training Fundamentals from £12.50 a month excluding VAT over 60 months. We wouldn't recommend adding these into one figure until your device and user counts, overlaps, terms and VAT basis are known, and none of them is a binding quote.

For the quoted services, it's worth checking each of the following on any quote rather than assuming it's included.

Monthly billing also doesn't mean you can cancel monthly, as each service has a minimum term in its Schedule or Order, and BT don't publish a bundle discount for buying several products together.

BT Endpoint Threat Protect is BT's CrowdStrike-powered device protection for small businesses, priced at £4.99 per device per month. It includes AI-driven next-generation antivirus, malicious file quarantine, suspicious process blocking, network containment and a central dashboard, as well as 24/7 first-line support from BT, although it's your business that handles the security events in the portal.

• AI-driven next-generation antivirus

BT launched the service on 30 October 2025 as BT Business Antivirus Detect and Respond, powered by CrowdStrike Falcon Go, which was then renamed to BT Endpoint Threat Protect, so if you're looking for BT antivirus for a business, this is now the product to go for. The product page lists the following.

• BT Business Antivirus Detect and Respond

The £4.99 is for each device, and BT's Schedule defines a licence as access to the service for one endpoint, therefore someone using a laptop, a desktop and a phone that all need protecting would need three licences. As an example, a business with 10 people and 20 eligible devices would need an estimate for 20 devices (£99.80 a month), not 10. The published rate also isn't the final invoice, as VAT, the contract term and any extras are confirmed in the written quote.

BT lists all sensor versions for Windows, Mac and Linux, as well as Android 9.0 and iOS 15 and later. We'd treat that list as a starting point rather than a guarantee, as the controls can differ between a laptop, a server and a phone, so we'll check your exact operating systems and versions before you order.

Endpoint Threat Protect isn't a managed security operations centre, and it isn't CrowdStrike Falcon Complete or BT's enterprise managed endpoint service. BT describe it as endpoint detection and response, however under the Schedule it's your business that views and handles security events in the portal, while BT's support covers the service rather than investigating incidents or repairing devices, and BT don't guarantee it will detect or block every threat. If you need a team to investigate and contain threats for you, BT Managed Endpoint CrowdStrike is a separate, quoted service (see the wider managed security section).

On the topic of existing antivirus, the public Schedule doesn't say whether Endpoint Threat Protect can run alongside another product, therefore we'd check what you have installed, and when it renews, before planning the switch.

It suits small businesses that want a simple per-device price, have someone in-house (or an IT provider) to keep an eye on the portal, and have staff working away from the office, as the protection is installed on each device rather than tied to one connection.

An internet connection and access to BT Business Apps, which is how BT deliver the service, and the Schedule doesn't require BTnet or BT broadband.

For a full breakdown of the service, to check your devices and to confirm current pricing, see our BT Endpoint Threat Protect page.

• BT Endpoint Threat Protect

BT Business Broadband comes with Web Threat Protect, which warns you before you visit a harmful website once it's activated in My Account, however it works at network level and doesn't replace device protection. If you want a firewall on a broadband connection, BT Broadband Ultra includes Cisco Meraki security with a firewall, content filtering, anti-malware and intrusion detection and prevention.

• BT Web Threat Protect

Web Threat Protect is included with BT Business Broadband and needs switching on in My Account. It protects browsing on your BT connection, as well as on BT Wi-Fi hotspots when you sign in with your BT username, however it doesn't follow a device onto a home, mobile or other provider's network. BT are clear that it doesn't replace BT Business Antivirus or any other endpoint protection, therefore we'd treat BT broadband security as a useful extra rather than your security.

Ultra is BT's business broadband with a cloud-managed Cisco Meraki security device built in, and BT lists the following as part of the package.

BT currently advertises Ultra from £133 a month excluding VAT, with speeds up to 900Mbps on 36 or 60-month terms, and the monthly price rises each April from 2027 (to £136, then £139 and £142, as well as £145 and £148 on 60-month contracts), so it's worth checking the current offer and availability at your address.

• Ultra

Ultra suits a single office that wants a managed firewall on broadband, with guest Wi-Fi and 4G backup, without paying for a leased line. The lack of static IPs is the main thing to check, as it typically rules Ultra out if you host services on site, rely on IP allow-listing or need a VPN that expects a fixed address.

If you're comparing BT cloud security, Cloud Threat Protect comes in three tiers priced per user. Cloud Essentials (£3.30) covers web security, URL filtering and anti-malware, Cloud Native (£6.40) adds cloud application security and data breach prevention, and Cloud Advanced (£9.50) adds email security, all per user per month excluding VAT. If you need email protection, it's Cloud Advanced.

BT deliver Cloud Threat Protect in partnership with TrustLayer, and it follows the user rather than the office, therefore it complements device protection and an office firewall rather than replacing either. Essentials is really about safer browsing, Native suits staff keeping business data in cloud apps, and Advanced is the one if phishing email is the concern. BT's public Schedule doesn't list the platforms it supports, so we'd ask which email and cloud platforms you use (Microsoft 365 or Google Workspace, for example) before choosing.

• Cloud Threat Protect
• BT's public Schedule

None of the tiers is a backup service, so it won't restore lost files or mailboxes, and it's a different product from BT Managed Cloud Security, BT's enterprise cloud service (covered further down).

You'll need an internet connection, BT Business Apps and a supported desktop agent for web security, and if you tell us your user numbers, platforms and whether email matters most, we'll confirm which tier fits.

A BTnet leased line on its own is a connection, not a security service, therefore you'll need to decide how it's protected. There are three routes, which are BTnet with your own firewall, BTnet Meraki with BTnet Security, or BT connectivity with a separately designed managed firewall or SD-WAN service, such as Fortinet. Each has different scope and responsibilities.

BTnet Security is only available with BTnet's Cisco Meraki managed equipment option, and BT's Annex (June 2024) sets out the following.

That makes BTnet Security a good fit for a single site that wants firewall, filtering and intrusion prevention on its leased line, however if you need VPN links between offices, or someone to look into what the security blocks, you'd need managed SD-WAN or a monitoring service. BT's BTnet page does list 24/7 proactive monitoring for the Meraki package, however the Annex is clear that BT don't investigate or act on detected threats, therefore we'd treat that as monitoring of the connection and equipment. BTnet's 100% availability SLA and 5-hour target fix also apply to the connection, not to security events.

• BTnet Security
• BTnet
• BTnet's

If you're after a BT firewall on Fortinet, BT Managed Firewall supports Fortinet as well as Cisco, Check Point and Palo Alto Networks, with BT managing and monitoring the firewall 24/7. It's a separately designed service over compatible BT connectivity rather than BTnet Security, therefore monitoring, change handling and response are whatever's agreed in the Order.

• BT Managed Firewall

Neither a firewall nor a dedicated line provides upstream DDoS mitigation, as a flood of traffic can fill the circuit before it reaches the firewall. BT offer DDoS protection with Arbor, using cloud-based detection and mitigation, scoped around the IP addresses you need protecting, and although a BTnet help page mentions Bronze, Silver and Gold packages, we'd confirm the current options in a quote.

• BT offer DDoS protection

Quote BTnet with the right security

• Quote BTnet with the right security

BT SD-WAN comes as a managed service on either Cisco Meraki or Fortinet. Meraki is licensed as Enterprise or Advanced per device, with LAN and Wi-Fi in its standard components, while Fortinet comes as a physical Standard licence with the security subscription included, or a virtual licence where security is optional. Neither overlay carries its own service levels under BT's Annexes.

SD-WAN runs on top of your internet or private connections (the underlay), and the managed SD-WAN service is the overlay, which routes traffic between sites and applies policy. BTnet can be one of those connections, but it isn't a prerequisite for either service, and BT's Fortinet Annex allows your own or third-party WAN where BT has confirmed in writing that it's compatible.

Meraki suits businesses that want one cloud-managed platform across the WAN, switches and Wi-Fi. The licence is the important decision for security, as Cisco describe Enterprise as Auto VPN and a firewall, while Advanced Security adds IDS/IPS, content filtering and Advanced Malware Protection. BT's Annex names both licences, although we'd confirm the exact feature mapping in your Order, and with Enterprise BT recommend a dedicated security solution at your host site.

• Cisco Meraki licence features
• BT Managed Meraki service annex

Cisco also sell a Secure SD-WAN Plus tier, however we haven't seen it listed as a BT orderable option, therefore we'd treat it as unavailable until BT confirm otherwise.

Fortinet suits businesses that want the firewall and SD-WAN in one device, with the security subscription included on physical Standard and opt-in on virtual, so on a virtual deployment it has to be selected rather than assumed. The Annex defines it as Fortinet's Unified Threat Protection (UTP), however which features are switched on, and the throughput with them enabled, depends on the design, and Fortinet's ENT bundle, FortiSandbox and OT-specific controls shouldn't be assumed.

• BT Managed Fortinet service annex, including its UTP definition
• Fortinet manufacturer security bundles

We don't quote FortiGate models in a guide like this, as the right one depends on throughput with security inspection on, your traffic mix, VPN tunnels and TLS inspection. Existing FortiGates can be taken on where BT agree they're suitable after their checks.

For a more detailed assessment of which platform fits your estate, see our BT Fortinet and Meraki SD-WAN comparison.

• BT Fortinet and Meraki SD-WAN comparison

With most BT security products, BT blocks threats automatically and supports the service, however your business is responsible for reviewing alerts and deciding what to do. The exceptions are services ordered specifically for monitoring, such as the optional Protective Monitoring Service on Fortinet SD-WAN, which covers High and Critical security events 24/7 using playbooks agreed with you.

• BT security products

The key boundary is on Fortinet, where BT's Annex states that as standard it doesn't proactively take any action on security alerts. Protective Monitoring (PMS) is the option to add if you want BT watching them, and it needs the Security Licence Subscription and logging switched on, with SSL inspection specified for the best quality, therefore uninspected encrypted traffic leaves gaps. When something is found, BT notify you of the remedial action and run any playbooks agreed with you, although the action itself may sit with you, with BT or with both.

• BT Fortinet annex: Protective Monitoring

It's also worth keeping connectivity and security response separate when comparing quotes. BTnet's 100% availability SLA and 5-hour target fix cover the leased line, BT's Meraki and Fortinet Annexes say service levels don't apply to the SD-WAN overlay, and neither is a promise about incident response, so any security response targets need writing into the Order.

• BTnet's

BT SASE is worth considering when you have branches as well as staff working away from the office who need controlled access to your applications. BT's managed SASE, launched in November 2024 and powered by Fortinet, adds firewall as a service, secure web gateway, CASB and zero trust network access to its managed Fortinet SD-WAN, with each element scoped and licensed separately.

• BT's managed SASE
• managed Fortinet SD-WAN

A typical case would be a business with branches on managed SD-WAN, as well as sales staff, engineers or hybrid workers connecting from home, customer sites and public Wi-Fi who need access to Microsoft 365 and cloud apps. SD-WAN secures the branches, but it doesn't cover someone on a hotel network, which is where SASE comes in, applying the same policy to users wherever they connect. BT list four main parts.

SASE is separately ordered, therefore a FortiGate security licence on your SD-WAN doesn't give you a SASE subscription. BT's Fortinet Annex sets out bandwidth licences and public IP licences that only come in groups of four, and lists FortiSASE points of presence in the UK, USA, India, Canada, the UAE, Germany, France, Singapore, Australia and Japan, with users in each country using the in-country one. BT's SASE page also describes a single SLA for network and security, whereas the Fortinet Annex says service levels don't apply, so we'd want the SLA written into the Order. Before quoting, we'd confirm users and sites, bandwidth, countries, identity provider and public IPs.

If you're on Meraki, BT's reviewed Meraki Annex doesn't document a SASE route, although that doesn't mean Meraki can't work with cloud security, so it's a question for BT based on your design. For the detail on BT's SD-WAN and SASE options, see our BT SD-WAN and SASE assessment.

• BT SD-WAN and SASE assessment

BT Security Awareness Training comes as Fundamentals, from £1.25 per user per month, or Personalised, from £1.50 per user per month, both excluding VAT on a 60-month basis. Fundamentals uses BT-branded courses and BT-selected phishing simulations, while Personalised lets you choose from a library of courses and simulations and add your own branding.

Training works alongside your technical controls rather than instead of them, and it often sits alongside Cloud Advanced where phishing is the concern. The 60-month term is the main thing to weigh up, as it's longer than the other published products, therefore we'd check it lines up with your other contracts.

• Training

BT's wider managed security services are for businesses that need a team to monitor, investigate and respond, or that need specific controls such as privileged access or segmentation. They're individually scoped and quoted, and they're separate products from the small-business services above, so BT Managed Endpoint CrowdStrike isn't an upgrade to the £4.99 Endpoint Threat Protect licence.

BT state there are no additional licensing costs for Microsoft E5 holders on Managed Endpoint Microsoft, however that's about licences, so BT's management charges still need quoting. Micro Segmentation also isn't part of Meraki or Fortinet SD-WAN, and doesn't on its own make you compliant with any regulation.

We can arrange a suitability conversation for any of these, and we'll confirm the ordering route with BT first.

These are illustrations of how the products fit together, not real customers, approved bundles or guaranteed recommendations.

Need: A single office on BT Business Broadband, with staff using laptops and phones and email in the cloud.

Candidate BT services: Web Threat Protect, Endpoint Threat Protect for every device, Cloud Advanced if email protection is needed, or Broadband Ultra for a firewall on the connection.

Remaining gaps: Who reviews endpoint alerts, backup of cloud data, and static IP needs if Ultra is considered.

Questions before quoting: How many devices, which operating systems, which email platform, and when does the current antivirus renew?

Need: Most staff working from home, customer sites or on the move, using cloud apps rather than an office network.

Candidate BT services: Endpoint Threat Protect on every device, Cloud Native or Cloud Advanced for each user, and BT managed SASE if staff need controlled access to specific applications.

Remaining gaps: Web Threat Protect won't follow staff onto home networks, and SASE licences, locations and identity integration all need scoping.

Questions before quoting: How many remote users, which countries do they work from, which apps do they need access to, and which identity provider do you use?

Need: A head office and several branches that need secure links between them, consistent Wi-Fi and firewall policy across every site.

Candidate BT services: BT Managed Meraki SD-WAN (Advanced) or BT Managed Fortinet SD-WAN (physical, with the security subscription and optional Protective Monitoring), plus Endpoint Threat Protect.

Remaining gaps: The overlay has no service levels of its own, BTnet Security won't provide the VPN between sites, and response responsibilities need agreeing.

Questions before quoting: How many sites, what connections and bandwidth, what throughput with security on, and do you already own Meraki or FortiGate equipment?

Need: A larger organisation that needs evidence of controls, defined responsibilities and 24/7 monitoring across endpoints, cloud and networks.

Candidate BT services: BT Managed Endpoint CrowdStrike or Microsoft, SOCaaS for Microsoft Sentinel or BT SIEM, Managed Firewall or SD-WAN, PAM, Micro Segmentation and Security Consulting to scope it.

Remaining gaps: No single product provides compliance, therefore responsibilities, evidence and response targets need writing into each Order.

Questions before quoting: What frameworks do you report against, what telemetry do you already collect, who handles incidents today, and when do current contracts end?

The more of these details you can give us, the more useful the first recommendation will be, although you don't need all of them to start. We'll always ask for devices as well as people, as endpoint protection is priced per device and cloud and training per user, and we'll never ask for passwords, security logs or network diagrams in a public form.

The first form only asks for your business email, what you need protecting, roughly how many people, devices and sites, and how you'd like us to get in touch, and we'll gather the technical detail afterwards. We'll then send a written shortlist of BT services, the exclusions that apply and the points BT need to confirm, followed by a scoped quote.

If you already know which product you need, you can go straight to our BT Endpoint Threat Protect page, our BT leased line quote tool or our BT Fortinet and Meraki SD-WAN comparison.

• BT Endpoint Threat Protect
• BT leased line quote tool
• BT Fortinet and Meraki SD-WAN comparison

Per device, at £4.99 per device per month, so someone with a laptop and a phone needs two licences. It includes NGAV, quarantine, suspicious process blocking, network containment, a dashboard and 24/7 first-line support. See Endpoint Threat Protect.

No. With Endpoint Threat Protect your business handles events in the portal, while BT Managed Endpoint CrowdStrike is a separate, quoted managed service.

No, it works at network level, on your BT connection and BT Wi-Fi hotspots with a BT username, but not on home, mobile or other networks.

Cloud Advanced, at £9.50 per user per month excluding VAT. Cloud Essentials and Cloud Native don't include email security.

Yes, BTnet is a connection, so it needs your own firewall, BTnet Security or a managed firewall or SD-WAN. See securing a BT leased line.

Yes, through BT Managed Firewall or Fortinet SD-WAN, and no, BTnet Security is only available with BTnet's Meraki option.

No, the BTnet Security Annex excludes site-to-site VPN, so you'd look at Meraki or Fortinet SD-WAN.

Meraki for one cloud-managed platform across WAN, switches and Wi-Fi, Fortinet for firewall security in the same device with optional monitoring. See the comparison.

It's included with physical Standard, and optional (opt-in) on virtual.

Not as standard on Fortinet, and Protective Monitoring adds 24/7 monitoring of High and Critical events. See who responds to alerts.

No, BTnet's SLA covers the connection, and security response depends on the service and its Order.

It's worth considering if remote staff need controlled access to apps wherever they connect, and SASE licences aren't included with SD-WAN.

Existing Fortinet devices where BT agree after checks, while Meraki reuse needs confirming with BT.

Often, yes, as Endpoint and Cloud Threat Protect need an internet connection and BT Business Apps, and Fortinet SD-WAN can use third-party WAN BT confirm in writing. Web Threat Protect, Ultra and BTnet Security need the BT connection.

No. BT's Schedules don't guarantee detecting or blocking every threat, and no single product makes a business compliant.

People and devices, operating systems, sites, connections, current products, remote users, platforms, who handles alerts and contract end dates. See how to get a useful quote.