When a Kent business decides to take cyber security seriously, the first question is usually who to bring in: a cyber security consultant for a project, or managed cyber security that runs all year round. This guide explains the difference between the two, and why at BCS we don’t think you should have to choose.
What does a cyber security consultant do?
A cyber security consultant, or consultancy, is brought in for a defined piece of work. Typical cyber security consulting services include:
- a cyber security audit or risk assessment
- preparing for Cyber Essentials, Cyber Essentials Plus or ISO 27001
- writing security policies and incident response plans
- advising on a specific decision, such as a cloud migration or rolling out AI tools
- support after a security incident
You get expert advice and a clear deliverable, usually a report or a plan. The catch is that a consultant typically hands the recommendations back to you. Someone still has to do the work and keep doing it.
If you’re buying cyber security advice, the NCSC runs an assured Cyber Advisor scheme aimed at small and medium-sized organisations. It focuses on the Cyber Essentials controls, and points businesses with more complex needs to its Assured Cyber Security Consultancy scheme.
What is managed cyber security?
Managed cyber security, also called cyber security managed services, is an ongoing service for a monthly fee. Instead of a one-off report, a provider takes day-to-day responsibility for protecting your business. That typically includes:
- monitoring for threats and responding to alerts
- endpoint protection on every device
- email filtering and phishing protection
- patching and security updates
- managing multi-factor authentication and user access
- staff security awareness training
- a named team to call when something looks wrong
See what’s included in our managed cyber security service.
Side by side
| Cyber security consultant | Typical managed cyber security | BCS managed cyber security | |
|---|---|---|---|
| How it works | Project-based, for a set scope | Ongoing, all year round | Ongoing, with consultancy built in |
| Cost model | Day rate or fixed project fee | Monthly fee, usually per user | One monthly fee, with security consultation included |
| What you get | Advice, a report and a plan | Protection, monitoring and response | 24/7 monitoring and response, plus a security team and technical account manager advising you throughout |
| Who does the work | Usually you or your IT provider | The managed provider | BCS, from the advice to the fix |
| Advice when a decision comes up | Book and pay for another engagement | Often limited to scheduled reviews | Ongoing access to our security team |
Which does your Kent business need?
Choose a consultant if:
- you have an in-house IT team who can act on recommendations
- you need a specific outcome, such as Cyber Essentials before a tender deadline
- you want an independent view of your current provider’s work
Choose managed cyber security if:
- you don’t have security expertise in-house
- you need continuous protection, not a snapshot
- you want one accountable partner rather than a report to act on alone
The best of both: managed cyber security with a consultant built in
Most businesses need both: expert advice to decide what to do, and a team to do it, day and night. Usually that means paying a consultant for the plan and a managed provider to deliver it, with gaps in between where nobody quite owns the problem.
BCS managed cyber security brings the two together in one service:
- 24/7 monitoring and response. Threats are watched for and acted on around the clock, not just in office hours via the in-house team and BitDefender.
- Ongoing consultation from our security team. When a decision comes up, such as a new system, an AI tool or a customer’s security questionnaire, you can ask our security team or your technical account manager for advice. There’s no separate consultancy engagement to book and no day rates. In-depth projects and queries would be handled by our security engineers during scheduled security visits and are chargeable on top of the managed security subscription.
- Your own technical account manager. One named person who knows your business, runs regular reviews of your security and IT, and turns advice into a roadmap and budget you can plan around.
What makes this different isn’t any single feature. Plenty of providers offer round-the-clock monitoring, and many assign account managers. The difference is that expert consultation is part of the service rather than an extra, and the people advising you are the same people protecting you. Nothing gets lost between the report and the fix.
Our security and compliance consultant Lee is CISSP qualified, and Business Computer Solutions (BCS) is certified to Cyber Essentials Plus and ISO 27001. We won the Kent Invicta Chamber Business Award for Excellence in Customer Service in 2024. As a 100% employee-owned business, the people looking after your security have a real stake in getting it right. See what’s included in BCS managed cyber security, or read why basic cybersecurity matters more than ever in the age of AI.
Questions to ask any provider
- What certifications do you and your staff hold?
- Who acts on the findings, and is that included in the price?
- How quickly do you respond to a security alert, day and night?
- Can you show examples of work for businesses like ours in Kent?
For more, read what to look for in an IT security provider as a Kent business.
Want consultancy-level advice and round-the-clock protection without managing two providers? Book a discovery call and we’ll show you how BCS managed cyber security would work for your business.
Frequently asked questions
How much does a cyber security consultant cost in the UK? Consultants usually charge a day rate or a fixed fee per project. Managed cyber security is usually charged per user, per month and is predictable for growing small businesses that are looking to mature their IT.
Is managed cyber security worth it for a small business? For most businesses without in-house security staff, yes. It costs less than hiring a security specialist and provides cover around the clock.
Can I switch from a consultant to a managed service later? Yes. A consultant’s audit often becomes the starting point for a managed service, so nothing is wasted.