# Endpoint Security for Nonprofits: Where a Small Budget Goes Furthest > How charities and nonprofits should spend a small security budget: pick among products sold online by independent test evidence rather than price alone, cover staff and volunteer devices that reach donor data, and pay for managed response only when the organisation holds sensitive beneficiary records. Endpoint Index research (Industry guide). Published 2026-09-25, updated 2026-09-30, data as of 2026-10-02. Source: https://endpointindex.com/research/endpoint-security-nonprofits/ ## Executive summary **A small nonprofit should buy an endpoint product it can order online that has current independent lab results, and put the money it saves into multi-factor authentication and backups before it pays for managed response.** Price alone is the wrong filter. The cheapest self-serve product in this database is not always one that a lab has tested recently, and a product that blocks threats on its own saves the staff time a nonprofit does not have. 10 of the 17 products we cover (prices checked 2026-10-02) can be bought through an online store, and the cheapest of them costs $300.00 a year for 10 seats (Webroot Business Endpoint Protection). Compare the two tables below to see how close the tested options come to that figure. Managed response is worth its price for one kind of nonprofit: one that holds sensitive records about the people it serves, such as case files, health information or shelter addresses, and has nobody to answer an alert at night. ## Why buy online? A self-serve store means no minimum contract negotiation, a card payment, and an agent running the same afternoon. For an organisation with a part-time administrator and no IT budget line, that matters more than any feature. It also puts the price in writing before you buy, which makes a grant budget easier to write. Budget on the renewal price, though: Avast's checkout shows a first-year discount, and our tables use the higher renewal rate. ## Which self-serve products have the evidence? This table is limited to products sold through an online store, because those are the ones a nonprofit can buy without a sales process. It shows the latest result from each independent lab:
ProductAV-Test protectionAV-Comparatives protectionMITRE ATT&CK Evaluation
Bitdefender GravityZone Business Security6.0/6 2025-1299.8% 2026-H172.5% coverage 2024 Dated
ESET PROTECT Core6.0/6 2025-1298.8% 2026-H1Participated 2025
Microsoft Defender for Business6.0/6 2026-0898.8% 2026-H183.8% coverage 2024 Dated
Bitdefender GravityZone Business Security Premium6.0/6 2025-1299.8% 2026-H172.5% coverage 2024 Dated
Avast Ultimate Business Security6.0/6 2026-0899% 2026-H1No public result
Acronis Cyber Protect6.0/6 2026-06No public resultParticipated 2025
CrowdStrike Falcon GoNo public result98.5% 2026-H198.9% coverage 2025
Webroot Business Endpoint ProtectionNo public resultNo public resultNo public result
ThreatDown EliteNo public resultNo public resultParticipated 2024 Dated
ThreatDown AdvancedNo public resultNo public resultParticipated 2024 Dated
Latest published round per lab, as recorded on each product page. Results marked "Dated" are past the freshness window and score zero in the SMB Fit Score. MITRE does not rank or score vendors.
Read it against the cost table below. Webroot Business Endpoint Protection ($30.00 per endpoint per year), for example, has no public result from AV-Test, AV-Comparatives or MITRE, so its price buys protection nobody independent has measured. Microsoft Defender for Business and Bitdefender GravityZone Business Security both have recent AV-Test and AV-Comparatives rounds at low prices. ## Price at list, before any charity discount
ProductPer unit per month10 seats / yr25 seats / yr100 seats / yr
Webroot Business Endpoint Protection$2.50 /endpoint/mo$300.00$750.00$3,000.00
Microsoft Defender for Business$3.00 /user/mo$360.00$900.00$3,600.00
Bitdefender GravityZone Business Security$3.21 /endpoint/mo$384.99$854.99$3,064.99
ESET PROTECT Core$4.58 /endpoint/mo$549.00$1,167.50Via sales (online up to 99)
Avast Ultimate Business Security$4.73 /endpoint/mo$567.70$1,329.50$4,050.00
CrowdStrike Falcon Go$5.00 /endpoint/mo$599.90$1,499.75$5,999.00
ThreatDown Advanced$6.58 /endpoint/mo$790.00Via sales (online up to 20)Via sales (online up to 20)
Acronis Cyber Protect$7.08 /endpoint/mo$850.00$2,125.00$8,500.00
Bitdefender GravityZone Business Security Premium$7.33 /endpoint/mo$879.99$1,869.99$6,039.99
ThreatDown Elite$8.25 /endpoint/mo$990.00Via sales (online up to 20)Via sales (online up to 20)
Annual totals from each vendor's store or calculator at list price. "Quote only" means the vendor publishes no online price at that seat count; "Min N seats" means the vendor's smallest purchase is larger.
Some vendors offer charity or nonprofit pricing that they do not publish. Ask before buying, and compare the discounted figure with these list prices, or with the [price index](/research/smb-endpoint-security-price-index/) for a product this table leaves out, rather than with nothing. ## What should each organisation buy? **Volunteer-run group with a few laptops and no office.** Check minimum purchases first: ESET PROTECT Core sells from 5 seats and ThreatDown from 5, while Bitdefender GravityZone Business Security ($38.50 per endpoint per year) sells from 3 and Microsoft Defender for Business from 1. Put it on every laptop that signs into the donor database. **Charity of 10 to 40 staff on Microsoft 365.** Microsoft Defender for Business ($36.00 per user per year) is licensed per user and covers up to five devices per user, including phones ([Microsoft FAQ](https://learn.microsoft.com/en-us/defender-business/mdb-faq)). It adds EDR and a central console to the Microsoft tenant you already run. See [is Microsoft Defender for Business enough?](/research/is-microsoft-defender-for-business-enough/) for its limits. **Nonprofit holding sensitive beneficiary records.** Health, legal, immigration or domestic-abuse services hold data whose exposure harms people, not just the organisation. Here, pay for a product with 24/7 managed response; 3 products in this database include it, the cheapest published at $99.00 per seat per year (ThreatDown Elite). ThreatDown does not sign HIPAA Business Associate Agreements, so if you provide health services, check whether HIPAA applies before choosing it; the [medical and dental guide](/research/endpoint-security-medical-dental-practices-hipaa/) covers the BAA question. **Nonprofit that takes card donations in person.** The card terminal and any PC that can reach it fall under PCI DSS. Ask your card processor which devices it treats as in scope before you buy protection for them. ## Mistakes nonprofits make - **Using free or consumer antivirus on work laptops.** It has no central console, so nobody can see which devices are protected, and a consumer licence may cover personal use only. - **Choosing the cheapest row without checking the lab table.** A few dollars per seat is a small saving against untested protection. - **Paying for managed response before turning on MFA.** A stolen password bypasses endpoint protection entirely; MFA on email and the donor database comes first. - **Letting volunteers' own devices into the donor database** with no protection and no restriction on what they can reach. ## Frequently asked questions ### How much should a small charity spend on endpoint security? At list price, a 10-seat licence among self-serve products starts at $300.00 a year. Products with recent lab results may cost more per seat, so read the lab table before the price column. Ask vendors for nonprofit discounts, which are rarely published. ### Do volunteers' personal laptops need protection? If they sign into your donor database, email or file storage, yes, or you should limit what those devices can reach. Where you cannot install your product, restrict access instead. ### When is managed detection and response worth it for a nonprofit? When you hold sensitive records about the people you serve and nobody can respond to an alert out of hours. For an office holding donor contact details only, automatic blocking and a weekly report are usually enough. ### Is Microsoft Defender for Business a good choice for charities? For a charity already on Microsoft 365, yes: it adds EDR and central management with current lab results. It has no 24/7 team, so someone must read its alerts. ## Methodology and caveats The efficacy and cost tables are filtered to products recorded as purchasable through a vendor's online store. Prices are list prices; nonprofit discounts are not recorded because vendors rarely publish them. Every lab result, price and capability shown is drawn from our product records, where each value carries its own source link and check date. No regulation applies to nonprofits as such; sector rules such as HIPAA or PCI DSS apply when their triggers do. ## Sources 1. Microsoft Learn. [Defender for Business FAQ](https://learn.microsoft.com/en-us/defender-business/mdb-faq). 2. Endpoint Index. [SMB Fit Score methodology](/methodology/). 3. Endpoint Index product pages with vendor pricing and lab sources. Dataset last verified 2026-10-02.