A question like this is almost to vauge to answer, even with the small bit of data you have provided. You say very basic in your post, but then say HIPAA in another. To ballpark it (And I reiterate, this is a rough ballpark) it would be about $2500 a month just for the HIPAA compliance. That doesn't include the other ~$2500 a month for user support and service plan. Also based on the hardware you described there would be project work needed to get the environment up to date before we would officaially support the network. More on reddit.com

Here's your one year free credit monitoring. Did you even say thank you? More on reddit.com

I am the CISO for a SaaS business and happy to give you a bit of inside information. There are so many competing priorities in software development. Customer Bugs, Internal Bugs, New Features, Tech Debt and of course security fixes. Balancing this given a finite number of developers/ hours in a given release is no easy task. While it is easy to say "it's security put it above everything else" that is not how it works in most businesses. When a security issue is identified in our product it goes through an evaluation which spits out a severity, we then cross reference this against the Vulnerability Policy which outputs a fix timeline. The key here is that the business decided the timelines for each severity in advance. The evaluation includes looking at exploitability, knowledge factors, compensating controls, CIA impact (and a weighting against each of them), reputation impact, and of course legal and compliance. If you want to really understand this process in your organisation ask to sit in/ follow along with the triage process. It may help you get a better understanding of why the thing you think is a top priority is actually not. All of this is assuming you work for at least a semi decent organisation. More on reddit.com

If people keep paying these prices - why would they stop? This industry is filled to the brim with overpriced training, certificates, and credentialing bodies that are looking for every new way to grab peoples money. I used to love doing training and getting a shiny new badge every now and then but it's gotten to be too much. I've let every single cert I've had lapse now except the CISSP because it's the only one my company cares about me having. You know who has fantastic training for cheap? (I don't work for these companies I just appreciate affordable training) TCM Security HackTheBox Academy TryHackMe PortSwigger Antisyphon If we all stop buying this shit and stop giving these greedy organizations money - they will die off or adapt. No one should spend $7,000 to learn something you could learn for maybe a couple hundred. More on reddit.com