MDR pricing in 2026
Public MDR pricing references by provider.
Provider pricing
Clean MDR prices
12| PROVIDER | PRICE REF | EVIDENCE | SCOPE | CONF. | MIN. |
|---|---|---|---|---|---|
 | $12-18/endpoint/mo | Buyer data | Per-endpoint | medium | Not published |
 | $8-15/endpoint/mo | Partner | Per-endpoint | medium | Not published |
 | $7-10/endpoint/mo | Per-endpoint | high | 20 | |
 | Buyer benchmark: $30-100/endpoint/yr | Buyer data | Per-endpoint | medium | Not published |
 | TrustRadius: from $11,640/yr | Third-party annual estimate | medium | Not published | |
 | From EUR 8.99/endpoint/mo | Vendor | Starting monthly price | medium | Not published |
 | MDR Core: $3-$20/user/mo | Vendor | Per-user | medium | Not published |
 | $13.99-16.99/endpoint/mo | Vendor | Per-endpoint | high | Not published |
 | Azure package: EUR 3,300/mo for 300 users | Marketplace | Marketplace package | medium | Not published |
 | EUR 7,999/mo for 2 months, up to 500 assets | Per-asset | high | Not published | |
 | $99/endpoint/yr | Per-endpoint | high | 5 | |
 | From $11/device/mo; annual MDR contract | Starting monthly price | medium | Not published |
$12-18/endpoint/mo
Not published
medium
Per-endpoint
$8-15/endpoint/mo
Not published
medium
Per-endpoint
Buyer benchmark: $30-100/endpoint/yr
Not published
medium
Per-endpoint
TrustRadius: from $11,640/yr
Not published
medium
Third-party annual estimate
From EUR 8.99/endpoint/mo
Not published
medium
Starting monthly price
MDR Core: $3-$20/user/mo
Not published
medium
Per-user
$13.99-16.99/endpoint/mo
Not published
high
Per-endpoint
Azure package: EUR 3,300/mo for 300 users
Not published
medium
Marketplace package
EUR 7,999/mo for 2 months, up to 500 assets
Not published
high
Per-asset
From $11/device/mo; annual MDR contract
Not published
medium
Starting monthly price
Weak or non-MDR prices
25| PROVIDER | PRICE REF | EVIDENCE | SCOPE | CONF. | MIN. |
|---|---|---|---|---|---|
 | XDR+SOC estimate: from ~$4,317/mo | Estimate | XDR+SOC listing | low | Not published |
 | Reseller 3-year SKU: ~$14.50/endpoint/yr | Reseller | Reseller SKU | low | 25 |
 | Est $15-25/endpoint/mo, 200+ endpoints | Estimate | Per-endpoint | low | 200 |
 | From GBP 4/user/mo (MDR Auto only) | Vendor | Entry tier only | medium | Not published |
 | Buyer benchmark: median $218,983/yr | Buyer data | Buyer annual spend | medium | Not published |
 | AppSource from GBP 6/user/mo; min spend unclear | Marketplace | Per-user | medium | Not published |
 | One-time deployment: from $25,000; MDR custom | Deployment only | high | Not published | |
 | Managed EDR estimate: ~$2.50-$3.50/endpoint/mo | Buyer data | EDR price reference | low | 50 |
 | Unverified MDR field estimate: $30K-$200K+/yr | Estimate | Third-party annual estimate | low | Not published |
 | Third-party starting estimate: ~$43,775/yr | Estimate | Third-party annual estimate | low | Not published |
 | Single reviewer: under $20/user/yr; unit unclear | Buyer data | MDR reference | low | Not published |
 | MSS example: $24K-$90K/yr; not MDR-only | Vendor | Not MDR-specific | low | Not published |
 | Mandiant software benchmark: ~$83K/yr; not Managed Defense | Estimate | Not MDR-specific | low | Not published |
 | MSP security bundle: $90-$275/user/mo; not Adlumin standalone | Estimate | Managed IT bundle | low | Not published |
 | SamurAI XDR SaaS: $3.33/endpoint/mo; MDR custom | Vendor | Non-MDR product | medium | Not published |
 | Cortex XDR Pro platform: ~$81/endpoint/yr; MDR extra | Estimate | Platform price only | low | Not published |
 | Est from ~$17/asset/mo, 500-asset min | Estimate | Per-asset | low | 500 |
 | Core rates, period unstated: $120/endpoint + $100/user + $250/cloud resource | Marketplace | Billing period unclear | medium | Not published |
 | Buyer benchmark: median $91,350/yr | Buyer data | Buyer annual spend | medium | Not published |
 | MDR add-on est $15-30+/endpoint/yr; platform extra | Estimate | Platform + MDR estimate | low | Not published |
 | GBP 80/user/mo | Marketplace | Limited listing | medium | Not published |
 | SMB Spain/Chile: EUR 3.99-8.99/user/mo + site fees | Vendor | Limited listing | medium | Not published |
 | $99K-$199K/package; billing period unstated | Vendor | Billing period unclear | medium | Not published |
 | Managed IT + security bundle: $135/user/mo | Vendor | Managed IT bundle | medium | Not published |
 | Base platform from $250/mo; MXDR pricing unpublished | Vendor | Platform base only | medium | Not published |
XDR+SOC estimate: from ~$4,317/mo
Not published
low
XDR+SOC listing
Reseller 3-year SKU: ~$14.50/endpoint/yr
25
low
Reseller SKU
Est $15-25/endpoint/mo, 200+ endpoints
200
low
Per-endpoint
From GBP 4/user/mo (MDR Auto only)
Not published
medium
Entry tier only
Buyer benchmark: median $218,983/yr
Not published
medium
Buyer annual spend
AppSource from GBP 6/user/mo; min spend unclear
Not published
medium
Per-user
One-time deployment: from $25,000; MDR custom
Not published
high
Deployment only
Managed EDR estimate: ~$2.50-$3.50/endpoint/mo
50
low
EDR price reference
Unverified MDR field estimate: $30K-$200K+/yr
Not published
low
Third-party annual estimate
Third-party starting estimate: ~$43,775/yr
Not published
low
Third-party annual estimate
Single reviewer: under $20/user/yr; unit unclear
Not published
low
MDR reference
MSS example: $24K-$90K/yr; not MDR-only
Not published
low
Not MDR-specific
Mandiant software benchmark: ~$83K/yr; not Managed Defense
Not published
low
Not MDR-specific
MSP security bundle: $90-$275/user/mo; not Adlumin standalone
Not published
low
Managed IT bundle
SamurAI XDR SaaS: $3.33/endpoint/mo; MDR custom
Not published
medium
Non-MDR product
Cortex XDR Pro platform: ~$81/endpoint/yr; MDR extra
Not published
low
Platform price only
Est from ~$17/asset/mo, 500-asset min
500
low
Per-asset
Core rates, period unstated: $120/endpoint + $100/user + $250/cloud resource
Not published
medium
Billing period unclear
Buyer benchmark: median $91,350/yr
Not published
medium
Buyer annual spend
MDR add-on est $15-30+/endpoint/yr; platform extra
Not published
low
Platform + MDR estimate
GBP 80/user/mo
Not published
medium
Limited listing
SMB Spain/Chile: EUR 3.99-8.99/user/mo + site fees
Not published
medium
Limited listing
$99K-$199K/package; billing period unstated
Not published
medium
Billing period unclear
Managed IT + security bundle: $135/user/mo
Not published
medium
Managed IT bundle
Base platform from $250/mo; MXDR pricing unpublished
Not published
medium
Platform base only
No public MDR price
85| PROVIDER | STATUS | MODEL | MINIMUM |
|---|---|---|---|
 | Custom quote | Custom-quoted | Not published |
 | Not published | Custom-quoted | Not published |
 | Not published | Per-endpoint | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Not published | Per-endpoint | Not published |
 | Custom quote | Per-endpoint | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Per-user | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Per-endpoint | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Not published | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Not published | Per-user | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Per-GB / Volume | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | 25 |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Per-endpoint | Not published |
 | Custom quote | Per-endpoint | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Not published | Per-endpoint | Not published |
 | Custom quote | Per-endpoint | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Not published | Per-endpoint | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Per-endpoint | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Per-user | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Per-GB / Volume | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Per-user | Not published |
 | Not published | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Per-user | Not published |
 | Custom quote | Custom-quoted | 251 |
 | Not published | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Not published | Custom-quoted | Not published |
 | Custom quote | Custom-quoted | Not published |
 | Custom quote | Per-endpoint | Not published |
Custom quote
Not published
Custom-quoted
Not published
Not published
Custom-quoted
Not published
Not published
Per-endpoint
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Not published
Not published
Per-endpoint
Custom quote
Not published
Per-endpoint
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Per-user
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Per-endpoint
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Not published
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Not published
Not published
Per-user
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Per-GB / Volume
Custom quote
Not published
Custom-quoted
Custom quote
25
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Per-endpoint
Custom quote
Not published
Per-endpoint
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Not published
Not published
Per-endpoint
Custom quote
Not published
Per-endpoint
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Not published
Not published
Per-endpoint
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Per-endpoint
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Per-user
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Per-GB / Volume
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Per-user
Not published
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Per-user
Custom quote
251
Custom-quoted
Not published
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Not published
Not published
Custom-quoted
Custom quote
Not published
Custom-quoted
Custom quote
Not published
Per-endpoint
Planning ranges
| SCENARIO | ANNUAL RANGE | SCOPE |
|---|---|---|
| 500 endpoints | $48K-$210K | Endpoint-only MDR at roughly $8-$35/endpoint/mo. |
| 500 endpoints + surfaces | $96K-$420K+ | Endpoint, cloud, identity, SaaS, network or IR scope added. |
| 10,000 endpoints | $400K-$1M+ | Enterprise benchmark; coverage scope and provider tier dominate. |
500 endpoints
$48K-$210K
Endpoint-only MDR at roughly $8-$35/endpoint/mo.
500 endpoints + surfaces
$96K-$420K+
Endpoint, cloud, identity, SaaS, network or IR scope added.
10,000 endpoints
$400K-$1M+
Enterprise benchmark; coverage scope and provider tier dominate.
Pricing units
| UNIT | USUALLY MEANS | WEAK POINT |
|---|---|---|
| Per-endpoint | Workstations, laptops and servers. | Cloud, identity and log ingestion may sit outside the base price. |
| Per-user | One licensed user, often with multiple devices. | Service accounts, contractors and shared mailboxes can change the count. |
| Per-GB / volume | Log ingestion, SIEM data or monitored telemetry. | Noisy telemetry and incidents can increase ingestion quickly. |
| Annual deal value | Buyer-reported or marketplace deal size. | Scope is often unclear, so it should not be compared like a list price. |
| Custom quote | Sales-scoped pricing. | The public page does not show the billing unit or included coverage. |
Per-endpoint
Workstations, laptops and servers.
Cloud, identity and log ingestion may sit outside the base price.
Per-user
One licensed user, often with multiple devices.
Service accounts, contractors and shared mailboxes can change the count.
Per-GB / volume
Log ingestion, SIEM data or monitored telemetry.
Noisy telemetry and incidents can increase ingestion quickly.
Annual deal value
Buyer-reported or marketplace deal size.
Scope is often unclear, so it should not be compared like a list price.
Custom quote
Sales-scoped pricing.
The public page does not show the billing unit or included coverage.
Price drivers
ENDPOINTS
Workstations, laptops, servers and VMs. Server-heavy environments can change the effective rate.
IDENTITY
Entra ID, Okta, Google Workspace, ITDR and user-risk monitoring may be separate modules.
CLOUD
AWS, Azure, GCP, containers and Kubernetes are often priced outside endpoint coverage.
LOG VOLUME
SIEM-backed MDR depends on daily GB, retention window, archive cost and overage pricing.
RESPONSE
Alert-only, guided response and active containment can sit in different tiers.
IR SCOPE
Emergency response, retainer hours and breach support may be excluded from the base service.
Cost estimator
Planning estimate only. It does not include MSP markup, one-time implementation fees, special contract terms, retention overages or incident-response retainers.
Quote checks
| CHECK | GET IN WRITING | WHY IT MATTERS |
|---|---|---|
| Growth pricing | Year-1, year-2 and year-3 cost at current size, 2x growth and 3x growth. | A good first-year price can hide expensive expansion bands. |
| Maximum bill | The maximum monthly charge during log spikes, incidents and temporary asset growth. | Volume pricing can turn an incident into a billing surprise. |
| Add-ons | Which identity, cloud, SaaS, SIEM, IR, retention and support items are excluded. | The base MDR quote may not include the coverage you assumed. |
| Right-sizing | Whether the bill drops after endpoint reductions, layoffs, divestitures or tool consolidation. | Some contracts only move upward during the term. |
| Exit costs | Data export, agent removal, final retention, archive access and early termination fees. | Switching providers can create last-month costs. |
Growth pricing
Year-1, year-2 and year-3 cost at current size, 2x growth and 3x growth.
A good first-year price can hide expensive expansion bands.
Maximum bill
The maximum monthly charge during log spikes, incidents and temporary asset growth.
Volume pricing can turn an incident into a billing surprise.
Add-ons
Which identity, cloud, SaaS, SIEM, IR, retention and support items are excluded.
The base MDR quote may not include the coverage you assumed.
Right-sizing
Whether the bill drops after endpoint reductions, layoffs, divestitures or tool consolidation.
Some contracts only move upward during the term.
Exit costs
Data export, agent removal, final retention, archive access and early termination fees.
Switching providers can create last-month costs.
Breach warranties
A breach warranty is a financial guarantee covering incident response costs if you’re breached while under the provider’s service.
| Provider | Max Coverage | Caveat |
|---|---|---|
| Arctic Wolf | $3,000,000 | Doubled from $1.5M to $3M in April 2025. Requires deploying Aurora Managed Endpoint Defense alongside a Security Operations Bundle. Covers ransomware costs, BEC costs, legal assessment, emergency response, litigation/settlement, and lost business income. |
| CrowdStrike | $2,000,000 | Warranty tiers: $1M standard, $2M for Falcon Complete + Identity. Must meet CrowdStrike deployment best practices. Covers response costs, not business losses. |
| Pondurance | $2,000,000 | Called the 'MDR Pondurance Assurance Program.' Covers up to $2M in DFIR services for qualifying breach incidents. Qualification criteria not publicly detailed. Free to MDR customers. |
| Bitdefender MDR | $1,000,000 | Cysurance Certification Warranty. MDR tier covers up to $100,000 for ransomware events only. MDR PLUS covers up to $1,000,000 for any security incident. Requires 1,000+ endpoints. Legacy tiers (Foundations, Premium, Enterprise) have no warranty coverage until contract renewal to current tiers. Announced November 2024. |
| Kroll | $1,000,000 | Included for qualifying Responder clients with endpoint protection. Covers ransomware, BEC, compliance failure, and business income loss. Not dependent on client size. Enrollment via account manager or onboarding. |
| Rapid7 | $1,000,000 | Only available with Managed Threat Complete Ultimate tier. Covers forensics, legal counsel, post-incident response, PR. Coverage based on environment size. Must maintain security best practices. |
| SonicWall SonicSentry MDR | $1,000,000 | SonicWall says qualifying customers using SonicSentry services, SonicWall firewall, Cloud Threat Analytics and in some cases Cloud Email Security can receive cyber warranty coverage. Eligibility and control requirements need contract review. |
| Sophos | $1,000,000 | MDR Complete only (not Essentials). Single-claim limitation: one total claim across all subscriptions. Ransomware payment coverage capped at $100,000 per incident within the $1M total. Read warranty terms carefully. |
| UnderDefense | $1,000,000 | Requires 3-year MDR contract. Covers ransomware attacks and business email compromises. Does not cover regulatory fines or compliance failures. Who underwrites the warranty (UnderDefense directly or a third-party insurer) is not publicly documented. |
| N-able | $500,000 | Included with Adlumin Protection Plus suite at no additional cost. Requires adherence to cybersecurity best practices. Specific qualification requirements not published. Separate $100K MSP Advanced Warranty available for MSPs covering ransomware and BEC. |
| Barracuda Networks | Available | Available through Cork partnership for MSPs using Barracuda's XDR full-stack offering. Covers costs for data recovery, business interruption, and incident response for ransomware and BEC incidents. Requires MSP channel participation. |
| Palo Alto Networks | Available | MSIAM 2.0 (Feb 2026) includes Breach Response Guarantee: up to 250 hours of Unit 42 IR services for complex incidents. Not available on base MDR tier. |
| SentinelOne | Available | $1M Breach Response Warranty ($1,000/endpoint affected, max $1M per 12 months). Covers Windows, Linux, macOS, cloud workloads. Requires proper deployment and configuration. Underwritten by third-party insurance. |
Doubled from $1.5M to $3M in April 2025. Requires deploying Aurora Managed Endpoint Defense alongside a Security Operations Bundle. Covers ransomware costs, BEC costs, legal assessment, emergency response, litigation/settlement, and lost business income.
Warranty tiers: $1M standard, $2M for Falcon Complete + Identity. Must meet CrowdStrike deployment best practices. Covers response costs, not business losses.
Called the 'MDR Pondurance Assurance Program.' Covers up to $2M in DFIR services for qualifying breach incidents. Qualification criteria not publicly detailed. Free to MDR customers.
Cysurance Certification Warranty. MDR tier covers up to $100,000 for ransomware events only. MDR PLUS covers up to $1,000,000 for any security incident. Requires 1,000+ endpoints. Legacy tiers (Foundations, Premium, Enterprise) have no warranty coverage until contract renewal to current tiers. Announced November 2024.
Included for qualifying Responder clients with endpoint protection. Covers ransomware, BEC, compliance failure, and business income loss. Not dependent on client size. Enrollment via account manager or onboarding.
Only available with Managed Threat Complete Ultimate tier. Covers forensics, legal counsel, post-incident response, PR. Coverage based on environment size. Must maintain security best practices.
SonicWall says qualifying customers using SonicSentry services, SonicWall firewall, Cloud Threat Analytics and in some cases Cloud Email Security can receive cyber warranty coverage. Eligibility and control requirements need contract review.
MDR Complete only (not Essentials). Single-claim limitation: one total claim across all subscriptions. Ransomware payment coverage capped at $100,000 per incident within the $1M total. Read warranty terms carefully.
Requires 3-year MDR contract. Covers ransomware attacks and business email compromises. Does not cover regulatory fines or compliance failures. Who underwrites the warranty (UnderDefense directly or a third-party insurer) is not publicly documented.
Included with Adlumin Protection Plus suite at no additional cost. Requires adherence to cybersecurity best practices. Specific qualification requirements not published. Separate $100K MSP Advanced Warranty available for MSPs covering ransomware and BEC.
Available through Cork partnership for MSPs using Barracuda's XDR full-stack offering. Covers costs for data recovery, business interruption, and incident response for ransomware and BEC incidents. Requires MSP channel participation.
MSIAM 2.0 (Feb 2026) includes Breach Response Guarantee: up to 250 hours of Unit 42 IR services for complex incidents. Not available on base MDR tier.
$1M Breach Response Warranty ($1,000/endpoint affected, max $1M per 12 months). Covers Windows, Linux, macOS, cloud workloads. Requires proper deployment and configuration. Underwritten by third-party insurance.
Most warranties require specific deployment configurations and only cover IR costs, not business losses or regulatory fines.