Provider prices
All 130 providers · A–Z
ProviderPrice referenceSourceConf.MinWarranty
Module add-on ceilings $13.46-$46.84 per unit; Falcon Complete itself unpriced
medium250$2,000,000Billing period unclear
MSP security bundle: $90-$275/user/mo; not Adlumin standalone
Managed IT bundle
Estimate
Cortex XDR Pro platform: ~$81/endpoint/yr; MDR extra
Platform price only
Estimate
$61,975 for up to 500 endpoints ($21,875 XDR license + $40,100 Managed XDR service)
high——Billing period unclear
MDR add-on est $15-30+/endpoint/yr; platform extra
Platform + MDR estimate
Estimate
Reseller SKU
Reseller
Min: 25Warranty: Available
No public price
Not published
Min: —Warranty: $1,000,000
Billing period unclear
Confidence medium
Min: 250Warranty: $2,000,000
Buyer annual spend
Buyer data
Min: —Warranty: —
Annual deal value
Confidence medium
Min: —Warranty: —
Per-user
Marketplace
Min: —Warranty: —
Cloud resource
Confidence high
Min: —Warranty: —
Deployment only
Confidence high
Min: —Warranty: —
Billing period unclear
Confidence high
Min: —Warranty: —
EDR price reference
Buyer data
Min: 50Warranty: —
Billing period unclear
Confidence low
Min: —Warranty: —
Third-party annual estimate
Estimate
Min: —Warranty: $1,000,000
Third-party annual estimate
Estimate
Min: —Warranty: —
MDR reference
Buyer data
Min: —Warranty: —
Not MDR-specific
Vendor
Min: —Warranty: —
Not MDR-specific
Estimate
Min: —Warranty: —
Managed IT bundle
Estimate
Min: —Warranty: $500,000
Scoped by sales
Not published
Min: —Warranty: —
Non-MDR product
Vendor
Min: —Warranty: —
Marketplace package
Marketplace
Min: —Warranty: —
Platform price only
Estimate
Min: —Warranty: Available
Per-asset
Estimate
Min: 500Warranty: $1,000,000
Per-endpoint
Confidence high
Min: —Warranty: —
Billing period unclear
Confidence high
Min: —Warranty: —
Platform + MDR estimate
Estimate
Min: —Warranty: Available
Scoped by sales
Not published
Min: —Warranty: $1,000,000
Limited listing
Vendor
Min: —Warranty: —
Billing period unclear
Vendor
Min: —Warranty: —
Managed IT bundle
Vendor
Min: —Warranty: —
Platform base only
Vendor
Min: —Warranty: —
Starting monthly price
Confidence medium
Min: —Warranty: $1,000,000
Planning ranges
$48K-$210K
500 endpoints. Endpoint-only MDR at roughly $8-$35/endpoint/mo.
$96K-$420K+
500 endpoints + surfaces. Endpoint, cloud, identity, SaaS, network or IR scope added.
$400K-$1M+
10,000 endpoints. Enterprise benchmark; coverage scope and provider tier dominate.
Pricing units
Per-endpoint
Workstations, laptops and servers. Weak point: Cloud, identity and log ingestion may sit outside the base price.
Per-user
One licensed user, often with multiple devices. Weak point: Service accounts, contractors and shared mailboxes can change the count.
Per-GB / volume
Log ingestion, SIEM data or monitored telemetry. Weak point: Noisy telemetry and incidents can increase ingestion quickly.
Annual deal value
Buyer-reported or marketplace deal size. Weak point: Scope is often unclear, so it should not be compared like a list price.
Custom quote
Sales-scoped pricing. Weak point: The public page does not show the billing unit or included coverage.
Price drivers
Endpoints
Workstations, laptops, servers and VMs. Server-heavy environments can change the effective rate.
Identity
Entra ID, Okta, Google Workspace, ITDR and user-risk monitoring may be separate modules.
Cloud
AWS, Azure, GCP, containers and Kubernetes are often priced outside endpoint coverage.
Log volume
SIEM-backed MDR depends on daily GB, retention window, archive cost and overage pricing.
Response
Alert-only, guided response and active containment can sit in different tiers.
IR scope
Emergency response, retainer hours and breach support may be excluded from the base service.
Cost estimator
508505,000
LOW
$131K/yr
SMB-tier per-endpoint
MEDIAN
$294K/yr
Most representative tier
HIGH
$571K/yr
Enterprise full-stack
Planning estimate only. It does not include MSP markup, one-time implementation fees, special contract terms, retention overages or incident-response retainers.
Quote checks
- 01Growth pricing. Year-1, year-2 and year-3 cost at current size, 2x growth and 3x growth. A good first-year price can hide expensive expansion bands.
- 02Maximum bill. The maximum monthly charge during log spikes, incidents and temporary asset growth. Volume pricing can turn an incident into a billing surprise.
- 03Add-ons. Which identity, cloud, SaaS, SIEM, IR, retention and support items are excluded. The base MDR quote may not include the coverage you assumed.
- 04Right-sizing. Whether the bill drops after endpoint reductions, layoffs, divestitures or tool consolidation. Some contracts only move upward during the term.
- 05Exit costs. Data export, agent removal, final retention, archive access and early termination fees. Switching providers can create last-month costs.
Breach warranties
A breach warranty is a financial guarantee covering incident response costs if you’re breached while under the provider’s service.
Arctic Wolf$3,000,000Up to $3M requires a Security Operations Bundle plus Aurora Managed Endpoint Defense on a 3-year term; lesser configurations carry lower ceilings (a Core 3-year Bundle floor is reported around $100k). Doubled from $1.5M on 2025-04-28. Covers ransomware, BEC, compliance/legal assessment, cyber legal liability, and lost business income. The warranty terms (2025.05) route claims through a third-party administrator, Cysurance, which decides qualification in its sole discretion: 1 qualifying event per enrollment term, damages must plausibly exceed $5,000, a deductible applies, the event must be reported within 48 hours of Arctic Wolf's incident-response referral, and requested documentation supplied within 15 days. Eligibility requires patching within 60 days of release, MFA on email and critical systems, current antivirus, and working backups; systemic attacks and zero-day exploits causing widespread harm are excluded. It is a warranty, not insurance.
CrowdStrike$2,000,000Two tiers: up to $1M for EDR only, up to $2M with Identity Threat Protection, calculated at $2,000 per impacted covered endpoint. Covers ransomware only. Automatically included with an active Falcon Complete subscription, not purchasable or negotiable separately. Requires MFA on internet-facing services, supported OS, recommended security posture, and current or near-current sensor. Excludes pre-existing or ongoing incidents and jurisdictions where it would count as an insurance contract.
Pondurance$2,000,000Called the 'MDR Pondurance Assurance Program.' Covers up to $2M in DFIR services for qualifying breach incidents. Qualification criteria not publicly detailed. Free to MDR customers.
Bitdefender MDR$1,000,000Cysurance Certification Warranty. MDR tier covers up to $100,000 for ransomware events only. MDR PLUS covers up to $1,000,000 for any security incident. Requires 1,000+ endpoints. Legacy tiers (Foundations, Premium, Enterprise) have no warranty coverage until contract renewal to current tiers. Announced November 2024.
Kroll$1,000,000Included for qualifying Responder clients with endpoint protection. Covers ransomware, BEC, compliance failure, and business income loss. Not dependent on client size. Enrollment via account manager or onboarding.
Rapid7$1,000,000Only available with Managed Threat Complete Ultimate tier. Covers forensics, legal counsel, post-incident response, PR. Coverage based on environment size. Must maintain security best practices.
SonicWall SonicSentry MDR$1,000,000SonicWall says qualifying customers using SonicSentry services, SonicWall firewall, Cloud Threat Analytics and in some cases Cloud Email Security can receive cyber warranty coverage. Eligibility and control requirements need contract review.
Sophos$1,000,000MDR Complete only, not Essentials or MSP. $1M annual aggregate with a $1,000 per breached device sub-cap and a $100,000 ransomware payment cap. One total claim across all subscriptions. Requires a 12-month paid-up subscription, a 60-day waiting period, and $5,000 minimum out-of-pocket to file. Excludes virtual desktop environments and state-sponsored attacks.
UnderDefense$1,000,000Requires 3-year MDR contract. Covers ransomware attacks and business email compromises. Does not cover regulatory fines or compliance failures. Who underwrites the warranty (UnderDefense directly or a third-party insurer) is not publicly documented.
N-able$500,000Included with Adlumin Protection Plus suite at no additional cost. Requires adherence to cybersecurity best practices. Specific qualification requirements not published. Separate $100K MSP Advanced Warranty available for MSPs covering ransomware and BEC.
Barracuda NetworksAvailableAvailable through Cork partnership for MSPs using Barracuda's XDR full-stack offering. Covers costs for data recovery, business interruption, and incident response for ransomware and BEC incidents. Requires MSP channel participation.
Palo Alto NetworksAvailableMSIAM 2.0 (Feb 2026) includes Breach Response Guarantee: up to 250 hours of Unit 42 IR services for complex incidents. Not available on base MDR tier.
SentinelOneAvailable$1M Breach Response Warranty ($1,000/endpoint affected, max $1M per 12 months). Covers Windows, Linux, macOS, cloud workloads. Requires proper deployment and configuration. Underwritten by third-party insurance.
Most warranties require specific deployment configurations and only cover IR costs, not business losses or regulatory fines.