MDR Pricing Comparison
Only 9 of 57 providers publish pricing. The rest require a sales call. Here’s what we know about all of them.
9 of 57
Publish pricing
7
Free trials
19 offer POV
6
Breach warranty
$500K–$3M
3
Minimum seats
10–200 endpoints
What Does MDR Actually Cost?
For a 500-endpoint environment, endpoint-only MDR runs $48K–$210K per year ($8–$35 per endpoint per month). But endpoint-only is just the floor.
Add cloud workload monitoring, identity protection, SaaS coverage, and network detection, and total costs typically double: $96K–$420K+ per year. Some providers bundle everything into a single per-user price; others charge per-surface add-ons that stack up fast.
Per-user equivalence: Published per-user pricing across our directory ranges from $2–$200+/user/month. The low end is MDR as an add-on to an existing platform; the high end is all-inclusive coverage with identity, cloud, and SaaS monitoring built in.
Reality check: 14% of providers are custom-quoted, meaning you can’t comparison-shop without sitting through a sales call. That’s by design — it gives the vendor pricing power. Providers who publish pricing are making a transparency statement.
Pricing Models Explained
There is no standard MDR pricing model. Here’s how each works and what to watch for.
Per-endpoint
7 providersCharged per device (server, workstation, VM). Most transparent for endpoint-only deployments.
+ Predictable, easy to benchmark
− Costs spike when adding cloud/identity
− Some count servers at 2x
Per-user
6 providersCharged per person across all their devices. Common in the Microsoft ecosystem.
+ Predictable for multi-device orgs
+ Often bundles identity monitoring
− Expensive for server-heavy environments
Per-GB / Volume
1 providersCharged by data ingested or events processed. Costs spike during incidents.
+ Works for low-volume environments
− Unpredictable during attacks
− Punishes you for needing help
Custom-quoted
8 providersPrice determined after scoping your environment. Common for enterprise deals.
+ Tailored to your environment
− Makes comparison shopping harder
− Gives vendor pricing power
Ask every provider: “What is the maximum I could pay in a single month?” This one question surfaces data overage charges, burst pricing, and incident-related cost spikes that flat quotes hide.
Provider Pricing at a Glance
57 providers sorted alphabetically. “Not published” means the provider does not publicly disclose this information — that itself is a data point.
| Provider | Model | Published Price | Minimum | Trial / POV | Breach Warranty |
|---|---|---|---|---|---|
| Ackcent Cybersecurity | Not published | Not published | None | Neither | No |
| Alert Logic | Not published | Not published | None | Neither | No |
| Arctic Wolf | Per-user | From ~$20/user/mo | None | POV | $3,000,000 |
| Armor | Not published | Not published | None | Neither | No |
| Barracuda Networks | Per-endpoint | ~$14.50 | None | POV | No |
| Binary Defense | Custom-quoted | Not published | None | Neither | No |
| Bitdefender MDR | Not published | Not published | None | Neither | No |
| Blackpoint Cyber | Not published | Not published | None | Neither | No |
| Blumira | Not published | Not published | None | Neither | No |
| Check Point | Per-user | Custom pricing | None | POV | No |
| ConnectWise | Not published | Not published | None | Neither | No |
| Critical Start | Not published | Not published | None | Neither | No |
| CrowdStrike | Per-endpoint | $15-25/ep/mo | 200 seats | TrialPOV | $2,000,000 |
| Cybereason MDR | Not published | Not published | None | Neither | No |
| Cyderes | Not published | Not published | None | Neither | No |
| Cynet | Not published | Not published | None | Neither | No |
| Cyrebro | Custom-quoted | Not published | None | POV | No |
| Datashield (Lumifi) | Not published | Not published | None | Neither | No |
| Daylight Security | Per-user | $200/user/mo | None | POV | No |
| Deepwatch | Not published | Not published | None | Neither | No |
| eSentire | Custom-quoted | Not published | None | POV | No |
| ESET | Custom-quoted | Custom pricing | 25 seats | TrialPOV | No |
| Expel | Not published | Not published | None | Neither | No |
| Field Effect | Not published | Not published | None | Neither | No |
| Fortra | Custom-quoted | Not published | None | POV | No |
| glueckkanja | Custom-quoted | Not published | None | POV | No |
| GoSecure | Not published | Not published | None | Neither | No |
| Huntress | Not published | Not published | None | Neither | No |
| IronNet | Not published | Not published | None | Neither | No |
| Kroll | Custom-quoted | Not published | None | Neither | $1,000,000 |
| Kudelski Security | Not published | Not published | None | Neither | No |
| LMNTRIX | Not published | Not published | None | Neither | No |
| Mandiant | Not published | Not published | None | Neither | No |
| N-able | Per-user | $90 | None | TrialPOV | $500,000 |
| Nuspire (PDI Security & Network Solutions) | Not published | Not published | None | Neither | No |
| Ontinue | Per-endpoint | Not published | None | POV | No |
| Open Systems | Not published | Not published | None | Neither | No |
| Optiv | Per-endpoint | Not published | None | POV | No |
| Orange Cyberdefense | Not published | Not published | None | Neither | No |
| Palo Alto Networks | Not published | Not published | None | Neither | No |
| Proficio | Custom-quoted | Not published | None | POV | No |
| Rapid7 | Per-endpoint | From ~$17/asset/mo | None | TrialPOV | $1,000,000 |
| Red Canary | Not published | Not published | None | Neither | No |
| ReliaQuest | Per-endpoint | $172,500 | None | Neither | No |
| Secureworks | Not published | Not published | None | Neither | No |
| SentinelOne | Not published | Not published | None | Neither | No |
| SOC Prime | Not published | Not published | None | Neither | No |
| Sophos | Per-user | Custom pricing | 10 seats | TrialPOV | $1,000,000 |
| Sygnia | Not published | Not published | None | Neither | No |
| Tata Communications | Per-GB / Volume | Not published | None | POV | No |
| ThreatDown | Not published | Not published | None | Neither | No |
| ThreatLocker | Per-user | $2 | None | TrialPOV | No |
| Todyl | Not published | Not published | None | Neither | No |
| Truesec | Not published | Not published | None | Neither | No |
| Trustwave | Not published | Not published | None | Neither | No |
| Uptycs | Per-endpoint | $3/mo | None | TrialPOV | No |
| WithSecure | Not published | Not published | None | Neither | No |
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Per-user
From ~$20/user/mo
None
POV
$3,000,000
Not published
Not published
None
Neither
No
Per-endpoint
~$14.50
None
POV
No
Custom-quoted
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Per-user
Custom pricing
None
POV
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Per-endpoint
$15-25/ep/mo
200 seats
Trial / POV
$2,000,000
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Custom-quoted
Not published
None
POV
No
Not published
Not published
None
Neither
No
Per-user
$200/user/mo
None
POV
No
Not published
Not published
None
Neither
No
Custom-quoted
Not published
None
POV
No
Custom-quoted
Custom pricing
25 seats
Trial / POV
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Custom-quoted
Not published
None
POV
No
Custom-quoted
Not published
None
POV
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Custom-quoted
Not published
None
Neither
$1,000,000
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Per-user
$90
None
Trial / POV
$500,000
Not published
Not published
None
Neither
No
Per-endpoint
Not published
None
POV
No
Not published
Not published
None
Neither
No
Per-endpoint
Not published
None
POV
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Custom-quoted
Not published
None
POV
No
Per-endpoint
From ~$17/asset/mo
None
Trial / POV
$1,000,000
Not published
Not published
None
Neither
No
Per-endpoint
$172,500
None
Neither
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Per-user
Custom pricing
10 seats
Trial / POV
$1,000,000
Not published
Not published
None
Neither
No
Per-GB / Volume
Not published
None
POV
No
Not published
Not published
None
Neither
No
Per-user
$2
None
Trial / POV
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Not published
Not published
None
Neither
No
Per-endpoint
$3/mo
None
Trial / POV
No
Not published
Not published
None
Neither
No
Breach Warranty Comparison
6 of 57 providers offer a breach warranty — a financial guarantee covering costs if you’re breached under their protection.
| Provider | Max Coverage | Caveat |
|---|---|---|
| Arctic Wolf | $3,000,000 | Industry's largest warranty. Included at no additional cost with Arctic Wolf bundles. Requires Arctic Wolf Aurora endpoint security for full coverage. |
| CrowdStrike | $2,000,000 | Warranty tiers: $1M standard, $2M for Falcon Complete + Identity. Must meet CrowdStrike deployment best practices. Covers response costs, not business losses. |
| Kroll | $1,000,000 | Complimentary $1M Incident Protection warranty included for all Responder clients. Covers ransomware, BEC, compliance/regulatory failure, and business income loss. Not dependent on client size. |
| Rapid7 | $1,000,000 | Only available with Managed Threat Complete Ultimate tier. Coverage amount based on environment size. Must meet best-practice security requirements. |
| Sophos | $1,000,000 | Only available with MDR Complete tier (not Essentials). No warranty tiers, no minimum contract terms, no additional purchase requirements. Lasts full subscription duration. |
| N-able | $500,000 | Terms and conditions apply; coverage details available upon request |
Industry's largest warranty. Included at no additional cost with Arctic Wolf bundles. Requires Arctic Wolf Aurora endpoint security for full coverage.
Warranty tiers: $1M standard, $2M for Falcon Complete + Identity. Must meet CrowdStrike deployment best practices. Covers response costs, not business losses.
Complimentary $1M Incident Protection warranty included for all Responder clients. Covers ransomware, BEC, compliance/regulatory failure, and business income loss. Not dependent on client size.
Only available with Managed Threat Complete Ultimate tier. Coverage amount based on environment size. Must meet best-practice security requirements.
Only available with MDR Complete tier (not Essentials). No warranty tiers, no minimum contract terms, no additional purchase requirements. Lasts full subscription duration.
Terms and conditions apply; coverage details available upon request
Read the fine print: Most breach warranties require specific deployment configurations and cover incident response costs, not business losses or regulatory fines. Ask exactly what’s included and what voids the warranty.
How to Negotiate MDR Pricing
1. Get multi-year pricing with growth scenarios
Ask: “What do I pay in year 1, year 2, and year 3 if we grow from 500 to 1,000 endpoints?” Lock in year-3 rates upfront.
2. Negotiate a maximum bill cap
Especially critical for volume-based pricing. What’s the maximum you’ll ever pay in a single month, even during an active incident?
3. Request quarterly right-sizing
If you reduce endpoints (layoffs, divestitures, infrastructure consolidation), can you reduce your bill? Get it in writing.
4. Use the POV as leverage
19 of 57 providers offer a proof of value. Use results from competing POVs to negotiate pricing — providers know you’re comparing.
5. Ask for total cost of ownership
Not just the MDR line item. Include add-ons (cloud, identity, SaaS), growth projections, required technology changes, and any hidden escalators.
Next Steps
MDR Finder
Get matched to providers based on your stack, team size, and budget in 60 seconds.
Compare Providers
Side-by-side comparison of response types, coverage, and pricing.
Buyer’s Guide
The definitive vendor-neutral handbook for evaluating MDR providers.
20 Evaluation Questions
Print-ready list of questions to ask every provider on your shortlist.