MDR Pricing: What Managed Detection and Response Costs
Ask three providers what managed detection and response costs and you get three numbers that cannot be compared, because none of them is priced on the same unit. The published figures that do exist are worth knowing, and so is who published them.
You send the same short brief to three providers. Two hundred laptops, forty servers, Microsoft 365, one AWS account, no security staff of our own, we need someone watching at night. Three proposals come back. One is priced per endpoint, one is priced per user, one is a flat monthly fee with a data ceiling attached to it. The annual totals are within thirty percent of each other and not one of them is measuring the same thing, because the first quote counts a server as an endpoint, the second counts a person who owns three devices once, and the third stops ingesting logs when you cross a limit that nobody read out loud.
That is what buying managed detection and response is actually like. The service is expensive enough to need a business case and opaque enough that the business case cannot be built from the quotes alone. What follows names every published figure and who published it, with the date it was read, and where nothing is published it says what moves the price instead of inventing a number.
How Much Does Managed Detection and Response Cost?
The honest answer is that nobody knows the market price, including the people selling it, because there is no market price to know. MDR is quoted, not listed. Every provider prices against what it can see of your environment, what it thinks a competitor bid, and how badly it wants the logo, and none of those inputs appears on a rate card.
What does exist is a set of ranges that several publishers have put in writing. The security vendor Expel states on its pricing explainer that MDR typically costs $10 to $30 per device per month, which it translates to $50,000 to $300,000 or more annually depending on environment size and coverage scope. The managed services firm BCS365 gives the same $10 to $30 per asset each month as the wider market average. UnderDefense, which sells MDR, publishes $10 to $30 per asset as the typical monthly cost and $11 per device per month as the entry price for its own service.
Three publishers, one range. Treat it as the shape of the conversation you are about to have rather than as a price you can hold a provider to, for a reason set out under where those ranges come from. The number that decides your budget is the one your own environment produces, and it is not a per-endpoint rate at all.
What MDR Vendors Actually Publish
This is the part the buyer's guides skip. Instead of quoting a market range, open the vendors' own price lists and see where the publishing stops.
CrowdStrike runs a public store. On September 9, 2026, its pricing page listed Falcon Go at $7.99 per device billed monthly, Falcon Pro at $14.99 and Falcon Enterprise at $19.99, each with an add-to-cart button next to it. The next tier along that same page is Falcon Complete Next-Gen MDR, described as 24/7 expert-led managed detection and response. It carries no number. It carries "Contact sales".
Microsoft does the same thing at a different scale. Its Defender for Business page lists $3.00 per user per month, paid yearly, and Microsoft 365 Business Premium at $22.00. Its Defender Experts for XDR page, which is Microsoft's own managed detection service, contains no dollar figure anywhere on it.
The pattern tells you something practical about what you are buying. Software has a marginal cost near zero, so a vendor can put a price on a page and let the market sort itself out. A managed service has analysts in it, and the hours a given customer consumes depend on how noisy that customer's environment is. That is genuinely unknowable before onboarding, which is the defensible reason for quoting rather than listing. It is also extremely convenient, which is the less defensible one.
Those published tooling prices are still useful, because they set a floor. Two hundred devices on Falcon Enterprise at the published $19.99 is $47,976 a year for the endpoint agent alone, before a single person is paid to look at what it produces. Any MDR quote below that number for the same estate is either using cheaper tooling, counting fewer assets, or doing less watching than you think.
The MDR Price Ranges in Circulation, and Where They Come From
Go looking for what MDR costs and the same range comes back page after page: $10 to $30 per asset per month. It is worth being precise about what that agreement is evidence of.
Expel attributes its tier breakdown to "industry research" without naming the research. BCS365 gives the range as a market average with no citation, and separately mentions entry-level options starting at $11 per device per month, which is the same figure UnderDefense publishes for its own service. None of the three names a survey, a sample size, a date range or a set of contracts the number was drawn from.
The practical consequence: if a provider quotes above the range, "that is more than the published figure" is not an argument, because the figure carries no authority. What works is a normalized comparison against a second quote for your own environment, which is the only pricing evidence that exists in a market this private.
MDR Pricing Models Compared
Four structures cover almost every quote, plus hybrids of them. The structure matters more than the rate, because it decides who absorbs the cost when your environment changes.
| Model | The unit | Rewards you when | Costs you when |
|---|---|---|---|
| Per endpoint or per asset | Each monitored device, often including servers and cloud workloads | Your people carry several devices each, so users outnumber nothing | You run many servers, containers or short-lived cloud instances that all count |
| Per user | Each named person, whatever they carry | Everyone has a laptop, a phone and a desktop | Your estate is server-heavy or you have more machines than staff |
| Per ingested data volume | Gigabytes of logs per day | Your log sources are few and quiet | You add a firewall or a cloud audit trail and the bill moves without a decision being made |
| Flat rate or banded | A tier covering a range of assets | You are comfortably inside a band and growing slowly | You cross a band boundary by three devices |
Volume-based pricing is the one to watch hardest, because it makes your bill a function of an engineering decision. Someone turning on verbose logging on a log platform to debug an unrelated problem can move next month's invoice, and nobody in that chain thinks of themselves as spending money.
What Drives the Price of an MDR Contract
Ask two providers to price the same two hundred devices and the quotes can differ by a factor of three. The variables below account for nearly all of it, and every one of them is negotiable in a way the headline rate is not.
How many telemetry sources are connected. Endpoints only is one service. Endpoints plus identity, plus email, plus cloud control plane, plus network is a different service that happens to share a name. This is the single largest driver and the one most often left vague in a proposal.
What the provider is allowed to do without calling you. A service that isolates a host and disables an account at 3am costs more than one that sends an email and waits, because it carries risk and requires a more senior analyst on shift. Both get described as response.
How long log data is retained. Ninety days of hot searchable data is a different storage bill from thirteen months, and compliance obligations often set the answer for you.
The service level commitments. Time to acknowledge, investigate and contain, as numbers with consequences attached, cost more than the same words as aspirations.
The reason the inner layers matter is that everything outside them can be bought without a provider. Tooling is purchasable. Ingestion is purchasable. What you cannot buy off a price list is a person who has seen this pattern before, is awake at 3am, and is contractually permitted to end the session. That is the product, and it is why the price is quoted rather than listed.
What the Per-Endpoint Price Does Not Include
The per-endpoint rate is the part of the contract that gets negotiated and often the smaller part of what leaves the bank account. These are the lines that arrive later.
Onboarding and implementation. Some providers absorb it, some charge a one-time fee, and some charge nothing but take three months to connect your sources, during which you pay full rate for a service that is not yet watching.
Connector and integration fees. The cloud audit trail, the identity provider, the email gateway and the firewall may each be an add-on rather than part of the base.
Retention beyond the included window. Priced per gigabyte per month and easy to underestimate, because log volume grows with headcount and with every new tool.
Incident response hours. Most MDR contracts include triage and containment and stop there. Forensics, legal support, negotiation and recovery are separate, and buying them mid-incident is the most expensive way to buy them, which is what an incident response retainer exists to price in advance.
The renewal uplift. Year-one discounts are common and are not always described as discounts. Ask for the year-two and year-three rates in the same document, or you are comparing quotes on one third of their term.
- Year-one subscription, often billed annually in advance. Any one-time onboarding fee lands here too
- Onboarding. Endpoints deploy quickly; identity, cloud and email connectors are the slow ones. You are paying full rate throughout
- Tuning. Alert volume is at its highest and your own people spend real hours on escalations that later disappear
- Steady state. Retention overage, added connectors and asset growth show up as variable lines on top of the subscription
- First renewal. The year-one rate expires and any uplift applies. This is the moment a quote you never asked about becomes your budget
- Exit or renew. Log export, detection content ownership and the cost of running two providers in parallel during a migration
How to Compare Two MDR Quotes
The comparison that works is not rate against rate. It is fully loaded cost across the whole term, per asset you actually own, with both quotes forced onto the same asset count.
Take your own inventory, not the provider's estimate. Count workstations, servers, cloud workloads, identities and any device you would want isolated during an incident, and hold that number constant across both proposals. Then rebuild each quote against it: subscription for all three years including any uplift, plus onboarding, plus every connector, plus retention at the volume you actually generate, plus the response scope you would need in a real incident. Divide the three-year total by thirty-six and by your asset count. Now the two numbers mean the same thing, and the exercise usually reorders the quotes. It also exposes the proposal that looked cheap because it was covering less, which is a thing to discover before signing rather than during an incident.
MDR Cost vs an In-House SOC
The alternative to buying is building, and the constraint on building is not tooling. It is continuous coverage.
A year contains 8,760 hours. One analyst working forty hours a week, after vacation, public holidays, training and turnover, covers somewhere near 1,800 of them. Covering a single seat continuously therefore takes about five people, before anyone is sick, before a second pair of eyes on a night shift, and before a manager. The US Bureau of Labor Statistics puts the median annual wage for information security analysts at $129,180 as of May 2025, with employment projected to grow 21 percent from 2025 to 2035. Five analysts at that median is roughly $646,000 in salary alone, before employer taxes, benefits, recruitment, tooling and the management layer above them.
That arithmetic is the reason the category exists, and it is also incomplete. An in-house security operations center gives you context a provider cannot have and analysts who answer to you. A provider gives you a rota that already exists, exposure to attacks across its whole customer base, and a cost you can cancel. Companies that can afford the choice usually end up running both, with internal staff on daytime depth and a provider on nights, a trade worked through in hiring against outsourcing.
How Much Should a Small Business Budget for MDR?
Before budgeting for MDR, be sure it is the next purchase. For a company with no multi-factor authentication, unmanaged laptops and untested backups, MDR is monitoring for problems that cheaper controls would have prevented, and the money belongs further up the stack, an order set out in the guide to a small business security budget.
What the spend is actually against is the gap between intrusion and discovery. Mandiant's M-Trends 2026 report, drawn from more than 500,000 hours of frontline investigation, put the global median dwell time at 14 days in 2025, up from 11 the year before, and found 52 percent of intrusions were first detected internally, up from 43 percent. Just under half of intrusions are still found by somebody outside the organization. For context on the other side of that gap, IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99 million, a 12 percent rise and a record high.
Key takeaways
- There is no published market price for MDR. Providers quote privately, and the $10 to $30 per asset per month range that appears everywhere is published by Expel, BCS365 and UnderDefense without any of them naming a dataset behind it.
- What vendors do publish is the tier below MDR. On September 9, 2026 CrowdStrike listed Falcon Go, Pro and Enterprise at $7.99, $14.99 and $19.99 per device per month and Falcon Complete Next-Gen MDR at "Contact sales".
- The pricing model decides who absorbs change, so get the counting rule in writing before comparing rates. What counts as one billable unit varies enough to reverse which quote is cheaper.
- The largest driver of a quote is how many telemetry sources are connected, followed by what the provider may do without calling you.
- Compare fully loaded three-year cost per asset, not headline rate. Onboarding, connectors, retention overage, incident response scope and the renewal uplift all sit outside the rate.
- Building instead means covering 8,760 hours a year. At the BLS median wage of $129,180, a five-person rota is around $646,000 in salary before anything else.
Common questions
How much does MDR cost per endpoint?
No provider publishes a rate, so any figure you find is somebody's estimate. The ranges in circulation sit at $10 to $30 per asset per month and come from Expel, BCS365 and UnderDefense, none of which names a source for the number. Use it to sense-check a quote, never to argue one down.
Does any MDR vendor publish a price?
Not for the managed tier. CrowdStrike and Microsoft both publish per-device and per-user list prices for their security software and both switch to "contact sales" at the managed service. The stated reason is that analyst hours depend on how noisy a customer's environment turns out to be, which is genuinely unknowable before onboarding.
Why do two MDR quotes for the same number of endpoints differ so much?
Because they are rarely the same service. The gap is normally in how many telemetry sources are connected, whether identity and cloud are included, how long logs are retained, whether the provider may take containment action unprompted, and whether incident response is bundled or metered.
Does MDR pricing include incident response?
Triage and containment usually. Forensic investigation, legal support, ransom negotiation and recovery usually not. Read the scope line carefully, because the point where included work stops is the point where hourly rates start, and those hours get bought under pressure.
What is a typical minimum contract size for MDR?
Minimums are common and they are what makes MDR expensive for very small companies. Providers set a floor on billable units, so a company with thirty devices frequently pays for fifty. Ask for the floor as a number before comparing per-unit rates, since it can double an effective rate without changing the headline one.
Is MDR cheaper than building an in-house SOC?
For most companies below a few thousand staff, yes, and the reason is coverage rather than tooling. Continuous cover takes roughly five analysts per seat once vacation, holidays and turnover are counted, which is around $646,000 in salary at the BLS median before benefits, recruitment or software.
Does compliance make MDR more expensive?
Usually, through retention and reporting rather than through monitoring. A framework that requires twelve months of searchable logs, evidence packs for an auditor, or personnel screening on the provider's side moves the storage and service lines. Say which framework applies in the request for proposal so it is priced rather than discovered later.
Can I bring my own security tools to an MDR provider?
Often, and it changes the price in both directions. Providers that support your existing agent may drop the license portion and add an integration fee, while providers built around their own stack price the whole thing together. Ask what happens to your detections and data if you later switch tools, since that answer is where the lock-in lives.
How does MDR pricing compare with a broader managed security contract?
MDR is narrower and deeper. A broader managed security contract can include firewall management, patching and device administration, which MDR does not, while MDR concentrates on detection, investigation and response. Comparing the two on monthly cost alone tends to favor whichever has the fewer inclusions.
What is the most expensive mistake in an MDR contract?
Paying full rate through a long onboarding. A service that takes four months to connect identity, cloud and email is four months of subscription against partial coverage, and it rarely appears in the business case. Put a dated connection plan per source in the contract and tie the start of billing, or a credit, to it.
On this page
- How Much Does Managed Detection and Response Cost?
- What MDR Vendors Actually Publish
- The MDR Price Ranges in Circulation, and Where They Come From
- MDR Pricing Models Compared
- What Drives the Price of an MDR Contract
- What the Per-Endpoint Price Does Not Include
- How to Compare Two MDR Quotes
- MDR Cost vs an In-House SOC
- How Much Should a Small Business Budget for MDR?
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.