2026 MDR pricing intel

How much does MDR actually cost?

Six vendors. Real prices. No sales calls required. Independent managed detection and response (MDR) pricing intelligence for buyers evaluating CrowdStrike Falcon Complete, Arctic Wolf, SentinelOne Wayfinder MDR, Sophos MDR, Huntress, and Expel.

Run cost calculator Compare 6 vendors

The cost question, answered

What does managed detection and response (MDR) cost?

Managed detection and response pricing runs $3 to $50 per endpoint per month, with most mid-market deals landing at $7-25. SMB-focused tools like Huntress sit at $3-9, mid-market services like Arctic Wolf, Sophos, and SentinelOne Wayfinder MDR run $7-25, and enterprise all-in-one offerings like CrowdStrike Falcon Complete reach $25-45. As an annual contract, budget roughly $4-30K for 100 endpoints, $42-150K for 500, and $96-300K for 1,000. Vendr transaction data puts the median Arctic Wolf deal at $79,740 per year.

The managed detection and response cost for your business turns on four things: endpoint count, the response SLA you commit to, how many data sources you monitor (endpoint, cloud, email, identity), and whether MDR is bundled or bought as an add-on layer. The per-vendor breakdown and a cost calculator are below.

See all six vendors Run the cost calculator

MDR tier advisor

Which MDR tier should you actually buy?

Buy lite when you need full-service and you'll get burned at the first incident. Buy enterprise when you need lite and you'll burn 4x the budget. Set five sliders, see the tier that fits.

Endpoints250 endpoints

Users200 users

Compliance burdenSOC 2 / ISO 27001

Internal security maturity1-2 generalists

Threat profileStandard SMB

Pricing spectrum

Where each vendor sits per endpoint per month

$0 .... $50/endpoint/month

Huntress

$3-9

SMB / MSP

Sophos MDR

$7-17

Channel-led

SentinelOne Wayfinder

$7-23

Add-on layer

Arctic Wolf

$8-25

Concierge model

Expel

$11-30

Tool-agnostic

CrowdStrike Falcon Complete

$25-45

Enterprise all-in-one

SMB band Mid-market band Enterprise band

Vendor briefing

6 MDR vendors compared

Side-by-side pricing, SLAs, minimums, and target customer for the major MDR providers. Click any vendor to see the full pricing breakdown with negotiation tips and buyer-reported deal sizes.

Vendor	Per endpoint / mo	SLA	Coverage	Minimum	Best for
CrowdStrike Falcon Complete	$25-45	1 hour	24x7x365	250+ endpoints	Enterprises 500+ that want CrowdStrike's analysts running their stack
Arctic Wolf MDR	$8-25	4 hours	24x7x365	100 users	Mid-market wanting a named Concierge Security Team
SentinelOne Wayfinder MDR	$7-23	4 hours	24x7x365	No hard minimum	Existing SentinelOne customers adding managed eyes (formerly Vigilance)
Sophos MDR	$7-17	30-min response target	24x7x365	Channel-based	Mid-market in the Sophos ecosystem or partner-led
Huntress Managed EDR	$3-9	Same-day	24x7 monitoring	50 seats	SMBs and MSPs needing strong baseline coverage on a budget
Expel	From $11.6K/yr	4 hours	24x7x365	Flexible	Organisations with existing EDR who want managed monitoring on top

how vendors charge

Pricing models you'll meet

Per-endpoint

CrowdStrike, Arctic Wolf, SentinelOne, Sophos, Huntress

Most common. Linear scale with volume break points at 100, 500, 1,000, 5,000 endpoints.

Per-user

Sophos (alternative tier), Arctic Wolf (entry)

Cheaper when one user runs many devices (laptop + phone + VM).

Flat fee / base tier

Expel ($11.6K/yr base), Arctic Wolf ($44K/yr entry)

Predictable budget. Less elastic on the way up.

Add-on layer

SentinelOne Wayfinder MDR

MDR sits on top of platform licence. Total cost roughly doubles a base EDR contract.

cost factors

What drives the price difference

Coverage hours. 24x7 is standard but business-hours-only tiers run 30-50% cheaper.
SLA speed. A 1-hour MTTR commitment carries a 30-70% premium over the 8-hour standard.
Data sources monitored. Adding cloud, email, identity, and network typically doubles the per-endpoint base.
IR retainer hours. Standard MDR includes triage; full forensic IR is $250-400/hr in 40-hour blocks.
Contract length. 3-year deals shave 15-30% versus annual.

Volume tiers

Typical discount thresholds

Buyer-reported figures across multiple MDR contracts. Numbers normalised to per-endpoint per-month equivalent.

Up to 100 endpoints

$15-22

per endpoint / month

List pricing, low leverage.

100-500 endpoints

$12-18

per endpoint / month

First volume break. 15-20% off list.

500-1,000 endpoints

$10-15

per endpoint / month

Larger break. 25-35% off list.

1,000+ endpoints

$8-14

per endpoint / month

Enterprise discounts up to 45% off list.

tool

Cost calculator

Inputs for endpoints, SLA, coverage. Output: low/mid/high annual range.

Open →

tool

ROI calculator

Risk-adjusted breach cost vs MDR spend. IBM 2025 data, Forrester 210% TEI baseline.

Open →

guide

MDR for small business

Affordable options under $50K/yr. Real vendor recommendations.

Open →

guide

MDR & cyber insurance

Premium discounts, insurer requirements, the 97.5% lower-claim-value stat.

Open →

Head to head

Vendor-vs-vendor comparisons

Side-by-side pricing, coverage, and a clear who-should-pick-which for the matchups buyers actually weigh. Same-estate cost tables and verified, dated figures.

compare

Huntress vs CrowdStrike

Budget SMB managed EDR against enterprise Falcon-native MDR. $3-9 vs $25-45 per endpoint.

Open →

compare

Huntress vs Arctic Wolf

Budget detection against the named Concierge Security Team model. Where the premium goes.

Open →

compare

Arctic Wolf vs CrowdStrike

Platform-agnostic Concierge team against Falcon-native managed MDR. Mid-market vs enterprise.

Open →

compare

Rapid7 vs Red Canary

Bundled-SIEM MDR against EDR-agnostic MDR. Consolidation vs running on the agent you own.

Open →

compare

Huntress vs Sophos MDR

The two SMB-mid leaders head to head. Same-estate cost tables, the contractual SLA and $1M warranty gap, and deployment fit.

Open →

compare

Sophos MDR Essentials vs Complete

The one decision that separates the tiers: who finishes the response. Contractual SLA, $1M warranty, per-seat cost.

Open →

vendor

Red Canary MDR pricing

EDR-agnostic MDR. Resource-based pricing, Vendr buyer median, runs on your existing agent.

Open →

vendor

Rapid7 MDR pricing

Managed Threat Complete. Per-asset price bundling the InsightIDR SIEM and InsightVM.

Open →

Adjacent buying decisions

If you're shopping MDR, you may also need

edrcost.com

EDR pricing

The software underneath MDR. Compare CrowdStrike, S1, Defender, Sophos.

xdrcost.com

XDR pricing

Broader telemetry version of EDR. Often what your MDR runs under the hood.

siemcostcalculator.com

SIEM pricing

Often replaced or complemented by MDR's analyst-led detection layer.

FAQ

Frequently asked questions

How much does MDR cost per endpoint per month in 2026?

Industry pricing falls between $3 and $50 per endpoint per month. SMB-focused tools like Huntress sit at $3-9. Mid-market MDR services like Arctic Wolf, Sophos, and SentinelOne Wayfinder MDR run $7-25. Enterprise all-in-one offerings like CrowdStrike Falcon Complete reach $25-45. The right number for your business depends on endpoint count, SLA tier, coverage scope, and whether you bundle or buy MDR as an add-on.

What does an MDR contract typically cost per year?

For 100 endpoints, expect $4,000 to $30,000 per year depending on vendor and tier. For 500 endpoints, the typical mid-market range is $42,000 to $150,000. For 1,000 endpoints, $96,000 to $300,000 is normal. Vendr transaction data shows the median Arctic Wolf deal is $79,740 per year.

Why do MDR vendors hide their pricing?

Three reasons: pricing is genuinely complex (it scales with endpoints, log volume, response SLA, and bundled tools), they want to qualify your budget before quoting, and discounts are large and negotiable so they don't want public anchors. Public list prices would also lock them into commitments their channel partners can't match.

Is MDR worth the cost compared to building an in-house SOC?

For most organisations under 5,000 endpoints, yes. A 24x7 in-house SOC needs at least 5-6 analysts plus a manager (roughly $700K-$900K/year in salary) plus tooling, training, and threat intel feeds. Year-one infrastructure investment is $1M-$2M. By contrast, MDR for 500 endpoints typically lands at $90K-$300K/year. See our full comparison at /mdr-vs-soc.

Does MDR replace EDR, or do I need both?

MDR includes EDR. The MDR provider deploys and manages an EDR agent (their own or one you already own). You don't pay for EDR separately when you buy MDR. The exception is Expel, which monitors your existing EDR rather than replacing it.

What hidden costs come with MDR beyond the per-endpoint price?

Onboarding fees ($5K-$25K one-time), log ingestion overages ($1-5/GB/day), incident response retainer hours ($250-$400/hour, typically sold in 40-hour blocks), annual price escalation clauses (3-7% built into most contracts), and coverage expansion to email, identity, and cloud workloads which can double the base price. See /hidden-costs for the full breakdown.

Disclaimer

MDRCost.com is an independent pricing guide. We are not affiliated with any MDR vendor. Pricing data is compiled from public sources, partner channels, Vendr transaction data, and verified buyer reports. Always request a direct quote for your environment.