2026 MDR pricing intel
How much does MDR actually cost?
Six vendors. Real prices. No sales calls required. Independent managed detection and response (MDR) pricing intelligence for buyers evaluating CrowdStrike Falcon Complete, Arctic Wolf, SentinelOne Wayfinder MDR, Sophos MDR, Huntress, and Expel.
The cost question, answered
What does managed detection and response (MDR) cost?
The two published MDR rates are $7.99 per endpoint per month (Huntress Managed EDR at 100 endpoints) and $10.00 per endpoint per month (Red Canary, from its $120 per endpoint per year AWS Marketplace listing). Everything else in this market is quoted individually. For budgeting against services that publish nothing, our own working band is $8 to $30 per endpoint per month, or roughly $4-30K a year for 100 endpoints, $42-150K for 500, and $96-300K for 1,000. Those brackets are our estimate and nobody's list price. The table below separates the MDR prices that are actually published from the ones that are not.
The managed detection and response cost for your business turns on four things: endpoint count, the response SLA you commit to, how many data sources you monitor (endpoint, cloud, email, identity), and whether MDR is bundled or bought as an add-on layer. The per-vendor breakdown and a cost calculator are below.
Published prices, checked 7 September 2026
Which MDR vendors publish their prices, and what those prices are
One MDR vendor in this comparison publishes a list price you can read without a sales call: Huntress Managed EDR at $7.99 per endpoint per month at 100 endpoints, rising to $8.99 at the 50-endpoint entry tier. Every other major MDR service quoted on this site is sold by quotation only. That is the honest state of the market, and it is why most published MDR "average prices" are estimates rather than list prices.
| Vendor | Publishes a list price? | What the vendor's own page states |
|---|---|---|
| Huntress | Yes | Managed EDR $7.99 per endpoint per month, Managed ITDR $3.60 per licensed identity, Managed SIEM $3.50 per data source, Managed ISPM $3.40 per licensed identity, Security Awareness Training $1.75 per learner. All shown at 100 units; the page states the per-unit rate falls as volume rises. |
| CrowdStrike | Partly | Self-service endpoint bundles carry published device prices: Falcon Go $7.99 per device per month (capped at 100 devices), Falcon Pro $14.99, Falcon Enterprise $19.99. Falcon Complete Next-Gen MDR, the actual managed service, is contact-sales with no published price. |
| Arctic Wolf | No | The Arctic Wolf pricing page carries no dollar rate. The only figures on it are security-operations warranty coverage amounts ($100K to $3M). Buyers are directed to request a demo. |
| Sophos MDR | No | The Sophos MDR product page shows no per-user or per-endpoint rate and no tier prices. It offers a "Get Pricing" contact route instead. |
Read that table before you read any per-endpoint range, including ours. Where a vendor publishes, you can hold them to the number. Where a vendor does not, every figure in circulation is an estimate assembled from buyer reports, and the only price that binds anyone is the one on your quote. Ask each vendor for the per-unit rate, the unit it is billed on, the minimum, and the term in writing.
Sources, all checked 7 September 2026: huntress.com/pricing · crowdstrike.com/en-us/pricing · arcticwolf.com/simple-soc-service-pricing · sophos.com/en-us/products/managed-detection-and-response
Which MDR tier should you actually buy?
Buy lite when you need full-service and you'll get burned at the first incident. Buy enterprise when you need lite and you'll burn 4x the budget. Set five sliders, see the tier that fits.
Pricing spectrum
What each vendor publishes per endpoint, and what it does not
$0 .... $50/endpoint/month
Two MDR services carry a published per-endpoint rate: Huntress Managed EDR at $7.99 per endpoint per month at 100 endpoints ($8.99 at the 50-endpoint entry tier), and Red Canary at $120 per endpoint per year on its AWS Marketplace listing, which is $10.00 per endpoint per month before its other billing dimensions. CrowdStrike publishes Falcon Enterprise at $19.99 per device per month but nothing for Falcon Complete, so $19.99 is drawn as a floor, not an estimate. Arctic Wolf, Sophos, SentinelOne Wayfinder and Expel publish no per-endpoint rate at all, and Expel does not bill by endpoint in the first place. We draw an empty track rather than invent a band. Sources: huntress.com/pricing, crowdstrike.com/en-us/pricing, and the Red Canary and Arctic Wolf AWS Marketplace listings, all checked 7 September 2026.
Vendor briefing
7 MDR vendors compared
Side-by-side pricing, SLAs, minimums, and target customer for the major MDR providers. The price column carries a figure only where the vendor publishes one, and says so plainly where it does not. Click any vendor for the full breakdown, the sources behind each figure, and negotiation guidance.
| Vendor | Per endpoint / mo | SLA | Coverage | Minimum | Best for |
|---|---|---|---|---|---|
| CrowdStrike Falcon Complete | Not published | 1 hour | 24x7x365 | 250+ endpoints | Enterprises 500+ that want CrowdStrike's analysts running their stack |
| Arctic Wolf MDR | $44K/yr to 100 users | 4 hours | 24x7x365 | 100 users | Mid-market wanting a named Concierge Security Team |
| SentinelOne Wayfinder MDR | Not published | 4 hours | 24x7x365 | No hard minimum | Existing SentinelOne customers adding managed eyes (formerly Vigilance) |
| Red Canary | $10.00 (published) | Custom | 24x7x365 | None stated | Teams that already own a strong EDR and want analysts on top of it |
| Sophos MDR | Not published | 30-min response target | 24x7x365 | Channel-based | Mid-market in the Sophos ecosystem or partner-led |
| Huntress Managed EDR | $7.99 (published) | Same-day | 24x7 monitoring | 50 seats | SMBs and MSPs needing strong baseline coverage on a budget |
| Expel | Not billed per endpoint | 4 hours | 24x7x365 | Flexible | Organisations with existing EDR who want managed monitoring on top |
how vendors charge
Pricing models you'll meet
Per-endpoint
CrowdStrike, Arctic Wolf, SentinelOne, Sophos, Huntress
Most common. Linear scale with volume break points at 100, 500, 1,000, 5,000 endpoints.
Per-user
Sophos (alternative tier), Arctic Wolf (entry)
Cheaper when one user runs many devices (laptop + phone + VM).
Flat fee / base tier
Arctic Wolf ($44K/yr for up to 100 users on AWS Marketplace), Expel (telemetry and integration driven)
Predictable budget. Less elastic on the way up.
Add-on layer
SentinelOne Wayfinder MDR
MDR sits on top of platform licence. Total cost roughly doubles a base EDR contract.
cost factors
What drives the price difference
- Coverage hours. 24x7 is the norm across every service here. Business-hours-only tiers cost less where they are offered at all.
- SLA speed. A contractual response commitment is one of the few things vendors will put in writing, and a tighter one costs more. Ask for the SLA and the remedy if it is missed.
- Data sources monitored. Endpoint, cloud, email, identity and network are usually metered separately. Red Canary is the clearest published example: separate annual rates per endpoint, user account, cloud resource and network unit.
- Incident response scope. Standard MDR usually includes triage and containment. Full forensic IR is normally a separate retainer, priced on request. Ask whether it is included and whether there is an hourly cap.
- Contract length. A real lever, but only Red Canary publishes what it saves (up to 50% at 24 months, up to 67% at 36). Elsewhere, ask for the 1-year and 3-year figures side by side.
We removed the percentages this panel used to carry (30-50% for business hours, a 30-70% SLA premium, $250-400 per hour for IR, 15-30% for a 3-year term). None was traceable to a vendor or a named reseller.
Volume tiers
The volume and term discounts vendors actually publish
This section used to show a four-tier per-endpoint discount ladder described as buyer-reported figures across multiple MDR contracts. We run no buyer survey, and those tiers could not be traced to a source, so they are gone. Below is every volume or term discount an MDR vendor states openly.
Huntress, by volume
$8.99 to $7.99
per endpoint / month
The published step from the 50-unit entry tier to 100 units. Huntress states the rate keeps falling above 100 but does not publish those tiers.
CrowdStrike, by billing
23% to 37%
annual vs monthly
Falcon Enterprise is $184.99 a year against $239.88 paid monthly; Falcon Go is $59.99 against $95.88. This applies to the self-service bundles, not Falcon Complete.
Red Canary, by term
Up to 67%
36-month contract
Its AWS Marketplace listing states savings of up to 50% at 24 months and up to 67% at 36 months against the 12-month rate.
Everyone else
Not published
no stated discount
Arctic Wolf offers 12, 24 and 36 month terms on AWS Marketplace but does not say what the longer ones save. Sophos, SentinelOne and Expel publish nothing.
Sources: huntress.com/pricing, crowdstrike.com/en-us/pricing, and the Red Canary and Arctic Wolf AWS Marketplace listings, all checked 7 September 2026. The CrowdStrike percentages are our arithmetic on the published monthly and annual prices.
tool
Cost calculator
Inputs for endpoints, SLA, coverage. Output: low/mid/high annual range.
Open →
tool
ROI calculator
Risk-adjusted breach cost vs MDR spend. IBM 2025 data, Forrester 210% TEI baseline.
Open →
guide
MDR for small business
Affordable options under $50K/yr. Real vendor recommendations.
Open →
guide
MDR & cyber insurance
Premium discounts, insurer requirements, the 97.5% lower-claim-value stat.
Open →
Head to head
Vendor-vs-vendor comparisons
Side-by-side pricing, coverage, and a clear who-should-pick-which for the matchups buyers actually weigh. Same-estate cost tables and verified, dated figures.
compare
Huntress vs CrowdStrike
Budget SMB managed EDR against enterprise Falcon-native MDR. One publishes a price, one does not.
Open →
compare
Huntress vs Arctic Wolf
Budget detection against the named Concierge Security Team model. Where the premium goes.
Open →
compare
Arctic Wolf vs CrowdStrike
Platform-agnostic Concierge team against Falcon-native managed MDR. Mid-market vs enterprise.
Open →
compare
Rapid7 vs Red Canary
Bundled-SIEM MDR against EDR-agnostic MDR. Consolidation vs running on the agent you own.
Open →
compare
Huntress vs Sophos MDR
The two SMB-mid leaders head to head. Same-estate cost tables, the contractual SLA and $1M warranty gap, and deployment fit.
Open →
compare
Sophos MDR Essentials vs Complete
The one decision that separates the tiers: who finishes the response. Contractual SLA, $1M warranty, per-seat cost.
Open →
Adjacent buying decisions
If you're shopping MDR, you may also need
FAQ
Frequently asked questions
How much does MDR cost per endpoint per month in 2026?
What does an MDR contract typically cost per year?
Which MDR vendors publish their prices?
What is the published price of MDR per endpoint per month?
Why do MDR vendors hide their pricing?
Is MDR worth the cost compared to building an in-house SOC?
Does MDR replace EDR, or do I need both?
What hidden costs come with MDR beyond the per-endpoint price?
Disclaimer
MDRCost.com is an independent pricing guide. We are not affiliated with any MDR vendor. Where a vendor publishes a price, we cite the vendor's own pricing page or marketplace listing with the date we checked it. Where a vendor does not publish, we say so and label the figure as channel-reported or as a third-party aggregate, naming the aggregator. We do not run our own buyer survey. Always request a direct quote for your environment.
You're using a tool we built.
Digital Signet builds custom software and AI automation for security teams. Dashboards, evidence collection, vendor integrations, workflow automation.
See what we build →