MDRCost.comMDR pricing intel
Independent MDR-cost research, read by teams pricing their security stack.Sponsor this site →

Vendor briefing / Red Canary

Red Canary MDR pricing / 2026

The EDR-agnostic MDR that runs on the endpoint agent you already own. Its full rate card is public on AWS Marketplace, which makes Red Canary one of the few MDR services you can price before the first call. The rates, the multi-year discounts, the detection model, and where it fits versus Rapid7 and Arctic Wolf.

How much does Red Canary cost?

Red Canary is unusual in this market: its full rate card is public, just not on redcanary.com. The AWS Marketplace listing prices a 12-month contract at $120 per endpoint per year, plus $100 per user account, $250 per cloud resource and $20 per network unit, each metered independently. The same listing offers up to 50% off on a 24-month term and up to 67% off on 36 months, so a long commitment takes the endpoint rate towards $40 per year.

Contract termListed savingEndpoint rate that implies
12 monthsBaseline$120 / endpoint / yr
24 monthsUp to 50%About $60 at the full discount
36 monthsUp to 67%About $40 at the full discount

Source: Red Canary's AWS Marketplace MDR listing, checked 7 September 2026. The 12-month rates and the "up to" saving percentages are Red Canary's published figures; the third column is our arithmetic applying those percentages to the $120 baseline, and it is a ceiling on the discount rather than a rate anyone is promised. Red Canary publishes no rate card on redcanary.com, so a direct quote may differ from the marketplace listing.

Published rate, AWS Marketplace

$120

per endpoint per year, 12-month term

Red Canary's listed annual rate per endpoint, checked 7 September 2026, alongside $100 per user account, $250 per cloud resource and $20 per network unit. EDR-agnostic: runs on the endpoint agent you already own (Falcon, SentinelOne, Defender, Carbon Black, Cortex XDR). Each resource type is metered independently, so the endpoint rate alone will understate your bill.

Quick facts

Per endpoint (listed)$120/yr
Per user account (listed)$100/yr
Per cloud resource (listed)$250/yr
Per network unit (listed)$20/yr
TiersCore, Complete, Enterprise
ModelEDR-agnostic, resource-based
ContractAnnual, multi-year discounts
Coverage24x7x365

Pricing structure

Resource-based, not per-seat

Red Canary meters each kind of resource it protects separately rather than charging one blended per-seat fee. These are the listed annual rates on a 12-month term, taken from Red Canary's AWS Marketplace listing:

ResourceListed price / yearWhat it covers
Endpoint$120Workstation or server telemetry from your EDR agent.
User account$100Identity monitoring (Microsoft 365, Okta, Google).
Cloud resource$250Cloud workload and control-plane coverage.
Network coverage$20Network sensor and detection unit.

List rates, not your rate

Every figure in this table is Red Canary's own listed price on AWS Marketplace, checked 7 September 2026, and each dimension carries an overage charge if you exceed the units you bought ($10 per endpoint, $8.33 per account, $20.83 per cloud resource, $1.66 per network unit). What it does not tell you is what a negotiated direct contract looks like. For a broad sense of scale, Vendr reports a median Red Canary contract of $79,881 per year across anonymised deals it says it handled, on a range it gives as $26,980 to $154,687 (checked 7 September 2026). That is Vendr's aggregate rather than a Red Canary figure or ours, and we cite it as such.

The model

Why EDR-agnostic changes the cost equation

Most MDR providers bundle their own endpoint agent into the price. Red Canary does not. It ingests raw telemetry (process creation, network connections, file writes, registry changes) from EDR platforms you already run:

  • CrowdStrike Falcon. Monitor your existing Falcon estate without buying Falcon Complete.
  • SentinelOne. Analyst layer on top of your Singularity agents.
  • Microsoft Defender for Endpoint. The common pairing for Microsoft-first estates.
  • VMware Carbon Black and Palo Alto Cortex XDR. Both supported as telemetry sources.

The cost implication is real: if you already own a strong EDR licence, Red Canary lets you add a 24x7 analyst team without paying for a second endpoint agent. For organisations that have not yet bought EDR, the underlying agent licence is an additional line item on top of the Red Canary fee, which is the opposite trade from a vendor-native service like Falcon Complete.

What you get

The detection and response process

Red Canary's value is its detection engineering and triage quality rather than a proprietary agent. The operating model:

  • Automated triage first. Initial filtering removes the bulk of noise before a human looks at anything.
  • Analyst review with context. A SOC analyst enriches each detection with affected systems, threat context, and likely impact.
  • Only confirmed threats escalate. Red Canary cites a very high true-positive rate, which is the headline pitch against alert fatigue.
  • Actionable remediation. Escalations arrive with clear, specific response steps rather than raw alerts.

Fit profile

Who Red Canary suits and who should look elsewhere

Best fit: organisations that already own a strong EDR (Falcon, SentinelOne, Defender) and want a top-tier analyst layer without vendor lock-in, mid-market and enterprise teams that value detection-engineering depth, and buyers who want telemetry from multiple tools correlated in one place.

Poor fit: very small businesses on tight budgets (Huntress is materially cheaper at 50-250 seats), teams that have no EDR yet and want one bundled vendor (a vendor-native service or Rapid7 consolidates more), and buyers who need a named, relationship-led Concierge Security Team (Arctic Wolf is built around that).

Already running CrowdStrike or SentinelOne?

Red Canary can monitor your existing agents instead of replacing them. For the base EDR platform pricing underneath, see edrcost.com. If you want a single vendor for both platform and analysts, compare CrowdStrike Falcon Complete.

Tool

Cost calculator

Model your MDR spend.

Vendor

Rapid7 MDR pricing

The closest comparison.

Compare

Rapid7 vs Red Canary

Side-by-side breakdown.

FAQ

Red Canary MDR pricing questions

How much does Red Canary MDR cost in 2026?
Red Canary publishes a full rate card, but on AWS Marketplace rather than on its own website. On a 12-month contract the listed annual rates are $120 per endpoint, $100 per user account, $250 per cloud resource and $20 per network unit. The listing offers savings of up to 50% on a 24-month term and up to 67% on a 36-month term, which takes the endpoint rate down towards $40 per year at the longest commitment. Checked 7 September 2026.
How does Red Canary's resource-based pricing work?
Rather than a single per-seat fee, Red Canary prices by the resources it covers: endpoints, user identities, cloud resources, and network coverage are each metered separately. The AWS Marketplace listing prices them at $120 per endpoint, $100 per user account, $250 per cloud resource and $20 per network unit per year on a 12-month term, with an overage charge per unit if you exceed the count you bought. Endpoint usage is measured monthly, servers and workstations are counted separately, and true-ups are reviewed quarterly. Longer terms carry listed savings of up to 50% at 24 months and up to 67% at 36 months. Checked 7 September 2026.
Does Red Canary replace my EDR or work with it?
Red Canary is deliberately EDR-agnostic. It does not sell its own endpoint agent. Instead it ingests raw telemetry from EDR platforms you already run, including CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, VMware Carbon Black, and Palo Alto Cortex XDR. This is the core differentiator from vendor-native MDR like CrowdStrike Falcon Complete, which requires the Falcon platform underneath. If you already own a top-tier EDR licence, Red Canary adds the analyst layer without forcing a migration.
What are the Red Canary plan tiers?
Red Canary offers three tiers. Core targets small to medium businesses needing essential MDR. Complete suits larger enterprises needing comprehensive coverage across endpoints, cloud, and identity. Enterprise adds custom security recommendations and dedicated technical support. Higher tiers raise the per-resource rate and add advisory depth rather than changing the underlying metering model.
Red Canary vs Rapid7 MDR: which is cheaper?
They are priced differently, so the answer depends on your estate. Red Canary meters endpoints, users, and cloud resources separately and runs on top of your existing EDR. Rapid7 Managed Threat Complete prices per asset (buyer-reported roughly $15 to $22 per asset per month) and bundles its own InsightIDR SIEM and InsightVM vulnerability management. For an endpoint-heavy organisation that already owns a strong EDR, Red Canary can be leaner. For a team that wants SIEM and vulnerability management folded into one MDR contract, Rapid7 often consolidates more spend. See our Rapid7 vs Red Canary comparison for a side-by-side.

Disclaimer

MDRCost.com is an independent pricing guide. We are not affiliated with any MDR vendor. Where a vendor publishes a price, we cite the vendor's own pricing page or marketplace listing with the date we checked it. Where a vendor does not publish, we say so and label the figure as channel-reported or as a third-party aggregate, naming the aggregator. We do not run our own buyer survey. Always request a direct quote for your environment.