Why does one managed detection and response (MDR) quote come in at $8 per endpoint per month while another lands at $45 for what sounds like the same service? The gap isn’t random. It reflects what’s bundled, who does the work, and how much of your team’s burden the vendor truly absorbs. Understanding that structure turns a confusing sales conversation into a straightforward comparison.
What MDR Pricing Actually Covers
MDR is a subscription service, but it’s not one product. It’s a bundle of people, process, and technology delivered continuously. When a vendor quotes a price, they’re pricing several things at once:
- Human monitoring capacity. A 24/7 security operations center (SOC) costs real money to staff. Round-the-clock coverage in multiple time zones is the single biggest cost driver, which is why business-hours-only tiers exist and cost less.
- Detection tooling. Some vendors supply their own endpoint detection and response (EDR) agent; others plug into the EDR you already own. Supplying the tool usually means a higher per-endpoint rate but one fewer contract to manage.
- Response authority. A vendor that can isolate a host, kill a process, or revoke credentials on your behalf carries more operational risk than one that only sends alerts and waits for approval.
- Included incident response hours. Many contracts bundle a block of IR hours for major incidents. Generous blocks cost more upfront but can save six figures when ransomware hits.
- Compliance reporting. If you need evidence for auditors, insurers, or regulators, expect a line item for it.
The practical takeaway: two quotes are only comparable when you match scope line by line. A cheap quote that excludes 24/7 coverage and response actions isn’t cheaper — it’s a different service.
The Four Pricing Models You’ll See
MDR vendors generally sell in one of four ways, and each shifts risk differently.
| Model | How It’s Billed | Best For | Watch Out For |
|---|---|---|---|
| Per endpoint | Monthly fee per protected device | Organizations with clear device counts | Server vs. workstation rates often differ |
| Per user | Monthly fee per employee | Cloud-heavy, identity-centric environments | Contractors and shared accounts get murky |
| Flat annual retainer | Fixed yearly fee by scope | Mid-size firms wanting budget certainty | Overage charges when device counts grow |
| Tiered bundles | Escalating service levels | Teams that want a growth path | Tier boundaries can be gamed in the quote |
Per-endpoint pricing is the most common structure in the mid-market, but published list prices are rare because most vendors quote custom. That opacity is a feature, not an accident — it lets vendors price to perceived value rather than a fixed rate card.
What Drives the Price Up or Down
Several levers move an MDR quote more than others. Knowing them gives you negotiating room.
Coverage hours. Business-hours monitoring can cost meaningfully less than 24/7. But consider what “business hours” means when an attacker strikes at 2 a.m. on a Sunday. For most organizations, true 24/7 is the point of buying MDR at all.
Endpoint volume. Larger fleets usually earn lower per-endpoint rates, but the discount curve flattens. A 200-endpoint shop and a 2,000-endpoint shop may see very different unit economics.
Tooling ownership. If you already run a mature EDR platform, a vendor that integrates with it may charge less than one requiring a rip-and-replace. Conversely, if your current stack is thin, a fully managed tooling bundle can be worth the premium.
Response scope. Alert-only service is cheaper. Full response — where the vendor contains threats without waiting for your approval — costs more and is usually worth it. The gap between “we told you at 3 a.m.” and “we contained it at 3:05 a.m.” is the difference between an incident and a catastrophe.
Compliance and reporting depth. Regulated industries pay for audit-ready documentation. If you’re in healthcare, finance, or handling payment card data, budget for it.
Contract length. Multi-year terms typically bring discounts, but they also lock you in. A three-year deal at a 15% discount is a bad trade if the service underperforms in year one.
How to Compare Quotes Without Getting Fooled
Buyers routinely make the same mistakes. Here’s what actually works in practice.
- Demand a scope sheet, not a brochure. Ask each vendor to list exactly what’s monitored, who responds, how fast, and what’s excluded. Put the sheets side by side.
- Normalize to a per-endpoint, per-month figure. Even if a vendor quotes annually or per user, convert everything to one unit so the comparison is honest.
- Ask about the first 90 days. Onboarding effort varies wildly. A vendor that charges separately for deployment may look cheap on the subscription line and expensive overall.
- Test the escalation path. Ask what happens when the SOC finds a confirmed compromise at 2 a.m. on a holiday. Vague answers are a red flag.
- Check the exit terms. Data ownership, log retention after termination, and transition assistance should all be in writing.
A useful sanity check: if a quote seems dramatically below the market, something is missing — usually response authority, coverage hours, or both.
Where Analysts Fit In
Buyers often lean on analyst research to anchor expectations. Gartner publishes MDR market guidance and peer insights, and Forrester produces security services research that evaluates providers on capability and strategy. These are reasonable starting points for building a shortlist, though most full reports sit behind paywalls, so plan to work with what’s publicly visible.
For procurement and risk context, NIST’s cybersecurity framework offers a vendor-neutral way to describe what you expect the service to deliver, and CISA’s guidance on managed security services helps frame expectations for critical infrastructure and public-sector buyers. Neither publishes price data, but both help you write a requirement document that vendors must respond to specifically rather than generically.
It’s also worth reading how pricing transparency varies across the tech industry — the same dynamic shows up in Leonardo ai pricing plans and features explained, where tiered bundles obscure true unit costs in much the same way.
The Hidden Costs Nobody Quotes
Subscription price is only part of the total. Budget for these:
- Integration and deployment. Connecting your identity provider, cloud accounts, and existing tools takes engineering time — yours or theirs.
- Log ingestion overages. Some contracts cap data volume, then charge per gigabyte beyond it.
- Add-on modules. Threat hunting, dark web monitoring, and phishing simulation are frequently separate SKUs.
- Your own staff time. Even fully managed services need an internal owner who reviews reports and makes judgment calls.
- Insurance interplay. Some cyber insurers now ask whether you have MDR and may adjust premiums or coverage terms accordingly. Confirm with your broker rather than assuming a discount.
The pattern is consistent across service industries: the headline number is rarely the real number. The same holds for home and household insurance: coverage options explained, where exclusions matter more than the premium quoted.
A Realistic Budget Framework
Rather than chasing a single market rate, build a range based on scope. A useful approach:
- Define your minimum viable service: 24/7 monitoring, endpoint coverage, and response authority.
- Price that baseline with three vendors.
- Layer in optional modules one at a time and note each price delta.
- Compare the total three-year cost, including onboarding and any overage risk.
This method exposes which vendors charge for essentials versus extras. It also gives you leverage: when you can show a vendor exactly how their quote compares on a like-for-like basis, discount conversations get shorter.
For teams used to comparing complex purchases — the way buyers weigh BMW M3 lease deals or Mini Cooper lease deals by term and model — the discipline is familiar. Strip out the marketing, match the terms, and compare what’s actually included. (Cyber Threats and Advisories)
Common Mistakes That Cost Real Money
Buying on per-endpoint price alone. The cheapest unit rate often comes with the thinnest response scope. A $10 endpoint that only alerts may cost more in breach damage than a $35 endpoint that contains.
Skipping the trial or proof of value. Many vendors offer a limited pilot. Use it to test detection quality on your actual environment, not a demo tenant.
Ignoring the device count creep. Cloud workloads and contractor laptops multiply. Contracts priced per endpoint without a growth clause can spike at renewal.
Forgetting about coverage gaps. Ask specifically about cloud infrastructure, SaaS applications, and remote workers. Some MDR services are endpoint-only in practice despite broader marketing.
Not assigning an internal owner. MDR works best as a partnership. Without someone internally who reads the reports and acts on recommendations, the service becomes an expensive alert feed.
Negotiation Levers That Actually Work
Vendors expect negotiation, and a few levers consistently move the number:
- Commit to a longer term only after a successful pilot, and ask for the discount in writing before signing.
- Bundle endpoints and identity coverage in one agreement rather than buying separately.
- Ask for onboarding to be included rather than priced as a professional services line.
- Request a renewal cap so year-two increases are predictable.
- Get IR hours written into the base contract rather than purchased as an emergency add-on.
None of these are unusual requests. Vendors that refuse all of them are telling you something about how they’ll behave when a real incident lands.
Conclusion
Managed detection and response pricing isn’t a number you look up — it’s a number you construct through scope decisions. The per-endpoint rate is just the visible tip; coverage hours, response authority, tooling ownership, and included incident response hours do most of the work. Buyers who demand scope sheets, normalize every quote to a common unit, and compare three-year totals consistently make better decisions than those who chase the lowest headline rate. Treat the quote as the start of a requirements conversation, not the end of one, and the pricing picture becomes far clearer.
Frequently Asked Questions
How much does MDR typically cost per endpoint?
Published list prices are uncommon because most vendors quote custom, and rates vary widely with scope. A business-hours, alert-only service sits at the low end, while 24/7 coverage with full response authority and bundled incident response hours sits at the high end. Always compare quotes on identical scope before drawing conclusions.
Is per-user pricing better than per-endpoint pricing?
Neither is inherently better. Per-user pricing suits identity-centric, cloud-heavy environments where devices are fluid. Per-endpoint pricing suits organizations with stable, countable device fleets. What matters is that you understand which assets are covered and what happens when your count changes mid-contract.
What’s the difference between MDR and a traditional MSSP?
A managed security service provider typically monitors and alerts, often with broad coverage but limited response. MDR emphasizes detection plus active response — containment, isolation, and remediation guidance. The distinction matters for pricing because response authority carries more operational risk and more vendor cost. (Managed detection and response)
Does MDR replace an in-house security team?
No. MDR augments a team by handling continuous monitoring and first-line response, which is hard to staff internally at small and mid-size organizations. Someone internally still needs to own the relationship, review reports, and make business-level decisions during incidents.
Should I buy MDR from my EDR vendor or a separate provider?
Buying from your EDR vendor often means tighter integration and simpler contracting. A separate MDR provider may offer more flexibility if you want to keep your existing tooling or avoid single-vendor dependency. Evaluate detection quality on your own environment during a pilot rather than relying on either vendor’s claims.
What should I check before signing an MDR contract?
Confirm coverage hours, response authority, included incident response hours, log retention, data ownership after termination, renewal increase caps, and overage terms for device or data growth. Get the escalation path in writing, including what happens on nights, weekends, and holidays.
