MDRCost.comSOC pricing intel

2026 MDR pricing intel

How much does MDR actually cost?

Six vendors. Real prices. No sales calls required. Independent pricing intelligence for buyers evaluating CrowdStrike Falcon Complete, Arctic Wolf, SentinelOne Vigilance, Sophos MDR, Huntress, and Expel.

Run cost calculatorCompare 6 vendors

Pricing spectrum

Where each vendor sits per endpoint per month

$0 .... $50/endpoint/month

Huntress
$3-9
SMB / MSP
Sophos MDR
$7-17
Channel-led
SentinelOne Vigilance
$7-23
Add-on layer
Arctic Wolf
$8-25
Concierge model
Expel
$11-30
Tool-agnostic
CrowdStrike Falcon Complete
$25-45
Enterprise all-in-one
SMB band Mid-market band Enterprise band

Vendor briefing

6 MDR vendors compared

Side-by-side pricing, SLAs, minimums, and target customer for the major MDR providers. Click any vendor to see the full pricing breakdown with negotiation tips and buyer-reported deal sizes.

VendorPer endpoint / moSLACoverageMinimumBest for
CrowdStrike Falcon Complete$25-451 hour24x7x365250+ endpointsEnterprises 500+ that want CrowdStrike's analysts running their stack
Arctic Wolf MDR$8-254 hours24x7x365100 usersMid-market wanting a named Concierge Security Team
SentinelOne Vigilance$7-234 hours24x7x365No hard minimumExisting SentinelOne customers adding managed eyes
Sophos MDR$7-178 hours (Essentials) / 1 hour (Complete)24x7x365Channel-basedMid-market in the Sophos ecosystem or partner-led
Huntress Managed EDR$3-9Same-day24x7 monitoring50 seatsSMBs and MSPs needing strong baseline coverage on a budget
ExpelFrom $11.6K/yr4 hours24x7x365FlexibleOrganisations with existing EDR who want managed monitoring on top

how vendors charge

Pricing models you'll meet

Per-endpoint

CrowdStrike, Arctic Wolf, SentinelOne, Sophos, Huntress

Most common. Linear scale with volume break points at 100, 500, 1,000, 5,000 endpoints.

Per-user

Sophos (alternative tier), Arctic Wolf (entry)

Cheaper when one user runs many devices (laptop + phone + VM).

Flat fee / base tier

Expel ($11.6K/yr base), Arctic Wolf ($44K/yr entry)

Predictable budget. Less elastic on the way up.

Add-on layer

SentinelOne Vigilance

MDR sits on top of platform licence. Total cost roughly doubles a base EDR contract.

cost factors

What drives the price difference

  • Coverage hours. 24x7 is standard but business-hours-only tiers run 30-50% cheaper.
  • SLA speed. A 1-hour MTTR commitment carries a 30-70% premium over the 8-hour standard.
  • Data sources monitored. Adding cloud, email, identity, and network typically doubles the per-endpoint base.
  • IR retainer hours. Standard MDR includes triage; full forensic IR is $250-400/hr in 40-hour blocks.
  • Contract length. 3-year deals shave 15-30% versus annual.

Volume tiers

Typical discount thresholds

Buyer-reported figures across multiple MDR contracts. Numbers normalised to per-endpoint per-month equivalent.

Up to 100 endpoints

$15-22

per endpoint / month

List pricing, low leverage.

100-500 endpoints

$12-18

per endpoint / month

First volume break. 15-20% off list.

500-1,000 endpoints

$10-15

per endpoint / month

Larger break. 25-35% off list.

1,000+ endpoints

$8-14

per endpoint / month

Enterprise discounts up to 45% off list.

tool

Cost calculator

Inputs for endpoints, SLA, coverage. Output: low/mid/high annual range.

Open →

tool

ROI calculator

Risk-adjusted breach cost vs MDR spend. Forrester 201% ROI baseline.

Open →

guide

MDR for small business

Affordable options under $50K/yr. Real vendor recommendations.

Open →

guide

MDR & cyber insurance

Premium discounts, insurer requirements, the 97.5% claim stat.

Open →

Adjacent buying decisions

If you're shopping MDR, you may also need

edrcost.com

EDR pricing

The software underneath MDR. Compare CrowdStrike, S1, Defender, Sophos.

xdrcost.com

XDR pricing

Broader telemetry version of EDR. Often what your MDR runs under the hood.

siemcostcalculator.com

SIEM pricing

Often replaced or complemented by MDR's analyst-led detection layer.

FAQ

Frequently asked questions

How much does MDR cost per endpoint per month in 2026?
Industry pricing falls between $3 and $50 per endpoint per month. SMB-focused tools like Huntress sit at $3-9. Mid-market MDR services like Arctic Wolf, Sophos, and SentinelOne Vigilance run $7-25. Enterprise all-in-one offerings like CrowdStrike Falcon Complete reach $25-45. The right number for your business depends on endpoint count, SLA tier, coverage scope, and whether you bundle or buy MDR as an add-on.
What does an MDR contract typically cost per year?
For 100 endpoints, expect $4,000 to $30,000 per year depending on vendor and tier. For 500 endpoints, the typical mid-market range is $42,000 to $150,000. For 1,000 endpoints, $96,000 to $300,000 is normal. Vendr transaction data shows the median Arctic Wolf deal is $96,340 per year across 17 verified purchases.
Why do MDR vendors hide their pricing?
Three reasons: pricing is genuinely complex (it scales with endpoints, log volume, response SLA, and bundled tools), they want to qualify your budget before quoting, and discounts are large and negotiable so they don't want public anchors. Public list prices would also lock them into commitments their channel partners can't match.
Is MDR worth the cost compared to building an in-house SOC?
For most organisations under 5,000 endpoints, yes. A 24x7 in-house SOC needs at least 5-6 analysts plus a manager (roughly $700K-$900K/year in salary) plus tooling, training, and threat intel feeds. Year-one infrastructure investment is $1M-$2M. By contrast, MDR for 500 endpoints typically lands at $90K-$300K/year. See our full comparison at /mdr-vs-soc.
Does MDR replace EDR, or do I need both?
MDR includes EDR. The MDR provider deploys and manages an EDR agent (their own or one you already own). You don't pay for EDR separately when you buy MDR. The exception is Expel, which monitors your existing EDR rather than replacing it.
What hidden costs come with MDR beyond the per-endpoint price?
Onboarding fees ($5K-$25K one-time), log ingestion overages ($1-5/GB/day), incident response retainer hours ($250-$400/hour, typically sold in 40-hour blocks), annual price escalation clauses (3-7% built into most contracts), and coverage expansion to email, identity, and cloud workloads which can double the base price. See /hidden-costs for the full breakdown.

Disclaimer

MDRCost.com is an independent pricing guide. We are not affiliated with any MDR vendor. Pricing data is compiled from public sources, partner channels, Vendr transaction data, and verified buyer reports. Always request a direct quote for your environment.