Pricing · 12 of 27 publish · checked 2026-11-08
What MDR costs
Every price the providers on this board publish themselves, as they word it. No estimates, no figures from procurement sites or forums.
12 of 27 MDR providers publish a price: 3 on their own site and 9 on a cloud-marketplace listing they sell themselves. The other 15 quote on request. Units differ (per endpoint, per user, per asset, or a fixed annual package), so compare like with like.
Prices on the providers’ own sites
As each provider words it, with the unit and any minimum it states.
| Provider and offer | Published price | Unit | Minimum | Source |
|---|---|---|---|---|
| Field EffectField Effect MDR | $5 to $25 per user per month, “typically”, depending on the solution, number of users and deployment | per user per month | — | fieldeffect.com |
| HuntressManaged EDR | $8.99 per endpoint per month | per endpoint per month, MSRP | Huntress-required minimum of 50 seats per product when buying direct or through a reseller; no Huntress-required minimum when buying through an MSP | huntress.com |
| HuntressManaged ITDR | $4.80 per licensed identity per month | per identity per month, MSRP | as above | huntress.com |
| HuntressManaged SIEM | $4.00 per data source per month | per log source per month, MSRP | as above | huntress.com |
| HuntressManaged ISPM | $4.00 per licensed identity per month | per identity per month, MSRP | as above | huntress.com |
| HuntressManaged SAT | $2.08 per learner per month | per learner per month, MSRP | as above | huntress.com |
| eSentireAtlas Professional | $17.00 per user per month (up to 100 users; $16.15 for 101–250) | per user per month, billed annually, minimum 10 users | 10 users | shop.esentire.com |
| eSentireAtlas Enhanced | $24.00 per user per month (up to 100 users; $22.80 for 101–250) | per user per month, billed annually, minimum 10 users | as above | shop.esentire.com |
| eSentireAtlas Elite | $28.00 per user per month (up to 100 users; $26.60 for 101–250) | per user per month, billed annually, minimum 10 users | as above | shop.esentire.com |
| eSentireLaunch & Optimization fee | $2,500 per package per year, whatever the user count | per package per year | as above | shop.esentire.com |
List prices on cloud marketplaces
Listings the provider sells itself on AWS, Azure or Google Cloud Marketplace. These are list prices for a defined package, not quotes; a private offer on the same marketplace can differ.
| Provider | Marketplace and product | List price | As listed | Term |
|---|---|---|---|---|
| Adlumin (N-able)sold by Adlumin | AWS MarketplaceCloud-Native MDR Platform plus Risk Management and Security Services | $15,575 | 12-month contract; dimension ‘Adlumin Premium SMB – Support for up to 100 endpoints and devices’: $15,575.00. Vendor refund policy: ‘No Refunds’.per 12-month contract, up to 100 endpoints and devices | 12 months |
| Arctic Wolfsold by Arctic Wolf | AWS MarketplaceArctic Wolf Managed Detection and Response (MDR) | $44,000 | MDR Basic, monitor up to 100 users: $44,000 for 12 months ($93,685.68 for 24 months, $140,528.52 for 36 months)per contract, up to 100 users | 12 months |
| Binary Defensesold by Binary Defense | AWS MarketplaceBDVision (managed EDR, an add-on to its MDR) | $136,842.11 | 5,000 endpoints: $136,842.11 for 36 monthsper contract, 5,000 endpoints | 36 months |
| BlueVoyantsold by BlueVoyant | AWS MarketplaceMDR for Splunk Enterprise | $73,872 | $73,872 for 12 months ($147,744 for 24, $221,616 for 36); the listing adds “Price will depend on scope”per contract | 12 months |
| Deepwatchsold by Deepwatch | AWS MarketplaceDeepwatch Managed Security Services | $245,198 | MDR (Deepwatch-provided Splunk licensing, 50 GB per day) $245,198.00; MEDR (up to 1001 endpoints, Deepwatch-provided EDR licensing) $98,369.00; VM Essential (up to 2500 IPs) $192,251.00; FW (up to 10 firewalls, BYOL Palo Alto, Check Point or Fortinet) $50,160.00; each per 12 months.MDR, 50 GB/day Splunk licensing included | 12 months |
| Expelsold by Expel | AWS MarketplaceExpel Managed Detection and Response (MDR) | $88,800 | Cloud infrastructure: By resources, Unit = 500, 1-year contract, paid upfront: $88,800.00 per 12 months. 24- and 36-month contract tabs also shown. No refunds.500 cloud-infrastructure resource units | 12 months |
| Rapid7sold by Rapid7 | AWS MarketplaceManaged Threat Complete Essential | $73,000 | Starting at 300 assets: $73,000 for 12 monthsper contract, from 300 assets | 12 months |
| Rapid7sold by Rapid7 | AWS MarketplaceManaged Threat Complete Advanced | $111,000 | Starting at 500 assets: $111,000 for 12 monthsper contract, from 500 assets | 12 months |
| Rapid7sold by Rapid7 | AWS MarketplaceManaged Threat Complete Ultimate | $175,000 | Starting at 500 assets: $175,000 for 12 monthsper contract, from 500 assets | 12 months |
| Red Canary (Zscaler)sold by Red Canary | AWS MarketplaceRed Canary Managed Detection and Response | $120 | 12-month contract: Endpoint $120.00 (overage $10.00/unit); Account $100.00 (overage $8.33/unit); Resource $250.00 (overage $20.83/unit); Network $20.00 (overage $1.66/unit). 24-month (‘save up to 50%’) and 36-month (‘save up to 67%’) tabs shown. No refunds.per endpoint | 12 months |
| Sophossold by Sophos | AWS MarketplaceSophos MDR - Endpoint (user workstations, with XDR tools) | $239.64 | $239.64 per unit for 12 months; the listing doesn’t define the unit or the MDR tierper unit | 12 months |
| Sophossold by Sophos | AWS MarketplaceCloud Workload MDR (server operating systems, with XDR tools) | $390.72 | $390.72 per unit for 12 months; the listing doesn’t define the unit or the MDR tierper unit | 12 months |
Listings sold by resellers are left out: they are the reseller’s price, not the provider’s. Checked November 8, 2026.
Need a number for your size?
Most providers quote on request. Tell us your endpoint count, the EDR you run and what you need covered; we reply by email with the providers that fit and what each publishes about price.
We only pass your details to a provider if you ask us to.
How MDR is priced
The units in the published prices above. The same provider can sell in different units on its own site and on a marketplace.
To compare two quotes, convert both to the same unit for the same scope: the number of endpoints and users covered, which data sources are watched (endpoint only, or identity, cloud and email too), how much incident response is included, and how long logs are kept. A low per-endpoint price that excludes identity alerts and incident response can cost more than a higher one that includes them.
Providers that quote on request
No dollar figure on their own sites or on marketplace listings they sell themselves, as of the check date.
Bitdefender, Blackpoint Cyber, Critical Start, CrowdStrike, Fortinet, Ontinue, Palo Alto Networks Unit 42, Secureworks (Sophos Taegis), SentinelOne, Trustwave (LevelBlue), Kroll, Mandiant (Google Cloud), Trend Micro, Microsoft, Todyl.
Free trials or free tiers stated: Huntress (Free trial: ‘the same fully featured version as our paid products, including 24/7 SOC support’; ‘no commitments necessary’); Blackpoint Cyber (Free trial with ‘Full platform access from day one’; ‘No credit card, no strings attached’); Trend Micro (30-day free trial of the TrendAI Vision One platform (not stated to include MDR)).
Questions
How much does MDR cost?
It depends on the unit the provider sells in, and most don't say. 12 of the 27 providers on this board publish a dollar figure, on their own site or on a cloud-marketplace listing they sell themselves; the other 15 quote on request. Every published figure is in the tables on this page, with its unit and source.
Why don’t MDR providers publish prices?
Most price by the number of endpoints, users or assets, by which data sources they watch, and by how much incident response is included, so a single list price would fit few buyers. The providers that do publish one say what the price is counted per, and for what size.
Are marketplace prices what you would actually pay?
They are the provider’s own list price for a defined package on that marketplace, which is real but not necessarily what a negotiated contract costs.
What is usually extra?
Incident response beyond containment, coverage for identity, cloud or email sources, log retention beyond a set period, and onboarding. Ask for each in writing before comparing quotes.
Sources for this page
- Field Effect: pricing — ‘Field Effect MDR pricing typically ranges from $5–$25 per user per month, depending on the chosen solution, volume of users, and deployment requirements.’ Prices through an MSP or reseller may vary.
- Huntress: pricing — Managed EDR $8.99/month per endpoint; Managed ITDR $4.80/month per licensed identity; Managed SIEM $4.00/month per source; Managed SAT $2.08/month per learner; Managed ISPM $4.00/month per licensed identity. ‘Pricing shown is MSRP. Your per-unit rate goes down as volume goes up.’
- eSentire: pricing — Atlas Professional $17.00, Atlas Enhanced $24.00, Atlas Elite $28.00 per user per month for up to 100 users (minimum 10); $16.15 / $22.80 / $26.60 for 101-250 users; billed annually; plus a Launch & Optimization fee of $2,500 per package per year regardless of user count. Add-ons per user per month: Network Detection & Response $6.00, AI Detection & Response $6.00, autonomous pen testing $2.75, phishing simulation and awareness training $1.00, extended log storage $1.00. Above 250 users: contact sales.
- Adlumin (N-able) on AWS Marketplace — 12-month contract; dimension ‘Adlumin Premium SMB – Support for up to 100 endpoints and devices’: $15,575.00. Vendor refund policy: ‘No Refunds’. (12 months), sold by Adlumin.
- Arctic Wolf on AWS Marketplace — MDR Basic, monitor up to 100 users: $44,000 for 12 months ($93,685.68 for 24 months, $140,528.52 for 36 months) (12 months), sold by Arctic Wolf.
- Binary Defense on AWS Marketplace — 5,000 endpoints: $136,842.11 for 36 months (36 months), sold by Binary Defense.
- BlueVoyant on AWS Marketplace — $73,872 for 12 months ($147,744 for 24, $221,616 for 36); the listing adds “Price will depend on scope” (12 months), sold by BlueVoyant.
- Deepwatch on AWS Marketplace — MDR (Deepwatch-provided Splunk licensing, 50 GB per day) $245,198.00; MEDR (up to 1001 endpoints, Deepwatch-provided EDR licensing) $98,369.00; VM Essential (up to 2500 IPs) $192,251.00; FW (up to 10 firewalls, BYOL Palo Alto, Check Point or Fortinet) $50,160.00; each per 12 months. (12 months), sold by Deepwatch.
- Expel on AWS Marketplace — Cloud infrastructure: By resources, Unit = 500, 1-year contract, paid upfront: $88,800.00 per 12 months. 24- and 36-month contract tabs also shown. No refunds. (12 months), sold by Expel.
- Rapid7 on AWS Marketplace — Starting at 300 assets: $73,000 for 12 months (12 months), sold by Rapid7.
- Rapid7 on AWS Marketplace — Starting at 500 assets: $111,000 for 12 months (12 months), sold by Rapid7.
- Rapid7 on AWS Marketplace — Starting at 500 assets: $175,000 for 12 months (12 months), sold by Rapid7.
- Red Canary (Zscaler) on AWS Marketplace — 12-month contract: Endpoint $120.00 (overage $10.00/unit); Account $100.00 (overage $8.33/unit); Resource $250.00 (overage $20.83/unit); Network $20.00 (overage $1.66/unit). 24-month (‘save up to 50%’) and 36-month (‘save up to 67%’) tabs shown. No refunds. (12 months), sold by Red Canary.
- Sophos on AWS Marketplace — $239.64 per unit for 12 months; the listing doesn’t define the unit or the MDR tier (12 months), sold by Sophos.
- Sophos on AWS Marketplace — $390.72 per unit for 12 months; the listing doesn’t define the unit or the MDR tier (12 months), sold by Sophos.
Each provider’s own sources are linked from its entry on the provider board. How providers are chosen and ordered, and how to correct an entry: methodology.
Cite this page
MDR Companies. “What MDR costs: every price the providers publish.” Updated November 8, 2026. https://mdrcompanies.com/pricing/