Per-Endpoint and Per-Identity: The Two Dominant Units

Per-endpoint dominates the SMB and lower mid-market because the unit is intuitive, easy to forecast, and aligns with the largest XDR vendors' commercial gravity (CrowdStrike, SentinelOne, Sophos). The pricing reflects real cost — the EDR sensor is the heaviest telemetry source and the largest analyst workload. It breaks down in three estates: heavy container/serverless (where ephemeral hosts churn faster than the licence model accommodates), VDI farms (where one image serves dozens of concurrent users), and OT/ICS networks (where "endpoint" is not a meaningful unit). For these, ask vendors for asset-based or seat-based variants.

Per-identity pricing has emerged in parallel because identity is the new perimeter — every credible 2024-2025 incident report makes the same point. T1078 Valid Accounts has displaced unpatched edge devices as the dominant initial-access vector for ransomware affiliates. Per-identity pricing models follow the threat: Identity Threat Detection and Response (ITDR or IDR) modules from Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, Silverfort, and SentinelOne Singularity Identity sit at $50-100 per identity per month for the premium tier.

The math gets uncomfortable on customers with high service-account ratios. We have seen Nordic banking customers with 40,000 identities, of which 28,000 are service principals or RPA bots — the standard per-identity quote priced as if each had a human at the keyboard. Negotiate service-account exemption explicitly; major vendors all have it but rarely volunteer it. Pair the identity-priced contract with Zero Trust architecture rollout so service-account scopes are tightly constrained and the IDR signal-to-noise stays high.

Per-Log-GB Pricing and the Sentinel Ingestion Trap

Microsoft Sentinel commits at $2-5/GB/day for analytics tier and ~$0.10/GB/month for archive tier — see our Azure Sentinel managed service for the operating model. Splunk Cloud commits per ingest with workload pricing options. Either way, ingestion volume is the lever that breaks budgets when you are not paying attention.

The four ingestion-cost levers worth knowing:

• Filter at source — drop verbose Windows event IDs (4658, 4663 high-volume modes) at the agent before they hit the SIEM. Keep DNS, but downsample HTTP access logs.
• Tier the data — Sentinel basic logs ($0.50/GB ingested, $0.005/GB-day stored) for forensic-only data; analytics logs for hunting and rules.
• Watch retention transitions — moving from 90-day hot to 1-year archive costs storage but cuts hot-tier ingest charges. Most customers leave money here.
• Cap with workspace daily quota — a hard daily ingestion cap stops a misconfigured firewall from generating $40K of overage in a long weekend.

Tiered Bundles and All-You-Can-Eat

Most major vendors now ship three-tier bundles. The structure rewards the top tier and starves the bottom. The bottom tier ("Essential" or equivalent) typically excludes proactive threat hunting, IDR, and active response authority — exactly the deliverables that distinguish MDR from MSSP. The middle tier is the sweet spot for most mid-market customers; the top tier ("Complete" or equivalent) adds vCISO services, premium IR retainer, and tabletop exercises.

The tier-jump trap: features get reorganised between tiers at renewal. A capability you bought in tier 2 last year may have moved to tier 3 this year, requiring an upgrade. Lock the feature inclusions in writing on signature, not just the tier name.

Above 10,000 endpoints or 25,000 identities, the unit-economics model becomes harder to justify than a flat-fee, all-you-can-eat MDR. Vendors offer enterprise agreements at $120K-$1M+/year that bundle everything into a single line item. The advantage is procurement simplicity and a consistent renewal target. The disadvantage is the true-up clause: most contracts include a 10-15% growth allowance, with overage pricing that resembles the per-unit list rate. Acquisitions and rapid growth blow these contracts open.

Real Customer Math: A 2,500-Endpoint Example

For a representative 2,500-endpoint, 4,000-user Nordic mid-market customer with 8 GB/day SIEM ingestion:

The MSSP option looks cheaper on paper and almost certainly costs more after the first incident. IBM's 2024 Cost of a Data Breach Report puts the average breach at $4.88M; the marginal $120K/year between MSSP and MDR is rounding error against a single contained ransomware event.

Contract Clauses That Move the Number

Six clauses to negotiate every time:

1. True-up cap — annual growth allowance and overage rate, with a hard ceiling.
2. Service-account exemption — explicit on identity-priced contracts.
3. Detection content portability — Sigma/KQL/SPL export at termination; rules you wrote belong to you.
4. Response authority — written authorisation for isolate-host, disable-account, revoke-token without per-incident approval.
5. SLA credits — concrete remedies for missed MTTA, MTTD, MTTR. Industry-standard 15-min MTTA, 1-hr MTTD on tier-1.
6. Tabletop and purple-team frequency — at least quarterly, with named ATT&CK techniques covered.

How Opsio Helps

Opsio's managed detection and response services price transparently across endpoint, identity, and SIEM ingestion components, with the contractual clauses above on the standard MSA. We also operate engagements as overlays on existing CrowdStrike, Microsoft Defender XDR, and SentinelOne deployments — customers keep the XDR licence relationship and gain 24x7 SOC operations on top. For Microsoft-centric estates we run the full stack via managed cloud security services, including Defender XDR, Sentinel, and Defender for Cloud as a single FinOps-tracked envelope.