How much is an MDR? MDR pricing models, examples and cost drivers

Managed detection and response (MDR) is usually priced per endpoint, user or identity per month. Published list prices for managed endpoint detection start below $10 per endpoint per month, while full-scope services covering cloud, identity and logs are quoted after scoping. Your total depends on asset count, coverage, response authority and the tools you already own.

Key takeaways

• MDR is a subscription. Most providers bill per endpoint, per user or per identity, with extra charges for log sources or SIEM data.
• Published list prices are rare. One example: Huntress lists managed EDR at an MSRP of $8.99 per endpoint per month.
• The service level matters more than the device count. Alert-only monitoring costs far less than 24/7 analysts who are allowed to isolate hosts and disable accounts.
• Reusing tools you already license (Microsoft Defender, CrowdStrike, a SIEM) usually lowers the MDR fee.
• A 24/7 in-house SOC needs roughly five analysts per seat just to cover every hour of the week, before tooling.
• Compare the annual MDR fee with the cost of an incident: IBM puts the 2026 global average breach at $4.99 million.

What is MDR?

MDR is a managed service in which an external security team monitors your environment around the clock, investigates alerts and responds to confirmed threats. You pay for people and process, not just software.

A typical MDR service combines four things:

• Telemetry: endpoint detection and response (EDR) agents, identity logs (for example Entra ID), cloud logs (AWS CloudTrail, Azure activity logs) and sometimes network sensors.
• Detection: rules, behavioural analytics and threat intelligence that turn raw events into alerts.
• Analysts: a security operations centre (SOC) that triages alerts, hunts for threats that rules miss and decides what is real.
• Response: containment actions such as isolating a laptop, killing a process, resetting credentials or blocking an IP, followed by a written incident report.

The difference between MDR and a monitoring-only service is the last point. If the provider only emails you an alert at 03:00, you are buying detection. If they contain the threat and then call you, you are buying response. If you need the analysts but want to run the tooling yourself, a SOC-as-a-service provider is the closer fit.

How is MDR priced?

MDR is priced as a recurring monthly or annual fee per protected unit. The unit varies by provider, so ask early which one a quote uses.

Many quotes mix these models. A common pattern is a per-endpoint fee for EDR coverage, a per-identity fee for identity threat detection and a per-source or per-GB fee for SIEM log monitoring.

What do MDR services cost? Published examples

Large MDR vendors rarely publish prices, so treat any single figure as a starting point. These list prices were published on vendor pages in October 2026:

• Huntress lists managed EDR at an MSRP of $8.99 per endpoint per month and managed identity threat detection (ITDR) at $4.80 per licensed identity per month. The page notes that the per-unit rate falls as volume rises.
• CrowdStrike publishes its Falcon endpoint licences at $59.99, $99.99 and $184.99 per device per year (Go, Pro and Enterprise). Its MDR bundle, Falcon Complete, is "contact sales" only.

The CrowdStrike numbers are a useful reminder that tool licences and the managed service are separate cost lines. If you already pay for EDR, a provider that runs your existing agents charges mainly for analysts and response.

A worked example: 300 endpoints and 50 cloud servers

Take a company with 300 laptops, 50 servers on AWS and Azure, and 320 Microsoft 365 users. At the Huntress list prices above, endpoint coverage alone would be 350 × $8.99 = about $3,150 per month, and identity coverage 320 × $4.80 = about $1,540 per month. That is roughly $4,700 per month before volume discounts, log monitoring or onboarding fees.

The point of the example is the structure, not the total. A quote from a different provider can be lower or higher, but it will almost always break down into the same lines: endpoints, identities, log sources, service tier and one-off onboarding.

What drives MDR cost up or down?

Five factors explain most of the difference between two MDR quotes for the same company.

1. Number and type of assets. Laptops are cheapest. Servers, cloud workloads, containers and operational technology (OT) need more tuning and cost more.
2. Coverage scope. Endpoint-only MDR is the entry point. Adding identity, email, cloud control planes and firewall logs raises the price and closes the gaps attackers use most.
3. Response authority. Ask whether analysts may isolate hosts and disable accounts without calling you first. Pre-approved containment costs more but shortens the time an attacker has.
4. Your existing stack. A vendor-agnostic provider that works with your current EDR and SIEM avoids double licensing. A provider that requires its own agent bundles the licence into the fee.
5. Compliance reporting. Organisations in scope of NIS2 must send an early warning within 24 hours of becoming aware of a significant incident and a fuller notification within 72 hours (NIS2 Directive, Article 23). If you want the provider to prepare that evidence, budget for it.

Onboarding is the hidden line. Deploying agents, connecting log sources and tuning detections for your environment usually takes a few weeks and is often billed once.

MDR vs building an in-house SOC

For most mid-sized companies, MDR costs less than a 24/7 in-house SOC because the provider shares analysts, tooling and threat intelligence across many customers.

The staffing maths is simple. A week has 168 hours. One analyst works about 40 of them, so a single seat staffed around the clock needs more than four full-time people, and closer to five once you add holidays, sick leave and training. Add a SOC lead, detection engineering and incident response skills, plus SIEM and SOAR licences.

Hiring is the second problem. ISC2 estimated a global shortage of 4.8 million cybersecurity professionals in its 2024 Cybersecurity Workforce Study, which makes night and weekend shifts hard to fill and keep filled.

A hybrid model is common too: an internal security lead owns policy and risk, and the MDR provider covers nights, weekends and first response.

Is MDR worth the money?

MDR is worth it when the yearly fee is small compared with the cost of one serious incident you would otherwise detect late. For most companies that comparison is not close.

IBM's Cost of a Data Breach Report 2026 puts the global average breach at $4.99 million. The same report found that organisations making extensive use of security AI and automation saved $1.93 million per breach compared with those using none. Faster detection and containment is exactly what MDR sells.

Build the business case on three numbers you can defend: the annual MDR quote, the internal staff time it replaces, and your own estimate of downtime cost per day for your most important systems.

Questions to ask before you sign

• What unit do you bill on, and what counts as an endpoint or identity?
• Which data sources are included: endpoint, identity, email, cloud, firewall?
• What can your analysts do without calling us, and what is your response time target?
• Can you use our existing EDR and SIEM licences?
• Where is our security data stored and processed (EU, India, US)?
• What does onboarding cost, and how long does it take?
• Do you provide incident reports in a format that supports NIS2 or GDPR notifications?

How Opsio helps

Opsio runs a 24/7 SOC and offers managed detection and response that works with the security tools you already use on-premises, in Microsoft 365, AWS and Azure. We price on your actual estate after a short scoping call, so you get one quote with endpoints, identities and log sources listed separately.

For Opus Bilprovning, which runs nearly 100 inspection stations and inspects around two million vehicles a year, Opsio provides 24/7 managed operations on AWS, including proactive monitoring and continuous security hardening. Read the Opus Bilprovning case. If you are comparing a full SOC model instead, see our SOC services and the related guide on what an MSSP costs.

Frequently asked questions

How much does MDR cost per month?

Expect a per-unit monthly fee. Published list prices start below $10 per endpoint per month for managed endpoint detection, for example Huntress at $8.99 MSRP. Broader services that add identity, cloud and log monitoring are usually quoted after scoping. At those list prices, a company with about 300 users and devices would pay a few thousand dollars a month.

Is MDR charged per endpoint or per user?

Both models are common. Per-endpoint pricing suits device-heavy estates, and per-user or per-identity pricing suits office staff with several devices. Many providers combine the two and add a per-source or per-GB fee for SIEM logs.

Is MDR cheaper than an in-house SOC?

For most small and mid-sized companies, yes. A single 24/7 analyst seat needs about five full-time staff to cover 168 hours a week, plus SIEM and SOAR licences. MDR spreads those costs across many customers.

What is the difference between MDR and MSSP pricing?

MSSP contracts often cover device management such as firewalls and VPNs, priced per device or as a retainer. MDR is focused on detection and response and is priced per endpoint, user or data volume. Some providers sell both.

How long does MDR onboarding take?

Standard deployments typically take a few weeks: installing or connecting agents, onboarding identity and cloud logs, and tuning detections. Large or highly regulated environments take longer.