Register of Vendor Pricing · Compiled by Digital Signet · Revised 20 June 2026
Folio 001 · Register of SOC and MDR Pricing

SOC pricing for 2026.

A register of MDR and SOC-as-a-Service pricing for the buyer who has already taken the vendor call and now needs the document that lets them push back. Fourteen vendors, sourced bands, an RFP normaliser stapled to the front, a procurement annex at the back.

Direct answer

SOC pricing in 2026 sits in the band $5 to $35 per endpoint per month for outsourced MDR, depending on tier and 24x7 coverage. Huntress publishes at the low end of that band. Arctic Wolf, CrowdStrike Falcon Complete, eSentire, ReliaQuest and the other quote-only majors decline to publish a list price, but field-reported bands cluster in the same range. Build the apples-to-apples number for your environment with the RFP normaliser below.

Vendor
$/endpoint/mo bandSrc
Arctic Wolfper user / year$ 75 - 250[I]
Huntress Managed EDR/MDRper endpoint / month$ 7 - 12[I]
Expelper integration / month$ 4,000 - 12,000[I]
eSentireper endpoint / month$ 15 - 45[I]
Red Canaryper endpoint / month$ 7 - 18[I]
ReliaQuest GreyMatterper year / enterprise contract$ 250,000 - 1,500,000[I]
CrowdStrike Falcon Completeper endpoint / month$ 15 - 45[I]
SentinelOne Vigilance Respondper endpoint / month uplift on Singularity Complete$ 3 - 8[I]
Sophos MDRper endpoint / month$ 7 - 17[I]
Rapid7 MDRper asset / month all-in (MDR + InsightIDR)$ 9 - 28[I]
Field Effect Covalenceper endpoint / month all-in$ 6 - 14[I]
UnderDefense MAXIper endpoint / month (service-only, BYO-SIEM)$ 5 - 15[I]
Critical Insightper log source / month$ 200 - 600[I]
Secureworks Taegisper endpoint / month (Taegis ManagedXDR)$ 8 - 22[I]

All bands inferred from G2 deal data, channel-partner listings, and field reports verified 19 June 2026. See /ledger-notes for sourcing and the brass source-mark legend.

RFP Normaliser

Enter the parameters of an incoming quote. The normaliser returns an apples-to-apples $/endpoint/mo, an itemised annual total, and a band-check against the published ledger.

Inputs
Endpoints
Log volume (GB / day)
Log sources (count)
Coverage tier
24x7 coverage required
Compliance overlay
IR retainer (hrs / yr)
BYO-SIEM (no proprietary ingest)
Normalised output
Base service$ 8,000
Ingest (proprietary)$ 1,020
24x7 uplift$ 3,200
Compliance uplift$ 1,120
IR retainer (amortised /mo)$ 1,417
Onboarding amortised$ 625
Total / month$ 15,382
Total / year$ 184,580
Normalised $/endpoint/mo$ 30.76

Band check
Your quote sits WITHIN the published $/endpoint/mo ledger band of $ 5 to $ 35.

Math exposed line by line; no black box. Verified worked example also rendered statically on /annex/in-house-tco-model.

Hubs

Three spokes and an annex.

The register has three spokes (vendors, head-to-head compares, tier bands) and a procurement annex for the artifacts the buyer wishes their procurement team had handed them.

AnnexVendors14 vendor pricing entries, each with model, source URL, last verified date.AnnexCompare7 decision-aid head-to-heads (Arctic Wolf vs Expel, Huntress vs Arctic Wolf, etc).AnnexTiers$/endpoint bands for Tier-1, Tier-1+2, Tier-1+2+3, co-managed, fully outsourced, AI-SOC.AnnexAnnexRFP template, SLA matrix, hidden-costs note, compliance uplift rail, glossary.
Bookmark

Notes to the ledger.

Every band on this site is dated, sourced, and traceable. Vendors who do not publish a list price are shown as quote-only and their inferred band is dated to a sourcing note in notes to the ledger. The brass source-marks [V] [G] [I] [R] ride on the same row as every number; hover or click for the underlying URL.

Compiled by Oliver Wakefield-Smith. Last revised 20 June 2026. Next scheduled revision 20 July 2026.