Folio 002 · Vendor Register

MDR pricing comparison: 14 vendors.

One ledger entry per vendor. Each entry records the pricing model, the published list price where any vendor publishes one, the inferred band where the vendor declines, the minimum commit, and a source URL with the date the entry was verified.

Direct answer

Of the 14 MDR vendors that mid-market buyers shortlist most often, zero publish a full list price on their own pricing page in 2026. Bands are derived from G2 deal data, channel-partner price lists, and Reddit r/cybersecurity quote dumps. Per-endpoint pricing is the most common model; Expel uses per-integration, Rapid7 uses per-asset, Critical Insight uses per-log-source.

Ledger

Vendor · Model · Segment

BandSrc

Arctic Wolfper-user · MID-ENTERPRISE · per user / year$ 75 - 250[I]

Huntress Managed EDR/MDRper-endpoint · SMB · per endpoint / month$ 7 - 12[I]

Expelhybrid · MID-ENTERPRISE · per integration / month$ 4,000 - 12,000[I]

eSentirehybrid · MID-ENTERPRISE · per endpoint / month$ 15 - 45[I]

Red Canaryper-endpoint · MID-ENTERPRISE · per endpoint / month$ 7 - 18[I]

ReliaQuest GreyMatterhybrid · ENTERPRISE · per year / enterprise contract$ 250,000 - 1,500,000[I]

CrowdStrike Falcon Completeper-endpoint · MID-ENTERPRISE · per endpoint / month$ 15 - 45[I]

SentinelOne Vigilance Respondper-endpoint · MID-ENTERPRISE · per endpoint / month uplift on Singularity Complete$ 3 - 8[I]

Sophos MDRper-endpoint · SMB-MID · per endpoint / month$ 7 - 17[I]

Rapid7 MDRper-asset · MID-ENTERPRISE · per asset / month all-in (MDR + InsightIDR)$ 9 - 28[I]

Field Effect Covalenceper-endpoint · SMB · per endpoint / month all-in$ 6 - 14[I]

UnderDefense MAXIhybrid · SMB-MID · per endpoint / month (service-only, BYO-SIEM)$ 5 - 15[I]

Critical Insightper-log-source · MID · per log source / month$ 200 - 600[I]

Secureworks Taegisper-endpoint · MID-ENTERPRISE · per endpoint / month (Taegis ManagedXDR)$ 8 - 22[I]

How the pricing models meter

Per-endpoint. Charged on every device running the agent. Most common (Huntress, CrowdStrike, SentinelOne, Sophos, Red Canary, Secureworks, Field Effect).
Per-user. Charged on human users rather than devices. Used by Arctic Wolf as the primary metering unit.
Per-asset. Charged on endpoints plus servers, cloud workloads, network devices. Used by Rapid7; widens the count vs pure per-endpoint.
Per-log-source. Charged on each integration ingesting logs. Used by Critical Insight; Expel runs a similar per-integration model.
Hybrid (platform + service). Two-line model where the platform fee and the service fee bill separately. Used by ReliaQuest, eSentire (Atlas XDR + service), UnderDefense.

Related ledger entries

AnnexCompareVendor-vs-vendor decision aids for the 7 most common head-to-heads.AnnexTiers$/endpoint bands per Tier-1 / Tier-1+2 / Tier-1+2+3 / co-managed / fully outsourced / AI-SOC.AnnexPricing modelsPer-endpoint vs per-log-source vs per-GB vs per-asset, when each helps and hurts the buyer.AnnexGlossaryCST, pod, log source, EPS, MTTD, MTTA, MTTR, XDR, SOAR, TIP.