UnderDefense MAXI pricing.
BYO-SIEM-friendly MDR with two delivery paths: customer-stack monitoring (Sentinel, Splunk, Elastic) or UnderDefense MAXI proprietary stack. IR retainer hours sold as a separate SKU.
UnderDefense MAXI does not publish a list price on its official page in 2026 (Quote-only ('Pricing' page goes to a request form)). Field-reported bands cluster at 5 to 15 USD per endpoint / month (service-only, BYO-SIEM), sourced from G2 deal data, channel-partner listings, and Reddit r/cybersecurity quote dumps verified 2026-06-19.
Ledger entry
What changes the quote
The headline hybrid band moves with endpoint count, contract length, 24x7 vs business-hours coverage, the inclusion of an incident-response retainer, whether the customer brings their own SIEM, and the compliance overlay (HIPAA, PCI, CMMC L2, FedRAMP, DORA). See /annex/quote-decoder for the question ladder that decodes a UnderDefense MAXI quote line by line.
What is bundled and what gets line-itemed
Bundled into the base subscription: 24x7 SOC monitoring, EDR licence (where vendor-supplied), portal access, standard onboarding. Line-itemed at extra cost: ingest overage above the contracted GB/day, non-standard log sources, dedicated tenancy, evidence packs for regulated frameworks, IR retainer hours, and contract off-boarding. Cross-reference /annex/hidden-costs for the full schedule.
Recent changes
Continued growth in 2026 as a BYO-SIEM-friendly alternative for buyers who already own Sentinel or Splunk licences.
Source
Primary source: https://underdefense.com/services/managed-detection-and-response/, verified 2026-06-19. Inferred-band sourcing note: G2 review data 2025-2026; band rises when UnderDefense MAXI stack is used in place of customer SIEM.
See notes to the ledger for the source-mark legend and the inferred-band derivation methodology.