Managed Detection and Response Pricing: What MDR Costs

Managed detection and response pricing runs from about $10 to $75 per endpoint per month, and the number on the quote matters less than what it buys. Some plans watch your alerts around the clock. Others also act on them. Those are very different products with the same acronym.

Most providers don't publish a real MDR price. The figures below come from the ones that publish endpoint prices, plus two buyer guides. Treat every number as a range to test against a written quote.

What does managed detection and response pricing look like?

Two published ranges give you the frame. BCS365 says the wider market runs $10 to $30 per asset each month, with some entry-level options from $11 per device. Meriplex puts managed security at $20 to $75 per endpoint per month, or $50 to $200+ per user per month, and labels those figures directional, not fixed.

The Meriplex range covers managed security services broadly, not MDR alone. Read it as the ceiling for a heavier engagement.

That spread is the whole story of managed detection and response pricing. A $10 plan and a $75 plan are not the same service at different prices.

Endpoint detection and response pricing is not MDR pricing

Endpoint detection and response pricing covers the software. MDR adds people who watch it. If a quote only lists the agent, you're pricing a tool and you still need someone on the other end.

CrowdStrike publishes its software tiers, so it makes a clean example. Falcon Go is $59.99 per device billed annually, Pro is $99.99, and Enterprise is $184.99. Go is capped at 100 devices. Its MDR tier, Falcon Complete, shows "Contact sales" and no number.

Microsoft follows the same pattern. The endpoint agent has a list price. The managed service doesn't.

Managed detection and response pricing: per endpoint or per user

Providers bill MDR one of three ways: per endpoint, per user, or a custom quote. Each one punishes a different kind of business.

• Per endpoint. Cheaper for offices where each person has one laptop. It gets expensive with shared devices, servers and kiosks.
• Per user. Easier to budget, and it follows headcount. BCS365 warns you to check how the provider tracks active accounts to avoid unexpected fees.
• Custom quote. Fine for larger environments. For a small firm, push for a number you can compare.

Ask for the MDR cost both ways, and ask why if a provider can quote only one.

Three things that change MDR cost more than the sticker price

Response authority. Meriplex notes that some lower-tier offerings provide 24/7 alerting but not 24/7 human response or containment. An alert at 2 a.m. that nobody acts on is a notification, not a service. Get it in writing whether the provider can isolate a machine or disable an account without calling you first.

Incident response. Microsoft says plainly that neither Defender Experts MDR plan is an incident response engagement. BCS365 advises asking whether threat cleanup sits inside the flat monthly rate or gets billed as an extra.

Licenses you already own. If you're on Microsoft 365 with Defender already licensed, you may only need the people, not another agent. That can shrink the bill. See our comparison of Defender for Business, CrowdStrike and SentinelOne before you pay for a second endpoint tool.

What Microsoft publishes for MDR

Microsoft Defender Experts MDR has no public price. Standalone buyers fill out an interest form, and Plan 2 requires a minimum of 1,500 licensed seats, so it's out of reach for most small businesses. Smaller firms typically look to a managed provider instead.

How to compare managed detection and response pricing

Put every quote on the same sheet before you look at totals.

• Billing unit: endpoint, user, or custom, and how each is counted.
• Whether the agent license is included or you buy it separately.
• Who can isolate a device or lock an account, and at what hour.
• Whether breach cleanup is included, capped or billed hourly.
• Contract length and what happens to your data if you leave.
• What's excluded: servers, mobile devices, cloud workloads.

The cheapest line item is rarely the cheapest year. A lower monthly fee can mean key services are excluded or billed separately during an incident.

If you're still working out which category you need, start with EDR vs XDR vs MDR. If you're switching providers, the MDR onboarding checklist covers what to confirm before go-live.

Frequently asked questions

How much does managed detection and response pricing run for a small business?

Published ranges run about $10 to $30 per endpoint a month at the low end and $20 to $75 for heavier managed security. Per-user pricing quoted by one MSP runs $50 to $200+. Your real number depends on billing unit, response authority and cleanup terms.

What is the average MDR cost per endpoint?

BCS365 puts the market at $10 to $30 per asset each month. Meriplex's directional range for managed security is $20 to $75 per endpoint. Neither is a quote, so use them to spot offers that are suspiciously cheap or padded.

Is endpoint detection and response pricing the same as MDR pricing?

No. EDR pricing is the software agent. CrowdStrike lists its endpoint tiers from $59.99 to $184.99 per device a year, but its MDR tier is contact-sales. MDR adds the analysts who watch and respond.

Does MDR include incident response?

Often not. Microsoft states that neither Defender Experts MDR plan is an incident response engagement. Ask whether breach cleanup is in the monthly fee, capped, or billed hourly before you sign.

Not sure what you're paying for today? Talk to our team and we'll read your current MDR contract with you.