MDR pricing by provider (2026): RocketCyber, Huntress, CrowdStrike, Arctic Wolf and more

Across the major providers, managed detection and response (MDR) costs roughly $3 to $45 per endpoint per month. The few list prices we could verify run from about $9 (Huntress) to $28 (eSentire’s top tier) per endpoint or user, and most providers, including Arctic Wolf, Red Canary, Sophos, Blackpoint, ConnectWise and Microsoft, are quote-only.

This is the vendor-by-vendor companion to our MDR pricing explainer, which covers the general model and what drives a quote. Every vendor price below links to where we found it, and each is labelled as a list price, a marketplace price or reported buyer data.

MDR providers compared

Provider	Pricing unit	Public price	Best fit	EDR	Sales channel
Huntress Managed EDR	Per endpoint / month	$8.99 MSRP (list)	SMB, MSP	Included	MSPs, resellers, direct
Arctic Wolf MDR	Per user and per server	Quote-only	Mid-market	Integrates existing; own endpoint sold separately	Channel partners
CrowdStrike Falcon Complete	Per endpoint / year	Quote-only (UK framework list: £240/yr)	Mid-market, enterprise	Included (Falcon)	Direct, resellers
SentinelOne Wayfinder MDR (formerly Vigilance / WatchTower)	Add-on to per-endpoint Singularity licence	Quote-only	Mid-market, enterprise	Included (Singularity)	Authorised partners
Sophos MDR	Not published	Quote-only	SMB, mid-market	Sophos agent or BYO	Partners, MSPs
Red Canary (Zscaler)	Not published	Quote-only	Mid-market, enterprise	BYO	Zscaler / Red Canary sales
Blackpoint Cyber	Not published	Quote-only	MSP	Included (managed EDR)	MSPs
RocketCyber / Kaseya MDR	Per endpoint	Quote-only	MSP, small IT teams	BYO or Kaseya 365 bundle	Kaseya, to MSPs and IT teams
ConnectWise MDR (Perch lineage)	Not published	Quote-only	MSP	Choice of Bitdefender, Defender for Business, SentinelOne	MSP partners
Expel	Monitored assets	Quote; one marketplace price	Mid-market, enterprise	BYO (required)	Direct, AWS Marketplace
eSentire	Per user / month	$17–$28 (list)	Mid-market	BYO	Direct online shop, sales
Microsoft Defender Experts MDR	Not published	Quote-only	Enterprise on Microsoft 365 E5	Microsoft Defender	Microsoft Security Sales

“Best fit” is our editorial read of who each service is packaged for, not a vendor claim.

Provider by provider

Huntress. Huntress publishes a rate card: Managed EDR is $8.99 per endpoint per month MSRP, with lower rates at higher committed volumes. That price includes the agent, the 24/7 SOC and managed Microsoft Defender Antivirus. Identity coverage (ITDR, $4.80 per identity a month) and SIEM ($4.00 per source a month) are separate list-price lines. Direct and reseller buyers face a 50-seat minimum and a 12-month term. MSPs get separate partner pricing, which isn’t published.

Arctic Wolf. No public prices. Vendr’s buyer data puts the median contract at $79,740 a year, ranging from $24,469 to $315,023 (reported, updated February 2026). A UK reseller’s G-Cloud price list shows MDR licensed per user and per server. Arctic Wolf has sold only through channel partners in the US and Canada since 2019.

CrowdStrike Falcon Complete. CrowdStrike’s pricing page lists Falcon Go, Pro and Enterprise at $59.99 to $184.99 per device per year, but shows Falcon Complete as “Contact sales”. In its own UK G-Cloud 15 pricing document (January 2026), Falcon Complete Next-Gen MDR is £240 per endpoint per year. That’s a list price based on a two-year term and 50 endpoints, with further discounts available through resellers. It works out to about £20 per endpoint per month, Falcon EDR included.

SentinelOne. The pricing page lists Singularity Complete at $179.99 and Commercial at $229.99 per endpoint per year (5–100 workstations, sold through authorised partners), and marks MDR as an add-on with no price. Its managed services, previously sold as Vigilance MDR and WatchTower, have been branded Wayfinder since November 2025, with MDR Essentials and MDR Elite tiers. Budget for the platform licence plus a quoted MDR add-on.

Sophos MDR. No published price. The service runs on Sophos’s own agent or alongside Microsoft, CrowdStrike and SentinelOne, and the page advertises incident response with no hourly caps, so confirm which tier your quote covers. MSPs can buy it with usage-based monthly billing under MSP Flex.

Red Canary. Red Canary is now part of Zscaler, and its old pricing URL redirects to a Zscaler contact page, so it’s quote-only. It works through your existing tools: it isolates hosts via your EDR, suspends users via your identity provider, and also covers cloud and email.

Blackpoint Cyber. Blackpoint sells to MSPs, including through the Pax8 Marketplace, and doesn’t publish pricing. Its Blackpoint Response bundle includes managed EDR, so compare it against EDR-plus-MDR totals, not MDR alone.

Expel. Expel prices by monitored assets, not a flat per-endpoint rate. Its AWS Marketplace listing shows $88,800 for 12 months for the cloud-infrastructure dimension, sold in units of 500 resources (marketplace price). Vendr’s data shows a median of $196,629 a year across 51 purchases (reported). Vendr also notes that Expel needs an EDR already in place.

eSentire. eSentire publishes an online price list: Atlas Professional at $17, Enhanced at $24 and Elite at $28 per user per month for 10–250 users, plus a $2,500 annual launch-and-optimisation fee (list). All three tiers run on an EDR you already license (CrowdStrike, SentinelOne, Defender for Endpoint or Palo Alto). Full DFIR retainer services are Elite-only.

Microsoft Defender Experts. The service page, still titled Defender Experts for XDR and now headed Defender Experts MDR, says “Contact Sales”. Plan 1 covers Microsoft Defender workloads. Plan 2 extends triage to third-party sources ingested through Microsoft Sentinel. Microsoft’s 2026 Defender Experts Suite promotion requires at least 1,500 seats plus Microsoft 365 E5, E7 or a qualifying suite.

RocketCyber (Kaseya MDR): how it’s sold and priced

RocketCyber is a managed SOC platform that Kaseya acquired in February 2021 to serve its MSP and SMB customers. In April 2026 Kaseya relaunched it as Kaseya MDR, described as a complete rebuild of RocketCyber. It covers endpoints, firewalls and Microsoft 365 from a SOC operating in Florida and Ireland. The product page lists 400-day log retention and response actions such as isolating endpoints.

How it’s priced. Kaseya MDR is per-endpoint and quote-based: the pricing page is a request form. It’s included in Kaseya 365 Endpoint Pro and also sold standalone, and Kaseya says existing RocketCyber customers can migrate with no price increase. Kaseya pitches it at MSPs and small IT teams, and it integrates with third-party EDR, including Bitdefender GravityZone, CrowdStrike, Datto EDR, SentinelOne, Sophos and Webroot.

Public pricing. The only public figure is the Kaseya 365 bundle price at launch. In May 2024, ChannelPro reported $3.99 per endpoint per month, or $1.75 without MDR. The cheaper Express tier is the same bundle minus MDR/SOC, so the $2.24 gap is the closest public proxy for what the RocketCyber layer added (our calculation). Treat it as 2024 bundle pricing to MSPs, not a current end-customer rate. An MSP reselling it adds its own margin and services.

ConnectWise MDR and the Perch history

Perch Security built what ConnectWise called the only MSP-designed SIEM. ConnectWise acquired Perch, along with StratoZen, in November 2020. The product lives on as ConnectWise SIEM (formerly Perch), which MSPs can run themselves or buy as Co-Managed SIEM with a 24/7 SOC. ConnectWise MDR is the endpoint service: 24/7 monitoring of clients’ endpoints on a choice of Bitdefender, Microsoft Defender for Business or SentinelOne. Neither has a public price. Old Perch-era price lists aren’t current, so ask ConnectWise or your MSP for a quote.

MDR pricing outside the US: Canada, UK and EU

• UK. Public-sector framework documents are the best public price source. Besides CrowdStrike’s £240 list price (the document also notes CrowdStrike transacts in USD), managed service provider Ekco lists its own MDR at £7.84–£9.68 per device per month, plus £5,000–£7,500 onboarding. Those figures exclude VAT and product licences.
• Data residency. Arctic Wolf’s sub-processor list lists MDR hosting in the USA, Canada, Germany or Australia, with data-warehouse storage based on SOC location. Sophos opened a Montreal data centre that supported its managed threat response service at launch. Its licensing guide says only the US and EU regions support every product.
• Canada. eSentire is based in Waterloo, Ontario, but its published list prices are in USD. Ask for CAD pricing, and confirm in writing where data is stored and where analysts work.
• EU and Germany. Ask for EUR quotes, the data processing agreement and the sub-processor list. Check which region your tenant runs in, because some features differ by region.

Worked example: 200 endpoints at three tiers

These figures are SecurityBudget estimates: 200 endpoints multiplied by the per-endpoint tier rates used across this site and in our calculator. They are not vendor quotes.

Tier	Rate (per endpoint / month)	Annual cost
Lean / alert-focused	$3–$7	$7,200–$16,800
24/7 managed response	$7–$15	$16,800–$36,000
Premium / bundled tooling	$15–$45	$36,000–$108,000

At our ~$6 typical rate, that’s about $14,400 a year. If the service doesn’t include EDR, add roughly $8 per endpoint per month ($19,200 a year) for the licence, per our EDR pricing comparison.

Against published list prices, Huntress at $8.99 MSRP comes to $21,576 a year (EDR included), which sits in the middle tier. eSentire Atlas Professional at its listed 101–250-user rate ($16.15) comes to $41,260 for 200 users, including the $2,500 fee, before your own EDR. Falcon Complete at the UK framework list price is £48,000, before currency conversion. Both of those land in the premium band. For smaller estates, see MDR costs for 100–250 employees.

How to compare MDR quotes like-for-like

Convert every quote to an annual total for your actual estate, because units differ: per endpoint, per user, per asset or per resource block. Then ask each provider:

• EDR: Is it included, or do I license it separately? Which EDR products do you support?
• Response actions: Will you isolate hosts, kill processes and disable accounts yourselves, or only alert us? Is approval needed?
• Identity, cloud and SaaS: Is Microsoft 365, identity or cloud coverage in the base price or a separate line?
• Incident response: How many IR hours are included, and is full forensics extra?
• Retention and fees: How long are logs kept? Are there onboarding fees, minimum seats or multi-year terms?
• Exit: Who keeps the detection history and case data if we leave?

Our EDR vs MDR vs XDR comparison explains what each layer buys you, and the MDR cost guide covers per-user pricing and the in-house SOC alternative. To see MDR next to the rest of your security budget, run the cybersecurity budget calculator.

FAQ

How much does RocketCyber cost?

RocketCyber, now Kaseya MDR, is priced per endpoint by quote. There’s no public rate card. The only public data point is Kaseya 365 Endpoint’s 2024 launch pricing, reported at $3.99 per endpoint per month with MDR and $1.75 without. Kaseya says existing RocketCyber customers can move to Kaseya MDR with no price increase.

Is CrowdStrike Falcon Complete priced per endpoint?

Yes. CrowdStrike’s UK framework document prices Falcon Complete Next-Gen MDR per endpoint per year, at a £240 list price on a two-year, 50-endpoint basis. In the US it’s “Contact sales”, and Falcon EDR is included.

How much does SentinelOne MDR cost?

SentinelOne doesn’t publish an MDR price. Wayfinder MDR is an add-on to Singularity, which lists at $179.99 (Complete) or $229.99 (Commercial) per endpoint per year, so you pay the platform licence plus a quoted MDR fee.

What happened to Perch Security pricing?

ConnectWise acquired Perch in 2020, and its SIEM became ConnectWise SIEM. Endpoint MDR is now ConnectWise MDR. Both are sold to MSPs without public pricing, so current costs come from a ConnectWise or MSP quote.