Guide · MDR pricing scenarios
MDR cost for 100–250 employees: worked pricing examples
Assumptions behind these numbers
MDR quotes for small organizations are rarely published, so these scenarios are SecurityBudget calculations, not vendor quotes. Each one multiplies an endpoint count by the per-endpoint monthly rates we use across the site (see MDR pricing by endpoint) and annualizes the result.
| Input | Value used | Why |
|---|---|---|
| Endpoints per employee | 1.3 | One workstation each plus servers, VMs and shared devices. |
| Lean / alert-focused | $3–$7 / endpoint / mo | Alert triage and guided response. |
| 24/7 managed response | $7–$15 / endpoint / mo | 24/7 monitoring with active containment. |
| Premium / bundled | $15–$45 / endpoint / mo | Bundled EDR, identity/cloud telemetry, threat hunting. |
| Per-user model | $7–$25 / user / mo | Some providers meter people rather than devices. |
| Separate EDR license | ~$8 / user / mo | Typical EDR cost when MDR doesn't include an agent. |
Excluded: one-time onboarding, log retention beyond the provider's default, SIEM licensing, incident-response retainer hours, and taxes.
MDR price for 100, 160 and 250 employees
Annual MDR fee by company size and service tier. The 24/7 managed response column is the most common choice at this size: someone watches alerts around the clock and can isolate a compromised machine without waiting for your team to wake up.
| Employees | Endpoints | Lean | 24/7 response | Premium | Per-user model |
|---|---|---|---|---|---|
| 100 | 130 | $5K–$11K | $11K–$23K | $23K–$70K | $8K–$30K |
| 160 | 208 | $7K–$17K | $17K–$37K | $37K–$112K | $13K–$48K |
| 250 | 325 | $12K–$27K | $27K–$59K | $59K–$176K | $21K–$75K |
Annual MDR fee only. Add the EDR license if it isn't bundled: about $10K, $15K and $24K a year for 100, 160 and 250 users.
Worked example: total price for 160 users
Take a 160-person company with a laptop for everyone, a few dozen servers and cloud VMs — about 208 endpoints. At the 24/7 managed-response tier ($7–$15 per endpoint per month), the MDR fee comes to $17K–$37K a year. If the provider doesn't supply its own agent, add roughly $15K for EDR licensing.
Your endpoint count moves the number more than anything else. The same company, priced at the same tier:
| What's covered | Endpoints | Annual MDR fee |
|---|---|---|
| Laptops only | 160 | $13K–$29K |
| Laptops + typical servers | 208 | $17K–$37K |
| Laptops + servers + VDI / shared devices | 256 | $22K–$46K |
For context, the cross-industry median for security spend per employee is about $2,300 a year, which would put a 160-person company's whole security program near $370K. A 24/7 MDR service at this size is usually a modest share of that total, not the bulk of it.
EDR included vs. bring your own
Many quotes look cheap until you notice they assume you already pay for EDR. Before comparing providers, put every quote on the same basis:
- Bundled agent: the MDR provider deploys and licenses its own endpoint agent. One line item, usually at the higher tiers.
- Bring your own EDR: the provider monitors Microsoft Defender, CrowdStrike, SentinelOne or similar that you license separately. Lower MDR fee, but add the EDR cost. See the EDR pricing guide.
- Identity and cloud coverage: Microsoft 365 / Entra ID and cloud workload telemetry are often add-on modules. At 100–250 employees, account takeover via email is a common attack path, so ask whether it's in scope.
What moves an MDR quote at this size
- Minimums. Some providers set minimum seat counts or annual contract values. They matter most below ~250 employees, where a minimum can exceed the per-endpoint math.
- Servers and workloads. Some providers price servers and cloud workloads separately from workstations.
- Response depth. Alert-and-email services cost less than providers that isolate hosts and disable accounts for you.
- Onboarding. Ask whether deployment and tuning are included or billed once up front.
- Term length. Multi-year commitments usually lower the per-endpoint rate.
- Buying through an MSP. Many companies this size buy MDR through their managed IT provider, which adds a margin but bundles deployment and support.
MDR vs. hiring in-house
At 100–250 employees the comparison is lopsided. One security analyst costs about $168K a year fully loaded (BLS median wage plus ~30% overhead) and works one shift. Covering nights, weekends and holidays takes 8–12 people. MDR doesn't replace an internal owner for security decisions, but it is the realistic way to get 24/7 detection and response at this size. For published prices by provider, including Huntress, eSentire and RocketCyber, see MDR pricing by provider. The longer build-vs-buy math is in the MDR vs in-house SOC guide.
Questions to ask every MDR provider
- Is the price per endpoint, per user, or a flat fee, and what is the minimum?
- Is the EDR agent included, and which EDR products can you monitor if not?
- Will you contain threats (isolate hosts, disable accounts) without waiting for our approval?
- Are Microsoft 365 / identity and cloud workloads covered or extra?
- What are the response SLAs at 3am on a weekend?
- Is onboarding included? How long until we're fully covered?
- Are incident-response hours included if something serious happens?
Frequently asked questions
How much does MDR cost for 160 users?
Roughly $17K–$37K a year for 24/7 MDR with active response, assuming about 208 endpoints at $7–$15 per endpoint per month. Lean, alert-focused services can land near $7K–$17K; premium bundles with EDR, identity coverage and threat hunting can reach $37K–$112K. If the provider prices per user instead, expect about $13K–$48K.
Does MDR pricing include the EDR license?
Sometimes. Some MDR services bundle their own endpoint agent; others run on top of EDR you already license. If EDR is separate, budget roughly $8 per user per month — about $15K a year for 160 users — on top of the MDR fee.
Is MDR worth it for a 100-person company?
Usually, if you need after-hours coverage. A single security hire costs about $168K a year fully loaded and still cannot watch alerts 24/7; round-the-clock coverage needs 8–12 people. MDR for 100 employees typically costs a fraction of one hire.
Is per-user or per-endpoint MDR pricing cheaper?
It depends on your device ratio. With fewer than about 1.3 endpoints per person, per-endpoint pricing is usually cheaper; server- and VM-heavy estates often come out better on per-user pricing. Ask for both and compare against your actual asset inventory.
References
Price MDR inside your full security budget
Enter your headcount and endpoints to see MDR next to EDR, identity, email and staffing — with peer benchmarks.
Open the budget calculatorEstimates are SecurityBudget calculations based on public pricing and industry benchmarks. For planning only — not a vendor quote or professional advice.