Security Tooling Price Index 2026: What Each Control Actually Costs

Most security budgets are assembled control by control, yet published vendor pricing rarely tells the whole story — and rarely tells it in comparable units. This price index normalizes the major control categories into the units buyers actually negotiate (per user, per endpoint, per workload, per engagement, per year) using vendor list pricing cross-checked against Vendr buyer data, all verified in June 2026. Treat every figure as a planning range, not a quote.

How to read these numbers

Unit pricing varies by tier, commitment length, and bundle. A “typical” figure here is the rate a mid-market buyer commonly lands at, not the cheapest entry tier or the enterprise ceiling. Per-user controls scale with headcount; per-endpoint controls scale with device count, which often exceeds headcount once servers and cloud instances are included; and volume-based controls like SIEM scale with data, which is the hardest input to estimate in advance.

The most expensive surprises are almost never the per-user tools. They are the volume-scaled line items — SIEM ingest and MDR endpoint counts — where the meter runs faster than headcount.

Per-user and per-endpoint controls

These are the recurring subscriptions that form the backbone of most programs. Endpoint protection (EDR/XDR), identity (MFA/SSO and lightweight PAM), and email security are the three most common starting points.

Control	Unit	Range	Typical
Endpoint (EDR/XDR)	per user / mo	$3–$20	~$8
Identity (MFA/SSO/PAM-lite)	per user / mo	$3–$12	~$7
Email security	per user / mo	$2–$8	~$4
DLP	per user / mo	$3–$15	~$5
MDR	per endpoint / mo	$3–$45	~$6

Combined, the three core per-user controls typically run $9 to $40 per user per month, with most mid-market buyers landing near the lower-middle of that band. MDR is priced per endpoint rather than per user, so a fleet with many servers and shared devices can cost more than a headcount-based estimate suggests.

Volume-scaled and per-asset controls

These categories do not track headcount cleanly, which makes them the most common source of budget variance.

Control	Unit	Range	Typical
SIEM	per year (ingest-based)	$30K–$150K	~$70K
Cloud security (CSPM/CNAPP)	per workload / yr	$60–$1,200	full CNAPP ~$30K–$60K/yr
PAM	per privileged user / yr	$300–$8,000	privileged ≈ 10% of staff
Vuln management	per asset / yr	$17–$42	~$30

SIEM pricing is driven by data ingested, not seats, so two organizations of identical size can see very different bills depending on log volume and retention. Cloud security follows a similar pattern: a mid-market estate of around 40 workloads commonly lands at $30K–$60K per year for a full CNAPP, but the per-workload rate spans a wide $60–$1,200 depending on depth (posture-only versus runtime). PAM is best estimated by counting privileged users — roughly 10% of staff is a reasonable planning assumption — rather than total headcount.

Project-based and program costs

Not every control is a subscription. Penetration tests are bought per engagement, and compliance is an ongoing program cost that sits alongside, not inside, tooling.

Item	Unit	Range	Typical
Penetration test	per engagement	$5K–$50K	~$18K
Compliance — HIPAA	per year	—	~$15K
Compliance — PCI DSS	per year	—	~$20K
Compliance — SOC 2	per year	—	~$40K
Compliance — ISO 27001	per year	—	~$40K
Compliance — GDPR	per year	—	~$60K

Compliance figures represent annualized program cost — audits, tooling overhead, and internal effort — and exclude the security controls themselves, which are budgeted separately above. A penetration test at the high end of the range typically reflects a larger scope or a specialized environment rather than a premium for the same work.

List price versus negotiated price

Published pricing is the starting point of a negotiation, not its conclusion. Across the categories in this index, Vendr buyer data shows negotiated deals commonly landing 20–40% below list, with the larger discounts concentrated in multi-year commitments, multi-product bundles, and end-of-quarter timing. Per-user tools tend to discount on the lower end of that band; larger annual contracts like SIEM and PAM tend toward the higher end. Build budgets against list price for safety, then treat the negotiated savings as upside rather than assumed. No tool or bundle eliminates risk on its own, so resist letting a discount drive which controls you adopt.

A worked 800-employee stack

Unit rates become useful when they are multiplied by a real environment. The following illustration uses 800 employees, 1,100 endpoints, 40 cloud workloads, and 60 applications. It is not a quote; it shows which assumptions dominate the total.

Control family	Planning input	Typical annual amount	Main uncertainty
Endpoint, identity, email	800 users	~$182K	Bundle overlap and enterprise agreement discounts
SIEM	1,100 endpoints + cloud logs	~$72K	Ingest, retention, and filtering discipline
MDR	1,100 endpoints	~$79K	Response scope and included telemetry
Cloud security	40 workloads	~$32K before platform floors	Workload definition and CNAPP module breadth
Staffing	3 loaded FTE	~$504K	Geography, seniority, and outsourcing mix

The worked stack shows why list-price comparisons alone are insufficient. Staffing is larger than any individual platform, while SIEM cost can move dramatically without headcount changing at all.

Index methodology and limitations

Each range begins with an observable unit—user, endpoint, workload, asset, privileged account, data ingest, engagement, or annual retainer. Public list prices are preferred. Where vendors do not publish prices, the model blends marketplace records, buyer-data summaries, and named industry guides and lowers the confidence rating. Contract floors, implementation services, taxes, currency, and negotiated bundles can move actual invoices outside the published range. The index is reviewed quarterly and when a vendor materially changes packaging.

How to use this

These unit prices are planning ranges meant to be combined against your real environment — headcount, endpoint count, workload count, and privileged-user count. To assemble them into a full program estimate and compare it against spend benchmarks, run the cybersecurity budget calculator, then use these ranges as a checklist when reviewing vendor quotes line by line.