Security Tooling Price Index 2026: What Each Control Actually Costs

Most security budgets are assembled control by control, yet published vendor pricing rarely tells the whole story — and rarely tells it in comparable units. This price index normalizes the major control categories into the units buyers actually negotiate (per user, per endpoint, per workload, per engagement, per year) using vendor list pricing cross-checked against Vendr buyer data, all verified in June 2026. Treat every figure as a planning range, not a quote.

How to read these numbers

Unit pricing varies by tier, commitment length, and bundle. A “typical” figure here is the rate a mid-market buyer commonly lands at, not the cheapest entry tier or the enterprise ceiling. Per-user controls scale with headcount; per-endpoint controls scale with device count, which often exceeds headcount once servers and cloud instances are included; and volume-based controls like SIEM scale with data, which is the hardest input to estimate in advance.

The most expensive surprises are almost never the per-user tools. They are the volume-scaled line items — SIEM ingest and MDR endpoint counts — where the meter runs faster than headcount.

Per-user and per-endpoint controls

These are the recurring subscriptions that form the backbone of most programs. Endpoint protection (EDR/XDR), identity (MFA/SSO and lightweight PAM), and email security are the three most common starting points.

Control	Unit	Range	Typical
Endpoint (EDR/XDR)	per user / mo	$3–$20	~$8
Identity (MFA/SSO/PAM-lite)	per user / mo	$3–$12	~$7
Email security	per user / mo	$2–$8	~$4
DLP	per user / mo	$3–$15	~$5
MDR	per endpoint / mo	$3–$45	~$6

Combined, the three core per-user controls typically run $9 to $40 per user per month, with most mid-market buyers landing near the lower-middle of that band. MDR is priced per endpoint rather than per user, so a fleet with many servers and shared devices can cost more than a headcount-based estimate suggests.

Volume-scaled and per-asset controls

These categories do not track headcount cleanly, which makes them the most common source of budget variance.

Control	Unit	Range	Typical
SIEM	per year (ingest-based)	$30K–$150K	~$70K
Cloud security (CSPM/CNAPP)	per workload / yr	$60–$1,200	full CNAPP ~$30K–$60K/yr
PAM	per privileged user / yr	$300–$8,000	privileged ≈ 10% of staff
Vuln management	per asset / yr	$17–$42	~$30

SIEM pricing is driven by data ingested, not seats, so two organizations of identical size can see very different bills depending on log volume and retention. Cloud security follows a similar pattern: a mid-market estate of around 40 workloads commonly lands at $30K–$60K per year for a full CNAPP, but the per-workload rate spans a wide $60–$1,200 depending on depth (posture-only versus runtime). PAM is best estimated by counting privileged users — roughly 10% of staff is a reasonable planning assumption — rather than total headcount.

Project-based and program costs

Not every control is a subscription. Penetration tests are bought per engagement, and compliance is an ongoing program cost that sits alongside, not inside, tooling.

Item	Unit	Range	Typical
Penetration test	per engagement	$5K–$50K	~$18K
Compliance — HIPAA	per year	—	~$15K
Compliance — PCI DSS	per year	—	~$20K
Compliance — SOC 2	per year	—	~$40K
Compliance — ISO 27001	per year	—	~$40K
Compliance — GDPR	per year	—	~$60K

Compliance figures represent annualized program cost — audits, tooling overhead, and internal effort — and exclude the security controls themselves, which are budgeted separately above. A penetration test at the high end of the range typically reflects a larger scope or a specialized environment rather than a premium for the same work.

List price versus negotiated price

Published pricing is the starting point of a negotiation, not its conclusion. Across the categories in this index, Vendr buyer data shows negotiated deals commonly landing 20–40% below list, with the larger discounts concentrated in multi-year commitments, multi-product bundles, and end-of-quarter timing. Per-user tools tend to discount on the lower end of that band; larger annual contracts like SIEM and PAM tend toward the higher end. Build budgets against list price for safety, then treat the negotiated savings as upside rather than assumed. No tool or bundle eliminates risk on its own, so resist letting a discount drive which controls you adopt.

How to use this

These unit prices are planning ranges meant to be combined against your real environment — headcount, endpoint count, workload count, and privileged-user count. To assemble them into a full program estimate and compare it against spend benchmarks, run the cybersecurity budget calculator, then use these ranges as a checklist when reviewing vendor quotes line by line.