The best EDR for a small business, judged on price, lab and contract data

Executive summary

In the 2026 small-business EDR market, the best-evidenced product is also the cheapest: the only EDR product with current results from both AV-Test and AV-Comparatives, Microsoft Defender for Business, has the lowest published price at 10 seats, while no product that bundles 24/7 managed response has a recent result from either lab. The data covers 8 EDR products as of 30 September 2026. Published prices at 10 seats run from $36.00 to $179.99 per seat per year, with a median of $79.99.

Three more findings shape how a small business should buy. 2 of the 8 products have no published price. Three vendors in the group, Microsoft, SentinelOne and ThreatDown, took part in MITRE's 2024 ATT&CK Evaluation but not the 2025 one. And the contract terms, from 120% auto-renewals to non-cancellable orders, differ more than the feature lists do. For a ranked shortlist, see Best EDR for small business.

How wide is the price spread?

List price per seat per year at 10 seats

10 seats25 seats100 seats

EDREDR with 24/7 managed response

1. Microsoft Defender for Business$36.00
2. ThreatDown Advanced$79.00
3. SentinelOne Singularity Control$79.99
4. ThreatDown Elite$99.00
5. SentinelOne Singularity Complete$179.99

The spread is wide for products that, on paper, do similar work. SentinelOne Singularity Complete sits at the top at $179.99. Microsoft Defender for Business sits at the bottom at $36.00, and its licence covers a user, not a device, which widens the gap further for staff with a laptop and a phone.

Price in this market tracks two things: whether analysts are included, and how the product is sold. Of the two bundles with managed response that publish a price, ThreatDown Elite sits above the median at 10 seats, and Huntress Managed EDR has no 10-seat price at all: bought direct, it sells from 50 endpoints. The most expensive product without managed response, SentinelOne Singularity Complete, is sold only through partners.

How many vendors let you see a price?

The quote-only products are Cynet and WatchGuard Endpoint Security 360. SentinelOne Singularity Control has left that group: as of our 30 September 2026 check, SentinelOne shows a list price of $79.99 per endpoint per year for 5 to 100 workstations; the final price still comes from the partner who sells it. A small business cannot compare them without a sales conversation, and the SMB Fit Score gives them no price points for that reason.

Seat minimums bite hardest at the small end. Both SentinelOne tiers show prices from 5 workstations, and ThreatDown's store starts at 5 devices. Huntress Managed EDR sets no Huntress minimum through an MSP but asks direct and reseller buyers for 50.

Which products have current independent evidence?

AV-Test and AV-Comparatives measure day-to-day protection and false alarms; MITRE ATT&CK Evaluations record detection across the steps of an emulated attack. The SMB Fit Score treats results older than 18 months as dated. Sorted by what each EDR product can show as of 30 September 2026:

Two patterns stand out. Most of the market cannot be checked against a current protection test. And the evidence gap follows the managed-response line: the vendors that sell analysts in the price rely on those analysts, not on lab scores, to make their case.

The 2025 MITRE withdrawal

Microsoft, SentinelOne and ThreatDown all took part in the 2024 MITRE ATT&CK Evaluation (ER6) and none took part in 2025 (ER7). Bitdefender, whose small-business tiers we list as prevention products, did the same. Microsoft cited its Secure Future Initiative; SentinelOne said it would prioritise product and engineering resources on customer-focused initiatives. Among the EDR vendors here, only Cynet and WatchGuard appear in the 2025 results.

WatchGuard entered its higher Advanced EPDR tier (now Endpoint Security Elite), not Endpoint Security 360. For a buyer, the effect is that MITRE results for most of this market are now more than a year old. A vendor quoting a 2024 MITRE result in 2026 sales material is quoting its last result, not a current one.

How managed response is packaged

• Included in the price: 3 products (ThreatDown Elite, Huntress Managed EDR, Cynet).
• Sold as an add-on: WatchGuard Endpoint Security 360.
• Not available from the vendor: Microsoft sells no managed response for Defender for Business (its Defender Experts services are for enterprise suites), and SentinelOne's package table lists MDR as not included in Complete or Control. Buyers of these products get round-the-clock monitoring from an MSP or a separate provider.

Only one included-MDR product, ThreatDown Elite, can be bought online at a published price, and only for 5 to 20 devices. For the add-on route, none of the MDR prices is recorded in our data, so a small business comparing "EDR plus MDR" totals has to collect quotes.

Contract terms the data turns up

None of these terms shows up on a feature list, yet the SentinelOne uplift alone raises the second-year cost by a fifth.

Volume discounts are the exception

Most published EDR prices stay flat from 10 to 100 seats. A small business planning to grow should not assume the per-seat price will fall; the chart shows the products where it does.

What the data means for buyers

• You want the most evidence per dollar: start with Microsoft Defender for Business, the cheapest EDR product here and the only one with current AV-Test and AV-Comparatives results, and plan who answers alerts.
• You have no one to answer alerts: you are choosing among products without current lab results. Judge them on the managed service: response time, what analysts do without asking, and contract terms.
• You are comparing quote-only products: ask each for a written 10-seat price and renewal price before a demo, so you compare like with like.
• You are signing an annual contract: diary the notice date on day one.

Three mistakes recur in this data. Buyers read a 2024 MITRE result as current. They compare a list price with a partner quote. And they assume EDR includes someone to watch it, when only 3 of 8 products do.

Frequently asked questions

Methodology and caveats

"EDR products" means every product in the database with EDR included, including managed EDR bundles. Prices, lab results, capabilities and contract terms are drawn at build time from each product's Endpoint Index page, where every value carries a source and verification date, and counts update automatically when the data changes. The evidence table groups products by what is on record on 30 September 2026. A dated or missing result means no current public evidence, not poor protection. Download the full dataset from the data page (CC BY 4.0).

Sources

1. AV-Test Institute. Tests of business endpoint protection.
2. AV-Comparatives. Business Security Test 2026 (March to June).
3. MITRE. ATT&CK Evaluations: Enterprise round 7 results.
4. Microsoft Tech Community. Microsoft's participation in MITRE ATT&CK Evaluations Enterprise 2025.
5. SentinelOne. SentinelOne and the MITRE ATT&CK Evaluations Enterprise 2025.
6. Endpoint Index. Product pages for each EDR product, with per-value sources. Dataset prices last verified 2026-10-02.