Endpoint IndexManaged detection and response (MDR) pricing for small business
What managed EDR and MDR services charge a small business, provider by provider, and which ones won't say.
25 services from 18 providers · from the SMB Endpoint Security Price Index · prices from vendors' own pages and marketplace listings, checked 8 Oct 2026
Managed detection and response (MDR) and managed EDR cost a small business $8.25 to $19.97 per endpoint or user a month at published prices, as of 8 Oct 2026. Of the 25 managed services in the SMB Endpoint Security Price Index, 8 publish a price per endpoint or user, 3 sell only in fixed packs and 14 sell by quote. Each published price links to the vendor or marketplace page it was read from.
What does each MDR service cost?
List price in US dollars, before tax and discounts, at the seat count under each price. Per month is the annual price divided by 12, except where the vendor bills monthly.
| Service | Per unit a month |
|---|---|
 ThreatDown Elite ThreatDown · per endpoint · min 5 | $8.25 10 seats |
 ESET PROTECT Premium ESET · per device · min 10 | $8.58 10 seats |
 Huntress Managed EDR Huntress · per endpoint · min 50 | $8.99 50 seats, the smallest order |
 Red Canary Managed Detection and Response, Endpoint (AWS Marketplace) Red Canary · per endpoint | $10.00 One flat rate, AWS Marketplace |
Xcitium MDR - Device Xcitium · per endpoint | $10.99 One flat rate, billed monthly |
ThreatDown Ultimate (MDR Plus) ThreatDown · per device · min 5 | $12.42 10 seats |
 WithSecure Elements XDR Managed (AWS Marketplace) WithSecure · per user | $15.90 One flat rate, AWS Marketplace, billed monthly |
 Sophos MDR (AWS Marketplace) Sophos · per user | $19.97 One flat rate, AWS Marketplace |
Compare the unit and the minimum before the price. ThreatDown Elite is cheapest at $8.25 per endpoint a month (10 seats); Sophos MDR (AWS Marketplace) is dearest at $19.97 per user. A per-user price covers every machine that person uses, and a seat minimum raises the real cost for a small team.
Which MDR services sell only in packs?
Shown as sold, never split into a per-seat price. A business between pack sizes pays for the next pack up.
| Service | Pack price a year |
|---|---|
 Arctic Wolf Managed Detection and Response, MDR Basic (AWS Marketplace) Arctic Wolf | 100 users: $44,000.00 |
Aurora Managed Endpoint Defense (AWS Marketplace) Arctic Wolf | 100 devices: $18,240.00 |
ESET PROTECT Ultimate | 99 devices: $16,360.00 |
Which MDR providers sell only by quote?
14 services from 12 providers. What each pricing page says instead, as checked.
Blackpoint MDR
ConnectWise Managed EDR / MDR
Falcon Complete Next-Gen MDR"Contact sales"Checked 2 Oct 2026
eSentire Atlas MDR (Professional / Enhanced / Elite)
Expel MDR (Starter / Select / Premium)
Field Effect MDR (MDR Endpoint / Core / Complete)
Adlumin MDR
Rapid7 MDR
WatchGuard Core MDR (AWS Marketplace)Listed on AWS Marketplace with no per-unit priceChecked 2 Oct 2026WatchGuard Open MDR (AWS Marketplace)Listed on AWS Marketplace with no per-unit priceChecked 2 Oct 2026WatchGuard Total MDR (AWS Marketplace)Listed on AWS Marketplace with no per-unit priceChecked 2 Oct 2026Quoted prices vary by partner. Get at least two quotes, and ask each provider to list the licence, the monitoring and the contract term separately so the quotes can be compared line by line.
How much more does MDR cost than EDR?
At 10 seats, the cheapest managed service with a published price, ThreatDown Elite, costs $99.00 per endpoint a year. That is 2.8 times the cheapest EDR without managed response, Microsoft Defender for Business at $36.00 per user. The difference pays for analysts who watch the alerts and act on them.
Antivirus and EDR list prices for every product are in the small-business endpoint security cost report, and the ranking of endpoint protection with managed response weighs price against test results and terms.
How fast do MDR services say they respond?
Response figures each vendor publishes for its own service. No figure in this table is a contractual commitment.
| Service | Minutes |
|---|---|
Huntress Managed EDR mean time to respond, a marketing figure; the public pricing FAQ makes no response-time commitment | 8 |
ThreatDown Elite median time to contain, from ThreatDown's own incident data; contract-backed response times come only with MDR Plus in the Ultimate bundle | 19 |
 Cynet All-in-One No response time on the vendor's public pages | not published |
Is MDR worth it for a small business?
MDR is worth it for a small business when nobody on staff can answer a security alert within an hour, day or night. A business with an IT person who watches the console can run EDR on its own and spend the difference elsewhere. Without that person, EDR alerts go unread, so budget for the managed price.
Two checks before signing: what the provider will do on your machines without asking (isolate a device, stop a process, remove a file), and whether the response time it quotes is in the contract or only on its website.
Questions about MDR pricing
Why don't most MDR providers publish prices?
14 of the 25 managed EDR and MDR services in the Price Index show no per-unit price. They sell through quotes, resellers or managed service providers, where the price depends on the partner, the contract length and the number of devices. Endpoint Index lists each of them with the wording on its pricing page and the date it was checked, never an estimate.
Is MDR priced per endpoint or per user?
Both. Of the 8 services with a published price, 2 charge per user and 6 per device or endpoint. Per-user pricing costs less when each person uses more than one machine.
Is there a minimum order for MDR?
Often. Huntress Managed EDR starts at 50, ESET PROTECT Premium starts at 10, ThreatDown Elite starts at 5 and ThreatDown Ultimate (MDR Plus) starts at 5. A business smaller than the minimum pays for the minimum, which changes the real cost per seat.
Is MDR cheaper through an MSP?
Sometimes, but public prices can't show it. Providers that sell through managed service providers let the MSP set the price, and MSPs rarely publish theirs. Get a written quote from the MSP and one from the provider direct, where it sells direct.
What is the difference between managed EDR and MDR?
Managed EDR is an EDR product with the vendor's analysts watching it around the clock. MDR is the broader service name; some MDR services also cover identity, cloud or network signals. What managed detection and response includes covers the difference in detail.
How often are these prices checked?
This edition was checked between 2 Oct 2026 and 8 Oct 2026 from a US connection, with a dated screenshot for every price. Tracked products are rechecked weekly.
Prices from the Price Index, data licensed CC BY 4.0 · Methodology · Changelog · Report an error