Endpoint IndexHow much antivirus and EDR cost a small business in 2026
Contents
- Executive summary
- What does endpoint security cost at 10, 25 and 100 seats?
- How much does antivirus cost compared with EDR and managed response?
- Do endpoint security vendors give volume discounts?
- Why do some vendors not publish prices?
- What else adds to the cost?
- How much should a 10-person business budget for endpoint security?
- Frequently asked questions
- Methodology and caveats
- Sources
Executive summary
What a small business pays for endpoint security is decided by who does the response work, not by how clever the software is: entry-level EDR costs little more than entry-level antivirus, and the real jump comes when a vendor's analysts are included. The cheapest published antivirus is $30.00 per device per year and the cheapest EDR is $36.00. The cheapest bundle with 24/7 analysts included is $99.00.
The spread across all 17 products tracked, as of 2026-10-02, runs from $30.00 to $179.99 per endpoint or user per year; the midpoint is $69.50. Ten seats cost $300.00 a year at the bottom (Webroot Business Endpoint Protection) and $1,799.90 at the top (SentinelOne Singularity Complete).
What that means when you buy:
- Budget for the response, not the licence. If nobody on staff can act on an alert, the managed price is the one to plan around.
- Do not wait for volume discounts. Of the 9 products with list prices at 10 seats and at 100, only 3 charge less per seat at 100.
- Treat a missing price as a negotiation. 4 of 17 products are quote-only, sold through resellers or MSPs at whatever margin the partner chooses.
- Check the minimum before the price. 7 products refuse one-seat orders, which inflates the real cost for very small teams.
What does endpoint security cost at 10, 25 and 100 seats?
Every product that publishes a price appears below, at the list price the vendor publishes. Not every product has a price at every size: some stores stop below 100 seats, some vendors sell only above a minimum, and some larger-fleet rates are sold through sales or partners (see Methodology). The monthly column is the 10-seat annual price divided by twelve, for comparison with monthly billing. The SMB price index applies the same rule to products we don't track in depth, and lists the vendors that sell only by quote.
| Product | Per unit per month | 10 seats / yr | 25 seats / yr | 100 seats / yr |
|---|---|---|---|---|
 Webroot Business Endpoint Protection | $2.50 /endpoint/mo | $300.00 | $750.00 | $3,000.00 |
 Microsoft Defender for Business | $3.00 /user/mo | $360.00 | $900.00 | $3,600.00 |
 Bitdefender GravityZone Business Security | $3.21 /endpoint/mo | $384.99 | $854.99 | $3,064.99 |
 ESET PROTECT Core | $4.58 /endpoint/mo | $549.00 | $1,167.50 | Via sales (online up to 99) |
 Avast Ultimate Business Security | $4.73 /endpoint/mo | $567.70 | $1,329.50 | $4,050.00 |
 CrowdStrike Falcon Go | $5.00 /endpoint/mo | $599.90 | $1,499.75 | $5,999.00 |
 ThreatDown Advanced | $6.58 /endpoint/mo | $790.00 | Via sales (online up to 20) | Via sales (online up to 20) |
 SentinelOne Singularity Control | $6.67 /endpoint/mo | $799.90 | $1,999.75 | $7,999.00 |
 Acronis Cyber Protect | $7.08 /endpoint/mo | $850.00 | $2,125.00 | $8,500.00 |
| Bitdefender GravityZone Business Security Premium | $7.33 /endpoint/mo | $879.99 | $1,869.99 | $6,039.99 |
| ThreatDown Elite | $8.25 /endpoint/mo | $990.00 | Via sales (online up to 20) | Via sales (online up to 20) |
| SentinelOne Singularity Complete | $15.00 /endpoint/mo | $1,799.90 | $4,499.75 | $17,999.00 |
 Huntress Managed EDR | Min 50 seats | Min 50 seats | Min 50 seats | $9,588.00 |
Each row links to the product page, which carries the source page, the date the price was last checked and an archived screenshot of it.
How much does antivirus cost compared with EDR and managed response?
The three layers of endpoint security sit at clearly different price points:
| Layer | Products | Cheapest per unit per year | Median per unit per year |
|---|---|---|---|
| Antivirus / EPP | 9 | $30.00 | $56.77 |
| EDR | 8 | $36.00 | $79.99 |
| EDR with 24/7 managed response included | 3 | $99.00 | $99.00 |
The EDR row counts the managed bundles too, since they are EDR products. Medians use only published 10-seat prices, so a product with a larger minimum purchase (Huntress Managed EDR, 50 seats) is left out.
One caution on the EDR floor: per-user prices, such as Microsoft Defender for Business at $36.00 per user per year, look cheaper than they are for staff who use two machines. The pattern still holds across the table: moving from blocking to detection is cheap, and moving from detection to someone watching it is not.
Where nobody on staff handles security, the honest comparison is not managed EDR against antivirus. It is managed EDR against having nobody respond when EDR raises an alarm.
Do endpoint security vendors give volume discounts?
Few do. Of the 9 products with published prices at both 10 and 100 seats, 3 charge less per seat at 100. The others hold one per-seat rate from their minimum to their maximum.
- $88.00 at 10 → $60.40 at 100−31%
- $56.77 at 10 → $40.50 at 100−29%
- $38.50 at 10 → $30.65 at 100−20%
For a flat-rate product, 100 seats cost exactly ten times what 10 seats cost. Two consequences follow:
- Growth rarely reshuffles the ranking. A product that is cheap at 10 seats stays cheap at 100 unless it is one of the discounters.
- Negotiation happens in the channel. Resellers and MSPs move on price; published list prices mostly do not.
Why do some vendors not publish prices?
4 of the 17 products tracked have no public price. They sell through resellers and managed service providers, who add their own margin and often bundle the licence with services. For a buyer that has three practical effects:
- Get at least two quotes. Partners can price the same product very differently.
- Ask for the licence price and the term as separate lines. A bundled quote that includes monitoring or support hides what the software costs.
- Expect a floor. Channel-sold products often carry seat minimums or multi-year terms. Cynet, for example, is quote-only and its terms make sales orders non-cancellable.
A quote-only product scores zero on the price-transparency part of the SMB Fit Score. That penalises the buying experience, not the software.
What else adds to the cost?
The list price leaves out five costs that often decide the real total:
- Per user or per device. Microsoft sells Defender for Business per user, at $36.00 per user per year. Most others license per device, so the cheaper model depends on how many machines each person uses.
- Seat minimums. A 3-person team facing a 5-seat minimum pays for 5. Huntress Managed EDR bought direct or from a reseller starts at 50 endpoints, which the table shows as "Min" instead of a 10-seat price; through an MSP Huntress sets no minimum, but the MSP sets the price.
- Add-ons. Managed response, patch management, email security and mobile protection are often sold separately. Each product page marks every capability as included, add-on or not offered.
- Renewal terms. Annual prepayment and auto-renewal are the norm. SentinelOne's Master Subscription Agreement renews at 120% of the previous order if you neither give notice at least 30 days before the term ends nor place a renewal order.
- Staff time. A product that needs daily attention costs hours as well as dollars. 10 of 17 products have an online checkout, and those tend to be the ones built to run unattended.
The buyer mistake that follows from all five: comparing headline per-seat prices. Compare the one-year and three-year total at your own seat count instead.
How much should a 10-person business budget for endpoint security?
For ten people with one computer each, the published floors are:
- Self-managed antivirus / EPP: from $30.00 per device per year, or $300.00 a year for ten devices.
- EDR run by you or your IT provider: from $36.00 per user or device per year, plus the time of whoever answers the alerts.
- EDR with 24/7 managed response: from $99.00 per seat per year, or $990.00 for ten seats.
If you are a ten-person office with no IT support, plan on the managed figure; the antivirus figure is only honest if you accept blocking with no investigation. If you are already paying an MSP, ask what it charges for EDR monitoring before assuming the middle line is the cheapest. And if your staff each use a laptop and a desktop, price per-user and per-device products separately before choosing.
Frequently asked questions
How much does endpoint security cost per device?
The median is $69.50 per endpoint or user per year, and 10-seat list prices run from $30.00 to $179.99. Self-managed antivirus fills the bottom of that range and bundles with 24/7 analysts fill the top.
What is the cheapest endpoint protection for a small business?
Webroot Business Endpoint Protection costs least for 10 seats: $300.00 a year at list price. The lowest per-device antivirus price is $30.00 (Webroot Business Endpoint Protection). Cheapest is not the same as right; the buyer's guide explains how to weigh price against test results and who responds to alerts.
What does managed detection and response cost per seat?
Managed detection and response starts at $99.00 per seat per year among bundles that publish a price (ThreatDown Elite). Quote-only managed services sit outside that figure, so expect some quotes above it.
Is endpoint security cheaper per user or per device?
Per-user licensing is cheaper when each person uses two or more machines, because one licence covers them all. Per-device licensing is cheaper when devices barely outnumber people, or when shared machines serve several staff.
Do endpoint security prices change often?
Vendors adjust prices and promotions several times a year. An automated job re-checks every sourced price against the vendor's page each week, a changed value is corrected by hand before it publishes, and every change is logged with its old and new value in the public changelog.
Methodology and caveats
Prices were taken from each vendor's own online store, pricing calculator or pricing page, as a buyer sees them, in US dollars, for a one-year term at 10, 25 and 100 seats where the vendor publishes a price at that size. Where a vendor publishes a single per-seat price with no volume tiers, the totals multiply that price by the seat count, and the product page says so. A blank cell means the vendor publishes no price at that seat count; ESET's calculator, for example, stops at 99 devices. Where a vendor sells only above a minimum, the table shows "Min" and the minimum instead of a price.
- List prices only. Promotions, reseller discounts, multi-year discounts and taxes are left out. When a vendor shows a promotional price, the product page records it on a separate line.
- Units differ. Most products are priced per device. Microsoft Defender for Business is the only per-user product with a published price; Sophos Endpoint is also licensed per user but is quote-only. The tables label each unit.
- No price beyond the online store. ThreatDown's online store sells 5 to 20 devices, so at 25 and 100 seats the tables show "Via sales": ThreatDown publishes no price at those sizes. We never fill those cells from quotes or back-end price feeds.
- Figures update themselves. This report reads its numbers from the Endpoint Index database whenever the site is built, so a re-verified price changes here at the same moment. Most recent price check in this dataset: 2026-10-02.
- Coverage. 17 products from 14 vendors. Unlisted vendors can request inclusion at no charge.
This report is information for buyers, not procurement advice. Check the current price with the vendor before you buy.
Sources
- Vendor online stores, pricing calculators and pricing pages for each product, linked from each product page with verification dates and archived screenshots.
- SentinelOne. Master Subscription Agreement, section 11.1.
- Cynet. Terms and conditions, section 6.4.
- Endpoint Index. SMB Fit Score methodology.
- Endpoint Index. Public changelog of price and data changes.
Related research
All research ›Methodology · Report an error · Vendor not listed? Get listed