What “small business” means in EDR
Vendor SMB tier usually maps to sub-500 endpoints, sometimes sub-100. Marketing definitions of small business are looser. This page treats genuine small business as 50 to 250 endpoints with one to three IT staff and zero dedicated security headcount. The posture math is meaningfully different above 250 endpoints, where a part-time security analyst becomes affordable and the build-vs-buy IR question changes shape.
The three SMB defensive postures
Tier 1: Strong NGAV with cyber-insurance gap acceptance
Covers: Machine-learning malware prevention, exploit protection, basic behavioural detection. No persistent telemetry.
Gaps: No threat hunting capability. No post-incident forensics. No EDR-class detection of fileless attacks. Will not satisfy most cyber-insurance underwriters.
For: Unregulated SMBs without cyber insurance, with strong patching and outsourced IT support that handles incidents reactively. Honestly: a shrinking segment in 2026 because cyber-insurance requirements have tightened.
Tier 2: Cloud-managed EDR self-deployed (the SMB EDR sweet spot)
Covers: Full EDR-class detection, telemetry retention 30 to 90 days, response capability (kill process, isolate host), threat hunting tools. Satisfies most cyber-insurance underwriters.
Gaps: Requires some IT capability to interpret alerts. The platform provides detection; someone has to triage. SMBs without analyst capability can leave alerts unread for days.
For: The most common SMB path in 2026. 100 to 500 endpoints, one to three IT staff with security as a partial responsibility. Cyber-insurance compliant.
Tier 3: Managed EDR / MDR (the answer if you cannot triage)
Covers: EDR plus 24-hour monitored response by an external SOC. No internal security analyst capability required.
Gaps: Highest absolute cost. Vendor-lock typically structural (switching MDR provider often switches the underlying platform).
For: SMBs with no internal security capability. 'We don't have anyone to look at the alerts' is the right reason to choose this. Cross-link mdrcost.com.
SMB-specific cost optimisations
Several optimisations that materially reduce SMB EDR spend, in approximate order of impact:
- Microsoft 365 bundling. If you already pay for Microsoft 365 Business Premium ($22 per user per month) or M365 E3 ($36) or E5 ($57), Microsoft Defender for Endpoint Plan 1 or Plan 2 is included. This is structurally the cheapest EDR for organisations already on Microsoft 365 because the marginal cost is zero.
- Public sub-100-endpoint SMB plans. Several vendors publish list pricing for sub-100-endpoint tiers (CrowdStrike Falcon Go and others). These plans are feature-stripped versions of the broader product. Verify the SMB plan includes telemetry retention and response capability before purchasing.
- Annual vs monthly billing. Annual billing typically 10 to 20 percent cheaper than monthly. Always negotiate annual at SMB scale; monthly is a vendor-friendly default.
- Multi-year commitment. Two-year commitments unlock 10 to 15 percent additional reduction. Three-year commitments unlock 15 to 25 percent. At SMB scale where total spend is $5K to $30K per year, the dollar savings are real but the lock-in risk is also real if your headcount or insurance situation changes.
- Bundled with other security products. Some vendors bundle EDR with email security or SaaS-app security at SMB tier with material discounts. Worth asking.
What SMB buyers most often miss in the budget
- Server licence multiplier. One server is not one endpoint. Most vendors apply a 1.5x to 2.5x multiplier. A 200-endpoint SMB that is 150 workstations and 50 servers prices materially differently from 200 flat workstations.
- Migration credit when switching vendors. Most vendors will comp the migration service when you are leaving a competitor. Always ask. A typical SMB migration service is invoiced at $10K to $25K and is one of the easiest line items to negotiate to zero.
- Training credits. SMB tiers often include one to two free admin certification seats. These are commonly forgotten and quietly absorbed by the vendor. Always ask.
- Renewal escalation. Always negotiable, often forgotten. A 5 percent annual escalation compounds to 16 percent over three years. Cap it at the contract signing.
The cyber-insurance angle for SMB specifically
For most SMBs in 2026, the primary EDR motivation is cyber-insurance compliance. Coalition, Corvus, Beazley, Embroker, and Cowbell all reference EDR or equivalent endpoint detection in their underwriting questionnaires for SMB segments. Some carriers continue to accept NGAV equivalent for sub-100-employee accounts; the window is closing.
The premium offset is meaningful at SMB scale. A typical SMB cyber policy with $35,000 base premium that drops 10 percent for documented EDR ($3,500 saved) covers roughly 60 percent of a $6 per endpoint per month EDR spend on 200 endpoints. Combined with the underlying detection-coverage benefit and the compliance-framework benefit, the math works for most SMBs.
Cross-link EDR and cyber insurance for the full carrier-by-carrier requirement table and premium-reduction band.