The short answer
EDR licence costs land in the three to fifteen dollar per endpoint per month range for cloud-managed platforms, in aggregated public industry research. SMB-tier products with sub-100-endpoint plans run two to five dollars. Mid-market deployments typically settle at five to eight dollars per endpoint per month after volume discount. Premium platforms with extensive threat intelligence, threat hunting, and analyst tooling run ten to fifteen dollars and sometimes above.
Add deployment and onboarding at five to fifteen percent of year-one TCO. Add an optional incident-response retainer or fully-managed add-on in the fifteen to forty-five dollars per endpoint per month band for twenty-four-hour-monitored coverage. Add internal operating cost, typically half to one full-time equivalent per thousand endpoints, depending on whether you are running EDR yourself or contracting MDR.
These are aggregated public-research ranges, not quotes. They are sourced from Gartner Market Guide for EDR public summaries, Forrester EDR Wave public summaries, Bellator’s published EDR TCO research, IBM Cost of a Data Breach 2025, Verizon DBIR 2025, and public cyber-insurance underwriter guidance. See the sources page for the full citation list.
Why you cannot get a single number
EDR pricing is negotiated. The same vendor quotes materially different rates for 100 endpoints versus 1,000 versus 10,000. Volume discounts of fifteen to twenty-five percent at five hundred endpoints, and twenty-five to forty percent at two thousand endpoints, are typical at quarter-end. Multi-year commitments of two or three years unlock an additional ten to twenty percent reduction.
Server endpoints are typically priced higher than workstation endpoints, often in the 1.5x to 2.5x range because servers carry more telemetry and attract more threat-hunting attention. Mobile devices are sometimes free, sometimes paid at a discount to workstation rate. VDI environments are sometimes priced per-user instead of per-endpoint, which can move the total in either direction depending on user-to-device ratio.
Cloud-managed deployments are typically twenty to forty percent cheaper than on-prem deployments from the same vendor. SMB-tier products with public list pricing exist (some vendors publish sub-100-endpoint plans at standardised rates), but those plans are a feature-stripped slice of the broader market and do not indicate what an enterprise pays per endpoint after negotiation.
What you can do instead
Place yourself on the endpoint defense ladder before talking to vendors. Decide whether you need entry-level NGAV, mid-tier EDR, or premium EDR with managed-service add-on. Walking into a vendor call knowing your tier is the single most consequential preparation step.
Size your endpoint estate honestly. Workstations, servers, mobile, contractors, deployment topology. Server counts and contractor counts both move the quote materially.
Build a five-category total-cost-of-ownership model with line items in each category. Get three competing quotes. Normalise them onto a common pricing axis. Use the budget calculator to take a vendor-quoted rate and produce a defensible year-one and three-year number.
Three worked deployment scenarios
The numbers below use aggregated public-research market ranges. They are illustrative, not specific vendor claims. Each scenario assumes cloud-managed EDR with annual billing.
| Line item | SMB (50 – 250 ep) | Mid-market (250 – 2,500 ep) | Larger (2,500 – 10,000 ep) |
|---|---|---|---|
| Per-endpoint rate | $3 – $8 | $5 – $9 | $4 – $7 (post-discount) |
| Discount band off list | 0 – 10% | 15 – 25% | 25 – 40% |
| Year-one licence | $1.8K – $24K | $15K – $270K | $120K – $840K |
| Deployment one-time | $5K – $15K flat | $25 – $50/ep | $25 – $75/ep |
| Optional IR retainer/yr | $15K – $40K | $50K – $250K | $200K – $1M+ |
| Internal ops (FTE) | 0.25 – 0.5 | 1 – 2 | 2 – 5 |
The internal operating cost line is what most often surprises finance teams. A 1,000-endpoint mid-market shop running EDR in-house typically allocates one full-time analyst at fully-loaded cost of $130,000 to $180,000 per year against the EDR platform. That allocation is structurally larger than the licence in many deployments.
The five variables that move your quote most
- Endpoint count. The largest single variable. Volume discount tiers commonly start at 500 endpoints, with major step-changes at 2,000 and 10,000.
- Telemetry retention length. Default thirty days is cheapest. Ninety days is a common mid-tier upgrade adding ten to twenty percent. One-year retention is typically a premium SKU.
- Server-vs-workstation mix. Server endpoints typically priced 1.5x to 2.5x the workstation rate. A 500-endpoint estate that is actually 350 workstations and 150 servers prices materially higher than a 500 flat-workstation estate.
- Contract length. One-year contracts are baseline. Two-year contracts typically unlock 10 to 15 percent off list. Three-year contracts unlock 15 to 25 percent off list, sometimes more at quarter-end.
- Managed add-ons. Pure-EDR licence rate is the cheapest configuration. Adding vendor-managed threat hunting, twenty-four-hour SOC, or fully-bundled MDR can double the per-endpoint total all-in.
Next step
Move from a market range to a defensible number for your specific environment. The pricing models page covers the per-endpoint, per-user, and per-device-class axes vendors quote on. The total cost of ownership page walks through the five categories. The onboarding and setup fees page covers the often-missed deployment line items. The budget calculator stitches it all together. SMB-specific guidance lives on the EDR for small business page.