How we source EDR pricing figures
Every vendor price on this site traces to one named, checkable source, and the page carries it: a link, the surface it came from, and the date we read it. Where a vendor publishes a price itself we cite its own page. Where it publishes nothing but a reseller has filed a rate card, we cite the part number and the filing, and we carry the filing’s vintage rather than dressing it up as today’s price. Where no published price exists in any form, we say so and label the figure an estimate instead of inventing a list price. Cost ranges we build ourselves are arithmetic over inputs stated on the page, so you can redo the sum.
Sources
- Vendor public pricing pages. CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne Singularity and Bitdefender GravityZone each publish per-tier prices on their own sites. These are quoted as list prices, with the vendor page as the source.
- Marketplace listings. AWS Marketplace publishes fixed 12-month dimensions for vendors whose own sites route to a quote, which is where our Sophos Intercept X figures come from. A marketplace listing is a real published price for that listing; it is not evidence of what the vendor sells for directly, so we attribute it to the marketplace.
- Filed reseller rate cards. Palo Alto publishes no Cortex XDR price at all, but its resellers file full price schedules with part numbers on the UK G-Cloud framework. We read those filings directly and cite the SKU. Because a filing is a snapshot, we state when it was filed as well as when we read it.
- Published efficacy testing. MITRE ATT&CK Enterprise Evaluations, AV-Comparatives and AV-TEST, used for detection-quality context only. We do not price from them.
What we deliberately do not publish
- Specific customer contract values. Where a specific organisation's EDR contract value is known to us through public reporting, it is described in band terms only.
- Vendor-private discount math. Bespoke discount levels are commercially confidential. Expect 20-50% movement on a real negotiation, depending on volume and renewal posture.
- Side-by-side feature grids. We publish positioning notes per vendor but not feature grids. EDR feature parity changes monthly; static grids are stale within weeks.
Update cadence
Site values update only when the underlying reality changes. Triggers:
- Major vendor pricing-model change (e.g. per-endpoint to per-identity, module repackaging)
- New entrant publishing pricing materially below the existing band
- Major EDR acquisition or product retirement event
- Substantive changes in published efficacy testing that affect tier assignments
Cosmetic date bumps are not made.
Editorial position
This site is operated by Digital Signet, an independent AI-development studio. Digital Signet does not sell EDR software, does not run a managed-EDR practice, does not act as a vendor reseller, and does not accept paid placements from any EDR vendor. See /about for the operator and the wider network.
Editorial direction is set by Digital Signet's editor. Drafts are produced via Digital Signet's autonomous AI development methodology and reviewed against the editorial framework before publication.
Contact
For methodology questions, corrections, or scenarios that don't fit cleanly: [email protected].