EDR vendor pricing: the entry EDR tier for every major platform.

On entry-EDR-tier price, standalone Datto EDR is the lowest of the named vendors at roughly $2.99 per endpoint per month (~$36 per year), though it is MSP-channel sold rather than self-serve and Kaseya publishes no list price. Among published list prices, Microsoft Defender for Endpoint Plan 2 is cheapest at $5.20 per user per month ($62.40 per user per year), and it is free for Microsoft 365 E5 customers. Palo Alto Cortex XDR Pro is next at $70.00 per endpoint per year on the filed G-Cloud rate card, which makes the Cortex licence cheaper than most of this table rather than the premium option it is usually assumed to be. The catch is retention: the Cortex licence includes 30 days, and each further 30 days of hot storage lists at $7.50 per endpoint per month, so a 60-day requirement takes it to $160 per endpoint per year and past everything below. Bitdefender Business Security Premium follows at $88.00 per device per year falling to $60.40 at 100 devices, then CrowdStrike Falcon Pro at $99.99 per device per year, Sophos XDR at $136.60 per user per year, and SentinelOne Singularity Complete at $179.99 per endpoint per year. All list prices move on negotiation, and SentinelOne and Sophos both route real deals through partners.

Most of them now do, and that changed during 2026. CrowdStrike and Microsoft publish per-tier prices on their own sites. SentinelOne publishes Singularity Complete and Commercial on its platform packages page. Bitdefender sells GravityZone direct with a device-count calculator up to 100 devices. Sophos publishes fixed 12-month rates on its own AWS Marketplace listing even though sophos.com routes to a quote. Palo Alto publishes nothing itself, but its resellers file full Cortex XDR price schedules with part numbers on the UK G-Cloud framework, which is where the $70.00 per endpoint per year figure on this table comes from. What is still genuinely unpublished in any form: Kaseya's Datto EDR and Kaseya 365 bundles, Bitdefender's Enterprise tier, SentinelOne's Enterprise package, and every managed-detection add-on. Vendors hide pricing to preserve discount flexibility and to make apples-to-apples comparison harder. Where a price is genuinely unpublished, the figures on this site are labelled as aggregated estimates rather than vendor list prices; where a filed rate card exists, we cite the part number.

Public buyer reports put typical movement at 20 to 50 percent off list, driven by volume thresholds (commonly 500, 1,000, and 5,000 seats), multi-year commitment (a further 10 to 20 percent), and competitive quotes. A genuine competing quote in writing is the single strongest lever; CrowdStrike and SentinelOne in particular discount hard against each other.