MDR Pricing in 2026: What Managed Detection and Response Costs

Managed detection and response (MDR) in the United States is typically quoted per endpoint or per user per month, and most providers quote each customer individually rather than publishing a rate. The figure on the first page of a proposal is rarely the figure you pay. Scope, data sources, contract terms and response boundaries move the total more than the unit rate does, and this guide explains how to read each of them.

We wrote it for technology leaders at small and mid-sized organizations, local government and critical infrastructure operators who have to put an MDR line into a budget and defend it. It also covers how fractional or virtual CISO pricing compares, because many buyers price the two together.

TL;DR

• Most MDR providers quote individually against your own inventory rather than publishing a rate, so treat any price range that circulates online with caution.
• A low per-endpoint number can hide narrower coverage. Compare monitored surfaces, analyst involvement, response authority, retention and whether incident response is included.
• Ask every provider for an itemized quote: billing unit, minimums, term, discounts, expansion pricing, overages, third-party licenses and exit terms.
• Subsidized state programs are not commercial benchmarks. Public entities should check state and federal funding before comparing proposals.
• vCISO pricing is driven by scope and the number of compliance frameworks, so define both before requesting quotes.

Table of Contents

• What you are actually buying with MDR
• MDR cost in 2026
• What drives the price of an MDR quote
• Hidden costs to ask about
• Public sector and critical infrastructure: funding changes the math
• How to compare two MDR proposals fairly

• Where Simvay fits
• Virtual and fractional CISO pricing, briefly
• Building an MDR budget you can defend
• FAQ
• Sources

What you are actually buying with MDR

Before any number means anything, the product has to be defined. Gartner describes MDR as remotely delivered, human-led SOC functions that deliver rapid detection, investigation, and active threat disruption and containment. The 2024 Market Guide also notes that buyers increasingly want exposure identification and preemptive response in addition to detection.

That definition separates MDR from a software subscription. An EDR or XDR license gives you telemetry and alerts. It does not give you analysts who triage those alerts at 3 a.m., decide whether a signed binary loading a malicious DLL is a real intrusion, isolate the host and walk your administrator through remediation. Gartner’s guidance also flags a recurring problem: technology-first offerings get labeled MDR, so a low license price can describe a product with no human operating model behind it.

This matters because some endpoint vendors also sell a managed service under the MDR name. A vendor can sell endpoint technology and, separately, a managed service. Those are different line items with different costs. When you compare quotes, make sure each one prices the same thing: licensed software, or software plus a staffed detection and response function with authority to contain.

MDR cost in 2026

No single price list exists, and most providers decline to publish one. The planning ranges that circulate online come from independent compilations rather than audited datasets, so a provider’s actual quote can land well outside them. The dependable figures are a written quote priced against your own inventory and the published prices of public programs, covered below.

What drives the price of an MDR quote

The unit rate is the visible part. These factors decide the rest.

Coverage surfaces

Endpoint-only MDR is the cheapest tier. Adding cloud workloads, identity, SaaS applications, email, network telemetry or operational technology raises the price because each surface adds data volume, detection content and analyst work. If you need cloud, identity, SaaS, network or OT coverage, make sure those surfaces, and the response actions for each, are written into the proposal.

Response authority

Some services notify you and leave containment to your staff. Others isolate hosts, disable accounts and block indicators on your behalf under pre-approved rules. The second model costs more because the provider carries more operational responsibility, and it is worth more if you have no one on call overnight. Ask what the analyst is permitted to do without calling you, and what happens when no one answers.

Incident response inside or outside the contract

Some MDR contracts include a defined number of incident response hours. Others treat a confirmed breach as a separate engagement at hourly rates. A cheap monthly fee with uncapped, separately billed IR can cost more in a bad year than a higher fee with IR included. If a provider offers a retainer for IR, price it alongside the MDR fee and compare the two bundles.

Size, term and volume

Per-asset rates fall with volume and with longer commitments, and many contracts run twelve months or more. Ask for pricing at your current count and at the count you expect by renewal. Expansion pricing is where many contracts are less generous than the first-year quote suggests.

Retention and data handling

Log and telemetry retention affects both cost and your ability to investigate after the fact. Utah’s public-sector MDR project, for example, specifies 90-day EDR retention, which is the kind of detail that should appear in any proposal you receive.

Hidden costs to ask about

The most consequential pricing details are contractual. The State of Delaware’s request for proposals for managed detection asks vendors to disclose minimum commitments, discounts by volume and contract length, consulting hours, expansion pricing, third-party licenses, trials, and additional hourly or daily rates. Experienced public buyers insist on that itemization because a headline endpoint rate omits it. The same questions apply to a 60-person company or a county IT office.

Use this list in every quote request:

1. 1.Billing unit. Per endpoint, per user, per data source or tiered, and exactly how each is counted.
2. 2.Included devices and data sources. Servers, mobile devices, cloud tenants, identity providers and firewalls are often counted differently.
3. 3.One-time versus recurring charges. Onboarding, deployment and sensor installation fees.
4. 4.Minimum commitment and term. Including auto-renewal and notice windows.
5. 5.Discounts. For volume and for multi-year terms.
6. 6.Consulting and IR hours. What is included, and the rate beyond it.
7. 7.Expansion pricing and overages. What a new office, a merger or a surge in log volume costs.
8. 8.Third-party licenses. Whether the endpoint agent or SIEM license is bundled or billed separately.
9. 9.Trial or proof-of-value terms.
10. 10.Termination and data extraction. What you can take with you, in what format, and at what charge.

The Delaware RFP asks for the licensing model, monitored devices or data sources, base cost methodology, and one-time versus recurring costs, so put each bid into a spreadsheet with those columns before you look at the totals.

Public sector and critical infrastructure: funding changes the math

If you are a local government, school or utility, do not benchmark against commercial lists. State programs can price MDR far below what a provider would charge on its own.

Minnesota’s statewide program lists $32 per device per year for 2026, up from $22 in 2025, with $38 listed for 2027, all per device per year. The state attributes the price to bulk purchasing across many environments, with further reductions for local government partners through grant funding. K-12 schools have separate pricing instructions, and pricing from 2028 onward is to be determined.

Utah’s program goes further: its MOU provides MDR to participating local government entities at no cost for the project period, which ends December 31, 2027. The package includes endpoint protection, MDR, vulnerability management, 24/7/365 technical support, a technical account manager and limited DFIR access, and participation is governed by the memorandum of understanding.

The lesson is not that these numbers are what you should expect to pay. Both depend on eligibility, funding and program terms, and both expire or change. Public entities should first look for state or federal funding pathways, then evaluate any commercial proposal on retention, data location, response authority and what happens when program funding ends. Our who we serve page describes the two areas Simvay focuses on, including the public sector and critical infrastructure.

How to compare two MDR proposals fairly

A short method keeps the comparison honest.

1. 1.Write down your environment. Endpoint count by operating system, servers, cloud tenants, identity platform, SaaS applications, firewalls, and any operational technology.
2. 2.Ask each provider to price that same inventory. Do not accept a quote based on their own assumed environment.
3. 3.Test the human model. Who are the analysts, where are they located, and who answers when an alert fires at night? Can the provider contain an incident or only recommend containment?
4. 4.Ask for a written response scope. Actions the provider may take without approval, actions requiring your sign-off, and the service levels attached to each.
5. 5.Request three-year cost, not first-year cost. Include expansion, renewal uplifts and likely IR hours.
6. 6.Check the exit. Data export, agent removal and transition support.

The question underneath all six is outcome: does the service find intrusions early and stop them before they spread? A per-endpoint number cannot answer that, which is why Gartner’s framing of rapid detection, investigation and containment is a better buying lens than price alone.

Where Simvay fits

Simvay’s MDR and managed SIEM service includes identity threat detection, and incident response covers retainers, tabletop exercises and playbook development.

Virtual and fractional CISO pricing, briefly

Many MDR buyers are also deciding whether to add a part-time security executive. A vCISO and a fractional CISO are the same idea under two names: senior security leadership on a part-time basis, delivered as a monthly retainer, an hourly arrangement or a project.

Published vCISO ranges vary widely, and almost all are produced by firms that sell the service, so use them cautiously. What the guides agree on is the cost driver: scope and the compliance frameworks you must meet shape the price more than anything else, and the model should match the need, with hourly for one-off work and a retainer for ongoing leadership. Define these before you ask for quotes:

• Frameworks and deadlines. HIPAA, CJIS, PCI DSS, CMMC, NIST CSF or a state requirement each carry different workloads.
• Deliverables. Risk register, policies, board reporting, vendor reviews, incident readiness, audit support.
• Time commitment. Hours per week, and whether the person attends leadership meetings.
• Overlap with MDR. A vCISO who also oversees your detection provider can remove duplicated effort.

See Simvay’s fractional CISO service and compliance programs for what each covers.

Building an MDR budget you can defend

A workable budget has four parts: the recurring MDR fee at your current count, a growth allowance sized to your own expansion plans, a contingency for IR hours if they are not included, and one-time onboarding. Add the cost of the people and tools you would otherwise need to staff a 24/7 function, since that is the realistic alternative for most small organizations. For leaders presenting to a board or council, it helps to show the three-year total next to a conservative estimate of what a single incident would cost in downtime and recovery, using your own figures.

If your environment is mostly endpoints and one cloud tenant, an endpoint-led service may be sufficient. If you run identity, SaaS and network infrastructure that attackers target for persistence, confirm those are in scope before you sign. If you are unsure where you stand, Simvay’s services overview lists its assessment, vulnerability management and network security services.

FAQ

How much does MDR cost?

Most providers quote individually, usually per endpoint or per user per month. Public programs are the exception: Minnesota’s statewide program lists $32 per device per year for 2026. The final number depends on coverage surfaces, response authority, term and whether incident response is included. Ask for an itemized quote against your own inventory.

Why do MDR providers not publish prices?

Most price to the customer’s environment, including data sources, retention and response scope, so a single rate would mislead. That is why a written quote and service-level agreement matter more than any list price. It is also why you should give each provider the same inventory to price.

Is a low per-endpoint price a good deal?

Only if the scope matches. Gartner distinguishes MDR as human-led detection, investigation and containment, so a low rate for a license without that human function is not a comparable offer. Check monitored surfaces, analyst authority, retention and IR terms before comparing totals.

Can a local government get MDR at reduced or no cost?

Sometimes. Minnesota lists a program price of $32 per device per year in 2026, and Utah offers participating local governments MDR at no cost through December 31, 2027. Both depend on eligibility and program terms, so check your own state’s cybersecurity program before requesting commercial proposals.

How much does a virtual CISO cost?

It depends on scope, compliance frameworks and time commitment, and published figures come mostly from firms that sell the service. Define your frameworks and deliverables first, then request scoped quotes on an hourly, project or retainer basis.

Sources

• Market Guide for Managed Detection and Response, Gartner
• Managed Detection and Response, Minnesota IT Services
• SLCGP MOU, State of Utah
• Request for Proposals, Managed Detection and Response, State of Delaware DTI

Recommended

• MDR & Managed SIEM
• Fractional CTO & CISO
• Incident Response