Cisco XDR is licensed per user per year, not per endpoint. On the Cisco Global Price List, as filed by a reseller on UK G-Cloud 15 in January 2026, Essentials lists at $120.37 per user per year, Advantage at $181.58 and Premier, the Cisco-managed tier, at $419.66. Essentials and Advantage need at least 100 users; Premier needs 1,000.
Cisco XDR is licensed per user per year, sold in three tiers: Essentials, Advantage, and Premier. Cisco does not show prices on its own site, but the Cisco Global Price List figures are public in a UK G-Cloud 15 filing by the reseller Somerford Associates (January 2026), in US dollars: Essentials $120.37, Advantage $181.58 and Premier $419.66 per user per year. Every tier includes 2 GB of data ingestion per user per month and 90 days of retention by default, with more ingest and 180- or 365-day retention available. Many enterprise deals fold into a broader Cisco Enterprise Agreement, where the price is negotiated from list.
The three subscription tiers
| Tier | Per user / year | Best for |
|---|---|---|
| Essentials | $120.37 | Mid-market Cisco shops; full XDR analytics over the Cisco Security portfolio |
| Advantage | $181.58 | Adds Cisco-curated integrations with select third-party security tools |
| Premier | $419.66 | Cisco-run service: 24x7 Cisco SOC, penetration testing, Talos IR |
Source: Cisco Global Price List (USD, per user per 12 months) as filed by Somerford Associates on UK G-Cloud 15, pricing document dated 29 January 2026, checked 30 October 2026. Minimums: 100 users for Essentials and Advantage, 1,000 for Premier. These are list prices, not quotes; run a competitive process and bring a real Cortex XDR or CrowdStrike Falcon bid to the table.
What you actually buy at each tier
Essentials
XDR analytics over Cisco-native telemetry: Secure Endpoint (EDR), Umbrella (DNS / web), Secure Email, Duo (identity). Detection content covers the most common attacker behaviours; case management is single-team-friendly; retention is 90 days by default, with 180- and 365-day windows available. The right starting tier for organisations already running multiple Cisco security products who want to consolidate analytics without buying broader integration breadth.
Advantage
Everything in Essentials plus expanded third-party telemetry connectors (other EDR vendors, SaaS application logs, cloud platforms), more advanced detection content, and the case-management and reporting capabilities organisations with a dedicated SOC team typically need. At list it is $61.21 per user per year above Essentials.
Premier
Premier delivers the full Advantage feature set as a Cisco-managed service, not a self-run licence tier. Cisco's own security operations centre runs detection and response around the clock, and the tier bundles security validation through penetration testing and select Cisco Talos Incident Response services. It is positioned for organisations that want Cisco XDR's analytics operated for them rather than staffing a 24x7 SOC in-house. It lists at $419.66 per user per year with a 1,000-user minimum.
The Cisco EA bundling math
The price list notes that multi-year pricing is available on request and that Cisco XDR can be bought through a Cisco Enterprise Agreement or Security Suite. EA economics matter most for organisations already buying heavily into Cisco security and networking. Cisco does not publish EA discount levels, so compare any EA offer against the per-user list price above rather than against a quoted discount percentage.
When Cisco XDR is the right choice
- You already license multiple Cisco security products (Secure Endpoint, Umbrella, Secure Email, Duo, Secure Firewall).
- You are running a Cisco Enterprise Agreement and have remaining budget to consolidate into.
- Your security team is small to mid-sized and prefers a single-vendor stack to best-of-breed sprawl.
- Your environment is not so heavily cloud-native that AWS / Azure / GCP-native security tools (GuardDuty, Defender for Cloud, Security Command Center) are doing most of the detection.
When Cisco XDR is the wrong choice
- You are a greenfield XDR buyer with no existing Cisco security investment - Cortex XDR or CrowdStrike Falcon are usually stronger choices.
- You are deeply Microsoft-stack and want native Defender XDR integration as the centre of gravity.
- Your endpoint protection is CrowdStrike, SentinelOne, or Defender, and you do not want to pay Cisco a separate analytics layer over an EDR you bought elsewhere.