[advisory]Illustrative ranges only. Pricing ranges and examples on this page are illustrative market ranges aggregated from public industry research. They are not quotes, not vendor-specific, and should not be used as a basis for procurement decisions. Always request a direct quote from the vendors you shortlist.
CrowdStrike prices Falcon per device per year and routes all deals through sales, but it publishes reference tier pricing more openly than most XDR vendors. The figures below reflect publicly-disclosed reference rates and buyer survey data through June 2026. The key thing to understand is that Falcon Insight XDR is not a standalone SKU: it is the cross-layer analytics capability bundled into the Falcon Enterprise tier.
The three relevant tiers
| Tier | Per device / year | What it is |
|---|---|---|
| Falcon Pro | ~$99.99 | EDR plus next-gen antivirus. No cross-layer XDR. The EDR floor. |
| Falcon Enterprise | ~$184.99 | Adds Falcon Insight XDR and Adversary OverWatch managed threat hunting. The XDR tier. |
| Falcon Complete | Quoted | Fully-managed MDR: CrowdStrike's SOC runs detection and response. Per-environment quote, well above Enterprise. |
Reference per-device rates as of June 2026. The Insight XDR plus OverWatch premium over Pro is roughly $85 per device per year. Volume buyers commonly negotiate 15 to 30% off the Enterprise rate at scale. See /sources.
Four worked cost scenarios
Falcon Enterprise (Insight XDR included) at the $184.99 per device per year reference rate, before volume discount, Next-Gen SIEM ingestion, or onboarding.
| Environment | Devices | Enterprise / year | Likely negotiated |
|---|---|---|---|
| Small business | 250 | $46,000 | $39,000 - $43,000 |
| Mid-market | 1,500 | $277,000 | $195,000 - $235,000 |
| Lower enterprise | 5,000 | $925,000 | $650,000 - $785,000 |
| Enterprise | 25,000 | $4,625,000 | $3,000,000 - $3,700,000 |
Five optimisations that genuinely cut the Falcon bill
- Right-size the tier per device class. Servers and high-value endpoints justify Enterprise; low-risk kiosk and single-purpose devices can sit on Pro. Mixed-tier licensing cuts the blended per-device rate.
- Negotiate the Next-Gen SIEM ingestion rate separately. Third-party log ingestion is the line that grows after go-live. Lock the per-GB rate and a retention tier before signing the endpoint deal.
- Use Falcon Flex if your estate fluctuates. CrowdStrike's Flex commercial model lets you reallocate committed spend across modules; for seasonal or project-driven estates it beats fixed per-device counts.
- Bring a Cortex or SentinelOne competing bid. CrowdStrike discounts hardest against a real Cortex XDR Pro or SentinelOne Complete quote. Expect 15 to 30% movement on a genuine competitive process.
- Question Complete versus internal SOC. Falcon Complete is excellent but expensive; if you already run a 24/7 SOC, Enterprise plus your own analysts is usually cheaper than the managed tier.
Right pick when
- You want a single agent that does EDR and XDR with minimal tuning overhead.
- You value managed threat hunting (OverWatch) bundled into the licence.
- You may want to grow into Falcon Next-Gen SIEM and retire a legacy SIEM.
- You want the option of fully-managed response via Falcon Complete later.
Wrong pick when
- You only need EDR; Falcon Pro or a cheaper EDR beats paying the XDR premium.
- You are deeply Microsoft-stack with Defender XDR already funded through E5.
- You already run Palo Alto NGFWs and Cortex telemetry correlation is free for you.
- Your budget cannot absorb the Next-Gen SIEM ingestion line for full XDR breadth.
// Q&A appendix
Frequently asked questions
01.How much does CrowdStrike Falcon Insight XDR cost in 2026?+
Falcon Insight XDR is bundled into the Falcon Enterprise tier, which carries a published reference price of around $184.99 per device per year. Falcon Pro, the EDR tier without XDR, lists near $99.99 per device per year, so the Insight XDR plus Adversary OverWatch threat-hunting premium is roughly $85 per device per year. Falcon Complete, the fully-managed tier, runs materially higher and is quoted per environment. CrowdStrike does not publish full list pricing through sales, so negotiated rates vary; these are public reference figures verified June 2026.
02.Is Falcon Insight XDR a separate product or part of a Falcon bundle?+
Falcon Insight XDR is not sold as a standalone SKU; it is the XDR capability bundled into the Falcon Enterprise tier and above. You buy the Enterprise tier (around $184.99 per device per year reference) and Insight XDR is included alongside Falcon Insight EDR and Falcon Adversary OverWatch. Buyers wanting only EDR drop to Falcon Pro near $99.99 per device per year and forgo the cross-layer XDR analytics.
03.What is the difference between Falcon Pro, Enterprise, and Complete?+
Falcon Pro is EDR plus next-gen antivirus at around $99.99 per device per year. Falcon Enterprise adds Falcon Insight XDR cross-layer analytics and Adversary OverWatch managed threat hunting at around $184.99 per device per year. Falcon Complete is the fully-managed MDR tier where CrowdStrike's own SOC runs detection and response for you; it is quoted per environment and typically lands well above Enterprise on a per-device-equivalent basis.
04.Does CrowdStrike charge extra for data ingestion?+
Falcon's core endpoint telemetry is included in the per-device licence, but third-party log ingestion through Falcon Next-Gen SIEM (formerly Humio / LogScale) is billed separately on a data-volume basis. Environments that route firewall, cloud, and identity logs into Falcon for full XDR correlation should budget a separate ingestion line, commonly adding 20 to 40% on top of the per-device endpoint cost.
05.What does Falcon Insight XDR cost for 1,000 endpoints?+
A 1,000-device Falcon Enterprise deployment lands near $185,000 per year at the reference per-device rate, before any volume discount, third-party ingestion, or onboarding. Mid-market buyers commonly negotiate the per-device rate down 15 to 30% at scale, bringing the licence line to roughly $130,000 to $160,000. Add Falcon Next-Gen SIEM ingestion if you correlate non-endpoint telemetry, plus onboarding of $10,000 to $35,000 in year one.
06.Is CrowdStrike Falcon more expensive than Cortex XDR?+
At equivalent XDR tier the two are close, usually within 10 to 20% of each other, with the winner decided by negotiation leverage rather than list price. Falcon Enterprise lists near $184.99 per device per year; Cortex XDR Pro lands in a comparable $120 to $216 per endpoint per year band before discount. CrowdStrike tends to publish reference pricing more openly while Palo Alto keeps Cortex quote-only, but both move significantly in a competitive process. Run both as a live bid.