How much does XDR cost? The honest answer.

The short answer

Three of the six major XDR vendors publish a list price on their own site, and they price on different axes. CrowdStrike lists Falcon Enterprise, the tier that includes Falcon Insight XDR, at $184.99 per device per year, with Falcon Pro at $99.99. SentinelOne lists Singularity Complete at $179.99 and Singularity Commercial at $229.99 per endpoint per year, for 5 to 100 workstations. Microsoft prices per user: the Defender Suite add-on lists at $12 per user per month, and Microsoft 365 E5, which includes it, at $60. All checked 30 October 2026 on the vendors’ own pricing pages.

Palo Alto and Cisco show no prices on their own sites, but their US-dollar list prices are public in UK G-Cloud 15 reseller filings: Cortex XDR Pro at $70 per endpoint per year and Cisco XDR Essentials at $120.37 per user per year. Trend Vision One is sold in Flex credits, listed at $1.00 each on AWS Marketplace; Trend publishes how many credits each service uses. A list price is a small-quantity ceiling: larger estates negotiate below it, and the licence is only one of the five cost categories you will budget.

Sources: crowdstrike.com/pricing, sentinelone.com/platform-packages, microsoft.com security pricing. Checked 30 October 2026.

Why you cannot get a simple number

Every XDR vendor negotiates pricing per deployment. The same product is quoted at materially different rates for five hundred endpoints, five thousand endpoints, and fifty thousand endpoints, and the ratios are not linear. Volume discount tiers kick in at endpoint bands each vendor sets for itself, and multi-year commitments unlock another layer of discount on the per-unit rate.

Identity protection, cloud workload monitoring, email security, and data ingestion are almost always priced separately from the base endpoint rate, as additional stock keeping units. Two quotes from the same vendor for two customers of the same size can differ by more than double, depending on which modules each customer needs.

A published list price is therefore a ceiling, not a forecast of what you will pay. The useful tools are the list prices that do exist, an environment sizing exercise, and a normalisation method for the quotes you actually receive. That is what the rest of this site provides.

What you can do instead of looking up a list price

The buyer-side workflow is four steps. First, size the environment. Count endpoints, users, cloud workloads, and estimate daily telemetry volume and retention requirements. The sizing worksheet captures the six inputs a vendor sales engineer will ask for anyway; having your own numbers before the call changes the negotiation.

Second, structure the budget around the five total- cost-of-ownership categories: licensing, data ingestion and retention, onboarding and professional services, managed-service add-ons, and internal operating cost. Finance teams that see all five line items in the initial request are not surprised six months in; finance teams that see only licensing almost always are.

Third, issue an RFP to three vendors with an evaluation rubric. The vendor-evaluation page provides the rubric, and the question bank provides the prompts that force each vendor to disclose hidden fees during the quote call.

Fourth, normalise the three quotes onto a single axis. Each vendor will present the quote in the pricing structure that favours their product. Converting all three to a common per-endpoint-per-year figure exposes which vendor is actually cheapest for your environment. The pricing-models page walks through a normalisation example in detail.

The licence line at list for 1,000 endpoints

Each line is the published rate times the count, so you can redo it with your own numbers. It is the licence line only, before any negotiated discount, ingestion, onboarding or managed service. Microsoft prices per user, so its line assumes one user per endpoint.

The variables that move your quote most

• Endpoint count. Published list prices apply to small quantities (SentinelOne quotes its list for 5 to 100 workstations); above that, each vendor sets its own volume steps.
• Telemetry scope. Endpoint-only is the base rate. Adding email, identity, cloud workload, and third-party ingestion adds separate line items whose size depends on the vendor’s SKU structure.
• Retention length. Each package bundles a set retention window (SentinelOne lists 14 days in Complete and 90 days in Commercial); longer, compliance-driven retention is priced separately.
• Contract length. Multi-year commitments usually lower the per-unit rate, at the cost of flexibility if the environment changes.
• Daily ingest volume. Overage charges on ingestion start at the bundled threshold, so a telemetry forecast that runs low shows up as a bill months after go-live.