An XDR vendor’s pricing model is rarely pure. Most quotes combine two or three of four axes, layered as separate stock keeping units: a base license, an add-on identity module, a separate cloud workload protection SKU, and an ingestion overage band. Two quotes that look comparable on the cover page can price the same environment at radically different annual totals because the blend of axes is different.
Axis 1: Per endpoint
Per-endpoint pricing treats each device under protection as the billable unit. A quoted rate of ten dollars per endpoint per month for a two-thousand-endpoint environment means $240,000 per year before any other line item. Endpoints include workstations, servers, and managed mobile devices. Most vendors exclude containers and serverless functions from the endpoint count, charging them separately on the per-workload axis.
Per-endpoint rewards environments where users carry multiple devices. One user with a laptop, a tablet, and a phone counts as three endpoints; on a per-user axis the same user counts as one. For engineering-heavy or field-workforce organisations where the device-to-user ratio is above two to one, per-endpoint can price significantly higher than per-user for the same environment.
Per-endpoint penalises environments where devices are ephemeral or heavily virtualised. Virtual desktop infrastructure deployments with persistent pools often include more licensed endpoints than active users because the pool must size to peak concurrent load. Thin-client shops, seasonal retail, and contractor-heavy organisations typically pay less under per-user pricing.
- Endpoints: 2,000
- Quoted rate: $10 / endpoint / month
- Ingest overage: 10 GB/day over bundle @ $0.12/GB/mo
- Base license: 2,000 × $10 × 12 = $240,000
- Ingest overage: 10 × 30 × $0.12 × 12 = $432
- Year one total (license line): $240,432
Axis 2: Per user
Per-user pricing treats each protected identity as the billable unit. An identity includes full-time employees, contractors with access, and sometimes privileged service accounts depending on the vendor’s definition. Some vendors count all identities; others count only human identities and include service accounts in the bundle.
Per-user rewards device-heavy organisations. An engineer with a laptop, a desktop, and a dev server counts as one user on a per-user axis and three endpoints on a per-endpoint axis. For organisations where the device-to-user ratio is above one and a half, per-user is usually cheaper per device covered.
Per-user penalises contractor-heavy and seasonal workforces. Every contractor with an email address or a federated identity counts as a licensed user; many organisations are surprised by how much of their user count is contractor or partner access that was never billed under per-endpoint pricing. Extended access relationships with customers and suppliers can inflate the user count significantly.
- Users (inc. contractors): 1,400
- Quoted rate: $9 / user / month
- Identity add-on bundled
- Base license: 1,400 × $9 × 12 = $151,200
- Identity add-on: $0 (bundled)
- Year one total (license line): $151,200
Axis 3: Per cloud workload
A cloud workload is a unit of compute or storage in a cloud environment: a virtual machine, a container, a serverless function, a managed database instance. Per-workload pricing is almost always a separate SKU layered on top of per-endpoint or per-user; a vendor’s base XDR rate rarely covers cloud workload protection without a dedicated subscription.
Per-workload rewards environments with a static, predictable cloud footprint. An on-premises shop with fifty production VMs pays a small per-workload add-on. Environments where workload count is dynamic, particularly Kubernetes environments with frequent pod scheduling or serverless architectures with function counts in the thousands, face per-workload line items that can exceed the endpoint license.
Container and serverless counting is inconsistent across vendors. Some count peak concurrent workloads; some count average; some count per-workload-hour and bill a per-container equivalent based on runtime hours. The definition is worth asking before the quote is final; the same cloud environment can price differently across vendors by a factor of three depending on the counting method.
Axis 4: Per GB of ingest
Per-GB pricing treats each gigabyte of telemetry ingested into the platform as billable. Per-GB is the axis that most often surprises buyers after go-live. Initial quotes usually bundle a telemetry allowance (typically one to five GB per day per endpoint depending on source types); overage above the bundle is metered per GB with tiered pricing.
Per-GB rewards low-telemetry environments. Endpoint-only logging with minimal cloud audit ingestion and no packet capture can run under one GB per day per endpoint. Organisations that already ingest verbosely into a SIEM and migrate that ingest to an XDR face multiples of this. Full packet capture for a segment, detailed cloud audit logs from a heavy AWS or Azure footprint, and Kubernetes API logs can each add ten to twenty GB per day on their own.
The single most consequential per-GB decision is retention tier. Hot retention (immediately queryable) is commonly priced three to five times more per GB per month than cold archive. A compliance requirement for twelve months of queryable retention is a fundamentally different line item from twelve months of archive retention. The data ingestion cost page works the retention math through in full.
Normalising three quotes onto a common axis
The skill that matters most when evaluating XDR quotes is converting three differently-structured quotes into a single comparable figure. Assume an environment of two thousand endpoints, fourteen hundred users, one hundred and twenty cloud workloads, and forty GB per day of telemetry. Three hypothetical vendors quote as follows.
| Vendor A | Vendor B | Vendor C | |
|---|---|---|---|
| Structure | per-endpoint + per-GB overage | per-user bundled ingest | per-workload + per-GB |
| Quoted rate | $10/ep/mo + $0.12/GB | $11/user/mo | $4/ep + $0.08/GB |
| License calc | 2,000 × 10 × 12 = $240K | 1,400 × 11 × 12 = $185K | 2,000 × 4 × 12 = $96K |
| Ingest calc | 40 × 30 × 0.12 × 12 = $1.7K | bundled | 40 × 30 × 0.08 × 12 = $1.2K |
| Workload add-on | 120 × $5 × 12 = $7.2K | bundled | included |
| Normalised annual | $249K | $185K | $97K |
Vendor C looks cheapest on the surface. Before accepting the quote, a buyer should press on ingestion assumptions and verify that the bundled workload coverage is not limited by workload type or cloud provider. Many vendors offer headline rates that bundle generously and then exclude the most useful telemetry (for example, covering AWS CloudTrail but not AWS VPC flow logs) at a surcharge. The quote call should flush this out before the contract is signed.
Vendor B is the second cheapest despite the higher per-user rate because the bundled ingestion and workload coverage avoid the add-on SKUs. Vendor A is most expensive because the per-endpoint rate is aggressive but every module is separately billable. This pattern is common; the question bank lists the prompts that surface bundled-vs-unbundled differences.