XDRCost.com draws on two kinds of source. The framework pages (TCO, sizing, pricing models) use aggregated market ranges built from the published research below, presented as ranges rather than quotes. The named vendor pages (Cisco, Microsoft Defender, CrowdStrike, Cortex, SentinelOne, Trend Micro) cite each vendor’s own published list or reference pricing, labelled as list reference prices, not negotiated quotes. Where a vendor publishes no list price, that page’s figures are flagged as aggregated public-research bands.
Analyst reports
Annual market analysis covering XDR vendor landscape, native vs open architectures, and typical deployment patterns. Not a pricing source; used for category definition and architecture taxonomy.
Vendor capability evaluation. Used for cross-layer telemetry coverage benchmarks and for the definition of native-vs-open architecture distinctions.
Market-share and capability benchmarks. Used in the total-cost-of-ownership framework for category proportions (licensing, ingestion, onboarding, managed service, operating cost).
Total cost of ownership studies
Multiple TEI studies published for XDR and related platforms. Used for proportion estimates across the five TCO categories and for the consolidation-breakeven framing.
Honest TCO framework for small and mid-market EDR. Used as a reference point for per-endpoint licensing ranges and for the retention-cost math on the data-ingestion page.
Aggregated breach-cost data by industry and organisation size. Used for ROI framing in the consolidation breakeven model (breach-cost avoided as a soft benefit).
Compliance retention standards
Twelve months audit-log retention minimum, ninety days immediately queryable. Used on the sizing and data-ingestion pages. See also pcicompliancecost.com.
Six-year retention for documentation of policies and procedures; implicit audit-log retention to support access accountability.
Log retention policy is defined by the organisation's own control language, typically twelve months minimum. See soc2compliancecost.com.
Risk-based retention; retention period is defined by the organisation's risk assessment. Twelve months is a common baseline. See iso27001auditcost.com.
No explicit log-retention mandate; incident-response obligations imply evidentiary retention for security logs, commonly interpreted as twelve to twenty-four months.
Seven-year retention for financial-system audit logs relevant to internal control over financial reporting.
Vendor list pricing
Per-user list prices on the Microsoft Defender page (Defender for Endpoint P2 $5.20, Office 365 P2 $5.00, Identity $5.50, Cloud Apps $5.00; Microsoft 365 E5 ~$60 as of the 1 July 2026 uplift, up from $57) are Microsoft published list prices. E5 Security was renamed Microsoft Defender Suite in October 2025.
Cisco XDR is licensed per user per year. The Essentials starting reference (~$69/user/year) on the Cisco XDR page is sourced from the Cisco XDR licenses page and reseller (CDW) SKU listings; Cisco does not publish standalone per-user list rates for Advantage or Premier (Premier is a Cisco-managed service, quote-only). Labelled as published reference where available.
- Aggregated public-research bands (CrowdStrike, Cortex, SentinelOne, Trend Micro)
These vendors do not publish enterprise list pricing. Figures on their pages are aggregated from public research, reseller listings, and MSP-published TCO guides, and are labelled as research bands rather than vendor list prices.
Methodology notes
- Market range derivation
The per-endpoint and per-user ranges quoted across the site ($6-$18 and $5-$15 respectively) are the union of ranges reported in the Bellator, Forrester TEI, IDC, and IBM sources above, plus aggregated ranges from MSP-published TCO guides. They are not quotes and are not vendor-specific.
- Consolidation breakeven
The four-tool-rule-of-thumb for consolidation breakeven is an informal pattern from published TEI case studies. It is a rule of thumb, not a universal threshold; environments vary and the breakeven calculation on the TCO page is the method to verify for your own case.
- Retention cost math
Hot-vs-cold storage rates quoted at $0.12 and $0.03 per GB per month are illustrative mid-range values consistent with published vendor reference pricing. Actual rates vary by vendor and by contract; use the rates in your quote, not the illustrative rates, when calculating your own retention cost.
Research cited above represents the analyst landscape and compliance standards effective at the time of publication. Analyst reports are refreshed annually; compliance standards are refreshed on the framework publishers’ own cadence. The aggregated ranges on the site will be updated as new editions publish.