Three of the six XDR vendors covered here publish list prices on their own sites (CrowdStrike, SentinelOne and Microsoft), and those are the figures this site uses for them, linked and dated. Palo Alto and Cisco list prices are public only through resellers’ UK G-Cloud 15 filings, which their pages cite. Trend Micro sells credits. The framework pages (TCO, sizing, pricing models) are methods for your own numbers, and any worked figures on them are labelled illustrative.
Vendor list pricing (checked 30 October 2026)
Published per-device annual prices: Falcon Go $59.99, Falcon Pro $99.99, Falcon Enterprise $184.99. Falcon Complete (managed) is contact-sales. Used on the CrowdStrike pages and the homepage.
Published per-endpoint annual prices for 5 to 100 workstations: Singularity Complete $179.99, Singularity Commercial $229.99; Singularity Enterprise is contact-sales. SentinelOne states that purchases go through an authorised partner whose pricing controls.
Published US prices, paid yearly: Microsoft Defender Suite $12.00 per user per month (requires Microsoft 365 E3, or Office 365 E3 with Enterprise Mobility + Security E3); Microsoft 365 E5 $60.00 per user per month (E5 without Teams $51.45); Defender for Office 365 Plan 1 $2.00 and Plan 2 $5.00. Microsoft does not currently show standalone prices for Defender for Endpoint, Defender for Identity or Defender for Cloud Apps; it sells them inside the Defender Suite and Microsoft 365 E5.
List prices published only through resellers, or not at all
Palo Alto shows no Cortex XDR price on its own site. Its US-dollar list prices appear in UK G-Cloud 15 reseller pricing documents (Softcat 16 January 2026, CDW 8 January 2026): Cortex XDR Prevent $40 and Cortex XDR Pro $70 per endpoint per year, Pro $400 per daily ingested GB.
Cisco shows no Cisco XDR price on its own site. The Cisco Global Price List figures appear in a UK G-Cloud 15 filing by Somerford Associates (29 January 2026): Essentials $120.37, Advantage $181.58 and Premier $419.66 per user per year, US dollars.
Trend publishes how many credits each app and service consumes (for example Endpoint Security Core 45 credits per endpoint per year, Pro 300). Its AWS Marketplace listing for TrendAI Vision One prices TrendAI Flex credits at $1.00 each on a 12-month contract (aws.amazon.com/marketplace/pp/prodview-u2in6sa3igl7c, checked 30 October 2026).
Compliance retention standards
Twelve months audit-log retention minimum, ninety days immediately queryable. Used on the sizing and data-ingestion pages. See also pcicompliancecost.com.
Six-year retention for documentation of policies and procedures; implicit audit-log retention to support access accountability.
Log retention policy is defined by the organisation's own control language. See soc2compliancecost.com.
Risk-based retention; the retention period is defined by the organisation's risk assessment. See iso27001auditcost.com.
No explicit log-retention period; retention must be justified against the purpose for which the logs are kept.
Section 802 and the SEC's implementing rule require audit workpapers to be kept for seven years; organisations commonly align retention for logs that support internal control over financial reporting with it.
Breach cost context
Breach-cost data by industry and organisation size. Used only as context for the benefit side of a consolidation decision, never as a price.
Methodology notes
- Illustrative figures
The five-category TCO mix, the retention-rate examples and the worked scenarios on the framework pages are illustrative models built to show how the categories add up. They are not drawn from a published study. Replace each input with the figure in your own quote.
- Consolidation breakeven
There is no published threshold for how many point tools an XDR platform must retire to pay for itself. The TCO page shows the comparison to run on your own invoices.
Vendor prices are re-checked against each vendor’s own page; compliance standards are refreshed on their publishers’ own cadence.