What managed security services cost

Your insurer has asked who watches your systems overnight, or a customer's questionnaire wants to know, or a provider has just sent a proposal with a monthly figure on it. You go looking for what managed security should cost and find ranges with nobody's name attached.

The number matters more than it looks. These are annual contracts priced per head of your estate, and two proposals that look alike can be priced in different units, with the security software included in one and not the other. This page explains how the category is priced, sets out every figure we found on a provider's own pricing page, and lists the costs that sit outside the per-unit rate. It covers managed detection and response, managed SIEM and the services sold alongside them. It does not tell you who to hire.

How managed security is priced

Almost every provider charges a monthly rate per unit of your estate against an annual commitment. What changes from one proposal to the next is the unit.

• Per endpoint or device. Huntress prices managed EDR per endpoint. UnderDefense prices per asset, which its MDR pricing page defines as any host running a workstation or server operating system that has sent data in the last 30 days. Rapid7 uses the same definition for Managed Threat Complete.
• Per user. eSentire, Field Effect and BitLyft charge per user. Field Effect's pricing page notes that most organisations run 1.5 to 2 endpoints for every user, which is the conversion to apply before you set a per-user quote beside a per-endpoint one.
• Per component. Huntress prices each managed product separately: identities for identity threat detection, data sources for its SIEM, learners for awareness training.

Two quotes in different units cannot be compared until both are converted against your own counts, which our guide to choosing a cybersecurity company walks through.

What the monthly fee buys over a software licence is the analysts. Software vendors make the gap visible. CrowdStrike's pricing page lists Falcon Enterprise, its endpoint detection and response, at $184.99 per device billed annually, and puts Falcon Complete, the same technology run by its own analysts around the clock, behind "Contact sales". SentinelOne's packages page lists Singularity Commercial at $229.99 per endpoint a year for 5 to 100 workstations and shows managed detection and response as an add-on with no figure. A licence price is what it costs to run the tool yourself.

What providers actually publish

We read the pricing pages of twenty managed security providers on 15 October 2026. Four publish a rate an end customer could budget from.

• eSentire lists three Atlas MDR packages on its own shop: Professional at $17.00, Enhanced at $24.00 and Elite at $28.00 per user per month, for 10 to 100 users, falling to $16.15, $22.80 and $26.60 per user between 101 and 250. Above 250 users it scopes the engagement.
• Field Effect states that its MDR pricing typically ranges from $5 to $25 per user per month, depending on package, volume and deployment.
• Huntress publishes an MSRP of $8.99 per endpoint per month for managed EDR on its pricing page, with an example price of $7.99 at 100 endpoints. Managed identity detection lists at $4.80 per licensed identity, managed SIEM at $4.00 per data source and awareness training at $2.08 per learner, all monthly.
• UnderDefense says its MDR pricing starts at $11 per device per month, with each package quoted.

So the published span runs from $5 per user per month, the bottom of Field Effect's stated range, to $28 per user per month for eSentire Atlas Elite, with Huntress at $8.99 per endpoint list price and UnderDefense from $11 per device in between, in a different unit.

The other sixteen publish nothing an end customer can use. Arctic Wolf, Expel, Deepwatch, Blackpoint, Guardz, Todyl, BitLyft, Sophos, Microsoft Defender Experts, Red Canary (now part of Zscaler), CrowdStrike Falcon Complete and SentinelOne's MDR add-on route you to a demo or a quote, and Coro quotes through partners. Some state the structure without the number, which is still worth having. Rapid7's MDR pricing page quotes per asset on an annual contract with lower rates above 500 assets. BitLyft prices per user on a 12 month commitment with a minimum it does not publish. Vijilan's MDR pricing page prices per endpoint with servers and firewalls licensed separately, and releases its rate card only after partner verification. CyberQuell publishes a full rate card, but it is the wholesale rate for MSPs reselling its service, not a price an end customer pays.

No provider we read prices managed firewall or vulnerability management as a standalone service. Where those carry a figure at all, it is inside a package or as an add-on to one.

The costs outside the per-unit rate

The rate is the number on the proposal. These are the lines that decide what you actually pay.

• Fixed fees. eSentire adds a launch and optimisation fee of $2,500 a year regardless of user count. Huntress and Field Effect both state that there are no setup or onboarding fees.
• Minimums. eSentire starts at 10 users. Huntress requires 50 seats per product bought direct or through a reseller, and none through an MSP. BitLyft applies a minimum number of users without stating it. On a small estate the minimum, not the rate, sets the bill.
• Who deploys and runs it. Huntress says its rates cover its SOC but not deployment, integration or the day to day management a partner provides, and Field Effect says a price through an MSP may vary to reflect those services. Buying through an MSP is often the way round a minimum, with the MSP's own fee on top.
• The software licence. Some services bring their own agent and some operate over the one you already own. eSentire's Professional package runs alongside your existing endpoint technology, and Vijilan sells one service with the CrowdStrike licence included and another over the EDR you already have. A quote that leaves the licence out is not cheaper if you still have to buy it.
• Add-ons. eSentire prices them openly: network detection and response at $6.00 per user per month, autonomous penetration testing at $2.75, awareness training at $1.00 and extended log storage at $1.00. Field Effect sells extended log retention, dark web monitoring and awareness training as optional upgrades.
• Incident response and retention. In eSentire's ladder a forensics and incident response retainer arrives only at Elite, and log retention runs from none at Professional to 90 days at Enhanced and 365 days at Elite. Most of the $11 per user between its bottom and top tier is those two lines. A scheduled test is a separate purchase, covered in what a penetration test costs.
• Term. Every provider here that states a term states twelve months or annual billing, including Huntress, eSentire, UnderDefense, Rapid7 and BitLyft, which offers discounts on 36 month commitments.

A worked example at 100 people

This is arithmetic on the published rates above, for a company with 100 staff, 100 endpoints and 100 Microsoft 365 identities. It is not a quote.

• eSentire: 100 users at $17.00 is $1,700 a month on Professional and 100 at $28.00 is $2,800 a month on Elite, each plus $2,500 a year in launch fees.
• Huntress: 100 endpoints at $7.99 and 100 identities at $3.60, its 100 unit example prices, is $1,159 a month, before any partner's own charges.
• Field Effect: 100 users across its stated range is $500 to $2,500 a month.
• UnderDefense: 100 devices from $11 is from $1,100 a month.

The spread is mostly scope rather than margin. eSentire's Enhanced and Elite tiers add log detection and threat hunting, while the Huntress figure covers two products and not its SIEM. Line up what each number buys before reading anything into the totals.

Once you know what you are buying, we rank cybersecurity service providers and, separately, US-headquartered providers. If you are an MSP buying a service to resell, the margin side is covered in the best SOC providers for MSPs.