One price may cover endpoint software. Another may include servers, 24/7 monitoring, threat hunting, incident response, support or other security products.
Before deciding whether an EDR quote is expensive, find out what is inside it.
The short answer
Do not start by dividing the total quote by your endpoint count.
Start by separating the quote into:
- Endpoint software
- Server protection
- Managed detection and response
- Implementation or onboarding
- Support
- Additional security products or services
Only compare numbers after you know you are comparing the same things.
Public prices give you a starting point
Some EDR vendors now publish prices.
As of October 2026, CrowdStrike lists Falcon Enterprise at $184.99 per device per year when billed annually.
CrowdStrike lists Falcon Complete, its managed detection and response offering, as Contact sales rather than publishing a price.
Source: CrowdStrike official pricing. Vendor list price.
SentinelOne lists Singularity Complete at $179.99 per endpoint per year.
It lists Singularity Commercial at $229.99 per endpoint per year and Singularity Enterprise as Contact Sales for Pricing.
Source: SentinelOne official pricing. Vendor list price.
These are useful reference points.
They are not proof of what an organization with hundreds or thousands of endpoints should ultimately pay.
Real purchases can look very different
Public procurement records give us another view: what specific organizations were actually quoted or approved to spend.
They also show why price comparisons get dangerous quickly.
662 endpoints: $70,622.16 per year
Yellowstone County's April 22, 2026 renewal quote (Version 1) lists:
- 662 units
- SentinelOne Complete & Vigilance
- 24/7 SentinelOne SOC Management included
- $106.68 annual unit price stated by the source
- $70,622.16 annual total
A later version of the renewal increased the proposed annual total to $72,222.36. We preserve the earlier $70,622.16 quote because it is the source of the documented 662-unit and $106.68 figures rather than treating either number as a universal SentinelOne price.
But the description matters.
The quote is for SMART Endpoint Protection Plus and explicitly includes SentinelOne Complete and Vigilance with 24/7 SentinelOne SOC management.
That $106.68 figure therefore should not be treated as a clean software-only SentinelOne price.
Source: Yellowstone County, SentinelOne renewal quote #159521, Version 1, April 22, 2026. Official county record.
One SentinelOne quote, broken into pieces
A 2026 McLean County quote is particularly useful because it separates several components.
It includes:
- 1,050 Singularity Complete workstation licenses at $26.38 each
- 100 Singularity Complete server licenses at $93.01 each
- 1,150 Vigilance Respond Pro 24/7 MDR licenses at $27.72 each
- 1,150 Ranger licenses at $11.74 each
- 50 Mobile Defense licenses at $28.30 each
- Premium support and an XDR platform item
The total quote is $94,782.89.
The lesson is not that SentinelOne costs $26.38.
The lesson is that the endpoint software can be only one part of the security purchase.
Source: McLean County 2026 Executive Committee agenda / procurement quote. Public procurement quote.
A CrowdStrike example shows the same problem
El Dorado County approved $211,013.81 for one year covering CrowdStrike Falcon Complete endpoint protection and Security Information and Event Management services.
Falcon Complete itself includes managed detection and response.
The county had previously upgraded to Falcon Complete for 24/7 management, monitoring and response.
The $211,013.81 total is real.
But it is not a clean CrowdStrike EDR software price, because multiple services are inside the purchase.
Dividing the total by an endpoint count and publishing the result as "CrowdStrike price per endpoint" would create a number the source does not support.
Source: El Dorado County. Public procurement record.
Negotiated prices can be far below public prices
A Florida statewide CrowdStrike contract provides another useful example.
The contract lists a subsequent software year of endpoint detection and response at $79.66 per device, including ongoing training, integration maintenance and support services.
It separately lists optional Falcon Complete managed detection and response components.
Source: Florida Department of Management Services CrowdStrike EDR contract. Public contract.
Do not compare $79.66 directly with CrowdStrike's current $184.99 public Falcon Enterprise price and conclude that one is the "real" price.
The contracts are different, the buyers are different, the terms are different and the included items may be different.
The useful conclusion is narrower:
Published prices are not necessarily the final negotiated prices available to a large buyer.
How much room can there be to negotiate?
We cannot give every buyer a reliable discount percentage.
But we have evidence that negotiation can matter.
In July 2026, University of California Systemwide Procurement announced a new CrowdStrike agreement for Falcon Complete managed detection and response and related endpoint security capabilities.
UC reported a 61% cost reduction versus initial pricing.
UC did not publish enough information there for us to turn that percentage into a private-company pricing benchmark.
So we don't.
But it is evidence that an initial price and a negotiated price can be materially different.
Source: University of California Systemwide Procurement. Public procurement record.
Microsoft changes the math
Microsoft Defender for Endpoint is harder to compare with a simple per-endpoint price because many organizations buy it through broader Microsoft licensing.
Microsoft Defender for Endpoint Plan 2, which includes Microsoft's EDR capabilities, is available as a standalone license and is also included in Microsoft 365 E5 and certain other Microsoft plans.
Under Microsoft's licensing terms, an eligible licensed user can use Defender for Endpoint on up to five concurrent devices.
Server operating systems require separate licensing.
Sources: Microsoft Defender service description; Microsoft Product Terms. Vendor documentation.
This means a company already paying for Microsoft 365 E5 may face a very different incremental endpoint-security cost than a company starting from scratch.
Do not call Defender "free."
The organization is paying for the broader Microsoft license.
The useful question is:
What endpoint security are we already entitled to use, and what additional money would we spend by choosing something else?
See CrowdStrike vs SentinelOne vs Microsoft Defender.
Software price and operating cost are different
A cheaper EDR license is not necessarily the cheaper security operation.
Someone still has to:
- Watch alerts
- Investigate suspicious activity
- Tune the system
- Handle false positives
- Respond after hours
- Maintain the deployment
A quote that includes MDR may cost more than software alone because you are also buying people to perform some of that work.
Conversely, buying software alone does not make the people cost disappear. It moves more of that work inside your organization.
See EDR vs MDR.
How to normalize two EDR quotes
Before comparing Vendor A with Vendor B, put both quotes into the same structure.
1. Endpoint software
How many workstations are covered? What product or package is included? What is the term?
2. Servers
Are servers included in the workstation price or priced separately? How many servers are covered?
3. Managed response
Does the quote include 24/7 monitoring? Does the provider investigate alerts? Can it isolate an endpoint or take other response actions?
4. Other products
Is identity security included? SIEM? Mobile? Vulnerability management? Threat hunting? Device control?
5. Services
Is onboarding included? Implementation? Training? Premium support? Incident response?
6. Contract
Is this one year or multiple years? Is the price introductory? What happens at renewal? Are quantities committed?
A simple quote comparison