How Much Does EDR Cost in 2026? Per-Endpoint Prices Compared

Published US EDR list prices in September 2026 start at $3 per user per month for Microsoft Defender for Business, paid yearly. CrowdStrike Falcon Enterprise, the first Falcon card with detection, is $184.99 per device per year. SentinelOne Singularity Complete is $179.99 per endpoint per year for 5 to 100 workstations. Huntress is $7.99 per endpoint per month at 100 endpoints, SOC included.

Those four numbers are not the same purchase, and the cheaper card on two of these vendors is not detection. Toolradar data: Toolradar, the software directory we run, covers 816 security tools in its September 2026 security ranking. A buyer who blends them into one per-endpoint average will approve the wrong invoice, because a user seat, a device sensor, and a managed night shift are different purchases.

Endpoint detection and response is software on a laptop, server, or phone that records what ran, flags an intrusion, and gives a defender a way to investigate or contain it. Antivirus that only blocks a known file is a different product, and several endpoint price cards sell that narrower job. If the requirement is an investigation, a prevention-only card is money spent before the real detection order.

Per-endpoint prices at a glance

Every rate in the table was read on the vendor's own pricing page on 24 September 2026. Year totals later in this piece multiply those rates by the headcount, and they are our arithmetic rather than a quote a salesperson will honor.

License	Buyer it fits	September 2026 list price	Left off the sticker
Falcon Enterprise	Analysts who will hunt on their own sensors	$184.99/device/yr	Identity, Next-Gen SIEM, and CrowdStrike's own analysts
Singularity Complete	Detection with a sticker inside a 5 to 100 workstation band	$179.99/endpoint/yr	14-day retention, and a partner can replace the sticker
Singularity Commercial	That detection rate, plus identity and 90-day retention	$229.99/endpoint/yr	Managed detection, still an unpriced add-on
Defender for Business	A Microsoft tenant of 300 users or fewer	$3/user/mo, paid yearly	Servers, and anyone past the user cap
Microsoft Defender Suite	Extended detection stacked on a required base suite	$12/user/mo, paid yearly	The E3 seat the page requires before this add-on
Huntress Managed EDR	A managed SOC whose rate you can read before calling sales	$7.99/endpoint/mo at 100 endpoints	A smaller commit pays more per endpoint
LimaCharlie Standard	Engineers already near the published volume tier	$3.00/endpoint at 5,000 endpoints	Not a 100-seat price, and the page does not label it USD

Whether the product is worth buying is a separate question, answered in the endpoint detection guide. Modules missing from the Enterprise row are priced on the Falcon pricing breakdown.

A device, a user, and a volume tier are three different bills

EDR cost arguments fall apart when the unit changes and nobody notices. A device price multiplies by every sensor, so each extra laptop, server, or phone is another line. A user price multiplies by people, then covers several devices per person, which is why a laptop-and-phone staff looks cheap until servers are counted. A volume tier exists only at a stated headcount, and a smaller commit costs more per endpoint, so the headline rate understates that budget.

Servers are the line most budgets forget. Microsoft's user license excludes them, and the server add-on has no printed price, so a Windows server estate cannot be costed from the user card. SentinelOne's displayed prices cover workstations in a 5 to 100 band. A partner's price replaces that sticker when the two differ.

A 14-day history and a 90-day history are not the same incident record, so a case that surfaces after the shorter window is already gone. A console nobody staffs produces alerts rather than containment, and skipping that hire means you are buying a managed service. The managed detection roundup is the comparison beside the sensor.

Falcon Enterprise is the first CrowdStrike card with EDR

CrowdStrike's US pricing page puts detection, threat intelligence, and hunting on Falcon Enterprise, the annual rate for a queue your own analysts will work, while Go and Pro leave detection off. Go is $59.99 per device per year and stops at 100 devices, a cap rather than a discount. Pro is $99.99 per device per year and adds host firewall management, for a team that will still investigate elsewhere. The cheaper card in a comparison buys prevention, then a second order when detection is required.

Monthly Enterprise costs more than paying for the year. At $19.99 per device, twelve payments come to $239.88 per device, and 100 devices on that path come to $23,988. Sign the annual card when the sensor will stay installed. The directory record is the CrowdStrike page on Toolradar, and the product judgment sits in the CrowdStrike write-up.

IT hygiene, Identity Protection, and Next-Gen SIEM sit off the Enterprise card, so price them before you compare device rates. Falcon Complete, the 24/7 managed service with a Breach Prevention Warranty, publishes no USD price. Express Support is included on Enterprise and sold as an add-on on Complete. The 15-day trial is Falcon Prevent, Device Control, and Express Support, not a detection console you keep. An annual term can be refunded if you cancel inside the first 30 days.

CrowdStrike's licensing FAQ counts a server, a laptop, and a mobile device as endpoints once the sensor is installed and has checked in, all on one Enterprise device rate. A phone on Falcon for Mobile can sit beside the laptop and add a sensor a laptop-only budget never counted. Enroll those devices from the device management roundup and recount before anyone signs. Next-Gen SIEM bills ingest, not another device. Price that ingest in the SIEM cost guide, and compare products in the logging roundup until a per-gigabyte rate is on the order.

Singularity Complete is the printed EDR rate, and the history is 14 days

The package page is in US dollars for a workstation band of 5 to 100, tax can be added, and an authorized partner's price controls when it differs, so do not promise the sticker. Extended detection is included on Complete, Commercial, and Enterprise. It is unchecked on Core and on Control, so those cheaper columns fail once someone has to investigate.

Core is $69.99 per endpoint per year, protection without detection, for a shop that only wants a known file blocked. Control is $79.99 per endpoint per year and adds device control, firewall control, and remote shell, still without detection. You can manage the device and still have no incident history. Complete is the first printed column that is actually EDR, with cloud workload protection, an AI security assistant, and 14-day retention. Stay when that short history and the partner's price are acceptable. Leave when the case must still be visible later.

Commercial keeps detection, moves retention to 90 days, and adds identity threat detection plus managed threat hunting. Managed detection and response is an unpriced add-on on Commercial and on Enterprise, and it is absent on Complete, so Complete has no night shift. Enterprise adds the agentic analyst, network discovery, and forensic collection, and it is contact sales, so that column cannot enter a numeric comparison this week. Confirm the package on the SentinelOne page on Toolradar before a proof of concept. Use the Falcon versus Singularity matchup for the product, not this invoice.

The Complete product page keeps 14 days of standard EDR history and 365 days for malware and fileless incidents, with an unpriced upgrade to 365 days. A hands-on-keyboard intrusion that never became a malware verdict can disappear before the retainer call. Above that workstation band, do not multiply the displayed rate.

Defender for Business is a user price, and it stops at 300 people

Microsoft's US page lists standalone Defender for Business at the user price in the table, paid yearly, tax excluded, and set to auto-renew. One user covers up to five devices, there is no minimum device count, and the cap is 300 users, so a pilot is allowed and person 301 is not. It includes AI-powered detection and response, automated investigation, and vulnerability management on Windows, macOS, iOS, and Android. Servers are an unpriced add-on, which is the estate this card cannot cost.

A user seat and a device seat are different bills. One year of the user price is $36. Five devices on annual Falcon Enterprise are $924.95, our multiplication, before tax. That gap is why a laptop-and-phone staff under the cap should check Defender before a per-device card. A server-heavy estate, or person 301, is where the comparison stops.

Above 300 users, Microsoft names Defender for Endpoint. The enterprise page shows no standalone Plan 1 or Plan 2 amount in USD. It does print Microsoft Defender Suite at the add-on rate in the table, paid yearly. That add-on requires Microsoft 365 E3, or Office 365 E3 together with Enterprise Mobility + Security E3, so you cannot buy the suite row as a sensor alone.

E3 on that page is $39 per user per month, paid yearly. The plan FAQ calls E3 security Defender Antivirus plus Entra ID P1, not the full endpoint stack. E5 is $60 per user per month, paid yearly, with endpoint security and extended detection inside a much larger suite, so mail and meetings may ride along. Look up the suite under Microsoft 365 on Toolradar.

The endpoint user license still allows five devices and still excludes servers. A one-month trial converts to paid unless you cancel, and a 7-day window allows a prorated refund once the paid term starts. Defender for Business also comes inside Microsoft 365 Business Premium, a productivity suite, so use that bundle only if the company was buying the apps anyway.

Huntress prints a managed SOC rate that falls as the commit grows

Huntress's pricing page has a currency control, and the figures here use the US Dollar (USD) setting, so you are not budgeting a converted number. The Managed EDR example at 100 endpoints is $7.99 per endpoint per month, and the per-unit rate falls as volume rises. At 50 endpoints the page shows $8.99 per endpoint, which is $449.50 a month. Do not send finance the larger-commit rate for a smaller shop.

Huntress is the managed bill you can read before the call, the gap Falcon Complete and SentinelOne's MDR add-on leave. The price covers round-the-clock detection, response, remediation, incident reporting, and managed antivirus, so the night shift is inside the number, while partner deployment and portal work are extra. There is no separate setup fee, the term is 12 months, and there is no multi-year lock, so year two is not guaranteed.

Direct and reseller buys have a 50-seat minimum per product. An MSP purchase does not, so a company under that floor cannot buy the example direct. Overages are manual, not auto-billed, which keeps a spike from charging itself. The trial is the full product, SOC included, so you do not deploy a second agent if you buy. If you need a night shift rather than a console your analysts will live in, start from the Huntress page on Toolradar.

Vendor price changes, and the incidents that force a renewal, show up in Cyberpresso's daily brief. Subscribe here.

LimaCharlie prices the sensor at volume, not at a 100-laptop checkout

LimaCharlie lists a Community tier with EDR free for up to 2 endpoints, a lab, not a company rollout. Standard is $3.00 per endpoint as volume pricing at 5,000 endpoints, with one year of storage, so it is not a 100-laptop checkout. External telemetry is $0.20 per GB, a second meter for logs the sensor does not cover. The page shows a dollar sign and does not label the currency as US dollars, so do not treat the volume rate as a confirmed USD checkout.

A year of telemetry on a flat endpoint rate is a different meter from a 14-day EDR history. It fits a team that will run the platform and is already near that volume. It is a poor stand-in for a 40-person company shopping a managed SOC, because nobody on that card watches the queue overnight.

What 100 units cost on the published rates

The table is September 2026 list rates times 100, for the first year, excluding tax, add-ons, and partner discounts. SentinelOne's rows hold only inside the 5 to 100 workstation band. Microsoft's rows count users, and one user can cover five devices, servers excluded. Huntress uses the printed example at that commit.

Fleet of 100, license only	The unit being counted	Year-one total, our math
Falcon Enterprise, paid yearly	100 devices	$18,499
Singularity Complete, sticker for the year	100 workstations inside the 5 to 100 band	$17,999
Singularity Commercial, sticker for the year	100 workstations inside that band	$22,999
Huntress Managed EDR, example at 100	100 endpoints on the printed example	$9,588
Defender for Business, yearly	100 users, rather than 100 devices	$3,600
Microsoft Defender Suite, yearly	100 users, base suite not included	$14,400

At this headcount the managed example sits under both printed device rates, and the Microsoft user license sits under all of them, until servers, user 301, or the required E3 seat change the math. The Suite row is an add-on, not a sensor price finance can use alone.

The line items that still have no USD price

Some names buyers expect on an EDR shortlist publish no number you can multiply. Leave them out of the spreadsheet until sales replies.

Falcon Complete and Singularity Enterprise are contact-sales. Microsoft publishes no standalone Defender for Endpoint Plan 1 or Plan 2 USD price, even though the service description says Plan 2 can be its own license. SentinelOne's longer retention upgrade and its MDR add-on are unpriced. Bitdefender's US pages calculate a checkout for a device count you enter, up to 100 endpoints online, rather than a fixed per-endpoint EDR price, so two buyers will not see one shared sticker. The product is covered in the Bitdefender write-up, and the antivirus roundup for companies is the right page when the job is prevention, not a detection history.

Identity accounts, SIEM ingest, cloud hours, and a managed night shift can dwarf the sensor. Keep scanning you already pay for on the scanner roundup, including the Tenable write-up. Leave cloud posture on the cloud posture roundup until a vendor prints an hourly or per-workload rate.

Which bill matches the team you actually have

Defender for Business fits a Microsoft company under 300 users, on laptops and phones, because one seat covers five devices. It stops at user 301 and on the unpriced server add-on.

Annual Falcon Enterprise fits analysts who will work the queue. Go and Pro are the wrong checkout once detection is required. Identity, ingest, or CrowdStrike's own analysts need a quote, with the module list written down first.

Singularity Complete fits a fleet inside the printed workstation band that can accept a short history and a partner's final price. Commercial is the step when identity and the longer retention have to be on that rate, because Core and Control leave detection unchecked.

Huntress fits a night shift you can budget this week, repriced at the real commit. LimaCharlie fits engineers already near the volume tier on that page, not a small office that needs someone awake overnight.

How we priced this

We read the vendor pages on 24 September 2026. Those pages were CrowdStrike's US pricing page, SentinelOne's platform packages page and the Complete product page, Microsoft's US Defender for Business page and its enterprise security plans page, Huntress's pricing page with the currency control on US dollars, and LimaCharlie's pricing page. Multiplying the published rates by 100 is our arithmetic, and a vendor quote can still differ. Falcon Complete, Singularity Enterprise, standalone Defender for Endpoint, and Bitdefender's per-endpoint EDR rate have no public USD list price here, so they stay unpriced.

Louis Corneloup, founder of Toolradar and Dupple, was the editor. Read the order form again before anyone signs, because a partner price and a renewal price are not these cards. The EDR ranking ranks the products, and this page prices the bill only.

FAQ

How much does EDR cost per endpoint in 2026?

On vendor pages checked 24 September 2026, Defender for Business is $3 per user per month, paid yearly, for up to 300 users and five devices per user. Falcon Enterprise is $184.99 per device per year, and it is the first Falcon card that includes detection, so the cheaper Falcon cards are a different purchase. Singularity Complete is $179.99 per endpoint per year for 5 to 100 workstations, in US dollars, before a partner changes it. Huntress prints $7.99 per endpoint per month at 100 endpoints, SOC included, in the US dollar view, and a smaller commit does not get that rate.

Does the cheapest CrowdStrike or SentinelOne plan include EDR?

Neither cheaper card includes EDR. Falcon Go and Falcon Pro omit endpoint detection and response, and Go also caps purchases at 100 devices, so the device past that cap is a new order rather than an overage. SentinelOne Core and Control leave extended detection unchecked. Detection starts on Falcon Enterprise, and on Singularity Complete, Commercial, and the unpriced Enterprise column.

Is Microsoft Defender for Business cheaper than a per-device EDR card?

For a laptop-and-phone staff under 300 users, often yes, because one user covers five devices and one year of the user price is $36. Five devices on annual Falcon Enterprise are $924.95 at the September 2026 list rate, our multiplication, with servers excluded on the Microsoft side. At 100 users the Defender for Business year is $3,600, which is not a 100-device comparison. Past 300 users, or once servers enter the design, the public pages no longer give a standalone endpoint USD price.

How much is Huntress Managed EDR?

A year of the 100-endpoint US dollar example is $9,588, our multiplication, with the 24/7 SOC and managed antivirus included, and the monthly rate is the one in the table. At 50 endpoints the page shows $8.99 per endpoint, or $449.50 a month, so the headline overstates the discount a smaller commit receives, and the rate falls only as volume rises. Direct and reseller purchases have a 50-seat minimum, an MSP purchase does not, and a partner's deployment work is extra.

What do 100 endpoints cost on the published EDR rates?

Annual Falcon Enterprise for 100 devices comes to $18,499 on the September 2026 list. Singularity Complete's displayed year for 100 workstations inside its 5 to 100 band is $17,999, and Commercial's displayed year for that band is $22,999, before a partner changes either figure. Huntress at the 100-endpoint example is $9,588 for the year. Defender for Business for 100 users comes to $3,600 across the year, and the Defender Suite add-on for 100 users comes to $14,400 before the required E3 seat. None of these figures includes unpriced modules.

Is there a free EDR?

LimaCharlie's Community tier lists EDR as free for up to 2 endpoints, a lab rather than a company fleet. Its Standard rate is $3.00 per endpoint only as volume pricing at 5,000 endpoints, and that page does not label the currency as USD, so a small fleet should not annualize it. CrowdStrike's public trial is 15 days of prevention and device control, not an ongoing free detection plan. Huntress and Defender for Business offer trials of the paid product, and both convert or end rather than leaving a free production tier.

Why do two EDR quotes for the same fleet differ by so much?

The unit is usually different: devices, users with a five-device allowance, or a volume tier that exists only at a stated commit, and mixing those units is why two quotes for one fleet will not match. Retention, servers, identity, and whether a SOC is included move the invoice more than the headline sensor rate. A displayed SentinelOne price can also be replaced by the partner's price, and Falcon Complete still has no public USD figure at all.

Cite this: Cyberpresso, "How Much Does EDR Cost in 2026? Per-Endpoint Prices Compared", September 2026.

Endpoint invoices, and the incidents that move a renewal, land in the same Cyberpresso briefing each day. Join at cyberpresso.com.

Some offers on this page may be paid placements or contain affiliate links.