How Much Does MDR Cost? Pricing Guide
Posted by Saif Khan on 2026 Sep 14th
Managed detection and response is priced per user per year, and for most businesses it lands between $115 and $235 per user. The range depends on how many users you have and whether the provider finishes the incident response for you or hands it back. This guide gives the actual published figures rather than "contact us for pricing".
Almost no MDR provider publishes prices. That is not because the pricing is complicated. It is because per-user pricing looks expensive in isolation and cheap in context, and vendors would rather have the context conversation first. So here is both.
Sophos MDR pricing, per user per year
Live pricing from our store, in USD, on a one-year subscription. Price per user falls as the user count rises.
| Users | Sophos MDR | Sophos MDR Plus |
|---|---|---|
| 1 to 9 | $143.50 | $234.52 |
| 10 to 24 | $138.58 | $221.40 |
| 25 to 49 | $127.10 | $207.46 |
| 50 to 99 | $123.00 | $199.26 |
| 100 to 199 | $114.80 | $190.24 |
Those are per user, per year. A 40-person business on Sophos MDR is 40 x $127.10, which is $5,084 a year, or about $424 a month. The same business on MDR Plus is $8,298 a year, about $692 a month.
What that works out to per month
| Business size | Sophos MDR | Sophos MDR Plus |
|---|---|---|
| 10 users | ~$116/mo | ~$185/mo |
| 25 users | ~$265/mo | ~$432/mo |
| 50 users | ~$513/mo | ~$830/mo |
| 100 users | ~$957/mo | ~$1,585/mo |
Calculated from the annual figures above at the matching band. Multi-year terms are cheaper per year and fix your price for the period.
Why the two tiers differ by roughly 60 percent
Both tiers include 24/7 monitoring, threat hunting and active containment. The difference is who finishes the job.
| Capability | Sophos MDR | Sophos MDR Plus |
|---|---|---|
| 24/7 monitoring and threat hunting | Yes | Yes |
| Active threat containment | Yes | Yes |
| Who completes the cleanup | You, with guided steps | Sophos, end to end |
| Full incident response | Separate engagement | Included, no hourly caps |
| Dedicated incident response lead | No | Yes |
| Contractual response SLA | No | 60 min for 90% of high-severity cases |
| Breach Protection Warranty | Not included | Up to $1M in response expenses |
For a 40-person business the gap is about $3,200 a year. Set against a single incident response engagement at commercial hourly rates, that gap closes quickly. The question is not whether MDR Plus is worth it in the abstract, it is whether you have someone in-house who can run a cleanup at 2am on a Sunday.
What changes the price
- User count. Price per user drops as you scale. Moving from 9 users to 10 crosses a band boundary and lowers the per-user rate.
- Term length. Three and five year subscriptions cost less per year and fix your price. Monthly billing is available through an MSP but the rate can change.
- Servers. Servers are licensed separately from users and cost more each, because they carry more risk and more data.
- Tier. The MDR to MDR Plus step is roughly 60 percent.
The band boundary is worth checking. At 9 users you pay $143.50 each. At 10 users you pay $138.58 each. If you are at 8 or 9 people and hiring, ask about the next band before you buy.
How MDR pricing compares with hiring
The honest comparison is not MDR against nothing. It is MDR against building the same capability in-house.
24/7 coverage needs more than one person. A single security analyzt cannot cover nights, weekends and holidays. Even a minimal rotation is several full-time salaries plus the tooling, before anyone has looked at an alert. For a business under 200 people, MDR at $115 to $235 per user per year is not competing with a security team, it is competing with having no coverage at all outside office hours.
That is the framing that makes the number make sense, and it is why most businesses in this size range buy MDR rather than hire.
Frequently asked questions
How much does Sophos MDR cost?
Sophos MDR is priced per user per year. On a one-year subscription it ranges from $143.50 per user for 1 to 9 users down to $114.80 per user for 100 to 199 users. Sophos MDR Plus, which includes full incident response, ranges from $234.52 down to $190.24 per user. A 40-person business pays about $5,084 a year for Sophos MDR or $8,298 for MDR Plus.
How much does managed detection and response cost in general?
MDR is typically priced per user per year, and for small and mid-sized businesses it generally falls between $115 and $235 per user depending on the provider, the user count, and whether full incident response is included. Per-user rates fall as the user count rises. Most providers do not publish pricing, so figures like these come from resellers rather than vendor websites.
Is MDR priced per user or per device?
Sophos MDR is priced per user, with servers licensed separately and at a higher rate. Some providers price per endpoint or per device instead, which produces very different totals for a business where people use several devices each. When comparing quotes, check which unit each provider is counting.
Does MDR pricing get cheaper with more users?
Yes. Sophos MDR drops from $143.50 per user at 1 to 9 users to $114.80 at 100 to 199 users, a reduction of about 20 percent. The bands are stepped rather than continuous, so crossing a boundary changes the rate for every user.
What is the difference between Sophos MDR and Sophos MDR Plus in price terms?
MDR Plus costs roughly 60 percent more per user. At 25 to 49 users that is $207.46 against $127.10, a difference of about $80 per user per year. What the extra buys is full incident response carried out by Sophos with no hourly caps, a dedicated response lead, a contractual 60-minute response target for high-severity cases, and the Breach Protection Warranty.
Can I pay for MDR monthly?
Yes, through a managed service provider rather than as a direct multi-year purchase. Monthly rates are set by the vendor and can change, so only a term subscription fixes your price for the period. Ask for both so you can compare the total over the same horizon.
Get MDR priced for your business
Nuformat is a Sophos partner serving Canada and the United States. Send us your user and server counts and we will price both tiers, compare term against monthly billing, and tell you which tier we would actually recommend for your situation. Request a quote.
Sophos MDR products and pricing · Sophos XDR · Nuformat managed services
Prices shown in USD, current at the time of writing, and subject to change. Service details as published in Sophos product documentation.