MDR vs EDR vs XDR in one sentence: EDR is software that watches each endpoint, XDR is that detection widened to identity, email, cloud and network, and MDR is either of them run by a 24/7 human team that investigates and responds for you. Under 50 endpoints with a named person who owns alerts, EDR is enough. Everyone else, and anyone under NIS2, CMMC, HIPAA, ISO 27001 or a cyber-insurance questionnaire, should buy MDR, which in 2026 includes XDR telemetry by default. 2026 list prices per device per month: EDR $3 to $12, XDR $5 to $15, MDR $6 to $22. The rest of this page gives you the decision by company size, the cost at 10, 25, 50, 100 and 250 endpoints, and the questions to ask before you sign.
Updated September 21, 2026. Why the decision got harder this month: Microsoft’s September Patch Tuesday fixed 974 vulnerabilities, a record, including two zero-days already exploited for SYSTEM-level privilege escalation (CVE-2026-85880 and CVE-2026-81963). GitLab shipped a CVSS 10.0 fix for unauthenticated file reads, MikroTik routers got a chained passwordless-SSH flaw, and CISA announced it is ending its weekly vulnerability roundups. That is a month where the exploit window is hours and the summaries you relied on are going away. EDR software will log the attack. Whether anyone acts on it at 02:00 on a Sunday is the MDR question.
Quoted by Copilot, ChatGPT and Google AI answers. Three things they cannot give you:
- The EDR-or-MDR decision for your exact estate. Two-minute stack recommender: endpoints, servers, obligations, budget posture in, recommendation out.
- Your price, not a range. Get EDR and MDR quoted side by side at partner price for your device count, in writing, within 1 business day.
- Whether the quote you already have is high. Paste it and get a verdict in 30 seconds.
No phone call unless you ask · NDA on request · Partner pricing on Sophos, Microsoft, SentinelOne, CrowdStrike, Bitdefender and Huntress
Only comparing two of them? Go straight to MDR vs EDR or MDR vs XDR.
EDR vs MDR vs XDR at a glance
| EDR | XDR | MDR | |
|---|---|---|---|
| What it is | Agent on endpoints and servers recording behaviour, with detection and containment actions | EDR plus identity, email, cloud and network telemetry correlated in one console | EDR or XDR operated by a 24/7 security team that investigates, hunts and responds |
| Who watches it | You | You | The provider, around the clock |
| Response | Manual, when someone sees the alert | Manual or automated playbooks you build | Human-led within minutes, under agreed rules of engagement |
| Typical products | Microsoft Defender for Business, Sophos Intercept X, SentinelOne Singularity, CrowdStrike Falcon, Bitdefender GravityZone | Sophos XDR, Microsoft Defender XDR, SentinelOne Singularity XDR, CrowdStrike Falcon Insight XDR | Sophos MDR, Huntress, Blackpoint, SentinelOne Vigilance, CrowdStrike Falcon Complete, ITSecOps MDR |
| 2026 list price per device per month | $3 to $12 | $5 to $15 | $6 to $22 |
| Best for | Under 50 endpoints with an internal owner | Internal security team wanting one console | Everyone without a 24/7 team; regulated and insured businesses |
MDR vs EDR: the difference that matters
EDR and MDR are not competing products. MDR is a service wrapped around an EDR or XDR agent. When you buy MDR you still get EDR software on every device, usually the same Sophos, Microsoft, SentinelOne or CrowdStrike agent you would have bought alone. What changes is who is accountable at 02:00: with EDR it is your IT person or nobody, with MDR it is an analyst team with a contractual response time. The practical test is simple. If an alert fired right now, who would isolate the machine, and how long would it take? If the honest answer is “whoever sees it next” or “our MSP on Monday”, you need MDR, not more software.
XDR vs MDR: not a choice between two products
XDR describes what the detection covers, MDR describes who runs it. Since credential theft precedes most intrusions, any serious service in 2026 correlates endpoint events with identity sign-ins, email and firewall logs. Sophos, Microsoft, SentinelOne and CrowdStrike all sell XDR tiers, and ITSecOps MDR ingests those sources by default. So the real question behind “XDR vs MDR” is: do you have an internal security engineer who will live in the console? If yes, buy XDR and staff it. If you want the outcome without the headcount, buy MDR that runs on XDR telemetry. Buying XDR without someone to operate it is the most common wasted spend we see in quotes.
EDR vs XDR: when the wider view is worth paying for
EDR sees the laptop. XDR sees the laptop, the Microsoft 365 sign-in from an impossible location ten minutes earlier, the phishing email that started it, and the firewall connection to the attacker’s server. For a 15-person company on Microsoft 365 Business Premium, Defender for Business already gives you most of that correlation at no extra cost, so paying for a separate XDR tier rarely makes sense. Above 50 endpoints, with servers or multiple cloud tenants, XDR telemetry is what lets an analyst tell a real intrusion from a false positive in minutes rather than hours. That is why every MDR provider worth the name runs on it.
MDR vs EDR for small business: 10 to 100 endpoints
Small businesses ask this question more than anyone, and the vendor answer is always “buy more”. Here is the honest version by size:
| Company size | What is usually right | Why |
|---|---|---|
| Under 25 endpoints, no servers, no compliance obligation | EDR (Defender for Business or Sophos Intercept X), configured properly | You are unlikely to justify $150 to $500 a month for MDR unless a customer or insurer demands it. Spend the money on backup and MFA first. |
| 25 to 50 endpoints, or any server with customer or financial data | MDR, cheapest tier (Huntress, Sophos MDR Essentials, ITSecOps MDR on Defender) | At $6 to $10 per device the whole estate costs less than one hour of incident response. Ransomware operators target this size precisely because nobody is watching. |
| 50 to 100 endpoints, or NIS2, CMMC, HIPAA, ISO 27001, SOC 2 or insurance questionnaires | MDR with identity and email telemetry, plus compliance reporting | Every framework in that list expects continuous monitoring and evidence of response. MDR reports are the evidence. |
| 100 to 250 endpoints | MDR plus SIEM as a service for retention | MDR responds, the SIEM keeps the logs auditors and insurers ask for after the fact. |
What EDR, XDR and MDR cost at your size in 2026
Monthly cost at 2026 list prices, before partner discount. Ranges are wide because Microsoft Defender sits at the bottom of every column and CrowdStrike at the top.
| Endpoints | EDR ($3 to $12 per device) | XDR ($5 to $15 per device) | MDR ($6 to $22 per device) |
|---|---|---|---|
| 10 | $30 to $120 | $50 to $150 | $60 to $220 |
| 25 | $75 to $300 | $125 to $375 | $150 to $550 |
| 50 | $150 to $600 | $250 to $750 | $300 to $1,100 |
| 100 | $300 to $1,200 | $500 to $1,500 | $600 to $2,200 |
| 250 | $750 to $3,000 | $1,250 to $3,750 | $1,500 to $5,500 |
For comparison, one in-house security analyst costs $90,000 or more a year before tooling, and covering 24/7 needs at least five. Full provider-by-provider numbers are in EDR pricing 2026 and MDR pricing 2026, and the build-versus-buy math is in what a 24/7 SOC costs. Because ITSecOps partners with every vendor above, the quote you get from us is at partner pricing, below the vendor website, and includes deployment.
When EDR alone is enough
- Fewer than about 50 endpoints and no servers holding regulated data.
- A named person who checks the console daily and can isolate a device the same day.
- No cyber-insurance or compliance requirement for 24/7 monitoring.
- Microsoft 365 Business Premium already in place, so Defender for Business costs nothing extra.
In that case deploy EDR properly (tamper protection, attack surface reduction, removal of legacy antivirus) and revisit MDR when you grow. Our EDR service covers deployment at partner pricing.
When you need MDR
- 50 or more endpoints, or any servers holding customer, financial or health data.
- NIS2, CMMC, HIPAA, ISO 27001 or SOC 2 obligations that expect continuous monitoring.
- A cyber-insurance renewal asking for EDR “with 24/7 monitoring and response”.
- No one available at 02:00 on a Sunday, which is when encryption is scheduled.
- An incident in the last two years where you learned about it from a customer or a ransom note.
See what ITSecOps MDR includes and compare providers in Top MDR providers for SMBs and MSPs.
What about a SIEM?
A SIEM adds long-term retention and compliance reporting across every system, which matters once you pass roughly 100 endpoints or fall under NIS2 or CMMC. It does not replace MDR; it feeds it. See SIEM as a Service pricing.
Five questions before you sign an MDR contract
- Will you isolate a host and disable an account without calling me first? If the answer is “we send you a ticket”, it is monitoring, not response.
- Which telemetry beyond the endpoint do you ingest? Identity and email at minimum. Endpoint-only MDR misses the credential theft that starts most intrusions.
- Who is awake in my night? 24/7 should mean analysts on shift in your off-hours, not a queue that empties at 09:00 somewhere else.
- Can I keep the EDR I already own? The best providers run on Defender, Sophos, SentinelOne or CrowdStrike. Being forced onto a new agent is a cost and a migration risk.
- What is the contract term and the price after the first year? Month-to-month after a short initial term is normal. A three-year lock-in at list price is not.
Price comparison and vendor choice
List prices for each product are in the cybersecurity price comparison. The Security Stack Recommender gives you the EDR-or-MDR decision and an indicative budget in two minutes. Picked the tier, now the vendor: Sophos vs SentinelOne vs CrowdStrike compared on 2026 prices, rollback and identity protection.
Compare and price it: MDR vs EDR · MDR vs XDR · MDR pricing and cost per device
Frequently asked questions
What is the difference between EDR, MDR and XDR?
EDR is endpoint software that detects and contains threats on each device. XDR extends that detection to identity, email, cloud and network data in one console. MDR is a 24/7 service in which a provider’s analysts operate EDR or XDR for you, investigating and responding to threats under agreed rules.
Is MDR better than EDR?
MDR includes EDR, so it is not better software, it is the same software with a team behind it. It is better for any business that cannot investigate and respond to alerts within minutes around the clock. For a very small company with an attentive IT person, well-configured EDR can be enough.
Do I need EDR if I have MDR?
You already have it. Every MDR service deploys an EDR or XDR agent on your devices; that is what the analysts watch. You do not buy EDR separately on top of MDR.
Is XDR better than MDR?
They are not alternatives. XDR is a detection scope, MDR is an operating model. Modern MDR runs on XDR telemetry. Standalone XDR is only better if you have staff to operate it 24/7.
Is MDR worth it for a small business?
Above about 25 endpoints, yes. A 50-endpoint company pays roughly $300 to $1,100 per month for MDR at list, less at partner pricing; the average ransomware outage for an SMB costs far more in downtime alone, before any ransom.
Which is cheaper, EDR or MDR?
EDR, at $3 to $12 per device against $6 to $22 for MDR. The gap narrows at the low end: Huntress and Defender-based MDR start around $6 to $8, close to premium EDR licences that come with no response.
Can I upgrade from EDR to MDR later?
Yes, and on the same agent. Sophos, Microsoft, SentinelOne and CrowdStrike all offer MDR on top of their EDR licence, so nothing is reinstalled.
Does MDR replace my antivirus?
Yes. Every MDR service includes next-generation antivirus in the agent. Running a separate antivirus alongside it causes conflicts.
Is XDR the same as SIEM?
No. XDR correlates security telemetry for detection with short retention; a SIEM stores all logs for retention, search and compliance reporting. Larger and regulated businesses run both.
MDR vs EDR vs XDR vs SIEM: do I need all four?
No. A typical SMB stack in 2026 is MDR (which brings EDR and XDR telemetry) and, above roughly 100 endpoints or under NIS2 or CMMC, a SIEM for retention. Buying all four as separate products from separate vendors is how companies end up paying twice for the same detection.