How Much Does
MDR Cost?
MDR pricing in the UK starts from £900 per month, scaling with endpoints, log sources, and service tier. A typical mid-sized organisation pays £1,800 to £3,500 per month, roughly £11 to £22 per user. Building an equivalent in-house SOC costs £500,000 to £1,000,000 or more per year.
MDR in the UK costs from £900 per month, billed as a fixed monthly subscription that scales with endpoints, log sources, and service tier. Here is the full pricing breakdown, a worked example, and what should be included before you sign.
MDR costs from £900/month.
Managed detection and response pricing is billed as a fixed monthly subscription, scaling with the number of endpoints, the volume of log sources, and the service tier. Full incident response is included in every tier as standard, with no separate retainer.
First MDR engagement?
The Essential tier (from £900/month) is the most common starting point for small and mid-size organisations. It gives you 24/7 human-led monitoring with incident response included, satisfying most cyber insurance and Cyber Essentials monitoring requirements. Prefer to compare against a full outsourced SOC first? See the managed SOC cost guide.
How MDR pricing models work
Across the market, MDR is typically billed one of three ways: per-endpoint (a flat fee for every device monitored, scaling linearly with estate size), per-user (a flat fee per employee, common for identity and email-heavy coverage), or tiered (fixed monthly bands defined by endpoint count, log source volume, and level of human coverage, such as basic monitoring versus proactive threat hunting).
Most providers in the UK market will not publish a price. Every environment is genuinely different, so a scoping call is a reasonable part of the process. But an entry price still tells you whether a provider is even in your budget range before you spend an hour on a call, and its absence is often used to obscure how the quote is actually built.
Precursor prices MDR on published tiers, driven by endpoint count and log source volume, shown below. A free scoping call confirms the exact figure, but the starting point and the bands either side of it are visible up front.
MDR cost by tier
Three tiers covering every organisation size. Each is fixed monthly pricing, includes full incident response, and is scoped on a free call before you commit. Annualised, published tiers span roughly £30,000 to £144,000 per year depending on tier.
Essential MDR
50-100 endpoints | Core log sources
- 24/7/365 monitoring
- EDR + SIEM integration
- Alert triage by human analysts
- Basic incident response included
- Monthly reporting
Best for: First MDR engagement, small teams, satisfying cyber insurance and Cyber Essentials monitoring requirements.
Standard MDR
100-500 endpoints | EDR + cloud logs
- Everything in Essential
- Proactive threat hunting
- Dedicated analyst support
- MITRE ATT&CK-mapped reporting
- Quarterly strategic reviews
Best for: Growing mid-market organisations that need active hunting, not just alert forwarding.
Enterprise MDR
500+ endpoints | Multi-cloud estates
- Everything in Standard
- Dedicated analyst teams
- Custom detection rules
- Advanced threat intelligence
- Board-level reporting
Best for: Large or complex environments needing dedicated resource and bespoke detection engineering.
What does this cover?
MDR is usually priced on endpoints, log sources, and service tier rather than strictly per user, but a per-user figure is a useful planning guide. For a typical 160-user organisation, total monthly cost commonly lands between £1,800 and £3,500, depending on how many servers and cloud log sources are in scope and the depth of threat hunting required. That works out to roughly £11 to £22 per user per month for fully managed 24/7 detection and response with incident response included.
What should be included in the price
Not every provider bundles the same things into a headline figure. Before comparing quotes on price alone, confirm what is actually included.
With Precursor, incident response is included in every MDR tier as standard, not billed as a separate retainer when a confirmed threat needs containing. Some MDR pricing looks lower on paper because incident response, threat hunting, or onboarding are quoted separately once you are already a customer. Ask what happens, and what it costs, the first time a real incident is confirmed.
What drives MDR cost
Four factors set where your price lands. We confirm all four on a free scoping call before quoting.
MDR vs in-house SOC cost
The reason most UK organisations outsource: an in-house Security Operations Centre costs six figures a year before it detects a single threat.
| Option | Typical cost |
|---|---|
| MDR (Precursor) | From £900/month (£30,000-£144,000/yr by tier) |
| In-house SOC (3-5 analysts) | £500,000-£1,000,000+ per year |
An in-house build also carries threat intelligence feeds, training, and management overhead on top of salaries and licensing, and typically takes months to reach full operational maturity. MDR folds the equivalent capability into one fixed monthly fee, with CREST-accredited analysts already in place. For a broader outsourced-SOC comparison beyond endpoint-focused MDR, see the managed SOC cost guide.
Why is most MDR pricing quote-only?
Scoping variables are genuinely real. Endpoint count, log source variety, existing tooling, and required response depth all change the final number, and no provider can price that precisely without a conversation. That is a legitimate reason a final figure needs a scoping call.
Questions worth asking before you scope
Precursor publishes tier bands and a starting price precisely because scoping variables are real but should not hide the entry point. A free scoping call confirms your exact figure in writing, typically within 48 hours. For background on what MDR includes and how it differs from adjacent services, see what a managed SOC is and our guide to choosing an MDR provider.
Compare across the closed loop
Most UK mid-market organisations pair MDR with an annual penetration test, feeding findings straight into detection rules. See the closed-loop security model and related pricing.
Get your fixed monthly MDR price
A free scoping call establishes your endpoints, log sources, and coverage needs. You get a fixed monthly quote, no POA, with incident response included as standard.
Get a Fixed Monthly QuoteMDR pricing questions
MDR pricing in the UK starts from £900 per month, scaling with the number of endpoints, log sources, and service tier. Precursor MDR is billed as fixed monthly pricing after a free scoping call, with full incident response included in every tier and no separate retainer.
The main drivers are the number of endpoints and users covered, the volume and variety of log sources (endpoint, network, cloud, identity, email), the service tier (basic monitoring versus proactive threat hunting and dedicated analyst support), and whether incident response is bundled or billed as a separate retainer. Onboarding complexity, such as whether you already run EDR or SIEM tooling, also affects the final price.
For most organisations under 1,000 employees, yes. Building an equivalent in-house Security Operations Centre typically costs £500,000 to £1,000,000 or more per year once you account for 3 to 5 analysts on a 24/7 rota (£40,000 to £70,000 each), SIEM and EDR licensing (£50,000 to £200,000), threat intelligence, training, and management overhead. MDR delivers the same detection and response capability from £30,000 to £144,000 per year depending on tier, starting from £900 per month, with no recruitment or 6 to 12 month build time.
With Precursor, yes. Full incident response, including containment, forensic investigation, and remediation guidance, is included as standard in every MDR tier, with no additional retainer required. Not every provider bundles incident response into the headline price, so this is worth confirming before comparing quotes on price alone.
MDR is usually priced on endpoints, log sources, and service tier rather than strictly per user, but a per-user figure is a useful planning guide. For a typical 160-user organisation, total monthly cost commonly lands between £1,800 and £3,500 depending on how many servers and cloud log sources are in scope, which works out to roughly £11 to £22 per user per month for fully managed 24/7 detection and response with incident response included.