sourcing.cisomarketplace.com / endpoint-planner
Part of CISO Marketplace
Endpoint Licensing · Free Planner

Plan your EDR, MDR, or XDR license spend

Count your endpoints by type, pick a protection tier, get a vendor-neutral annual cost range with a feature breakdown. Servers cost 3-5× workstations. Cloud workloads cost ~3×. Mobile costs less. The numbers add up differently than you think.

i
Why this exists: vendor pricing pages quote workstation prices, not server or cloud-workload prices. A 2,000-endpoint shop with 200 servers pays roughly the same in server licenses as it does for all 1,800 workstations. Mixed-asset fleets get mis-budgeted constantly. This planner adds them up correctly.

Your Endpoint Inventory

Count by asset type. The planner uses different price bands for each.

▢Workstations
Laptops, desktops, knowledge worker devices.
▦Servers
Physical and virtual servers — on-prem or cloud-hosted VMs.
⌬Cloud workloads
Containers, K8s pods, serverless, ephemeral cloud compute.
▭Mobile devices
Managed phones and tablets requiring MTD agent.

Protection Tier

Pick what level of protection and response you actually need.

Annual License Cost
Self-managed EDR
Total endpoints 2,500
Low (volume / enterprise discount)
$0
$0 / endpoint / year
Mid (typical mid-market)
$0
$0 / endpoint / year
High (small fleet, list price)
$0
$0 / endpoint / year

Per-Asset Breakdown

Where the budget actually goes — at mid-market pricing.

Asset type Count $/ep/yr (mid) Annual cost % of total

What This Tier Includes

Compared to the tier above and below — capabilities you get and don't.

Tier Comparison

Annual cost at your fleet size across all four tiers.

Vendors at This Tier

Vendor-neutral, alphabetical. Not an endorsement — names are listed where the tier appears in their portfolio.

▸ See per-asset pricing bands and methodology

All prices are annual list per endpoint from publicly observable vendor catalog data, partner program documents, and reseller quotes. Real volume discounts run 20-40% off list for fleets above 1,000 seats; pricing also varies by contract term (1 vs 3 vs 5 years) and bundle composition. The mid-band is what a typical mid-market buyer pays at list with modest negotiation; the low band assumes 30-40% volume discount; the high band is small-fleet list.

TierWorkstationServerCloud workloadMobile
Basic AV / NGAV$25 – $45$80 – $150$60 – $120$15 – $30
Self-managed EDR$50 – $90$180 – $350$150 – $280$30 – $50
Managed (MDR)$90 – $160$300 – $600$250 – $500$40 – $80
Extended (XDR)$130 – $250$450 – $900$350 – $700$60 – $110

Notes:

  • Server pricing is higher because servers carry higher data volume, higher criticality SLA, and often more telemetry sources.
  • Cloud workload pricing is per-vCPU or per-workload in some vendor catalogs and per-host in others — we normalize to per-workload.
  • Mobile (MTD — mobile threat defense) is the cheapest because the threat surface and data volume per device are smaller.
  • MDR pricing here is for endpoint MDR only. Full MDR services including SIEM-side analyst hours are priced separately — see our SOC Build vs Buy tool.
  • XDR pricing typically bundles identity (Entra/Okta), email, cloud, and network telemetry, which is why it's the steepest tier.

📄 Download the procurement-ready PDF

Detailed report with your per-asset breakdown, tier comparison, vendor shortlist for your tier, and a 6-item RFP checklist to bring to vendor conversations.

✓ Sent! PDF downloading now...
Recommended next step

Get matched with endpoint protection vendors at your tier

Our 5-minute sourcing diagnostic matches you with 3 vetted vendors sized for your fleet and tier choice. No vendor pays for placement.

Open the sourcing diagnostic →