EDR cost is driven by how many endpoints you cover, how long you keep telemetry, who responds to alerts, and which modules you add. Count your real devices, decide retention from your investigation needs, price the people, and compare quotes on those four lines instead of headline rates.
Why is the licence line a poor guide?
The per device rate on a quote is the easiest number to compare and the least complete. Two quotes with the same rate can differ by a large factor once retention, managed response and integration work are included. This post gives no prices, because they change and depend on contract terms. It gives you the structure to build your own.
What are the four drivers?
Endpoint count. Start with an honest device inventory. Laptops are obvious. Servers, virtual machines, build agents, developer workstations and contractor devices are where counts drift. Ask whether short lived cloud workloads count by peak, average or total created.
Telemetry retention. EDR agents record process, file, network and login activity. Keeping it longer helps investigations of slow intrusions and costs more. Decide retention by asking how long it usually takes you to notice a problem, then buy for that, not for a number on a brochure.
Response capacity. An alert nobody works is wasted spend. You either staff review and response internally, which includes after hours coverage, or pay a managed service to do it. Price both honestly. A tool that is cheap per device but needs a full time analyst is not cheap.
Modules and integration. Vulnerability visibility, identity signals, mobile coverage and log forwarding are often separate lines. So is the time to connect EDR to your ticketing and your SIEM, if you have one.
How do you size them in practice?
Use a simple worksheet:
| Line | Your input | Common trap |
|---|---|---|
| Endpoints | Verified inventory by OS and type | Counting only managed laptops |
| Retention | Typical time to detect plus investigate | Buying the maximum by default |
| Response hours | Alerts per week times minutes per alert | Ignoring nights and weekends |
| Add ons | Modules you will actually use in year one | Paying for a bundle you will not deploy |
| Rollout effort | Hours to deploy, tune and train | Forgetting exclusions testing |
Then run the worksheet for three scenarios: current size, size plus 25 percent growth, and size after you add servers. A contract that looks good at one size can look poor at another.
What contract terms change the real cost?
Ask about minimum commitments, how you reduce count if you shrink, overage handling, price protection at renewal, data export, and what happens to your telemetry at exit. Ask whether performance testing on your own fleet is allowed before you sign. NIST SP 800-137 on continuous monitoring is a useful frame: you are buying ongoing visibility, so what happens in year three matters as much as year one.
What is outside the EDR budget?
EDR watches endpoints. It does not review your source code, your dependencies or your build pipeline. Budget for those separately. A supply chain compromise that ships through a package update arrives on endpoints as signed, trusted software.
How should you present the budget to finance?
Show three scenarios side by side: the current fleet, fleet plus growth, and a managed response option versus in house response. State every assumption on one page, such as device count, retention period and hours of alert review per week. Finance can then challenge an assumption instead of a total, and you can update one input when reality changes. Keep a line for one off rollout effort apart from the recurring lines, because it will not repeat at renewal.
Where Safeguard fits
EDR is not a Safeguard product and Safeguard does not replace it. Safeguard focuses on the application and software supply chain side: reachability analysis to show which vulnerable code paths are really exposed, and policies that gate builds, CI and releases. Treat it as a neighbour to your endpoint tooling, not a substitute, and budget for each on its own terms.
What to do
- Build a device inventory that includes servers, build agents and contractor machines.
- Decide retention from your own time to detect, not from vendor defaults.
- Estimate alert volume in a pilot and price the response hours, including off hours.
- List the modules you will use in year one and drop the rest from the comparison.
- Ask each vendor the contract questions and record the answers.
- Model three fleet sizes and review the budget at each renewal.
Quick check
What is the most commonly missed EDR cost?
People. Someone must triage alerts and respond, including outside office hours, whether in house or through a managed service.
Should I buy the longest retention available?
Not by default. Match retention to how long it usually takes you to notice and investigate a problem, and revisit it after your first incident review.
Sources
- NIST SP 800-137, Information Security Continuous Monitoring
- NIST SP 800-61 Rev. 3, Incident Response Recommendations
- MITRE ATT&CK
Last reviewed: 18 October 2026.
