XDR cost is driven by how much telemetry you send, how many assets it covers, how long you keep data, and how much staff time it takes to run. Build the budget from your own counts, request written quotes, and add the people cost, which is usually the largest line.
Why is a single XDR price hard to find?
Vendors package XDR in different ways. Some charge per endpoint, some per user, some per gigabyte of data ingested, and some bundle a managed detection service. This post gives no prices because none are fetched here and any number would age quickly. What it gives you is the list of drivers, so a quote can be tested.
Driver 1: Coverage count
Start by counting the things that would be licensed. Endpoints and servers are the obvious ones. Add identity accounts, cloud workloads, email mailboxes and network sensors if the product covers them. Write the number down for each. A quote that does not say what unit it is priced on is not a quote yet.
Count the awkward items too. Contractors, build agents, short-lived containers and test machines often fall outside the first scope and show up later as a true-up.
Driver 2: Data volume and retention
If pricing depends on ingest, you need an estimate of daily log volume per source. Pull it from your current logging, not from a guess. Ask the vendor which sources are included in the base fee and which count against a quota.
Retention is a separate decision. NIST SP 800-53 control SI-4 expects monitoring that detects attacks and unauthorized connections, and expects you to analyze detected events. That analysis often needs history. Decide how many days must be searchable now and how many can sit in cheaper storage, then ask for the price of each tier.
Driver 3: Detection content and tuning
Ask whether detection rules are included, and whether you can write your own. Tuning is real labor. A product that produces many alerts in week one costs analyst time in week two. Ask existing users, through references the vendor does not select for you, how long tuning took.
Driver 4: People
Add the cost of the people who will read alerts and act on them. If nobody is awake at night, think about who handles a midnight alert. A managed service moves some of that cost to the vendor, but you still need someone internally who can approve containment actions.
Estimate hours per week for triage, tuning, reporting and platform upkeep. Multiply by a loaded hourly rate from your own finance team. Do not use a generic salary figure from the internet.
Driver 5: Integration and migration
You will connect identity, ticketing, chat and existing logging. Each connection takes engineering time, and some need paid connectors. If you replace an existing endpoint agent, plan for a parallel run so you are not blind during cutover. Ask the vendor for a written scope of included integration work.
Driver 6: Contract shape
Look at term length, renewal uplift, minimum commitments, overage rates and what happens if your headcount drops. Ask for the overage rate in writing even if you never expect to use it.
A budget skeleton
Use five lines in a spreadsheet. License or subscription. Data and storage. Integration, one time. Internal staff time. External services such as managed monitoring or incident support. Fill each from a quote or an internal count, and put a note beside any figure you estimated. Show a low and high case, driven by the two inputs you trust least, usually data volume and staff hours.
What to do
- Count assets by type and note the unit each vendor prices on.
- Measure current daily log volume per source.
- Decide searchable retention and archive retention separately.
- Estimate staff hours per week using your own loaded rate.
- Get written quotes including overage and renewal terms.
- Build low and high cases and review them with finance before signing.
Where Safeguard fits
XDR is mostly an endpoint, identity and network detection topic, and Safeguard does not replace it. Safeguard works on the application and software supply chain side, for example reachability analysis on dependencies and policies at build and release. If you budget for both, keep them as separate lines so neither hides the other.
Quick check
Is per-endpoint pricing always cheaper than per-gigabyte pricing?
No. It depends on your estate and your log volume. Model both with your own numbers before deciding.
Which cost do teams most often forget?
Staff time for triage and tuning, followed by integration work and storage for longer retention.
Sources
- NIST SP 800-53 Rev. 5, control SI-4 System Monitoring (OSCAL catalog)
- NIST SP 800-137, Information Security Continuous Monitoring
Last reviewed: 18 October 2026.
