MDR vs EDR
MDR vs XDR, MDR vs MSSP, MDR vs SOC and MSSP vs MSP
EDR is a tool your team runs. MDR adds 24/7 analysts, at list prices of $108 to $350 per endpoint a year. We help you pick the level you need, then source and negotiate it.
Find the Right Fit for My TeamFree Security Coverage Review: send your endpoints, tools and timeline. You'll hear back within 24 hours.
MDR vs EDR comes down to who does the work: EDR (endpoint detection and response) is software that records what happens on laptops and servers and flags attacks, while MDR (managed detection and response) is a service in which a provider's analysts watch those alerts 24/7, investigate and act. A self-run EDR license lists at about $110 to $185 per endpoint a year, and managed EDR and MDR list at about $108 to $350 per endpoint a year with the analysts included (price listings cited below). The other terms on this page sit on the same ladder: XDR widens what is watched, an MSSP runs a broader set of security services, a SOC is the team and platform that does the watching, and an MSP runs IT rather than security. Pricing by provider is on our MDR providers and pricing page; the broader market is under managed security services and SOC as a service. Metro Colo Advisory helps mid-size and large companies pick the level they need and then sources and negotiates it; the provider you choose pays us, so it costs you nothing.
- Endpoints only
- Your team watches and responds
- Needs 24/7 staff to work at night
- Endpoints, watched 24/7
- Provider isolates hosts
- Agent usually included
- Endpoints plus identity and cloud signals
- Threat hunting and investigation
- Agreed response authority
- Endpoint, network, cloud, identity, email and logs
- One incident view
- Log retention for audits
- SIEM, firewall, vulnerability and compliance services
- Monitoring of everything that logs
- Response often by your team
Sources: AWS Marketplace listings for Sophos (EDR $110, MDR $239.64 per user, 12 months), Red Canary MDR ($120 per endpoint) and Rapid7 Managed Threat Complete ($111,000 and $175,000 from 500 assets); Unió Digital MDR and EDR pricing index (CrowdStrike Falcon Enterprise $184.99 per device a year, Huntress $8.99 per endpoint a month). In-house seat: MCA calculation from BLS, shown below. Price does not rise at every step: a self-run EDR license can cost as much as managed EDR, because managed EDR bundles its own agent. Prices checked October 2026. Free to cite with a link to this page.
- Endpoint count, split into workstations and servers
- The security tools and people you have today
- Identity, cloud, email and log sources
- Your timeline and any audit, insurer or CMMC requirement
- Which level fits: managed EDR, MDR, managed XDR, an MSSP or SOC as a service
- The per-endpoint range it should cost, from published prices
- Where a cheaper level covers you, we say so
- If it isn't a fit, we will say so
EDR vs Managed EDR vs MDR vs XDR vs MSSP vs SOC
| Service | What it is | Who runs it | Coverage | Response | Price model and cited range | Best fit by company size |
|---|---|---|---|---|---|---|
| EDR | Software on endpoints that records activity and flags attacks | Your team | Laptops and servers | Your team, when someone is watching | Per endpoint per year; $110 (Sophos EDR) to $184.99 (CrowdStrike Falcon Enterprise) list | Companies that already staff security around the clock |
| Managed EDR | A provider runs the EDR tool and works its alerts 24/7 | Provider | Endpoints | Provider: isolate hosts, stop processes | Per endpoint per month; $8.99 (Huntress) list, $107.88 a year | 200 to 1,000 employees, simple stack, little cloud |
| MDR | A 24/7 detection, hunting and response service | Provider | Endpoints plus identity and cloud signals | Provider, within agreed authority | Per endpoint per year; $120 (Red Canary) to $239.64 (Sophos) list | 500 to 5,000 employees without a 24/7 team |
| XDR and managed XDR | Correlates endpoint, network, cloud, identity and email data into one view | Your team (XDR) or provider (managed XDR) | Most of the environment, often with logs | Across endpoints, accounts and cloud | Per asset per year; Sophos XDR $136.60 list self-run; managed $222 to $350 (Rapid7) | 1,000 to 5,000+ employees, multi-site or cloud-heavy |
| MSSP | A provider of several managed security services under one contract | Provider | Whatever is contracted: SIEM, firewalls, vulnerability scans, sometimes MDR | Often alert and advise; hands-on if contracted | Per device or per GB of logs, plus onboarding and licenses; about $150,000 to $500,000 a year at 500 to 1,000 employees (MSSP pricing) | 1,000+ employees wanting one provider for several services |
| SOC as a service | An outsourced security operations center, usually SIEM-centered | Provider | Every system that sends logs | Triage and escalation; containment varies | Per device, user or GB per day; about $150,000 to $500,000 a year at 1,000 employees (SOC pricing); in-house $928,000 per 24/7 seat | 500+ employees with log monitoring required for audits |
| MSP | A managed IT provider: help desk, devices, patching, networks | Provider | IT operations | IT tickets, not security incidents | Per user or per device per month; quote-based | Any size that outsources IT operations |
Prices are published list prices from the sources under the chart above; provider-by-provider detail is on MDR pricing by provider. Best fit by company size is a Metro Colo Advisory read, not a published statistic.
Send the endpoints, the tools and the people you have today. You'll hear back within 24 hours. From there, we work out the level that fits and what it should cost. If managed EDR covers you, we will say so.
MDR vs EDR
EDR is the tool; MDR is the people using it. An EDR agent records process, file, network and login activity on each endpoint, matches it against known attack behavior and raises alerts. Someone still has to read those alerts, decide which are real and act, at any hour. MDR is that someone, sold as a service: analysts watching 24/7, hunting for threats the alerts missed, and taking response actions such as isolating a laptop or disabling an account under authority you agree in advance.
Choose EDR alone when
You already have people watching alerts nights and weekends, or you are buying the tool first and the service next. Expect $110 to $185 per endpoint a year at list for the license.
Choose managed EDR when
Most of your risk is on endpoints and nobody watches at night. Managed EDR lists at $107.88 per endpoint a year, about what a self-run license costs, with the analysts included.
Choose MDR when
Attacks would come through identity, email or cloud as well as endpoints, and you need hunting and a defined response process. List prices run $120 to $239.64 per endpoint a year.
EDR vs antivirus
Antivirus blocks known malicious files. EDR watches behavior, so it can catch an attacker using stolen credentials and legitimate admin tools that antivirus would let through. Most current EDR products include next-generation antivirus, so the choice for a mid-size company is usually EDR or MDR, not antivirus.
MDR vs XDR
XDR (extended detection and response) is a technology: a platform that pulls endpoint, network, cloud, identity and email data into one place and correlates it into a single incident. MDR is a service. The two meet in managed XDR, where a provider runs the XDR platform for you. Sophos shows the difference in one listing: its self-run XDR is $136.60 per user a year and its MDR is $239.64, so the managed service costs $103.04 more per user (MCA calculation from AWS Marketplace). Buy XDR if you have a team to run it; buy MDR or managed XDR if you do not.
MDR vs MSSP
An MSSP (managed security service provider) sells a range of managed security services, such as SIEM monitoring, managed firewalls, vulnerability scanning and compliance reporting. MDR is one specific service, focused on detecting and stopping attacks in progress. Some MSSPs offer MDR; many MDR providers offer nothing else. The practical difference is response: MDR providers are built to act on your endpoints and accounts, while a traditional MSSP more often alerts your team and advises.
MSSP pricing is usually a service fee plus the tools underneath. One example: a UK managed services provider lists its managed detection and response service at £7.84 to £9.68 per device a month, plus £5,000 to £7,500 one-time onboarding, with product licenses not included (G-Cloud 14 pricing document). Compare MSSP quotes with the licenses added back in. Our managed security services page covers MSSP pricing in full.
MSSP vs MDR: which do you need?
MDR first
Your main concern is ransomware and account takeover, you run your own firewalls and compliance reporting, and you want a provider that acts, not just alerts.
MSSP first
You want one contract covering managed firewalls, SIEM, vulnerability management and reporting, and your team can handle hands-on response or you add MDR to it.
Both
Common above about 2,000 employees: an MSSP for the broad services and an MDR provider for endpoint and identity response, with a clear line between them.
MDR vs SOC
A SOC (security operations center) is a team and platform that monitors an organization's security around the clock. MDR is a narrower service a SOC might provide. SOC as a service outsources the whole function, usually built around a SIEM that collects logs from everything you run, which gives broader visibility and the log retention auditors ask for; MDR goes deeper on endpoints and response. Building your own SOC is the expensive end: one seat staffed 24/7 needs 4.92 analysts and costs about $928,000 a year.
MSSP vs MSP
An MSP (managed service provider) runs IT: the help desk, laptops, patching, Microsoft 365 administration and the network. An MSSP runs security: monitoring, detection, firewalls, vulnerability management. Many MSPs resell security tools and some run a security practice, but monitoring and incident response are a different discipline with different staffing, and most mid-size companies keep the two contracts separate so the provider watching for attacks is not the one whose work it is checking. If your MSP says it covers security, ask who watches the alerts at 3 a.m. and what they are allowed to do.
We will tell you when managed EDR is enough
Metro Colo Advisory is an independent advisor. We source and negotiate managed security services, including MDR, SOC and MSSP contracts, and the provider you choose pays us through its channel program.
Disclosure: providers pay us a commission when a client chooses them. Our consulting work is separate and paid by the client.
Which One Fits a 500 to 5,000 Employee Company
Five questions settle most of it. Answer them in order and stop at the first level that covers you.
Is anyone watching alerts at night and on weekends?
If not, EDR alone leaves the gap attackers use. You need at least managed EDR.
Is your risk mostly on endpoints, or also identity, email and cloud?
Endpoints only: managed EDR. Microsoft 365 or Google accounts, SaaS and cloud workloads in scope: MDR.
Do you have several sites, a lot of cloud, or network gear you need watched?
Then you want one incident view across all of it: managed XDR, or MDR with SIEM.
Does an auditor, insurer or contract require log monitoring and retention?
PCI DSS, HIPAA, SOC 2 and CMMC programs usually do. Add SOC as a service or choose an MDR service with log coverage. Defense contractors should look at a CMMC enclave and GCC High together with monitoring.
Do you also want firewalls, scanning and reporting run for you?
That is an MSSP, alone or alongside MDR.
| Company profile | Usual fit | List budget at 500 endpoints | List budget at 1,000 endpoints |
|---|---|---|---|
| 500 to 1,000 employeesOne region, standard Microsoft or Google stack | Managed EDR, or MDR if identity is in scope | $53,940 to $119,820 | $107,880 to $239,640 |
| 1,000 to 2,500 employeesSeveral sites, some cloud, audit requirements | MDR, often with log coverage | $119,820 to $175,000 | $239,640 to $350,000 |
| 2,500 to 5,000 employeesMulti-site, cloud-heavy, regulated | Managed XDR or MDR plus SOC as a service or an MSSP | $175,000, plus the SOC or MSSP quote | $350,000, plus the SOC or MSSP quote |
MCA calculation: endpoints x published list price per year. Managed EDR $107.88 (Huntress), MDR $239.64 (Sophos), MDR with SIEM $350 (Rapid7 Managed Threat Complete Ultimate). The same figures appear on MDR cost per endpoint. Usual fit is a Metro Colo Advisory read. Negotiated prices at these sizes usually land below list.
Most companies are. Send what you run and who runs it, and we will tell you which level covers you and what it should cost. The provider you choose pays us, so it costs you nothing.
What None of Them Replace
Recovery
MDR, XDR and a SOC contain attacks; none restore encrypted data. Ransomware was in 48 percent of breaches in the 2026 Verizon DBIR. Pair detection with backup as a service and DRaaS.
Network access
Who can reach what is set by your network and access design. SASE and SD-WAN and an MPLS replacement cut what an attacker can reach in the first place.
Time to contain
In IBM's 2026 report (Baker Donelson summary), the average US breach cost $11.5 million and took 247 days to identify and contain. Detection shortens that window; it does not close it alone.
When the security decision is part of a bigger change, such as a cloud migration, cloud repatriation or a move into hybrid cloud colocation, our IT infrastructure consulting covers the whole environment. Consulting is paid by the client, with engagements from $45,000.
MDR vs EDR: Frequently Asked Questions
What is the difference between MDR and EDR?
EDR is software that records endpoint activity and flags attacks; your team has to watch and act on it. MDR is a service in which a provider's analysts watch those alerts 24/7, hunt for threats and take response actions. A self-run EDR license lists at about $110 to $185 per endpoint a year; managed EDR and MDR list at about $108 to $350 with the analysts included.
Is MDR better than EDR?
MDR is not a better tool; it is EDR plus the people to run it. If you already have staff watching alerts around the clock, EDR may be enough. If you do not, MDR or managed EDR closes the gap at nights and weekends.
What is the difference between MDR and XDR?
XDR is a technology that correlates endpoint, network, cloud, identity and email data into one incident view. MDR is a service run by a provider's analysts. Managed XDR combines them: a provider runs the XDR platform for you.
What is the difference between MDR and MSSP?
An MSSP sells several managed security services, such as SIEM monitoring, firewalls and vulnerability scanning, and more often alerts and advises. MDR is one service focused on detecting and stopping attacks, with the provider taking response actions itself.
MSSP vs MDR: which should a mid-size company choose?
Choose MDR first if your main concern is ransomware and account takeover and you want a provider that acts. Choose an MSSP if you want one contract for firewalls, SIEM, scanning and reporting. Many companies above about 2,000 employees use both.
What is the difference between MDR and a SOC?
A SOC is the team and platform that monitors security around the clock, usually built on a SIEM that collects logs from everything. MDR is a narrower, deeper service focused on endpoints, identity and response. SOC as a service outsources the whole function.
What is the difference between an MSSP and an MSP?
An MSP runs IT operations: help desk, devices, patching and networks. An MSSP runs security: monitoring, detection, firewalls and vulnerability management. Most mid-size companies keep them as separate contracts.
What is managed EDR?
Managed EDR is a service in which a provider runs an EDR tool for you, works its alerts 24/7 and takes endpoint actions such as isolating a host. Huntress lists Managed EDR at $8.99 per endpoint a month, or $107.88 a year.
How much more does MDR cost than EDR?
In Sophos's AWS Marketplace listing, self-run EDR is $110 per user a year and MDR is $239.64, so the managed service adds $129.64 per user. Other providers bundle the agent into a single managed price.
Is it cheaper to build a SOC or buy MDR?
For most companies under a few thousand employees, buying is cheaper. One analyst seat staffed 24/7 needs 4.92 analysts and costs about $928,000 a year in salary and benefits at BLS median pay. MDR for 1,000 endpoints lists at $107,880 to $350,000 a year.
Does Metro Colo Advisory charge to help choose between MDR, EDR and an MSSP?
No. We source and negotiate managed security services, and the provider you choose pays us, so it costs you nothing. If a cheaper level such as managed EDR covers you, we will say so.
Find the Right Fit for Your Team
Send the endpoint count, the tools and people you have, and your timeline, before you ask any provider for pricing. You'll hear back within 24 hours. From there, we work out the level that fits and what it should cost. If it isn't a fit, we will say so. If you have already spoken to one provider, tell us which; we can still run the rest of the market.
The provider you choose pays us, so it costs you nothing.
Security operations: MDR providers and pricing, SOC as a service, managed security services and managed firewall services.
Network and compliance: SASE and SD-WAN, CMMC enclave, GCC High and compliance colocation.
Recovery: backup as a service, DRaaS and disaster recovery colocation.
Infrastructure and cost: data center consulting, colocation pricing guide, data center cost and cloud repatriation.
Testing and deals: penetration testing cost and cybersecurity due diligence.
