Transparent pricing
What 24/7 MDR costs
Three clear tiers, typically REPLACE_WITH_PRICE_RANGE per month depending on your endpoints, data sources and coverage, with the per-endpoint maths published below. Almost no UK provider publishes MDR pricing; we think you should be able to budget before you ever speak to us.
Essential
REPLACE_WITH_PRICE_ESSENTIAL /month
REPLACE_WITH_ANNUAL_ESSENTIAL a year
24/7 detection and response across your endpoints and identities, for businesses that need real coverage fast.
- 24/7 monitoring by UK analysts
- Endpoint and identity telemetry (including Microsoft Defender)
- Human triage of every alert
- Response actions pre-authorised by you
- Monthly service reporting
- Named service lead
Managed
REPLACE_WITH_PRICE_MANAGED /month
REPLACE_WITH_ANNUAL_MANAGED a year
Everything in Essential, plus full SIEM management and coverage across your cloud and network estate.
- Everything in Essential
- Cloud platform and network telemetry
- Managed SIEM, including Microsoft Sentinel
- Detection rules written for your environment
- Quarterly proactive threat hunts
- Escalation runbooks agreed with your IT team or MSP
Strategic
REPLACE_WITH_PRICE_STRATEGIC /month
REPLACE_WITH_ANNUAL_STRATEGIC a year
Everything in Managed, plus the proactive depth larger or regulated estates need.
- Everything in Managed
- Monthly proactive threat hunts
- Board-level reporting on threats and posture
- Annual incident response table-top exercise
- Co-managed SOC options for your in-house analysts
- Priority access to CyPro incident responders
These tiers are a guide: every engagement is scoped and priced to your estate in a discovery conversation. The service runs at REPLACE_WITH_PRICE_RANGE per month.
The maths, in the open
How MDR pricing actually works
MDR is priced on what the SOC has to watch. The two numbers that matter are your endpoint count (devices and servers) and your data sources (identity, email, cloud platforms, network). Our tiers work out at roughly REPLACE_WITH_PER_ENDPOINT per endpoint per month at typical mid-market sizes, and the discovery call turns that into an exact figure for your estate.
What should make you suspicious elsewhere: quote-only pricing, per-incident response fees, and onboarding charges that only appear after the demo.
Worked example
A 150-person business
- Around 170 endpoints across laptops and servers
- Microsoft 365 identities and email as core data sources
- Azure cloud platform telemetry
- Existing Defender licensing reused as the sensor layer
Typical fit: the Managed tier at REPLACE_WITH_PRICE_MANAGED per month, full 24/7 coverage included. The equivalent in-house rota does not exist at this size.
Scoping
What determines your price
Endpoints and users
The number of devices and identities the SOC watches is the biggest driver, which is why we publish the per-endpoint maths.
Data sources
Endpoints only, or cloud platforms, SaaS and network telemetry too? Each source adds visibility and ingestion.
Response authority
Notification-only costs less than pre-authorised containment, but it also does less at 3am. Most clients authorise containment.
Your existing tooling
Strong sensors you already own (like Microsoft E5) lower the price. Gaps we need to fill add licensing.
Client results
What our clients say
"The University was able to secure a multi-million pound cyber security investment as a result of the cyber roadmap work we did."
Danielle Cairns Cyber Risk & Assurance Manager, University of Glasgow "Within 7 months Pactio achieved both ISO and SOC2 compliance, as well as reduced overall cyber risk."
Sophie Fallen Operations Lead, Pactio "Their new ISO 27001 and Cyber Essentials Plus certifications won them more public sector work."
Tom Bennett CTO, FreshWave "A reduced attack surface through consolidation of IT and compliance with GDPR and Cyber Essentials."
Chris Bayley CTO, Audley Travel "PureMalt were able to weigh up different strategic options and make an appropriate investment in cyber security."
Ross Turner Managing Director, PureMalt "Ozone utilised their new capabilities to market to larger clients, whilst expanding into new markets."
Scott Switzer CTO, The Ozone Project The alternative
Compare it with building a SOC
| Cost | In-house 24/7 SOC | 247 MDR |
|---|---|---|
| People | A rota of trained analysts to cover every night, weekend and holiday, plus management | Included in the monthly fee |
| Tooling | SIEM licensing, ingestion costs, detection content and the engineering to keep it tuned | Included, built on sensors you already own |
| Time to coverage | A build measured in months before anyone is genuinely watching | Watching within days of onboarding |
| Monthly cost | Salaries and licensing regardless of what happens | REPLACE_WITH_PRICE_RANGE, published in full |
The NCSC's guidance on building a SOC sets out what the in-house route really involves. The fuller comparison, including when building genuinely is the right call, is on our MDR vs SOC page.
Get your number
Get an exact price for your estate
A 45 minute discovery call is enough for us to count your endpoints and sources and give you a firm monthly price.