Pricing calculator
SOC as a service pricing calculator
Set your endpoint count, choose a tier, and see an indicative monthly price straight away. MDR pricing per endpoint is volume adjusted here, so the rate falls as the estate grows rather than staying flat all the way up.
Key assumptions
- Figures exclude VAT
- EDR, XDR and SIEM licences are owned by you, so your tooling and data stay yours
- Onboarding, migrations and bespoke integrations are usually included in the price, not charged as a separate project
- Flexible 1 to 3 year contracts with a straightforward exit clause, because a service should be kept on results, not lock-in
Full tier detail, and what sits inside each one, is on the pricing page.
The maths, in the open
How the pricing works
Almost no UK provider publishes these numbers at all. We think you should be able to budget before you ever speak to us.
Your count sets the base
Count the endpoints the SOC will watch: laptops, desktops, servers and virtual machines. That number drives the monthly figure, so growth is priced before you hire the people who cause it.
Volume brings the rate down
Above roughly 700 endpoints the rate per endpoint starts to fall, and keeps falling as the estate grows. Smaller estates pay exactly the published tier rate, with nothing added.
Minimums, not bands
Each tier carries a monthly minimum rather than a set of bands, so there is no cliff edge to fall off when your count changes by one.
The tier sets the depth
Escalation only costs less, but it also does less at 3am. Moving up adds response on your behalf, wider telemetry, threat hunting and custom detection engineering.
Common questions
About these numbers
How accurate is the calculator?
It is an indicative range rather than a quote. It reflects how we actually price, so most estates land inside it, but the final figure depends on the telemetry in scope and the number of sources we connect. A short scoping call is enough for us to confirm it.
Why does the price per endpoint fall as the estate grows?
Monitoring a larger estate costs us less per endpoint than monitoring a small one. Detection content, tuning and service management are largely fixed regardless of size, so the more endpoints in scope, the further those costs spread. We pass that on rather than charging a flat rate the whole way up.
What counts as an endpoint?
Anything running a sensor we monitor: laptops, desktops, servers and virtual machines. Mobile devices and network appliances are usually counted separately, and we will confirm exactly what is in scope before quoting.
What if we have more than 30,000 endpoints?
Estates that size are priced individually rather than off a published figure, because the shape of the environment matters more than the count. Talk to us and we will put a firm number to it.
Are there setup or incident fees on top?
No. Onboarding is part of the service rather than a project sold on top, and we do not charge per incident. Quote only pricing, per incident response fees and onboarding charges that appear after the demo are all worth questioning wherever you see them.
More questions answered on the full FAQ page.
Get your number
Get an exact price for your estate
A 45 minute discovery call is enough for us to count your endpoints and sources and give you a firm monthly price.