What managed detection and response costs for a 5, 10, or 25 person business (2026)
MDR costs for 5, 10, 25 and 50 devices: Ridge Watch's $15/device business rate, onboarding, the Huntress seat floor and Ridge Core's identity coverage.
Read articleEndpoint & Detection
Best MDR providers for small businesses (2026)
Compare seven small-business security options by response ownership, published prices, terms, minimums, identity coverage and insurance evidence.
SMB
Obsidian Ridge's Ridge Core costs $25 per person per month, month-to-month, with no minimum; managed endpoint detection and response and Microsoft 365 or Google Workspace identity monitoring are included. Business onboarding is separate. Huntress's SOC monitors and acts 24/7; Obsidian Ridge provides CISSP-led follow-through within one business day, serving the Research Triangle and businesses across the United States. 14
That is our offer, not a universal winner. Obsidian Ridge publishes this comparison and includes our own service, so the commercial interest is explicit. The useful question is who will act on a threat, what they can act on, and what the whole contract costs at your actual size.
This is a shortlist by buying model, not a test-lab ranking. Microsoft Defender for Business is included to show the self-run alternative. Obsidian Ridge uses Huntress, so those two rows do not represent independent detection technologies.
Compare response, price and the work you still own
Sources were checked on October 1, 2026. Prices are public US-dollar examples, not negotiated quotes. “Not published” means the cited public pages did not disclose that detail; it does not mean the feature is absent or the minimum is zero. Each table cell points to the source list below.
Scroll the table sideways to read every column when it is wider than the page. You can also focus the table and use the arrow keys.
| Provider | Who does the response | Pricing model | Published price | Contract term | Minimum seats | Identity coverage | Cyber-insurance evidence |
|---|---|---|---|---|---|---|---|
| Huntress (direct) 1 | Huntress's 24/7 SOC; the direct buyer owns deployment, portal management and follow-through on incident reports 1 | Published, volume-based endpoint licensing 1 | $8.99 per endpoint per month at 50 endpoints; $449.50 monthly at that floor 1 | 12 months standard 1 | 50 per product 1 | Managed ITDR is a separate product for Microsoft 365 and Google Workspace 1 2 | SOC incident reports; a carrier-specific evidence pack is not specified on the pricing page 1 |
| Blackpoint Cyber | Human-led SOC with active response 3 | Quote-only, per-seat subscription 3 4 | Not published 4 | Essentials: month-to-month; annual commitment for volume pricing 5 | Base minimum not published; volume pricing begins at 50 endpoints 5 | Cloud MDR supports Microsoft 365 and Google Workspace 5 | CompassOne posture rating documents security maturity; confirm the report included in your quote 6 |
| Sophos MDR | Sophos MDR operations team; full incident response described for MDR Plus 7 | Quote-only 8 | Not published 8 | Not published on the quote page 8 | Not published on the quote page 8 | Identity is within the advertised MDR scope; confirm integrations and licences 8 16 | MDR reports document service activity; ask which exports your carrier needs 9 |
| Arctic Wolf | SOC containment with human oversight and concierge-guided remediation 10 | Quote-only 10 | Not published 10 | Standard MDR term not published on the reviewed product page 10 | Not published on the reviewed product page 10 | Active Response integrations include Entra ID and Google Workspace 11 | Posture reviews are described; a carrier-specific evidence pack is not specified 10 |
| Defendify | Cybersecurity team monitors and responds around the clock 12 | Published starting package price; final scope quoted 13 | Detection & Response starts at $325/month; asset count affects the quote 13 | Standard term not published; annual-payment and multi-year discounts mentioned 13 | Not published 13 | Identity, cloud and SaaS are in the advertised scope; confirm your tenant integration 12 | Package includes an incident response plan; a carrier-specific pack is not specified 13 |
| Microsoft Defender for Business (self-run) | Your administrator, supported by automated investigation and remediation 17 | Published software licence 17 | $3/user/month, paid yearly 17 | Annual subscription, auto-renews 17 | No minimum device requirement; up to 300 users, five devices each 17 | Endpoint product; do not count the identity tools in separate Microsoft bundles as included 17 | Monthly security summaries; your team assembles the carrier evidence 17 |
| Obsidian Ridge (Ridge Core) 14 | Huntress SOC monitors and acts 24/7; Obsidian Ridge handles follow-through within one business day 14 | Published, per person; onboarding separate 14 | $25/person/month; $500 onboarding up to 25 machines 14 | Month-to-month 14 | No minimum; start with one person 14 | Microsoft 365 or Google Workspace ITDR included 14 | Readiness Sprint evidence pack is separate; annual questionnaire refresh is in Ridge Reserve 14 15 |
A report can support an insurance answer; it is not the same thing as the carrier accepting that answer. Ask for an example with customer details removed, the covered systems, the reporting period, and the person responsible for keeping it current. Our Cyber Insurance Readiness Sprint is a separately scoped engagement, not a benefit silently added to every MDR price.
Choose a buying model before choosing a logo
For a small firm without a security operator, begin with a managed service whose quote assigns containment, follow-through and communication. A “24/7” claim needs those duties attached to it. Ask who can disable an account or isolate a computer, and who helps restore normal work afterward.
If your IT team already operates security tools, consider direct licensing and a co-managed arrangement. Keeping deployment and tenant administration in-house is different from leaving them unassigned. The MDR service overview explains how our SOC and practitioner duties divide; managed ITDR addresses the account side.
If your main constraint is the bill for a small team, request the minimum and term in the same sentence as the unit rate. A published starting package is not a price for every headcount. An annual subscription billed monthly is not a monthly cancellation right. Compare setup, servers, identities, incident work and any required licences as separate lines.
Buying Huntress through a partner
Huntress requires 50 seats per product when bought directly and 50 through a reseller. Its MSP route has no Huntress-required seat minimum. Huntress's standard term is 12 months; an MSP's client-facing terms can differ. 1
A reseller quote and an MSP service agreement are different purchases. Our published pricing covers operating the platform and named practitioner follow-through. A direct buyer takes on the operational responsibilities in Huntress's pricing FAQ. Use that division of work to compare quotes, rather than describing one route as a markup on an identical service. 1 14
Four questions to take to the first call
- Who can act without waiting for my approval, and what can they do?
- Does this quote cover the computers, cloud accounts and servers I actually use?
- What is the bill at my current size, including the minimum, setup and term?
- What records will I receive to answer my insurer's questions truthfully?
If a renewal prompted the search, start with the cyber-insurance questionnaire and checklist. It helps turn a feature comparison into a list of controls and evidence you need to verify.
Sources
1. Huntress pricing: commercial terms, SOC inclusion, direct-buyer duties and incident reports. Numbers are rendered from the site's Huntress facts module, last checked September 30, 2026.
2. Huntress ITDR coverage announcement: Microsoft 365 and Google Workspace.
3. Blackpoint MDR: response and subscription model.
4. Blackpoint pricing: rates are not publicly listed; request a tailored quote.
5. Blackpoint MDR Essentials datasheet: coverage, monthly option and conditions for volume pricing. Confirm these Essentials terms in a current partner quote.
6. Blackpoint Security Posture Rating: documented maturity and its stated insurance use.
7. Sophos MDR Plus: scope of managed incident response.
8. Sophos MDR quote page: request pricing; no public rate, standard term or seat floor found on this page.
9. Sophos MDR reports: reporting documentation, not a promise of insurer acceptance.
10. Arctic Wolf MDR: response and posture reviews. The reviewed page does not publish a base MDR price, standard contract term or minimum.
11. Arctic Wolf Active Response: supported identity integrations.
12. Defendify MDR: response team and coverage scope.
13. Defendify pricing: starting package prices, included plan and quote inputs. Standard term and minimum not published on this page.
14. Obsidian Ridge pricing: price, units, terms, included identity protection, onboarding and operating responsibilities.
15. Obsidian Ridge Readiness Sprint: separate evidence engagement.
16. Sophos MDR overview: endpoint, cloud, identity and email scope.
17. Microsoft Defender for Business: US licence price, term, limits, automated response and reporting.
When you don't need MDR yet
You may not need to buy MDR yet if someone capable already owns endpoint monitoring and response, your coverage is current, and you can demonstrate how the business handles an alert during an absence. First check the configuration and licences you already pay for.
If those responsibilities are uncovered, postponing a product purchase does not settle them. Assign an owner, document the response plan, and compare managed options against the work that remains. The right purchase is the one that fills that gap at a bill and term you can sustain.
Last updated
October 2, 2026. We refresh this content as the threat landscape and tools evolve.
FAQ
Questions readers usually ask next
What is the best MDR for a small business?
The best fit is the service whose response duties, supported systems, minimum and total bill match your business. A firm without an alert owner needs managed response; a staffed IT team may prefer a direct licence.
Compare endpoint and identity coverage separately. Obsidian Ridge publishes Ridge Core with no minimum and month-to-month terms.
What are the best Huntress alternatives for a small business?
Blackpoint Cyber, Sophos MDR, Arctic Wolf and Defendify are managed-response options to evaluate. Microsoft Defender for Business is a self-run endpoint-security contrast, not an equivalent staffed MDR service.
Obsidian Ridge operates Huntress and adds deployment and CISSP-led follow-through; it is a different buying route, not a different detection engine.
Which MDR providers have no minimum?
Obsidian Ridge publishes no minimum for Ridge Core. Huntress publishes a 50-seat minimum per product for direct buyers and 50 through resellers, but no Huntress-required minimum through an MSP. The MSP can set its own terms.
Where this comparison says not published, ask for the minimum in the quote; do not assume zero.
Do small businesses need MDR or is EDR enough?
EDR can be enough when a capable person owns monitoring, investigation, containment and recovery, including absences and nights. MDR adds people to that operating model. Buy it when those duties are otherwise uncovered; endpoint software alone does not appoint an incident owner.
Related reading
Keep going
Huntress vs ThreatLocker: block everything, or watch everything
ThreatLocker blocks what is not on the list. Huntress watches what gets through. Most businesses comparing them are asking the wrong question.
Read articleHuntress vs Todyl: are you buying a layer or a whole stack?
Todyl sells a six-module platform including the network layer, channel-only, with no published pricing. Huntress sells a layer and publishes its rates.
Read article