Endpoint Detection & Response (EDR)

EDR subscriptions are priced per protected device per year, and almost every vendor bands that price by volume — the same product carries different SKUs at 25 to 49 seats, 50 to 99, 100 to 149 and upward, with separate government and academic price levels. A workstation seat and a server seat are usually different SKUs again, and the tier above the base product (the one that adds threat hunting, rollback, or a vendor-run detection service) is a different SKU a third time. Quoting the wrong band is the single most common way a renewal comes back higher than the budget line.

The technical surface is smaller than the SKU surface. An agent needs a supported operating system and, on modern Windows builds, a machine with TPM 2.0 and Secure Boot for the platform integrity features to mean anything. It reports to a cloud or on-premises console that has to be reachable through your egress policy. It exports to whatever log destination your retention policy names. And it usually pairs with the firewall and email licenses from the same vendor, which is the correlation story the XDR tier is sold on.

Subscriptions are sourced through authorized US distribution rather than held on a shelf, so stock language does not apply to them; what matters is the term, the seat band and the co-termination date.

An EDR console is an operational commitment. Somebody has to tune the policy down from the vendor default, triage what the agent surfaces, decide what gets isolated at two in the morning, and keep the exclusion list from quietly swallowing the estate. None of that is a purchase, and a supplier who implies otherwise is selling you a false economy.

We do not operate the platform after handover. The console, the policy, the tuning and the response process stay with your team or the MSP you have chosen; what we supply is the license, the hardware it runs on and the integration work that puts both into service.