When comparing MDR pricing, it helps to understand what the same annual budget would buy from each provider. Two proposals with similar prices may give analysts access to different evidence, retain it for different periods, or leave your team with different responsibilities. Those differences can affect what happens when you need to investigate a compromised account or trace an attacker’s low-and-slow activity across your environment.
For security leaders weighing asset-based against ingestion-based pricing, a useful comparison starts with the systems you need to protect and the logs required to investigate threats. Giving providers the same requirements and budget helps expose the decisions behind each quote, including what you would need to exclude or pay more to include.
Asset-based vs. ingestion-based MDR pricing
Under asset-based pricing, the charge is tied to a defined population of assets. You need to establish how the provider counts workstations, servers, cloud resources, and other systems, alongside which data sources and service capabilities the price includes. A predictable asset count can help with budgeting, but the proposal still needs to explain any integration limits or additional service charges. At Rapid7, an asset is defined as any physical or virtual endpoint or server running a supported operating system within the monitored environment.
With ingestion-based pricing, some of the cost depends on the volume of data collected or processed. The comparison needs to account for the included allowance, how billable volume is measured, and what happens when usage increases. Retention, search, and supporting infrastructure may also contribute to the overall cost, depending on the commercial model. At Rapid7, MDR customers have access to 13 months hot storage of logs as standard.
Whichever approach you are evaluating, include the technology, analysts, and response support needed to deliver the service. A SIEM ingestion charge on its own cannot be compared directly with an MDR subscription that includes investigation and response. Both proposals need to account for the work your organization expects the provider to perform – this clarity is key to a successful partnership.
How to make a like-for-like MDR pricing comparison
Give each provider the same asset inventory, required data sources, retention needs, and response expectations, then ask what fits within your annual budget. Any exclusions should be visible in the proposal, so you can judge their operational consequences before committing.
For example, one proposal might accommodate endpoint and identity data while requiring you to limit high-volume network sources. Another might accommodate those sources but lack an investigation capability your team needs. Looking at an MDR price per endpoint or per gigabyte will not resolve that difference; you need to see how the service uses the available data.
Use these questions during an initial demonstration to turn the pricing discussion into a practical comparison.
Comparison area
What to ask the provider
Evidence to request
Rapid7’s approach
Breadth of collection
Which required sources fit within this budget?
A list of included sources, exclusions, and extra charges.
Asset-based pricing with unlimited ingestion, supporting native and third-party telemetry across endpoint, cloud, identity, email, and network. Confirm coverage for your required sources in the proposal.
Depth of collection
Which events and fields are collected, filtered, or summarized?
Sample records showing what reaches the investigation platform.
Rapid7 ingests and normalizes telemetry from supported technologies. Use the demonstration or proof of concept to verify which events and fields your integrations provide.
Detection value
How does this data support the threats we need to detect?
A detection walkthrough showing its data dependencies.
Investigations combine security telemetry with vulnerability and asset-risk context. Completed threat hunts show the rationale, data examined, queries, and any linked investigations.
Investigation history
How long is data retained, and how can analysts search it?
A search against older records, with retrieval costs explained.
Rapid7 provides 13 months of log retention. Confirm the history available for each data type: 3rd party endpoint alerts have different availability from log-based searches.
Response scope
What will your team do after validating a threat?
A case walkthrough and documented responsibilities.
Rapid7 MDR includes unlimited incident response, covering investigation, containment, and threat eradication. Incident reports document findings, attacker timelines, and recommended corrective actions.
Cost variability
What changes the bill as assets or data volumes grow?
A calculation using your growth assumptions.
Asset-based pricing with unlimited ingestion removes data volume as the billing unit. Request a written calculation for additional billable assets and changes to service scope.
What Keyloop’s experience shows
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article:
MDR Pricing: Comparing Asset-Based and Ingestion-Based Costs