In short
MSSP pricing is usually a subscription built from the vendor licences behind the service plus the provider's management. Units vary: per user, per endpoint or server, per device, per gigabyte of log ingest for SIEM, or per asset. Service tier, log retention, integrations and incident response cover change the cost, so ask us for a quote.
Get a quote for managed security
Ask us for a quote and we will reply by email with options priced for your organisation.
What you are paying for
A managed security quote normally has two or three parts:
- The vendor service: the licence for the MDR, SOC or SIEM service and the platform it runs on, such as Sophos MDR or CrowdStrike Falcon Complete. This pays for the vendor's analysts, detections and infrastructure.
- Management: the provider's work to recommend, deploy, integrate, tune and manage the service, handle changes and act as your escalation point.
- Optional extras: SIEM and long-term log retention, identity or network detection add-ons, vulnerability management, incident response retainers and compliance reporting.
With Forever Systems, the 24/7 monitoring comes from the vendor service and the management comes from us. We set out both parts in the quote so you can see what each one buys. We do not publish prices, because the right combination depends on your estate: ask us for a quote.
Licensing units used by the services we supply
Each vendor counts differently. This table shows the licensing unit for the main services we supply; tier names follow the vendors' own material. For more on any one vendor, follow the licensing link.
| Service | Licensing unit | Tiers or packages | Licensing detail |
|---|---|---|---|
| Sophos MDR | Per user, with separate server licences | Sophos MDR (formerly MDR Essentials), Sophos MDR Plus (formerly MDR Complete) | Sophos MDR licensing |
| Check Point MDR | Per endpoint, standalone or as an add-on to Check Point Endpoint Security | MDR, MDR 360, MXDR 360 | Check Point MDR licensing |
| Cisco XDR | Per-user subscriptions | Essentials, Advantage, Premier (Cisco-managed) | Cisco XDR licensing |
| WatchGuard MDR | Core MDR per endpoint as an Endpoint Security module; other tiers per user, each covering one endpoint device | Core MDR, Core MDR for Microsoft, Total MDR, Open MDR | WatchGuard MDR licensing |
| Blackpoint CompassOne | Quoted on endpoints protected and package; ITDR on user accounts | Essentials, Core, Standard | Blackpoint CompassOne licensing |
| CrowdStrike Falcon Complete | Per endpoint | Falcon Complete Defend, including Falcon Complete Next-Gen MDR | CrowdStrike Falcon Complete licensing |
| SentinelOne Vigilance MDR | Add-on to SentinelOne's Commercial and Enterprise packages | Vigilance MDR, now marketed as Wayfinder MDR | SentinelOne Vigilance MDR licensing |
| Todyl MXDR | Per device | Modular: MXDR alongside SIEM, endpoint and SASE modules | Todyl MXDR licensing |
| ThreatDown MDR | Per endpoint | ThreatDown MDR, or the lighter Managed Threat Hunting | ThreatDown MDR licensing |
| Acronis MDR | On each workload running Acronis EDR or XDR; priced on endpoint count, tier, region and who delivers it | MDR Standard, MDR Advanced | Acronis MDR licensing |
Not sure which package fits? Ask us
We will match the right package to your requirements and quote for it.
SIEM and log retention: the other big variable
If your service includes a SIEM, the way it is licensed has a large effect on cost as your organisation grows:
| SIEM | How it is licensed | Retention |
|---|---|---|
| CrowdStrike Falcon Next-Gen SIEM | Per gigabyte; a Complete version is managed by CrowdStrike | 365 days in the add-on we supply |
| SentinelOne AI SIEM | On the volume of data ingested, measured as a monthly average | Agreed when we quote |
| Todyl SIEM | Per device | A choice of retention tiers |
| Sophos Next-Gen SIEM | On users and servers rather than data volume | Long-term retention for compliance, up to ten years |
| Exium XDR360 | Per user or per asset | 7, 30, 90 or 365 days |
| Blackpoint CompassOne Standard | Within the CompassOne package | 365 days of log storage |
Volume-based licensing suits organisations that know their log sources well; per-user or per-device licensing is easier to forecast. Either way, decide which sources you need before you ask for prices: firewall and server logs are usually the largest. Our SIEM as a service page covers the options in more depth, and Sophos MDR keeps 90 days of device data as standard, with a one-year storage option.
Service tiers and what they change
Most vendors offer more than one level of service. The differences that move the price are usually:
- Coverage: WatchGuard's tiers run from Core MDR (WatchGuard endpoints) and Core MDR for Microsoft (Microsoft Defender for Endpoint) to Total MDR (the wider WatchGuard stack) and Open MDR (third-party tools such as CrowdStrike, Okta and Duo)
- Incident response: Sophos MDR Plus adds full-scale incident response with a dedicated incident response lead and root cause analysis; Check Point MDR includes incident response
- Remediation and recovery: Acronis MDR Advanced adds 24/7 remediation and, with your agreement, attack rollback and recovery from backup, where MDR Standard covers protection, containment and prioritisation with guidance
- Breadth of platform: Blackpoint CompassOne Core adds vulnerability management and Microsoft 365 configuration management to MDR and ITDR, and Standard adds SIEM; Check Point MXDR 360 adds a fully managed SIEM and security data lake
- Lighter options: ThreatDown Managed Threat Hunting gives prioritised alerts and remediation guidance rather than full MDR
Pick the tier for the response you need, not the longest feature list. Our vendors page sets the tiers out side by side.
Want a price for your organisation?
Tell us your users, sites and timescales and we will come back with a clear quote.
What changes the cost
When we scope a quote, these are the questions that move the number:
- How many users, endpoints and servers need covering, and on what operating systems
- Which data sources the SOC should see: endpoints only, or also Microsoft 365, identity, email, firewalls and cloud
- How much log data you generate and how long you need to keep it
- Whether you want incident response included or as a separate incident response retainer
- Whether you already own licences the service can use, such as Microsoft Defender
- How much management you want from us: deployment only, or ongoing policy, change and escalation management
- Term length and billing options offered by the vendor, confirmed at quote
SOC as a service pricing vs building your own
Comparing a managed SOC with an in-house one is not just a licence comparison. Running your own 24/7 SOC means staffing every shift, including holidays and sickness, plus SIEM and detection tooling, threat intelligence, training and management. Most small and mid-sized organisations cannot justify that, which is why managed SOC services exist.
When you compare quotes from different providers, line them up on the same basis:
- List the users, devices and data sources each quote covers.
- Check which response actions are included and which only alert you.
- Compare log retention and where data is held.
- Check whether incident response is included, capped or extra.
- Separate one-off onboarding from the ongoing subscription.
- Read the service description, not just the summary; see how to choose an MSSP.
Ways to keep managed security costs in proportion
More spend does not automatically buy more protection. Before adding services, it is worth checking:
- Use what you already license: Microsoft 365 Business Premium and E5 include Microsoft Defender tools that several MDR services can work with; see MDR for Microsoft Defender
- Avoid paying twice: some endpoint bundles already include threat hunting or MDR features, and some firewall bundles include MDR threat feeds, so check for overlap
- Be selective with logs: send the SIEM the sources that matter for detection and compliance, rather than everything by default
- Match the tier to your team: if you have people who can act during the day, a co-managed service may suit better than a fully managed one; see co-managed SOC
- Fix the basics first: MFA, patching and good email security reduce how often the SOC has to act; Cyber Essentials is a sensible baseline
We look for these when we scope a quote, and we will tell you if something you already own covers part of what you asked for.
Getting a quote from Forever Systems
To give you a useful quote, we need a rough picture of your users and devices, your current endpoint, email, identity and firewall products, your Microsoft 365 licences, the log sources you care about, how long you need to keep data, and any compliance or contract requirements. We then recommend one or more vendor services and set out the vendor licence and our management separately.
Licensing detail for every vendor we supply is on Software Licensing UK under EDR, XDR and MDR. Ask us for a quote, or contact us with what you have and we will take it from there.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
How much does an MSSP cost?
It depends on the number of users and devices, the data sources monitored, log retention, the service tier and whether incident response is included. Most services are a subscription built from vendor licences plus management. Ask us for a quote and we will scope it with you.
How is SOC as a service priced?
Usually per user, per endpoint or per device for the monitoring service, with SIEM often priced on data volume or on users and devices. Service tier, retention and incident response inclusion all change the cost.
What is included in managed SOC pricing?
Typically the vendor's 24/7 monitoring, investigation and agreed response actions, plus the provider's onboarding and management. Long-term log retention, extra integrations, identity or network detection and full incident response may be extra, depending on the service.
Why does SIEM cost more as data grows?
Many SIEMs are licensed on the volume of data ingested, so adding firewall, server or cloud logs increases the cost. Some, such as Sophos Next-Gen SIEM and Todyl SIEM, are priced on users, servers or devices instead.
Is incident response included in MSSP pricing?
Sometimes. Sophos MDR Plus and Check Point MDR include incident response; other services contain the threat and hand over, with full investigation and recovery provided through a separate retainer. Check before you buy.
Still have a question about managed security?
Ask us and a member of our team will reply by email.