Managed detection and response for a 500-seat UK organisation has no single published sterling price, but you can still budget with confidence. Huntress publishes dollar list prices, Sophos and Arctic Wolf quote to scope, and a modelled Huntress endpoint service comes to £40,455 a year before tax and partner fees. The smart move is to take the published numbers as anchors, then ask all three vendors for the same fixed £ quote.
What does managed detection and response cost in the UK?
None of the three vendors publishes a UK sterling tariff that we could confirm on 8 November 2026. Huntress is the clearest, because its pricing page lists a manufacturer's suggested price of $8.99 per endpoint a month for Managed EDR, $4.80 per identity a month for ITDR, $4.00 per source a month for SIEM and $2.08 per learner a month for security awareness training. The page says your per-unit rate falls as volume rises.
Arctic Wolf says its pricing rests on users, servers and network egress points and gives no figures. Sophos documents its service tiers but also gives no tariff. That means any "typical UK range" you read elsewhere is unsourced, and we have not used one.
How much would 500 seats of Huntress cost in pounds?
Here is a transparent model. It assumes 500 endpoints, 500 licensed identities, 500 learners and, for SIEM only, 500 billable sources. It uses an assumed rate of $1 to £0.75, chosen to show the method and not an observed exchange rate. It applies Huntress's list prices with no discount, no tax and no partner fees.
| Scope | Calculation in dollars a month | Modelled £ a year |
|---|---|---|
| Managed EDR | 500 x $8.99 = $4,495 | £40,455 |
| Managed ITDR | 500 x $4.80 = $2,400 | £21,600 |
| Managed SIEM | 500 x $4.00 = $2,000 | £18,000 |
| Managed SAT | 500 x $2.08 = $1,040 | £9,360 |
| All four | $9,935 | £89,415 |
Modelled Huntress cost for 500 seats by product
Annual cost in pounds of 500 units of each Huntress product at list price and an assumed $1 to £0.75, before tax and partner fees.
View the data
| Category | £ a year |
|---|---|
| Managed EDR | £40,455.00 |
| Managed ITDR | £21,600.00 |
| Managed SIEM | £18,000.00 |
| Managed SAT | £9,360.00 |
A 500-person firm does not always have 500 endpoints or 500 log sources, so count your real estate before you ask for quotes. The all-four total is not a minimum for MDR, because identity, logging and training answer separate needs.
Which should you choose, Huntress, Sophos or Arctic Wolf?
Choose by who does the work, not by the label on the box. Start with Huntress if an MSP will run your security, because its Managed EDR price includes round-the-clock SOC monitoring, investigation and containment. Start with Sophos if you already run Sophos products, and start with Arctic Wolf where a mixed estate and a named Concierge Security Team matter most. That is a fit judgement from the vendors' own documentation, not a measured performance ranking.
How you buy changes the rules. Huntress says purchases through an MSP carry no Huntress-required minimum seat count, while direct or reseller purchases need 50 seats per product. Its standard term is 12 months. The list price leaves out your MSP's own deployment and management fees.
Which MDR service is best for ransomware?
No source we opened ranks these services on ransomware outcomes, and the vendors' own comparison pages are marketing, not independent tests. What you can compare is what each service is allowed to do. Huntress says Managed EDR covers investigation, containment and remediation. Sophos describes MDR as expert-led response across endpoint, identity, firewall and email. Arctic Wolf describes a Managed Containment workflow.
So test all three with the same scenario, such as ransomware on a file server at 2am, and ask who isolates the machine, who approves it and who restores the data. A strong answer on recovery matters as much as a fast alert.
How do ITDR, SIEM and training pricing differ?
They use different meters, so keep the counts separate. Huntress bills ITDR per licensed identity, typically matched to licensed Microsoft 365 users, and says service accounts and non-human accounts are not billed separately. It sells ITDR as a 12-month subscription billed annually. Its SAT is per learner, billed annually, with volume tiers from 50 learners and charges for active users only.
SIEM needs more care. Huntress's SIEM pricing page says retention beyond the standard period is a per-source add-on up to seven years, and that overage charges can apply if pooled volume goes over 10GB per source. Get the billable source, allowance and overage rate written into the contract. For Arctic Wolf, ask which of your log sources have parsing and detection rules, not just a connector.
How does Huntress Managed SIEM compare with Arctic Wolf for MSPs and small firms?
Both give you human-led monitoring, but they are sold differently. Huntress says its Managed SIEM price includes 24/7 SOC monitoring, threat detection, detection building and tuning, compliance reporting and onboarding, at $4.00 per source a month. Arctic Wolf says its core MDR includes endpoint agents, unlimited log retention and search, and external network scanning, with a named Concierge Security Team.
| Question | Huntress Managed SIEM | Arctic Wolf MDR |
|---|---|---|
| Public price | $4.00 per source a month | None published |
| Pricing basis | Per data source | Users, servers and network egress points |
| Human monitoring | 24/7 SOC included | 24x7 Concierge Security Team |
| Ask before signing | Overage rate above 10GB per source | Which of your sources have detections |
For an MSP running many small customers, Huntress's per-source meter is easy to forecast. For a mixed estate that wants one accountable team, Arctic Wolf may fit better. Either way, price the same log sources in both quotes.
What is the best EDR, SAT or ITDR choice for a small UK business?
We found no independent evidence that crowns one winner, so we will not invent one. Huntress is the only one of the three with public per-unit prices for EDR, ITDR and SAT, which makes it the easiest to budget. Sophos offers MDR Essentials and MDR Complete and is the natural pick if Sophos already protects your firewalls and email. Arctic Wolf is strongest where you want one team across network, endpoint and cloud.
For a small business, the practical test is simple. Pick the service that covers the machines and accounts you actually have, states in writing what it will do during an incident, and gives you a fixed £ price.
What extras can change a Sophos quote?
Sophos's service tier documentation says standard data storage is 90 days, with one-year extended storage as an add-on licence. Integration packs for third-party firewall, network, email, cloud and identity tools are licensed by user numbers. Sophos NDR carries its own licence fee.
The same page sets targets of two minutes from detection to case creation and 30 minutes from case creation to the first response action. For an existing Sophos customer this can make consolidation attractive. For a mixed estate, ask for an itemised proposal so integration packs and storage sit in the headline figure.
How much can the provider act without asking you?
Ask this before you sign. Arctic Wolf's FAQ describes Managed Containment, which isolates a threat at network and host level once a critical incident is found. Its wider FAQ says irreversible, high-impact or low-confidence actions keep human approval in place.
So agree in writing which containment steps the provider may take at 3am without waiting for you. Then run one ransomware scenario past all three bidders and compare the answers. The NCSC's guidance on choosing an MSP also asks you to agree incident reporting and check that backups can be recovered.
What UK GDPR duties apply to an MDR contract?
If the provider handles personal data for you, the ICO says the contract must cover security, sub-processors, assistance and what happens at the end of the deal. Ask where telemetry is stored, who can see it and how it is returned or deleted.
The reporting clock is yours. The ICO's breach guide says a notifiable breach must reach the ICO without undue delay and no later than 72 hours after you become aware of it. An MDR alert helps you meet that deadline, but someone in your business still has to decide whether to report.
What should you do next?
Send the same brief to all three vendors or their partners. State your endpoint and server counts, licensed identities, log sources, retention needs, out-of-hours approval rules and recovery expectations. Ask for a fixed first-year total in pounds, the renewal basis and the written volume rate. Treat the cheapest headline rate with care if it covers less than the others, and pick the offer that closes your real gaps at a price you can sign.
