Huntress, Sophos or ESET MDR for a Small UK MSP

A small UK managed service provider without an in-house SOC can resell managed detection and response from any of the three, but the margin mechanics differ sharply. Huntress publishes its direct list price and lets an MSP start with no vendor-required seat minimum, though it keeps partner rates private. Sophos and ESET both sell MDR at quote-only prices through tiered partner programmes with no published entry threshold on the ESET side and a documented step up on the Sophos side.

Key pointers

• Huntress is the only one of the three that publishes a direct list price on its own site, currently $7.99 per endpoint per month for Managed EDR at 100 endpoints, but it does not publish what MSPs actually pay.
• Huntress removes its own seat minimum for the MSP channel entirely; buying the same product as a reseller or direct customer requires a 50-seat minimum instead.
• Sophos MSP Flex, the monthly billing arrangement most small resellers use, has a contractual $200 Minimum Monthly Commitment, confirmed in Sophos's own MSP partner terms.
• The better Sophos economics sit behind Sophos MSP Elevate, which requires committing to $2,000 a month for 12 months before an MSP gets the bundled MDR Complete package and growth rebates.
• ESET MDR is not an endpoint-agnostic add-on. ESET sells it as ESET PROTECT MDR, a platform tier that bundles ESET's own endpoint protection with the MDR service.
• ESET's MSP programme has no published minimum spend and bills daily with monthly invoicing, so it suits an MSP still building volume.
• None of the three vendors publish a UK MSP partner rate in GBP. Ask your distributor or account manager for a written rate card in pounds before you quote a client.
• Ask each vendor what response commitment and incident response scope actually sit behind the SOC before comparing headline margin, because Sophos and Huntress differ on this in ways that change what you can promise a client.

What Reselling MDR Actually Means for a Small UK MSP

Reselling MDR is different from buying it for your own business. As an MSP you are the middle layer: you pay a vendor a wholesale rate, you carry the relationship and the support burden with the client, and you keep the difference between what you pay and what you bill. For an MSP without an in-house security operations centre, that difference has to cover not just profit but the deployment, tuning, escalation handling and client communication that a bare licence does not include.

The three vendors in this comparison approach that relationship differently. Huntress is explicit that its 24/7 human SOC is bundled into every product at no extra cost, whichever channel you buy through, so what an MSP is really pricing is deployment and account management on top of a fixed underlying service. Sophos and ESET both gate the fuller incident response experience, and in Sophos's case the better commercial terms, behind a partner tier that a small reseller has to commit to first.

For a small UK MSP without a SOC, that changes the practical question from "which product is cheapest" to "which commitment can I actually justify before I have the client base to fill it."

How the Margin Model Differs Between Huntress, Sophos and ESET

Huntress publishes its direct list price openly on its pricing page: $7.99 per endpoint per month for Managed EDR, plus $3.60 per identity for ITDR, $3.50 per data source for SIEM and $1.75 per learner for Security Awareness Training, all shown at 100 units, with the per-unit rate falling as volume rises. What it does not publish is the rate MSPs actually pay. Huntress's own FAQ states only that it "offers programs for both Managed Service Providers and Value-Added Resellers" with "simple, predictable per-unit pricing," and routes you to a quote form rather than a rate card. Independent pricing trackers such as mdrcost.com estimate MSP partner rates at roughly $2.50 to $3.50 per endpoint per month based on partner reports, which would put the resale spread in the same range Compare the Cloud has previously reported for Huntress channel markups, 30 to 50 percent depending on volume. Treat both figures as directional rather than a quote, since Huntress has not confirmed either.

The structural advantage for a small MSP is the seat minimum. Buying Huntress as an MSP carries no Huntress-required minimum seat count at all, so a small operator starting with two or three clients on a handful of endpoints each is not forced to license capacity it does not yet have. That minimum only applies through the reseller or direct-purchase route, where 50 seats per product is the floor.

Sophos takes the opposite approach on price transparency: nothing is published for either MDR Essentials or MDR Complete on Sophos's own product pages, which describe the tiers and the Service Level Targets but not a rate. What is documented, in Sophos's own MSP partner terms and conditions, is the entry commitment: MSP Flex, the monthly billing arrangement most small resellers use to avoid annual prepayment, carries a contractual Minimum Monthly Commitment of $200 or the local currency equivalent. That is a low bar to clear for even a very small MSP.

The better economics sit one tier up, in Sophos MSP Elevate, which requires a minimum monthly spend of $2,000 for a 12-month period on top of the MSP Flex prerequisite. Elevate is the route to an exclusive bundled MDR package built on MDR Complete, including full incident response, a year of data retention and Sophos Network Detection and Response and integration packs at no extra licence cost, plus growth-based rebates and a 40 percent discount on Sophos's Network-in-a-Box hardware bundles. For a small MSP still building its client base, that means the cheapest Sophos entry point (Flex) does not carry the best margin protection, and the tier that does (Elevate) asks for a committed monthly spend that a brand-new MDR reseller may not yet be generating.

ESET frames its MSP economics differently again, because ESET MDR is not something you can bolt onto another vendor's endpoint agent. It is sold as ESET PROTECT MDR, a platform tier that bundles ESET's own endpoint protection, server security and XDR with the MDR service, so an MSP evaluating ESET MDR is really evaluating whether it wants to run its endpoint stack on ESET at all, since the MDR economics live inside that broader platform relationship. Once on that platform, ESET's MSP programme offers daily billing with monthly invoicing, no flat rates and no long-term commitment, with commission rates ESET describes as rising with sales volume, though the actual percentages are not published. In 2025 ESET restructured its MDR commercials into a single SKU and told partners the change would cut average buying prices by up to 34 percent while adding margin protection, according to ESET's UK country manager Matt Knell.

Pricing and Cost Model

Only Huntress publishes a direct list price. Sophos and ESET are both quote-only for MDR, so the comparable figures for a small MSP are entry commitments and programme minimums rather than per-endpoint prices.

None of the three vendors publish a UK MSP rate in GBP, so a UK MSP will see actual pricing only from a distributor or account manager, and should ask specifically whether the quoted figure is VAT-inclusive and settled in pounds before building it into a client contract. Huntress's ITDR, SIEM and Security Awareness Training products are billed separately per unit, so a full stack quote for a client needs each line added individually rather than assumed as a single per-endpoint fee.

Onboarding Effort and What Each Vendor Includes

Onboarding effort and included incident response scope matter as much as headline margin, because they determine how much of the reselling MSP's own time gets consumed per client.

Huntress states there are no separate setup or onboarding fees and that, with the right permissions, an admin can typically deploy the platform in under an hour. The SOC is included at the same level across every product, with no separate tier to unlock deeper response. Huntress's public documentation does not, however, publish a formal response-time SLA for MSP-channel customers the way Sophos does.

Sophos publishes explicit Service Level Targets: 2 minutes from detection to case creation, and 30 minutes from case creation to the first response action. Its two-tier structure matters operationally, not just commercially: MDR Essentials gives 24x7 monitoring, threat hunting and active containment, but hands the MSP guided neutralisation to finish the job itself, while MDR Complete adds full incident response with no hourly caps. An MSP on the entry-level Flex programme, rather than Elevate, can still sell either tier, but only Elevate bundles MDR Complete into the exclusive MSP package.

ESET's UK product page claims a 6-minute incident response and cites a threat intelligence network described as more than 100 million sensors and over 100 dedicated threat hunters, plus SOC 2 Type 2 certification. Because ESET PROTECT MDR bundles ESET's own endpoint protection, onboarding effort for an MSP not already on ESET includes migrating the client's existing endpoint agents, not just switching on a detection service.

Vendor and Option Comparison

No option here is a universal winner. The right choice depends on whether the MSP already runs a particular endpoint platform, how much monthly spend it can commit to upfront, and how much of the incident response workload it wants a vendor to take off its own hands.

Editorial Analysis

ESET's 2025 repricing of its MDR bundle is the clearest public signal from any of the three vendors that partner economics on MDR are being actively renegotiated, not just held steady. Matt Knell, ESET's UK country manager, described the move as "a direct response to our partners' need for simplicity and stronger commercial outcomes," adding that it is "now easier than ever to deliver our core MDR solutions with compelling pricing and robust profit protection." That is a vendor's own characterisation of its pricing change, not an independently measured margin outcome, but it is a genuine attributed statement from a named executive, and it matches the wider pattern in this comparison: all three vendors are pulling small MSPs toward a committed relationship, whether that is ESET's single-SKU bundle, Sophos's Elevate spend threshold, or Huntress's volume-tiered rates, rather than treating MDR resale as an open shelf price any MSP can walk up to.

Sources

• Huntress, Request Pricing for Managed EDR, ITDR, SAT, SIEM
• Huntress, Managed Service Providers
• mdrcost.com, Huntress Pricing 2026
• ESET, Managed Endpoint Security, Join Our MSP Programme
• ESET, ESET MDR, Business Security & 24/7 Premium Support
• ESET, ESET Launches New Managed Detection and Response (MDR) Service for Small and Medium-Sized Businesses (SMBs)
• ESET, How DCS has embraced ESET's MDR
• ITPro, ESET targets partner profitability with new MDR bundle
• Sophos, Sophos MDR Service Tiers
• Sophos, Sophos Managed Service Provider Agreement
• Sophos, Sophos MSP Elevate
• Sophos, Introducing Sophos MSP Elevate
• National Cyber Security Centre, Choosing a managed service provider (MSP)
• Compare the Cloud, How Small UK Resellers Can Offer Managed Security Without Building a SOC