Huntress is the only one of the three that publishes a price you can model today: Managed EDR lists at $8.99 per endpoint per month, which is about £6.70 at the Bank of England rate for 2 November 2026. For 500 endpoints that is roughly £40,200 a year before partner discounts, identity cover or VAT. Sophos and ESET both sell through tailored quotes, so the sensible route is to take the Huntress figure as a reference and ask the other two to price the same scope.
What does managed detection and response cost for 500 seats?
There is no honest single price for "500 seats", because vendors bill different units. Huntress charges Managed EDR per endpoint and Managed ITDR per licensed identity, and those two counts rarely match headcount. A firm with 500 staff may have 650 endpoints once laptops, shared machines and servers are counted.
The calculation below uses Huntress's published list prices, which it labels MSRP, and the Bank of England spot rate of $1.3416 to the pound on 2 November 2026. It assumes one endpoint and one identity per person. Treat it as a worked example, not a quotation.
Huntress list price for 500 people, per year
Annual cost in pounds at Huntress's published MSRP, converted at the Bank of England rate for 2 November 2026, excluding VAT and discounts.
View the data
| Category | £ per year |
|---|---|
| Managed EDR | £40,206.00 |
| Managed ITDR | £21,467.00 |
| Both together | £61,673.00 |
| Scope for 500 people | Published price | Approx. £ per month | Approx. £ per year |
|---|---|---|---|
| Managed EDR, 500 endpoints | $8.99 per endpoint per month | 3,350 | 40,206 |
| Managed ITDR, 500 identities | $4.80 per identity per month | 1,789 | 21,467 |
| Both together | Sum of the two | 5,139 | 61,673 |
Prices checked on 9 November 2026 and exclude VAT. Huntress says the per-unit rate falls as volume rises, so a 500-endpoint buyer should expect to be quoted below list.
Does Huntress publish its prices, and are there set-up fees?
Yes to the first, and Huntress says no to the second. Its pricing page states that there are no separate setup or onboarding fees, and that an IT admin with the right permissions can usually deploy the platform in under an hour.
That statement covers Huntress's own charges only. A managed service provider may still bill for migration, policy design or user onboarding, and those lines should appear separately on its proposal.
The same page says partner pricing is available to MSPs and resellers through its partner programme. The public figures are therefore list prices, not what a UK MSP pays. The standard MSP term is 12 months, billed monthly in arrears on deployed usage.
How should you compare Huntress, Sophos and ESET like for like?
Start by comparing what each package includes, because the labels differ. Huntress includes the 24/7 SOC, remediation and managed antivirus in the EDR price. Sophos MDR includes Sophos XDR and is sold through a free, no-obligation tailored quote. ESET PROTECT MDR bundles endpoint protection with managed detection and response, and ESET offers a quote tailored to the organisation.
That gives a buyer three questions to put to each supplier in writing.
- Which endpoints, servers and identities are covered, and how many of each were assumed?
- Who investigates at 3am, and who is allowed to act?
- What is excluded, such as incident response, migration or log retention?
Asking for the answers in pounds, with VAT stated and the renewal basis spelled out, turns three different sales pitches into one comparison table.
Is a cheaper endpoint product a fair comparison?
Not usually. Microsoft Defender for Business is £2.30 per user per month, paid yearly and excluding VAT, which makes it a strong budget benchmark for the software layer. Microsoft also states it is designed for businesses with up to 300 users, so it does not map directly onto a 500-seat firm.
More importantly, a software licence is not a managed service. Someone still has to watch alerts and act on them. For a business without a security team, the right comparison is the combined cost of tools plus people, which is the gap MDR is built to fill.
What UK rules should shape the contract?
If the service touches personal data, which endpoint and identity monitoring almost always does, the UK GDPR applies to the arrangement. The ICO's guidance says a controller must report a notifiable personal data breach to the regulator within 72 hours of becoming aware of it, where feasible.
That clock should drive how you write the escalation clause. Agree who the provider calls, how fast, and what information it hands over, so your team has time to assess the incident. The ICO also expects a written contract with any processor, so check that the MDR agreement covers instructions, subprocessors, confidentiality and return or deletion of data.
Which response actions should you pre-approve?
Containment can interrupt a working business, so decide the rules before an incident, not during one. Ask each provider to show which actions it can take immediately, which need a named approver, and what happens when that person cannot be reached.
Write the answers into the operating agreement. Name the systems that must never be isolated without a call, such as a payments server, and name who can reverse an action. Clear authority up front makes a fast response far more likely.
What should a UK buyer do next?
Count your endpoints, servers and licensed identities first, because every quote depends on those numbers. Send the same inventory and the same list of questions to all three suppliers, and ask for pounds, VAT and renewal terms in writing.
Use the Huntress calculation above as a reference point, not a target. If a quote comes in well above or below it, ask what is different in scope. The answer usually tells you more than the price does.
