eSentire did something in 2026 that almost no managed detection and response provider does: it published prices. Businesses with 10 to 250 users can now buy its three packages online at a per user rate, which makes eSentire the most transparent name on our cybersecurity shortlist. Above 250 users the old model still applies: a negotiated order form priced per endpoint, with the numbers landing well off any list. This page covers both halves. For how eSentire compares to the rest of the market, see our Best Cybersecurity Providers ranking and our Arctic Wolf vs eSentire verdict.
What you will actually pay
| Package | List price | What it covers |
|---|---|---|
| Professional | $17 /user/mo | 24 hour detection and response on your endpoint, identity, and cloud tools |
| Enhanced | $24 /user/mo | Adds log management with 90 day retention, threat hunting, and scheduled penetration tests |
| Elite | $28 /user/mo | Adds 365 day retention, continuous testing and vulnerability scanning, forensics, and 24 hour support |
| Network detection | $6 /user/mo | Add on |
| AI detection and response | $6 /user/mo | Add on |
| Awareness training | $1 /user/mo | Add on; extended log storage is another $1 |
At list, a 100 user business pays roughly $23,000 a year on Professional, $31,000 on Enhanced, and $36,000 on Elite including the launch fee. At 250 users those figures become about $51,000, $71,000, and $82,000. The fixed launch fee matters at the small end: at 10 users it costs more than the Professional subscription itself.
Above 250 users, eSentire quotes on an order form, usually per endpoint, with servers and cloud workloads priced above user devices. Procurement benchmark data puts the median eSentire contract around $120,000 a year, with a range from the high $30,000s to the low $230,000s. Per endpoint, the same data shows roughly $60 to $100 a year at 50 to 200 endpoints, $40 to $80 at 200 to 1,000, and $30 to $60 above 1,000, plus onboarding of $5,000 to $25,000. The vendor's own public calculator estimates about $180,000 a year for a 500 to 1,000 user organization, and one county we have seen documents for pays about $90,000 a year on a three year term. As a directional guide, expect $60,000 to $120,000 a year at 500 endpoints and low to mid six figures at 2,000, depending on package, retention, and how much of your existing tooling eSentire can run on.
What moves the price
- Package tier. Elite lists about 65 percent above Professional. The difference is mostly retention and testing, so a business that already runs a log platform and a penetration testing program should price Professional with the add ons it actually lacks.
- Bring your own endpoint. The 2026 packages assume you keep your existing endpoint, identity, and cloud tools and eSentire operates them, with its own lightweight agent alongside. Licensing endpoint software through eSentire instead is a separate line.
- Signal add ons. Network detection and AI detection are $6 per user per month each, which on a 250 user deployment is as much as moving up a package tier. Buy the signals your environment generates, not the full menu.
- Servers and cloud workloads. On enterprise order forms these carry a premium over user endpoints. Count them separately before the first quote.
- Volume, term, and competition. The online store discounts 5 percent above 100 users. Negotiated deals discount 20 to 35 percent at 500 assets and up, multi year terms run 15 to 25 percent lower, and competitive evaluations against another managed detection provider move the number another 15 to 30 percent.
Contract factors to watch
- The online agreement is take it or leave it. The published terms state they are non negotiable, with no exit for convenience: termination is for uncured breach only. Buy the term you are sure of.
- Renewal starts high. Benchmark data shows renewal quotes opening 10 to 20 percent above the expiring rate, and 10 to 20 percent reductions are routinely negotiated back. Ask for a renewal cap in the first contract.
- Overage on per endpoint packages. The legacy endpoint packages let you run 10 percent over the purchased count for a month, after which you trim or move up a tier. Growing businesses should size for the year, not the signing date.
- Your data at exit. Client data is deleted when the agreement expires, and bulk export of raw data may carry a fee. Plan the export before the end date, not after.
- Service credits. The service level agreement promises five minute detection, twenty minute forensic, and five minute response averages with a 2 percent monthly credit per missed metric. Modest, but written, and worth holding them to.
- Payment terms. Invoices are due on receipt with 1.5 percent monthly interest after 30 days. Finance should see that line before signing.
The honest summary: eSentire is now the easiest managed detection price to see and one of the hardest contracts to leave, and both facts should shape the purchase. Under 250 users, the published price is a fair benchmark that is cheaper per user than the marketplace floor of its closest rival, and the decision is package fit plus the fixed fee. Above that, the per endpoint order form rewards a measured asset count, a multi year term, and a live alternative in the evaluation. Exact pricing is quote based at scale. We pull real numbers across eSentire and every serious alternative at once, free, and you sign directly with whichever provider you choose.