When comparing MDR pricing, it helps to understand what the same annual budget would buy from each provider. Two proposals with similar prices may give analysts access to different evidence, retain it for different periods, or leave your team with different responsibilities. Those differences can affect what happens when you need to investigate a compromised account or trace an attacker’s low-and-slow activity across your environment.
For security leaders weighing asset-based against ingestion-based pricing, a useful comparison starts with the systems you need to protect and the logs required to investigate threats. Giving providers the same requirements and budget helps expose the decisions behind each quote, including what you would need to exclude or pay more to include.
Under asset-based pricing, the charge is tied to a defined population of assets. You need to establish how the provider counts workstations, servers, cloud resources, and other systems, alongside which data sources and service capabilities the price includes. A predictable asset count can help with budgeting, but the proposal still needs to explain any integration limits or additional service charges. At Rapid7, an asset is defined as any physical or virtual endpoint or server running a supported operating system within the monitored environment.
With ingestion-based pricing, some of the cost depends on the volume of data collected or processed. The comparison needs to account for the included allowance, how billable volume is measured, and what happens when usage increases. Retention, search, and supporting infrastructure may also contribute to the overall cost, depending on the commercial model. At Rapid7, MDR customers have access to 13 months hot storage of logs as standard.
Whichever approach you are evaluating, include the technology, analysts, and response support needed to deliver the service. A SIEM ingestion charge on its own cannot be compared directly with an MDR subscription that includes investigation and response. Both proposals need to account for the work your organization expects the provider to perform - this clarity is key to a successful partnership.
How to make a like-for-like MDR pricing comparison
Give each provider the same asset inventory, required data sources, retention needs, and response expectations, then ask what fits within your annual budget. Any exclusions should be visible in the proposal, so you can judge their operational consequences before committing.
For example, one proposal might accommodate endpoint and identity data while requiring you to limit high-volume network sources. Another might accommodate those sources but lack an investigation capability your team needs. Looking at an MDR price per endpoint or per gigabyte will not resolve that difference; you need to see how the service uses the available data.
Use these questions during an initial demonstration to turn the pricing discussion into a practical comparison.
Comparison area
What to ask the provider
Evidence to request
Rapid7’s approach
Breadth of collection
Which required sources fit within this budget?
A list of included sources, exclusions, and extra charges.
Asset-based pricing with unlimited ingestion, supporting native and third-party telemetry across endpoint, cloud, identity, email, and network. Confirm coverage for your required sources in the proposal.
Depth of collection
Which events and fields are collected, filtered, or summarized?
Sample records showing what reaches the investigation platform.
Rapid7 ingests and normalizes telemetry from supported technologies. Use the demonstration or proof of concept to verify which events and fields your integrations provide.
Detection value
How does this data support the threats we need to detect?
A detection walkthrough showing its data dependencies.
Investigations combine security telemetry with vulnerability and asset-risk context. Completed threat hunts show the rationale, data examined, queries, and any linked investigations.
Investigation history
How long is data retained, and how can analysts search it?
A search against older records, with retrieval costs explained.
Rapid7 provides 13 months of log retention. Confirm the history available for each data type: 3rd party endpoint alerts have different availability from log-based searches.
Response scope
What will your team do after validating a threat?
A case walkthrough and documented responsibilities.
Rapid7 MDR includes unlimited incident response, covering investigation, containment, and threat eradication. Incident reports document findings, attacker timelines, and recommended corrective actions.
Cost variability
What changes the bill as assets or data volumes grow?
A calculation using your growth assumptions.
Asset-based pricing with unlimited ingestion removes data volume as the billing unit. Request a written calculation for additional billable assets and changes to service scope.
What Keyloop’s experience shows about MDR value
For Alan Simpson, now Rapid7’s Field CISO, the ability to collect previously restricted data made a practical difference during his time at Keyloop: "We were previously ingesting around 250 GB a day into Splunk. After moving to Rapid7, we reached 1.4 TB a day, including NetFlow, full DNS logging, and web application firewall logs. These were sources we’d previously had to limit or simply weren’t collecting, so we gained much better visibility and coverage."
The change also extended the history available for investigation, with greater certainty about how long that evidence would remain accessible: "We also moved from around 90 days of retention in Splunk to 13 months with Rapid7. Even those 90 days couldn’t be relied on, as retention depended on how much data we were ingesting at the time. Having a longer, predictable history made a real difference."
Price predictability was key as Keyloop grew through seven mergers and acquisitions, each bringing a different data profile. His experience illustrates why collection and retention belong in the buying decision, although these figures alone do not establish a like-for-like cost saving.
How to compare MDR pricing beyond log volume
Once you understand which data fits within the quote, examine what the provider can do with it. Collecting more logs can close visibility gaps, but useful investigations depend on relevant events, consistent timestamps, and enough context to connect activity to a user or system. AI-assisted investigation also depends on that foundation: a required event that was never recorded leaves an investigation gap.
Infrastructure design can improve the usefulness of that evidence. Routing access to a management interface through a controlled path, for example, creates a clearer monitoring point and helps distinguish expected access from activity requiring investigation. This is why log volume and detection-rule counts need to be assessed alongside how the environment operates.
During a proof of concept, choose a threat scenario relevant to your business and ask the provider to demonstrate the detection, evidence gathering, and response. You should be able to see which records support the conclusion and what happens if a required source is unavailable.
How will your MDR cost change as you grow?
Repeat the comparison using a plausible change, such as an acquisition, additional cloud workloads, or enabling a previously excluded log source. For asset-based pricing, calculate the effect of additional billable assets and changes in scope. For ingestion-based pricing, examine increased daily volume, applicable commitments, and retention requirements. Assuming asset counts stay the same, at Rapid7 contract renewals are capped at 5% uplift, for the contract term, not per year.
Ask both providers to document the assumptions, including implementation effort, required licenses, and work your team will continue to perform. You can then assess what the budget covers today, which evidence remains unavailable, and what it would cost to accommodate the changes you expect.
Explore Rapid7 MDR and discuss pricing based on your assets, required data sources, retention needs, and response scope.
*Referenced Rapid7 contract terms and capabilities are correct at time of publishing and are subject to change.
