- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
- Endpoint Management
- UEM & MDM
- RMM & Patch
- Endpoint Protection
- Remote Access & Support
Endpoint Management
- Security
- Backup & Cyber Resilience
- Backup & Recovery
- SaaS Backup
- Disaster Recovery
- Cyber Recovery
Backup & Cyber Resilience
- Identity & Access
- Privileged Access Management
- IAM, SSO & MFA
- Identity Governance
Identity & Access
- Network Security & SASE
- Firewall & Network Security
- SASE & SSE
- Zero Trust Access
- Secure Web & DNS
Network Security & SASE
You’re not buying software. You’re buying whether someone picks up the phone at 2am — and what they’re permitted to do.
An MDR is a team, a scope and an authority: who watches, what they watch (endpoint-only, the vendor’s platform, or your whole estate), and whether they may contain, remediate or only advise. The software underneath is someone’s EDR — theirs, or yours.
Sophos MDR documents integrations for CrowdStrike, Microsoft and others — it can run on an EDR you already own. CrowdStrike Falcon Complete monitors the Falcon platform only. Same word, opposite contracts.
Already decided — before the SOC tour
Still yours to weigh
What managed detection and response actually is
Someone else’s analysts, 24 hours a day, reading the alerts your detection tools raise, deciding which are real, investigating them and — up to a line written in the contract — acting: isolating a host, killing a process, resetting a credential, telling you what to rebuild. The software is the EDR or XDR underneath; the product is the people, the scope and the authority.
Three things vary more than the brochures admit. Scope: endpoint-only, the vendor’s own platform modules, or your whole estate including identity, email, cloud and network. Whose telemetry: most services require their own agent; a few run on the EDR you already have — which decides what happens at renewal. Authority: advise, contain with pre-approval, or full remediation and incident response. The endpoint-protection guide chooses the agent; this page chooses who runs it.
The most common mis-purchase
Endpoint-only scope discovered during an incident: the attack came through email or a cloud identity, the MDR saw the endpoint, and the contract said endpoints. Scope is the first line of the SLA to read, not the last.
Often confused withEndpoint Protection — the tool, versus someone to run it →·SIEM & Log Management — the data the SOC reads, and who owns it →·Vulnerability Management — what could be attacked; MDR watches what is →
MDR vs EDR you operate · MDR vs MSSP · MDR vs MXDR
Three pairs this buyer confuses, and nothing more. None of them is a quality ladder — each is a wider scope of people and telemetry, and wider costs more and needs more of your cooperation to run.
MDR vs EDR you operate yourself
Same EDR; different operator. Self-run EDR means your analysts read the console every day — budget the people. MDR means the vendor's or a partner's analysts do, within a contract. The tool is identical; the difference is the 2am phone call and who is permitted to act.
MDR vs MSSP
An MSSP manages security devices and monitors logs — firewalls, SIEM, tickets — and escalates to you. An MDR is built around detection and response on endpoints and telemetry, with analysts who investigate and act. MSSP breadth, MDR depth; many providers now sell both under one name — ask which you are being sold.
MDR vs MXDR
MXDR is MDR over XDR telemetry: endpoint plus email, identity, cloud and network, correlated. Wider scope, more sources to onboard, more for the analysts to read — and only worth it when those sources exist and the service actually ingests them. Platform vendors use the X to mean 'our stack'; ask which sources, named.
Six things decide this purchase. The feature grid is none of them.
Six variables decide this purchase. The instrument tests the ones documentation can verify (telemetry, scope, channel, compliance); response authority, India hours, onboarding and exit are prose because the honest answer is in the SLA, not the datasheet.
Scope of what's monitored
Endpoint-only, the vendor's platform modules, or your whole estate including identity, email, cloud and network — the most common mis-purchase is discovering the first during an incident.
Response authority
Advise-only, pre-approved containment, or full remediation and incident response. The ceiling is written in the SLA; read it aloud.
Whose telemetry
Does the service require its own EDR agent, or run on the one you already have? It decides the price of switching and what you keep at renewal.
India-hours coverage and language
24/7 global is not the same as an analyst in Indian hours and language; only Mitigata documents an India SOC.
Onboarding time
Days once a vendor agent is deployed; weeks per source for a BYO-telemetry estate.
What happens when you leave
Vendor-agent MDRs take the tuning and detections with them; BYO services leave your tools standing. Price the re-tooling before you sign, not after.
Narrow 11 products to your shortlist
Set what is true for you. Services that fail a constraint fade with the reason on them; services we cannot verify for your case are marked and stay. Every chip is reversible.
India
Whose telemetry
Your current EDR
What is monitored
How you buy
Estate size
Response authority, India hours, onboarding and exit are in the notes below, not chips — every service documents containment, and “24/7” is documented everywhere while “an analyst in India” is documented once.
per user / year reported (Essentials → Complete); AWS Marketplace lists $239.64 per endpoint / year; Mumbai data region
The largest pure-play MDR: 24/7 analysts on Sophos's agent or on the EDR, firewall and identity telemetry you already run, with full-scale incident response in the Complete tier.
The catch: No published list (reported ranges only); the Essentials tier stops at containment — full incident response is Complete; an India-located SOC is not documented.
per endpoint / month reported (MDR Core / Advanced SKUs); needs GravityZone
GravityZone estates — and SMBs via Foundations — wanting 24×7 monitoring, pre-approved response and threat-intel hunting without building a SOC.
The catch: Runs on Bitdefender's agent only; incident response beyond containment and the tailored threat model arrive at Premium / Enterprise; India SOC not documented.
per endpoint / year; Optimum (SMB, in Kaspersky Next MXDR Optimum) · Expert (enterprise, with KATA)
Kaspersky Next estates wanting the vendor's analysts with response actions (isolate, kill, registry) run automatically or on your approval.
The catch: Kaspersky telemetry only; procurement-sensitive in some sectors and countries (check your regulator); incident response is a separate Kaspersky service; no published list.
per endpoint / month reported (enterprise deployments); quote-only; covers the Falcon modules you license
Enterprises on the Falcon platform that want CrowdStrike's own team running it 24/7 with surgical remediation and a breach warranty.
The catch: Monitors the Falcon platform — third-party telemetry is Next-Gen SIEM, not Complete; enterprise-priced on quote; India in-country cloud announced, not yet documented live.
per endpoint / year add-on reported, on top of a Singularity licence (Complete ~$179.99); Respond Pro adds DFIR; Mumbai region
SentinelOne estates adding 24/7 triage, containment and — in Respond Pro — forensics and incident response on the agent they already run.
The catch: An add-on to SentinelOne only; priced per endpoint on top of the endpoint licence; an India-located SOC is not documented (data region is).
Vision One credits + service tier; covers endpoint, email, server, cloud workload and network sensors
Trend Vision One estates that want the vendor's analysts correlating endpoint, email, cloud and network from one console.
The catch: Needs Trend sensors across those surfaces to be worth it; credit billing is opaque until you run it; no published list.
per device / year on top of ESET PROTECT (Elite for Inspect XDR); Ultimate adds premium support and a named team
ESET PROTECT estates that want 24/7 monitoring with response actions ESET runs automatically or only the ones you allow.
The catch: ESET endpoint telemetry only — no third-party EDR, no estate-wide ingestion; quote-only; the Elite tier is a prerequisite for XDR-grade detection.
per endpoint / month modules on the Xcitium platform; Managed EDR for Microsoft Defender is a documented variant
Xcitium estates — and Defender shops — that want analysts plus ZeroDwell containment so unknowns never run while the SOC looks.
The catch: Young at scale (unverified above 2,000 endpoints); response is containment-first rather than full incident response; India SOC not documented.
per endpoint / user through an MSP; ingests endpoint, server, identity, cloud, email and firewall telemetry
Organisations served by an MSP that wants a 24/7 SOC over endpoints, email, identity and cloud without building one.
The catch: Sold and delivered through MSPs, not direct; response is containment and guidance through the MSP; which third-party EDRs it ingests is partner-documented, not listed publicly.
per user / month managed (historical; public list withdrawn in 2026) over Coro's endpoint, email and cloud-app modules
SMBs that want one agent, one console and one bill — with Coro's SOC handling what its auto-remediation does not.
The catch: Coro modules only (endpoint, email, cloud apps) — nothing it does not itself monitor; SMB-positioned and unverified above 2,000 endpoints; price now quote-only.
INR, per estate; 24×7 SOC from India on your tools, with incident response, forensics, CERT-In-empanelled audits and IRDAI-regulated cyber insurance under one roof
India-regulated organisations that want the SOC, the compliance programme (DPDP, ISO 27001, SOC 2, SEBI CSCRF) and the cyber-insurance broker from one provider, in Indian hours and language.
The catch: Founded 2023 — documented scale is young and the tooling is partner-delivered on your stack; quote-only; not a fit if you want a single global vendor's branded agent and SOC.
Why each constraint rules out what it doesShow the reasoning ↓
CERT-In audit and cyber insurance togetherRules out Sophos MDR (Essentials · Complete), Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, SentinelOne Vigilance Respond / Respond Pro, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate, Xcitium MDR, Barracuda Managed XDR and Coro Managed SOC — a detection-and-response service only; audits and insurance are other vendors. That leaves Mitigata Managed SOC.
Runs on the tools you already haveRules out Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, SentinelOne Vigilance Respond / Respond Pro, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate and Coro Managed SOC — requires the vendor's own agent; it does not run on third-party telemetry. That leaves Sophos MDR (Essentials · Complete), Xcitium MDR, Barracuda Managed XDR and Mitigata Managed SOC.
You run CrowdStrikeRules out Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), SentinelOne Vigilance Respond / Respond Pro, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate and Coro Managed SOC — cannot run on CrowdStrike telemetry (its own agent only). That leaves Sophos MDR (Essentials · Complete), CrowdStrike Falcon Complete, Xcitium MDR, Barracuda Managed XDR and Mitigata Managed SOC. It flags Xcitium MDR — Ingests third-party telemetry; CrowdStrike specifically not documented and Barracuda Managed XDR — Ingests third-party telemetry; CrowdStrike specifically not documented — marked on the cards, not removed.
You run Microsoft DefenderRules out Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, SentinelOne Vigilance Respond / Respond Pro, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate and Coro Managed SOC — cannot run on Defender telemetry (its own agent only). That leaves Sophos MDR (Essentials · Complete), Xcitium MDR, Barracuda Managed XDR and Mitigata Managed SOC.
You run SentinelOneRules out Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate and Coro Managed SOC — cannot run on SentinelOne telemetry (its own agent only). That leaves Sophos MDR (Essentials · Complete), SentinelOne Vigilance Respond / Respond Pro, Xcitium MDR, Barracuda Managed XDR and Mitigata Managed SOC. It flags Sophos MDR (Essentials · Complete) — Ingests third-party telemetry; SentinelOne specifically not documented, Xcitium MDR — Ingests third-party telemetry; SentinelOne specifically not documented and Barracuda Managed XDR — Ingests third-party telemetry; SentinelOne specifically not documented — marked on the cards, not removed.
Whole-estate scopeRules out ESET MDR / MDR Ultimate — endpoint telemetry only. That leaves Sophos MDR (Essentials · Complete), Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, SentinelOne Vigilance Respond / Respond Pro, Trend Service One (Managed XDR), Xcitium MDR, Barracuda Managed XDR, Coro Managed SOC and Mitigata Managed SOC. It flags Bitdefender MDR (Foundations · Premium · Enterprise) — Covers the vendor's own platform modules, Kaspersky MDR (Optimum · Expert) — Covers the vendor's own platform modules, CrowdStrike Falcon Complete — Covers the vendor's own platform modules, SentinelOne Vigilance Respond / Respond Pro — Covers the vendor's own platform modules, Xcitium MDR — Covers the vendor's own platform modules and Coro Managed SOC — Covers the vendor's own platform modules — marked on the cards, not removed.
Buying directRules out Barracuda Managed XDR — sold and delivered through MSPs. That leaves Sophos MDR (Essentials · Complete), Bitdefender MDR (Foundations · Premium · Enterprise), Kaspersky MDR (Optimum · Expert), CrowdStrike Falcon Complete, SentinelOne Vigilance Respond / Respond Pro, Trend Service One (Managed XDR), ESET MDR / MDR Ultimate, Xcitium MDR, Coro Managed SOC and Mitigata Managed SOC.
Above 5,000 endpointsRules nothing out on published terms. It flags Xcitium MDR — Unverified above 5,000 endpoints, Coro Managed SOC — Unverified above 5,000 endpoints and Mitigata Managed SOC — Unverified above 5,000 endpoints — marked on the cards, not removed.
Response authorityNot a chip because every service here documents containment; what differs is the ceiling. Sophos MDR Complete, CrowdStrike Falcon Complete, SentinelOne Respond Pro and Mitigata document full incident response (forensics, eradication, rebuild guidance); Bitdefender, Trend, Xcitium, Barracuda and Coro document pre-approved containment with guidance; Kaspersky and ESET let you set whether the analysts act automatically or on approval, and Kaspersky's incident response is a separate service. Read the authority line of the SLA — it is the product.
India-hours coverage and languageDocumented India SOC: Mitigata. Every other service is 24/7 from global SOCs — which may well cover Indian business hours — but an India-located analyst team, Indian-language support and in-country data handling are not documented for them, so nothing is ruled out on it. Ask where the analyst who calls at 2am sits, and in what language.
Onboarding timeVendor-agent services onboard in days once the agent is deployed (the agent rollout is the project); BYO-telemetry services (Sophos integrations, Barracuda, Mitigata) onboard per source — weeks for a multi-vendor estate. Your number is [TechBag to confirm].
What happens when you leaveVendor-agent MDRs leave you with the agent licence and no analysts — the detections and the tuning were theirs; BYO services leave your tools and your telemetry in place. Exit is the hidden variable: price the re-tooling before you sign.
Under 100 endpointsRules nothing out on documentation: Bitdefender MDR Foundations, Coro, Xcitium and Sophos MDR are sold to small estates; CrowdStrike Falcon Complete is enterprise-positioned but publishes no floor. Which SLAs are a poor fit at that size is delivery-team judgement: [TechBag to confirm].
Eight situations, eight shortlists — with the authority line answered
Each shortlist names who will be on the bridge at 2am and what they may do. If you already run an EDR, start from that row.
200–2,000 endpoints, no SOC, no EDR yet — buy the agent and the people together
Why: One contract: the vendor's agent plus 24/7 analysts, priced for mid-market. Sophos leads with MDR as the default product; Bitdefender Foundations and ESET MDR ride on published endpoint tiers.
The trade-off: You are choosing the EDR at the same time — and the exit path: when the MDR goes, the agent's tuning and detections go with it.
You already run CrowdStrike
Why: Falcon Complete runs the platform you licensed with surgical remediation and a breach warranty; Sophos MDR and Mitigata are documented to ingest CrowdStrike telemetry if you want an independent SOC.
The trade-off: Falcon Complete is enterprise-priced and Falcon-only; an independent SOC adds integration work and a second party to the incident bridge.
Microsoft 365 E5 — Defender for Endpoint P2 is already on the invoice
Why: Defender Experts for XDR is Microsoft's own managed tier (E5 prerequisite, quote); the documented third-party options that run on Defender telemetry are Sophos MDR, Xcitium's Managed EDR for Microsoft Defender and Barracuda's MXDR.
The trade-off: Running someone else's SOC on Defender telemetry keeps your agent; running Microsoft's keeps one vendor — price both, and read what 'response' means in each.
You already run SentinelOne
Why: Vigilance Respond (and Respond Pro with DFIR) is the add-on built for the agent; Mitigata runs on your tools with an India SOC.
The trade-off: Vigilance is priced per endpoint on top of the endpoint licence; Sophos and Barracuda may ingest SentinelOne but do not document it — confirm before assuming.
India-regulated — audits, insurance and a 24×7 SOC in Indian hours
Why: The only service here with a documented India SOC plus CERT-In-empanelled audits, DPDP / ISO 27001 / SOC 2 / SEBI CSCRF programmes and IRDAI-regulated cyber insurance under one roof — uncopyable by a global vendor.
The trade-off: Founded 2023: young scale, partner-delivered tooling on your stack, quote-only. One survivor is the honest answer here; pair it with a global agent if the board wants a brand.
Whole estate — email, identity, cloud and network, not only endpoints
Why: Trend correlates its sensors across email, endpoint, cloud and network; Sophos and Barracuda ingest third-party telemetry across the same surfaces.
The trade-off: Trend's breadth needs Trend sensors everywhere; Sophos and Barracuda need integration work per source — and scope creep is where 'endpoint-only discovered during an incident' is avoided or not.
Your MSP runs IT and should run security too
Why: Barracuda Managed XDR is built to be delivered through MSPs; Xcitium and Coro sell MSP programmes with the SOC attached.
The trade-off: You are one step removed from the analyst — make the MSP's escalation path and your direct access to the SOC part of the contract.
SMB wanting one agent, one console, one bill
Why: Coro's modules with its SOC, Xcitium's modular platform with MDR, Bitdefender MDR Foundations — all priced and positioned for small estates.
The trade-off: Scope is the stack: Coro watches Coro, Xcitium watches Xcitium; if the incident starts in a tool they do not see, you are on your own.
Three axes, and the corner most buyers end up in by accident
Every MDR sits somewhere on scope, telemetry and authority. The brochure shows the best corner; the SLA shows where you actually are. Place each service before you compare prices.
Axis 1 · Scope
Endpoint → platform → estate
Endpoint-only watches the agent's host telemetry. Platform scope watches the vendor's own modules — estate-wide only if you run their stack for email, identity and cloud. Estate scope ingests third-party telemetry across those surfaces. Sophos, Barracuda and Mitigata document the last; Trend across its own sensors.
Axis 2 · Telemetry
Their agent, or yours
Most services require the vendor's EDR. Sophos MDR (CrowdStrike, Microsoft and others), Xcitium (Managed EDR for Microsoft Defender), Barracuda and Mitigata document running on telemetry you already have — which is also the whole story of what you keep at exit.
Axis 3 · Authority
Advise → contain → remediate
Every service here contains. Full incident response — forensics, eradication, rebuild guidance — is documented at Sophos MDR Complete, CrowdStrike Falcon Complete, SentinelOne Respond Pro and Mitigata; ESET and Kaspersky let you set the level; the rest contain and guide.
The 2am test
Ask these before the price, in this order.
- —Where does the analyst who calls me sit, and in what language? “24/7 global” is documented everywhere; an India SOC is documented once (Mitigata).
- —What are you pre-authorised to do without calling me? Isolate a host, kill a process, disable an account, reset a credential — each is a separate yes in the SLA.
- —Which sources do you actually ingest, by name? “XDR” in the vendor’s mouth often means their stack. Name the email platform, the identity provider, the cloud accounts.
- —What do I keep when I leave? Agent, detections, tuning, telemetry — or none of them.
The India layer
Mitigata is the story no global vendor can copy — and it is not for everyone.
- —Security, compliance and insurance under one roof: a 24×7 SOC from India, CERT-In-empanelled audits, programmes for DPDP, ISO 27001, SOC 2 and SEBI CSCRF, and IRDAI-regulated cyber-insurance broking — one console, Indian hours, INR.
- —Why it matters: the regulator that asks for the audit and the insurer that pays the claim see the same SOC evidence. Nobody else on this page can say that.
- —Where it does not fit: an estate that wants one global vendor’s branded agent and SOC, or documented scale above 5,000 endpoints today (founded 2023). Pair it with a global agent and let the SOC sit in India — that is the honest hybrid.
What changes at 250, 2,000 and 10,000 endpoints
An MDR scales by alert volume and by the number of sources it must ingest, not by endpoint count alone. The bill scales per endpoint; the value scales with scope.
Scope is the constraint
- —A vendor-agent MDR onboards in days and covers the endpoints; the incident that starts in email or identity is outside the contract unless you wired it in.
- —Bitdefender Foundations, Coro, Xcitium and Sophos MDR Essentials are priced for this band; Falcon Complete is enterprise-positioned.
- —The agent and the SOC are one decision here — and so is the exit.
Put this in your PoC
Run a tabletop: an email-borne credential theft. Ask the vendor which step they would have seen and which they would have acted on.
Sources and authority are the constraint
- —Identity, email and cloud telemetry must be ingested or the SOC is blind where attacks start; BYO-telemetry services earn their keep here.
- —Authority must be pre-agreed per action — a containment that waits for approval at 2am is a notification.
- —Tuning becomes a joint project: their detections, your exclusions, one owner on each side.
Put this in your PoC
Ask for the named list of ingested sources for your estate and a signed authority matrix before the PoC, not after.
Exit and sovereignty are the constraint
- —Multi-region, multi-business-unit scoping; data residency per source; the India SOC question becomes a board question.
- —A mandated agent at this size is a multi-year lock — price the switch before the first renewal.
- —Your own SOC-lite (SIEM + a few analysts) plus an MDR for night cover is the common honest shape.
Put this in your PoC
Price a full exit: agent replacement, detection rebuild, telemetry export. If the number is unbearable, you have learned the real contract.
Sophos, Bitdefender, Kaspersky, CrowdStrike, SentinelOne, Trend, ESET and Barracuda document estates well above 5,000 endpoints; Xcitium, Coro and Mitigata are flagged unverified at that size, not ruled out. Where a specific service strains for your estate: [TechBag to confirm].
Leaving an MDR is the variable nobody priced
The analysts stop; the agent stays licensed or not; the detections and tuning were theirs. What you keep depends entirely on whose telemetry the service ran on.
Vendor-agent MDR
The agent licence continues (you can self-run or buy another MDR on it); the vendor's detection content, tuning and runbooks leave with the service.
BYO-telemetry MDR
Your EDR, SIEM and integrations stay; you lose the analysts and whatever detections lived in their platform. Onboarding the next service is per source again.
Evidence and history
Incident records, timelines and reports sit in the provider's portal. Export what audits and insurers may ask for before the contract ends.
The overlap
MDR contracts run on their own calendar; the new service needs weeks to onboard. Overlap two or accept a gap — either is a cost line.
Exit plan and re-onboarding weeks for your estate: [TechBag to confirm] — TechBag scopes it from your sources, agents and contract dates.
Per endpoint per month, times who is on the bridge
What you may already hold, the services priced the same way at three estate sizes in USD and INR, and what the licence line leaves out — which, for an MDR, is most of the story.
Do you already own one?
Four places a managed service may already be within reach.
- Microsoft 365 E5
- Partly Defender Experts for XDR is Microsoft’s own managed tier over Defender P2 — E5 prerequisite, quoted separately. E5 gives you the telemetry, not the analysts.
- Your EDR vendor
- Often Sophos, SentinelOne, Bitdefender, ESET, Kaspersky, Trend, Xcitium and CrowdStrike all sell the people on top of the agent you run. Read scope and authority before assuming it is the obvious answer.
- Your MSP
- Sometimes Barracuda Managed XDR, Xcitium and Coro are built to be delivered by MSPs. Ask the MSP which SOC is behind it and what authority they hold.
- Your cyber-insurer
- No Insurers price your controls; they do not run them — except Mitigata, which is an IRDAI-regulated broker and a SOC at once.
If the people you need already sit behind a licence you hold, we say so — and then read the authority line with you.
What the rest actually cost
Reported and reseller-listed prices (no MDR vendor here publishes a list), normalised to per endpoint per month, INR for scale, then worked at 250 / 1,000 / 5,000 endpoints. Where a service is quote-only the line says so rather than guessing.
- Bitdefender MDR(Core → Advanced, reported)$1,748–2,623 ≈₹1,45,084–₹2,17,709
- Sophos MDR(Essentials → Complete, reported $80–200 / user / yr)$1,667–4,167 ≈₹1,38,361–₹3,45,861
- SentinelOne Vigilance(add-on $15–50 / yr + Complete ~$180 / yr)$4,062–4,791 ≈₹3,37,146–₹3,97,653
- Coro Managed SOC(historical $20 / user / mo)$5,000 ≈₹4,15,000
- CrowdStrike Falcon Complete(reported $25–45 / endpoint / mo)$6,250–11,250 ≈₹5,18,750–₹9,33,750
- Trend Service OneQuote
- Kaspersky MDRQuote
- ESET MDRQuote
- Xcitium MDRQuote
- Barracuda Managed XDR(via MSP)Quote
- Mitigata Managed SOC(INR)Quote
- Bitdefender MDR(Core → Advanced, reported)$6,990–10,490 ≈₹5,80,170–₹8,70,670
- Sophos MDR(Essentials → Complete, reported $80–200 / user / yr)$6,667–16,667 ≈₹5,53,361–₹13,83,361
- SentinelOne Vigilance(add-on $15–50 / yr + Complete ~$180 / yr)$16,249–19,166 ≈₹13,48,667–₹15,90,778
- Coro Managed SOC(historical $20 / user / mo)$20,000 ≈₹16,60,000
- CrowdStrike Falcon Complete(reported $25–45 / endpoint / mo)$25,000–45,000 ≈₹20,75,000–₹37,35,000
- Trend Service OneQuote
- Kaspersky MDRQuote
- ESET MDRQuote
- Xcitium MDRQuote
- Barracuda Managed XDR(via MSP)Quote
- Mitigata Managed SOC(INR)Quote
- Bitdefender MDR(Core → Advanced, reported)$34,950–52,450 ≈₹29,00,850–₹43,53,350
- Sophos MDR(Essentials → Complete, reported $80–200 / user / yr)$33,333–83,333 ≈₹27,66,639–₹69,16,639
- SentinelOne Vigilance(add-on $15–50 / yr + Complete ~$180 / yr)$81,246–95,829 ≈₹67,43,418–₹79,53,807
- Coro Managed SOC(historical $20 / user / mo)$1,00,000 ≈₹83,00,000
- CrowdStrike Falcon Complete(reported $25–45 / endpoint / mo)$1,25,000–2,25,000 ≈₹1,03,75,000–₹1,86,75,000
- Trend Service OneQuote
- Kaspersky MDRQuote
- ESET MDRQuote
- Xcitium MDRQuote
- Barracuda Managed XDR(via MSP)Quote
- Mitigata Managed SOC(INR)Quote
TechBag gives INR pricing, GST, PO cycle, minimums and tier-matched quotes. The INR above is conversion for scale at ≈₹83/$; the tier-matched INR quote is ours.
What isn’t in the licence price
The authority you didn't buy
A service that notifies at 2am while you approve is a notification, not a response. The price gap between Essentials and Complete tiers — reported $80 ≈ ₹6,640 to $200 ≈ ₹16,600 per user per year at Sophos — is the gap between those two nights.
Your own hours
Every MDR needs a person on your side to answer the call, approve the action and own the tuning. Budget one named owner and an escalation rota; the vendor will ask for it in week one.
The exit
Agent replacement, detection rebuild, telemetry re-onboarding — the switching-cost section above. With a mandated-agent service this is the largest number in the contract; with a BYO service it is the smallest. Your number is [TechBag to confirm].
What goes wrong
Documented scope and authority lines, cross-checked against TechBag engagements before any becomes a named case. Each is cheaper to read here than to discover on the bridge.
Endpoint-only scope discovered during an incident
The attack came through email or a cloud identity; the MDR saw the endpoint; the contract said endpoints. Scope is the first SLA line to read.
Vendor lock via the mandated agent
The MDR required its EDR; three years later the EDR, the detections and the tuning are all theirs. Switching means re-tooling the estate — the real contract length.
'24/7' that means a ticket queue
Round-the-clock monitoring is not round-the-clock response. Ask whether a human investigates at 2am or a ticket is created for 9am — in which time zone.
Response authority narrower than assumed
Pre-approved containment stopped at isolating the host; credential resets and cloud actions were 'advise'. The authority matrix, signed, is the product.
No exit path without re-tooling
Nobody priced leaving. With a mandated agent, the exit is an endpoint migration plus a detection rebuild; plan it before signing, not at renewal.
Two SOCs, one incident
An MDR for endpoints and an MSSP for the firewall, neither owning the bridge. Name the incident commander in the contract.
Platform 'XDR' that means 'our stack'
The X covered the vendor's email and cloud modules you do not run. Name the ingested sources for your estate, in writing.
India hours assumed, not documented
Global SOC coverage is real; an analyst in Indian hours and language is documented once on this page. Ask where the caller sits.
Three doors — pick by where you are
Vendor-neutral. No gated content.