The Reality of EDR Costs

With EDR, like other security tool types, effective performance always comes at a cost. 

Even if you use an EDR tool that is open source or free, your organisation will still need to invest time to configure, maintain and operate it on an ongoing basis. Sometimes, as we explain in this blog, these costs can dwarf the initial spend in getting an EDR licence in the first place.

But, paying high EDR costs is not the only way to get EDR capabilities. 

You can find much more cost-effective ways to protect your endpoints from advanced threats than with standalone EDR solutions.

To show you how, this blog explores where EDR costs come from and why a consolidated cyber defence platform like SenseOn makes more sense for most companies. 

The EDR Costs You Might Worry About 

The first part of any EDR cost equation is the licensing costs you pay for EDR agents and support. 

Although they tend to be based on a monthly cost per endpoint (rather than the data usage pricing typical of a SIEM), EDR licensing costs still vary enormously. 

You could get an EDR-esque capability by layering a vendor solution on top of Defender AV for a few pounds per endpoint. Or you could quickly pay several times that for a pure EDR with managed support. 

More expensive EDR solutions will have more advanced features and typically offer better visibility and control. For example, if you wanted to use your EDR to block USB ports for all but a small group of endpoints, it might be doable with a few clicks in one solution but be more or less impossible in another. 

Unlike with a SIEM, EDR licensing costs usually include storage, but this tends to be only for a set time limit. If you want to store EDR telemetry beyond a certain number of days (which could be anything from three days to two weeks), you will need to pay extra.

Your managed service provider might offer this to you as an optional add-on or roll it up into their existing costs. 

Where EDR Costs Really Hurt

EDR licensing fees and pricing models can be complicated, but they might not be the biggest EDR cost centres. There are hidden EDR costs that buyers need to be aware of. 

The first is the cost of not being as secure as you might think.

Relying on signature-based detection and needing constant network connectivity, standalone EDR solutions can end up missing threats like ransomware on endpoints. EDRs are particularly vulnerable to threats that linger in device memory during runtime (which EDRs cannot scan) and come without recognisable signatures (at least 16% of all malicious code).

Standalone EDR tools can also run up costs through the downtime they create.

The workflow created by EDRs often depends on security teams manually verifying threats and reimaging infected devices. This can seriously damage your productivity and is particularly unsuitable for remote environments. 

However, one of the highest costs is the human cost of dealing with false-positive threat alerts. Due to a mismatch between real-world behaviour and the signatures that EDR systems are tuned to detect, EDR produces a high volume of alerts in a typical IT environment. 

More than 40% of EDR alerts are likely to be false positives. Any security team chasing this many false positives will inevitably suffer from alert fatigue. 

Many security teams down-tune their EDRs as a result and increase the risk of real threats slipping through - negating the point of having an EDR solution in the first place and creating future costs when a breach happens.

Reducing EDR Costs with Consolidation 

You need the ability to detect and respond to threats on endpoints, but with siloed tools like standalone EDRs, you only get a fraction of the overall security capabilities you need. This is true even when you have a full suite of complementary tools across other parts of your environment.

Your EDR is doing its thing, but so is your AV, NDR, EPP, SIEM, etc. Information from these different point solutions is typically not shared, and valuable data that can be used to spot and stop threats is being missed. 

Mismatched security information is also spiralling your cybersecurity cost centres by tying down human resources and racking up licensing bills. 

A unified security platform like SenseOn is the solution. 

With SenseOn, your access points, networks, cloud assets and user devices are constantly sharing information, giving you a far more detailed and cost-effective insight into your security posture than EDR alone can ever deliver. 

You also pay far less than you would to deploy and operate a variety of point solutions.

Try a demo of SenseOn today.