How much does Expel MDR cost in 2026?

Expel MDR starts at $11,640 per year for the base tier. Mid-market deployments typically land between $50,000 and $200,000 per year. Vendr transaction data places the median Expel contract at $199,661 per year across 41 verified purchases, with the observed range running $54,028 to $302,483. Expel does not price per endpoint; the cost driver is the number of integrated technologies and telemetry volume (Vendr + Expel, 2026).

What is the difference between Expel Starter, Select, and Premium?

Starter covers cloud, identity, network, and endpoint coverage with endpoint auto-remediation. Select adds cloud control plane, SaaS apps, and multi-surface auto-remediation. Premium adds unlimited integrations, Workbench API access, and a dedicated engagement manager. All three tiers include remediation recommendations; multi-surface auto-remediation starts at Select (mdrproviders.io, June 2026).

Does Expel price per endpoint?

Expel does not price per endpoint for the MDR service itself because it monitors existing security tools rather than deploying its own agent. The cost driver is the number of integrated technologies and the volume of telemetry, not seat count. Pricing scales with asset count, but per-asset pricing typically improves at higher volumes (1,000+ assets). EDR coverage, on-prem coverage, and SaaS app coverage each have their own per-unit rate (Vendr, 2026).

What are typical Expel contract sizes by organization size?

Small deployments under 500 monitored assets typically land $75,000 to $150,000 per year. Mid-market deployments with 500 to 2,000 monitored assets and multiple integrated technologies typically land $150,000 to $400,000 per year. Large enterprises monitoring 2,000+ assets across complex multi-cloud environments commonly see $400,000 to over $1 million per year. Vendr median is $199,661 per year across 41 verified purchases (Vendr, 2026).

What discounts can buyers negotiate on Expel?

Multi-year 2 to 3 year commitments typically unlock 15 to 30 percent off initial quotes, with the strongest outcomes tied to 3-year commitments and consolidated renewals. Annual escalation clauses of 3 to 7 percent are reported by aggregators. Bundling onboarding into the annual fee often achieves 10 to 20 percent off initial quotes. Onboarding and professional services can be billed separately at $10,000 to $50,000+ (Vendr + mdrproviders.io, 2026).

Expel MDR Pricing 2026: Per Coverage Type Cost

Q: What are the Expel pricing dimensions?

Expel prices by coverage type rather than by seat count. Cloud infrastructure is priced per resource; on-prem infrastructure is priced per endpoint; SaaS applications are priced per user account; phishing is priced by email count. Each coverage type carries a separate per-unit rate. Expel for EDR starts at $11,640 per year for 125 endpoints; Expel for Cloud Infrastructure starts at $22,200 per year for 125 resources (TrustRadius, 2026).

Expel MDR pricing in 2026 starts at $11,640 per year for the base tier, with mid-market deployments typically landing $50,000 to $200,000 per year and a Vendr median of $199,661 per year across 41 verified purchases. Expel does not price per endpoint; cost is scoped by coverage type (cloud resources, on-prem endpoints, SaaS user accounts, phishing email count) and the volume of telemetry (Vendr + Expel, 2026).

The pricing model is Expel's structural differentiator. Buyers pay for integrated technologies and telemetry volume, not for seat count, which avoids the agent-licensing duplication that competitors charge.

Last verified: Sep 15, 2026.

At a glance

Base tier from $11,640 per year (EDR coverage for 125 endpoints)
Cloud Infrastructure $22,200 per year for 125 resources
On-Prem $24,000 per year for 125 endpoints
SaaS $16,560 per year for 125 users
Mid-market $50,000 to $200,000 per year typical
Vendr median $199,661 per year across 41 verified purchases

Expel pricing dimensions and coverage types

Expel prices by coverage type rather than by seat count, which is the structural difference from the rest of the MDR market. Cloud infrastructure is priced per resource. On-prem infrastructure is priced per endpoint. SaaS applications are priced per user account. Phishing is priced by email count. Each coverage type carries a separate per-unit rate, and the four dimensions add together for the total annual contract (TrustRadius, 2026).

FIELD REFERENCE FOR SOC TEAMS Blue Team Handbook: Incident Response

Don Murdoch • Condensed reference · 4.6

Check price on Amazon

Coverage type	Pricing unit	Starting rate	Coverage scope
Expel for EDR	Per endpoint	$11,640 per year for 125 endpoints	CrowdStrike, SentinelOne, Microsoft Defender for Endpoint integrations
Expel for Cloud Infrastructure	Per resource	$22,200 per year for 125 resources	AWS, Azure, GCP workload monitoring
Expel for On-Prem Infrastructure	Per endpoint	$24,000 per year for 125 endpoints	Servers, virtual machines, network sensors
Expel for SaaS Apps	Per user account	$16,560 per year for 125 users	Microsoft 365, Google Workspace, Salesforce, Slack

Expel monitors existing security tools rather than deploying its own agent, which is the key pricing difference from competitors like Arctic Wolf and eSentire that bundle an EDR agent. Organizations that have already invested in CrowdStrike Falcon or SentinelOne Singularity can pair their EDR with Expel for EDR coverage and pay only the Expel line, avoiding the agent-licensing duplication. Organizations standardizing on Expel as their primary MDR partner can layer Expel across all four coverage types (Vendr, 2026).

Starter, Select, and Premium tier comparison

Expel sells three published tiers with progressively broader coverage and integration depth. The financial decision is which tier the environment complexity and integration roadmap justify, because the per-unit rate is consistent across tiers but the scope of supported integrations changes substantially (mdrproviders.io, June 2026).

Tier	Coverage	Integrations	Best fit
Starter	Cloud, identity, network, endpoint with endpoint auto-remediation	Limited integration count	Small to mid-market with focused security stack
Select	Starter plus cloud control plane, SaaS apps, multi-surface auto-remediation	Expanded integration count	Mid-market with diverse cloud and SaaS footprint
Premium	Select plus unlimited integrations, Workbench API access, dedicated engagement manager	Unlimited integrations	Mid-market and enterprise with broad security stack

All three tiers include remediation recommendations; multi-surface auto-remediation starts at Select. Threat hunting, phishing response, and vulnerability prioritization are separate add-ons across all tiers; base tiers include remediation recommendations and endpoint auto-remediation only. Organizations with extensive security stacks and complex integration requirements should evaluate Premium tier pricing against the cost of paying for individual integrations at Select tier (mdrproviders.io, June 2026).

Typical contract sizes by organization scale

Vendr transaction data clusters around three size bands that map to organization complexity. The table below shows typical annual spend at three common scopes, based on 41 verified Expel purchases in the Vendr dataset (Vendr, 2026).

TOP PICK FOR SOC ANALYSTS CompTIA CySA+ CS0-004 Study Guide

Sybex • CS0-004 edition · 4.6

Check price on Amazon

Organization size	Asset count	Annual contract value	Typical integrations
Small	Under 500	$75,000 to $150,000	Endpoints plus one or two cloud environments
Mid-market	500 to 2,000	$150,000 to $400,000	EDR, SIEM, cloud security posture management
Enterprise	2,000+	$400,000 to $1 million+	Multi-cloud, multiple EDR platforms, custom integrations

Vendr's median Expel contract is $199,661 per year, which is consistent with a mid-market organization with 500 to 2,000 monitored assets and multiple integrated technologies. Multi-year commitments unlock 15 to 30 percent off initial proposals, with the strongest outcomes tied to 3-year commitments and consolidated renewals (Vendr, 2026).

Hidden costs and add-on modules

Several line items push Expel's real first-year cost above the base per-coverage-type rate. Threat hunting is an add-on to all MDR tiers and is not included in base pricing. Phishing response (Expel for Phishing) is a separate service priced by email count. Vulnerability Prioritization is a separate service. Multi-surface auto-remediation starts at Select; Starter includes endpoint auto-remediation only. Onboarding and professional services can be billed separately at $10,000 to $50,000+ (mdrproviders.io, June 2026).

Annual escalation clauses of 3 to 7 percent per year are reported by aggregators. Buyers should negotiate caps on renewal escalation and bundle onboarding into the annual fee rather than treating it as a separate billable event. The combination of coverage-type pricing, add-on modules, and onboarding services means the realistic first-year TCO typically runs 30 to 50 percent above the base per-coverage-type rate (Vendr, 2026).