Register of Vendor Pricing · Compiled by Digital Signet · Revised 20 June 2026
Annex IV · Schedule of Hidden Lines

MDR hidden costs.

Line items that show up after the headline quote is signed. Each line is either a contract-cap negotiation or a vendor margin that can be reduced by lifting it into the RFP commercial section.

Direct answer

The seven hidden lines that surface post-signature are: ingest overage, IR retainer overage, non-standard log sources, dedicated tenancy, evidence packs, off-boarding fee, and annual price escalation. All seven can be capped or eliminated in the RFP commercial section.

The ledger of hidden lines

Ingest overageper GB above contracted cap$ 0.40 to $ 1.20 per GB[G]
IR retainer overageper hour above included$ 350 to $ 600 / hour[G]
Non-standard log sourceper integration setup$ 2,500 to $ 15,000 one-time[I]
Dedicated tenancyvs multi-tenant default+15 to +40% on base[I]
Evidence pack (per audit)SOC 2 / HIPAA / PCI / CMMC$ 2,500 to $ 15,000 per pull[I]
Off-boarding / data exportcontract termination$ 5,000 to $ 50,000 one-time[I]
Annual price escalationif uncapped3 to 8% per year[I]

How to cap each line in the RFP

  • Ingest overage. Cap at the higher of 110% of contracted GB/day or a per-GB rate not to exceed $ 0.50.
  • IR retainer. State the hourly rate, the included hours, and the overage rate; require the vendor to deplete included hours first.
  • Non-standard log source. Convert one-time setup fees into amortised monthly costs for the RFP comparison; require a price-book.
  • Dedicated tenancy. Make it a yes/no toggle in the RFP commercial section; if required for compliance, hold the multiplier to +25% maximum.
  • Evidence packs. Specify the number of pulls per year (typically 2 to 4) in the contract.
  • Off-boarding. Cap data-export fee at $ 10,000; require 90-day retention post-termination.
  • Annual escalation. Cap at the lower of CPI or 4%; multi-year deals should fix the escalator.
Bands are field-reported from G2 deal data, channel-partner price lists, and Reddit r/cybersecurity quote dumps 2025-2026. See notes to the ledger.

Annex cross-references

AnnexRFP templateThe commercial section is where each hidden line gets capped.AnnexQuote decoderQuestion ladder to surface the hidden lines pre-signature.AnnexPricing modelsWhich metering model exposes you to which hidden line.