Annex V · Metering

Log source vs endpoint pricing.

The four metering models in active use in 2026: per-endpoint, per-log-source, per-GB ingest, and per-asset. Each model favours a different shape of buyer.

Direct answer

Per-endpoint suits laptop-heavy SMBs. Per-log-source suits buyers with few endpoints but many integrations (cloud-native). Per-GB suits ingest-light environments and punishes ingest-heavy ones. Per-asset suits mixed cloud / on-prem environments and is the only model that scales with cloud workloads alongside endpoints.

The four models

Per-endpoint

Charged on each device running the agent. Most common (Huntress, CrowdStrike Falcon Complete, SentinelOne Vigilance, Sophos MDR, Red Canary, Field Effect, Secureworks Taegis). Bounded and predictable, but does not bill cloud workloads or network devices that lack an agent.

Per-log-source

Charged per integration ingesting logs. Used by Critical Insight (healthcare); Expel uses a per-integration variant that bundles related sources. Suits buyers with few endpoints but many cloud or SaaS log sources. The risk is integration sprawl: every new SaaS adds a billable source.

Per-GB ingest

Charged on the volume of log data ingested per day or per month. Mostly seen as a line within hybrid models rather than as the primary metering unit. The risk is verbose-source contagion (one chatty Windows server inflates the bill).

Per-asset

Charged on endpoints plus servers, cloud workloads, network devices. Used by Rapid7 MDR. Scales cleanly across mixed environments but widens the billable count vs pure per-endpoint, which is why the per-asset $/unit/mo band sits below the per-endpoint band but the total bill often lands higher.

Hybrid models

Several vendors run a hybrid: a platform fee (per environment or per seat) plus a per-unit metered fee. ReliaQuest GreyMatter (platform + service), eSentire (Atlas XDR + service), and UnderDefense MAXI all use this shape. The negotiation pressure point is the platform fee, which is usually the biggest single line and the most discountable.

See /annex/rfp-template Section 3 for the commercial line items that decode each model.

Annex cross-references

AnnexBYO-SIEM pricingThe metering model changes when the buyer owns the SIEM.AnnexHidden costsIngest overage is the most common hidden line under per-GB and hybrid models.AnnexRapid7 MDRPer-asset metering example.AnnexExpelPer-integration metering example.