Red Canary pricing.
Per-endpoint annual subscription; EDR-source agnostic (works on CrowdStrike, SentinelOne, Microsoft Defender for Endpoint). Pricing published only via quote post Zscaler acquisition.
Red Canary does not publish a list price on its official page in 2026 (Quote-only via Zscaler sales). Field-reported bands cluster at 7 to 18 USD per endpoint / month, sourced from G2 deal data, channel-partner listings, and Reddit r/cybersecurity quote dumps verified 2026-06-19.
Ledger entry
What changes the quote
The headline per-endpoint band moves with endpoint count, contract length, 24x7 vs business-hours coverage, the inclusion of an incident-response retainer, whether the customer brings their own SIEM, and the compliance overlay (HIPAA, PCI, CMMC L2, FedRAMP, DORA). See /annex/quote-decoder for the question ladder that decodes a Red Canary quote line by line.
What is bundled and what gets line-itemed
Bundled into the base subscription: 24x7 SOC monitoring, EDR licence (where vendor-supplied), portal access, standard onboarding. Line-itemed at extra cost: ingest overage above the contracted GB/day, non-standard log sources, dedicated tenancy, evidence packs for regulated frameworks, IR retainer hours, and contract off-boarding. Cross-reference /annex/hidden-costs for the full schedule.
Recent changes
Zscaler acquisition completed 2025; Red Canary now sold inside Zscaler's broader Zero Trust + MDR bundle; standalone MDR SKU still available but increasingly cross-sold with Zscaler platform.
Source
Primary source: https://redcanary.com/managed-detection-and-response/, verified 2026-06-19. Inferred-band sourcing note: Pre-Zscaler G2 quote data 2024-2025; post-acquisition contracts being repackaged through Zscaler's Zero Trust platform sales motion.
See notes to the ledger for the source-mark legend and the inferred-band derivation methodology.