CrowdStrike vs SentinelOne vs Defender for Business: 2027 cost per device

Summary. On list price, Microsoft Defender for Business is the cheapest of these three endpoint detection and response (EDR) products for a US or UK business with up to 300 users: $3.00 per user per month (£2.30 before VAT), paid yearly, with up to five devices per user. Fifty users cost $1,800 a year. CrowdStrike's cheapest bundle, Falcon Go at $59.99 per device a year, comes to $2,999.50 for 50 devices, but Go and Pro do not include EDR; that starts with Falcon Enterprise at $184.99, or $9,249.50 for 50. SentinelOne lists Singularity Complete, which includes detection and response, at $179.99 per endpoint a year ($8,999.50 for 50) and Commercial at $229.99, priced for 5 to 100 workstations and sold through partners. At 250 endpoints, Falcon Go's 100-device cap and SentinelOne's price band push you to Falcon Pro, Falcon Enterprise or a partner quote, while Defender for Business costs $9,000. None of the three publishes an MDR price. CrowdStrike's sale for new customers runs from 23 November to 4 December 2026, and the discount was not shown on 13 November. Only CrowdStrike took part in the 2025 MITRE ATT&CK Enterprise Evaluation. Pick Defender if you already run Microsoft 365; pick CrowdStrike or SentinelOne for a non-Microsoft agent or vendor-run hunting, at five or more times the per-seat list price.

About this article. This is for owners, IT managers and MSPs in the US and UK who are buying or renewing endpoint security for 2027. We checked prices, plan contents, caps and billing terms on 13 November 2026 against CrowdStrike's US and UK pricing pages, SentinelOne's pricing page (through an archived copy of 22 October 2026, because the live page blocked automated reading), Microsoft's US and UK product pages, and MITRE's own release. We ran no hands-on tests, no vendor paid for inclusion, and vendors change prices often, so confirm before you buy. Researched with AI assistance and reviewed by our editorial team.

What changed for 2027 buyers

CrowdStrike has a dated sale, and the same dollar prices in the UK. CrowdStrike lists Falcon Go, Pro and Enterprise at $7.99, $14.99 and $19.99 per device per month, or $59.99, $99.99 and $184.99 per device per year. Its UK pricing page shows the same US-dollar figures and no sterling price. Its Black Friday and Cyber Monday sale runs from 23 November to 11.59 pm Pacific time on 4 December 2026, covers all three bundles, applies without a code, is open in the US and the UK, and is for new customers only. The discount itself was not published on 13 November. If you are new to CrowdStrike and already planning to buy, wait for 23 November, then get the year-two price in writing.

Microsoft's enterprise endpoint page leads with a suite. The Defender for Endpoint page shows no standalone plan prices. It shows Microsoft Defender Suite at $12.00 per user per month, paid yearly, which requires Microsoft 365 E3, or Office 365 E3 plus Enterprise Mobility + Security E3. Defender for Business is $3.00, and Microsoft 365 Business Premium, which includes it, is $22.00 (£16.90). Business Premium was not on Microsoft's list of products whose prices rose on 1 July 2026; Business Standard was. Our Business Premium vs E3 vs E5 comparison covers the wider suites.

The newest MITRE results do not cover all three. SecurityWeek reported that Microsoft, Palo Alto Networks and SentinelOne withdrew from the 2025 MITRE ATT&CK Enterprise Evaluation; CrowdStrike took part.

SentinelOne prices only a band. Its published prices are for 5 to 100 workstations, in US dollars, and sold through authorised partners whose pricing overrides the website.

CrowdStrike Falcon Go, Pro and Enterprise

CrowdStrike sells three bundles online, plus Falcon Complete Next-Gen MDR and Falcon Flex (access to the whole portfolio, with modules swapped once a year) through sales. Falcon supports Windows, macOS and Linux, and Go, Pro and Enterprise all include Express Support.

• Falcon Go ($59.99 a device a year). Next-generation antivirus, device control for USB and other removable media, and mobile protection for Android and iOS. Purchases are capped at 100 devices.

• Falcon Pro ($99.99). Everything in Go plus host firewall management.

• Falcon Enterprise ($184.99). Everything in Pro plus EDR, and threat intelligence and hunting, which CrowdStrike describes as its own experts hunting continuously in the Falcon platform.

Identity protection, IT hygiene and Next-Gen SIEM appear in the bundle lists but are not included in Go, Pro or Enterprise; CrowdStrike sells them as add-ons.

The EDR catch. Go and Pro are prevention products. If a cyber insurer, a customer questionnaire or your own policy asks for EDR, the cheapest CrowdStrike bundle that qualifies is Enterprise. Falcon Go's $59.99 is not an EDR price.

Billing. Annual subscriptions are billed in full at the start, with no other fees beyond optional add-ons, and CrowdStrike says you can cancel within 30 days for a full refund. Paying annually saves about 37% on Go ($59.99 against 12 × $7.99 = $95.88), 44% on Pro ($99.99 against $179.88) and 23% on Enterprise ($184.99 against $239.88). The 15-day free trial covers Falcon Prevent, device control and Express Support, with no credit card.

Best for: firms under 100 devices that want a non-Microsoft antivirus layer (Go), or mixed Windows, macOS and Linux estates that want EDR plus vendor-run hunting at one per-device price (Enterprise).

SentinelOne Singularity Complete, Commercial and Enterprise

SentinelOne publishes three Singularity packages. All purchases go through an authorised partner, prices are in US dollars and may exclude taxes, and partner pricing wins where the two differ.

• Singularity Complete ($179.99 per endpoint a year). AI-driven endpoint and cloud workload protection, real-time detection and response, 14 days of data retention and an AI security assistant. The comparison table also ticks endpoint protection, device and firewall control, remote shell and extended detection and response (XDR) for every package.

• Singularity Commercial ($229.99). Everything in Complete plus identity threat detection and response, 90-day retention and managed threat hunting.

• Singularity Enterprise (contact sales). Everything in Commercial plus an agentic AI SOC analyst for automated triage, network discovery and forensic data collection, and guided onboarding and training.

The comparison table marks managed threat hunting as an add-on for Complete, the agentic AI SOC analyst as an add-on for Complete and Commercial, and managed detection and response as an add-on for Commercial and Enterprise; it is not offered on Complete. The package selector also names Singularity Core and Singularity Control without a price, so treat them as quote-based.

Retention matters. Complete keeps 14 days of data. If an intrusion is found late, two weeks of history may not reach back to the start, so ask the partner what longer retention costs. Above 100 workstations, the $179.99 and $229.99 figures no longer apply and you are on a partner quote.

Best for: buyers who want EDR with cloud workload protection at the lowest non-Microsoft EDR list price (Complete), or identity detection, 90-day retention and hunting in one package (Commercial), bought through an MSP or reseller.

Microsoft Defender for Business and Defender for Endpoint

Defender for Business is Microsoft's endpoint product for organisations with up to 300 users. It costs $3.00 per user per month in the US and £2.30 in the UK before VAT, paid yearly on an annual subscription that renews automatically. Each user can cover up to five devices, with no minimum, across Windows, macOS, iOS and Android. Microsoft lists next-generation antivirus, EDR with automatic attack disruption, vulnerability management, automated investigation and remediation, wizard-based onboarding and monthly security summary reports. Servers need the Defender for Business servers add-on, whose price is not on the product page.

The one-month free trial needs a credit card and converts to a paid subscription; once paid, you have 7 days to cancel for a prorated refund. MSPs can view many customers' incidents and alerts in Microsoft 365 Lighthouse.

Business Premium at $22.00 (£16.90 before VAT) per user per month bundles Defender for Business with Defender for Office 365, Intune Plan 1, Microsoft Entra ID with multifactor authentication (MFA) and Purview data protection, for up to 300 users. Business Standard lists at $14.00, so the list-price step up to Premium is $8.00 per user per month.

Defender for Endpoint is the product for larger organisations, and Microsoft recommends it above 300 users. It is the foundation of Defender for Business and adds deeper configuration and advanced hunting. Microsoft's product page prices it only inside Defender Suite.

Best for: any business under 300 users that already runs Microsoft 365, especially one where staff carry a laptop and a phone, because one per-user licence covers both.

MDR options: who answers the alert at 2 am

EDR flags suspicious behaviour. Someone still has to look at it, decide and act, often outside office hours. All three vendors sell a managed service for that, and none publishes a price.

Microsoft says incidents on iOS, Android and IoT devices, and compliance, data loss prevention and custom detections, are outside Defender Experts MDR's scope, and it points customers to security partners in the Microsoft Intelligent Security Association. We did not review the terms of CrowdStrike's warranty, so read its conditions before treating it as insurance.

Ask every MDR provider the same questions: which actions its analysts can take without calling you (isolate a host, disable an account, roll back files), the response-time commitment, which devices and log sources are in scope, and what happens if you outgrow the quoted device count.

Independent tests: what MITRE ATT&CK Evaluations show

We make no detection claims of our own. The best-known independent test is MITRE's ATT&CK Evaluations.

• 2025 Enterprise round (results published 10 December 2025). Eleven vendors took part: Acronis, AhnLab, CrowdStrike, Cyberani, Cybereason, Cynet, ESET, Sophos, Trend Micro, WatchGuard and WithSecure. The round included MITRE's first cloud adversary emulation. SecurityWeek reported that the scenarios drew on Scattered Spider and Mustang Panda, and that Microsoft, Palo Alto Networks and SentinelOne withdrew, citing the resources the programme demands.

• CrowdStrike's reading. CrowdStrike says it achieved 100% detection, 100% protection and zero false positives. Its detection chart shows coverage once all execution runs were complete, and the tested platform included Falcon Next-Gen Identity Security, Falcon Cloud Security and Falcon Next-Gen SIEM, none of which ship inside Go, Pro or Enterprise.

• Microsoft and SentinelOne. Their latest Enterprise results are from the 2024 round. Microsoft's Defender for Endpoint page says it delivered 100% protection in that evaluation, and SentinelOne's pricing page cites its 2024 result. Both are vendor summaries.

MITRE states that the evaluations do not rank vendors. SecurityWeek also recalled a Forrester analyst's warning that 100% claims can rest on selective reporting or unrealistic product settings. Read MITRE's per-step results, treat no vendor percentage as a ranking, and pilot on your own machines.

Head-to-head comparison

The table draws on the three vendors' pricing pages as checked on 13 November 2026.

Decision table: choose X if

Worked cost: 50 and 250 endpoints

Both scenarios use the list prices above on 13 November 2026, annual billing unless marked, and one Windows or Mac computer per employee. They exclude servers, MDR, sales tax and VAT unless stated, and any CrowdStrike sale discount.

Scenario A: a 50-person US or UK firm with 50 laptops and 50 work phones.

Defender's per-user licence also covers the 50 phones, so its effective cost is $1,800 ÷ 100 devices = $18 per device a year. For the per-device products, ask the vendor or partner whether each phone uses a device licence before you compare.

Comparing EDR with EDR, the cheapest options at 50 seats are Defender for Business ($1,800), SentinelOne Complete ($8,999.50) and Falcon Enterprise ($9,249.50). Falcon Go is cheaper than the last two but is not EDR.

Scenario B: a 250-person firm with 250 computers.

At 250 seats the gap between Defender for Business and Falcon Enterprise is $46,247.50 - $9,000 = $37,247.50 a year. Hold that number against an MDR quote on the Microsoft stack: if a partner can run 24/7 monitoring on Defender for less, Microsoft plus MDR costs less than Falcon Enterprise without MDR.

US and UK buying notes

UK. Microsoft's sterling prices exclude VAT, charged at the 20% standard rate. CrowdStrike's UK page and SentinelOne's page show US dollars only, so a UK buyer carries exchange-rate risk at each renewal unless a reseller quotes in sterling. If you are certifying for Cyber Essentials, malware protection and the 14-day rule for critical and high-risk updates apply to every in-scope device; our Cyber Essentials Danzell guide explains the auto-fail rules, and Defender's vulnerability reports or Falcon's exposure data can supply patch evidence.

US. SentinelOne says its prices may exclude taxes, and software tax treatment depends on your state, so ask the reseller to show tax on the quote. Business Premium customers already own Defender for Business; check before buying a second EDR product for the same devices. If you are replacing Windows 10 PCs, roll the agent out with the new hardware, as set out in our Windows 10 ESU refresh plan.

Implementation checklist

1. Count users and devices separately. Include phones, shared PCs and servers. Per-user and per-device pricing produce different winners depending on the ratio.

1. Decide whether you need EDR. If you do, compare Falcon Enterprise, Singularity Complete and Defender for Business, not Falcon Go.

1. Price servers on their own line. Defender for Business needs the servers add-on, and SentinelOne's list price is shown for workstations, so ask each vendor or partner how servers are charged.

1. Decide who responds out of hours before you pick software: your own staff, your MSP or a vendor MDR service.

1. Pilot on 10 to 20 machines for two weeks. Remove the old antivirus first, test host isolation and file rollback, and measure the alert volume your team can handle.

1. Get year-two pricing in writing, especially if you buy during CrowdStrike's 23 November to 4 December sale.

1. Fix identity alongside endpoints. Endpoint agents do not replace sign-in protection; our Okta vs Microsoft Entra vs Google Cloud Identity comparison prices MFA and single sign-on.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cybersecurity services team can count your users and devices, pilot Defender for Business, Falcon and Singularity side by side on a sample of machines, and write the response runbooks your MSP or MDR provider will follow. Talk to us at /contact-us/.

Last updated: 13 November 2026.

References

1. Microsoft Defender for Business (US) — Microsoft

1. Microsoft Defender for Business (UK) — Microsoft

1. Pricing: Falcon Go, Pro, Enterprise and Complete (US) — CrowdStrike

1. Pricing and packages, archived copy of 22 October 2026 — SentinelOne

1. 2026 Black Friday and Cyber Monday deals — CrowdStrike

1. MITRE ATT&CK Evaluations advance cloud security and counter-espionage capabilities in latest round, 10 December 2025 (archived copy) — MITRE

1. Pricing (UK) — CrowdStrike

1. Microsoft Defender for Endpoint — Microsoft

1. Security pricing for small and medium businesses — Microsoft

1. Packaging and pricing updates for Microsoft 365 commercial suites: public FAQs — Microsoft

1. MITRE posts results of 2025 ATT&CK Enterprise Evaluations, 11 December 2025 — SecurityWeek

1. Microsoft Defender Experts MDR — Microsoft

1. CrowdStrike achieves 100% detection, 100% protection and zero false positives in 2025 MITRE ATT&CK Enterprise Evaluations, 10 December 2025 — CrowdStrike

1. VAT rates — GOV.UK