CrowdStrike MDR Pricing: Falcon Complete Cost Structure

CrowdStrike MDR pricing is quote-only: the company publishes no price for Falcon Complete, its managed detection and response service. Public contracts and CrowdStrike's own terms still fill in most of the picture. They show which meters a quote runs on, how the per-endpoint rate falls with volume, and where year-one spend grows beyond the endpoint line.

TL;DR:

• A per-endpoint headline means little without the volume band behind it, because the last public Falcon Complete schedule fell steeply from the smallest band to the largest.
• A Falcon Complete quote runs on several meters at once: endpoints, active identities, ingested data and its retention, and support billed as a share of the subscription.
• Renewal pricing, mid-term overage licenses, and the no-refund rule can move the total more than the sticker price does and are worth negotiating before signing.
• The ransomware warranty pays per impacted endpoint under strict conditions, and its headline maximum is a ceiling, not a flat benefit.

What CrowdStrike Actually Publishes: The Three Self-Serve Tiers

The CrowdStrike pricing page lists the bundles customers run themselves. Falcon Go costs $59.99 per device per year and caps at 100 devices, Falcon Pro costs $99.99, and Falcon Enterprise costs $184.99. Paying annually is a discount over twelve monthly payments: about 37% on Go, 44% on Pro, and 23% on Enterprise.

The fourth bundle, Falcon Complete Next-Gen MDR (marketed simply as Falcon Complete), shows "Contact sales." Falcon Elite is no longer listed as a bundle, so if "Elite" shows up on a quote, it refers to the premium support tier covered below.

Where Published Pricing Stops and Falcon Complete Begins

CrowdStrike publishes no US Falcon Complete list price and no minimum endpoint count. If a minimum applies to your deal, your quote is where it will show up.

Per-endpoint pricing is one of several MDR pricing models, and Falcon Complete uses it for the managed service itself. Falcon Identity Threat Protection, Falcon Next-Gen SIEM, and Falcon Cloud Security each carry their own unit, and the base endpoint rate covers none of them. Teams weighing Falcon Complete alternatives should compare scope line by line for the same reason: two quotes with similar endpoint rates can cover different ground.

What the Procurement Record Shows: The Volume Curve

The best public look at Falcon Complete's rate card comes from Texas. From August 2021 to November 2024, reseller Sirius Computer Solutions sold Falcon Complete to Texas public agencies under contract DIR-CPO-4764, with list prices across 13 volume bands. Newer Texas contracts list discounts only, so this 2021 schedule is still the clearest view of how the per-endpoint rate changes with deployment size:

‍

From Band 1 to Band 13 the MSRP falls 69.1%, so a per-endpoint figure means little until you know which band produced it.

The same schedule prices a prepaid Falcon Complete subscription at $125.14 for one year, $337.87 for three, and $563.12 for five. Both multi-year prices sit about 10% below the simple sum of annual rates. The five-year term bought no deeper discount than the three-year term and added two years of lock-in.

Texas agencies buying through Sirius paid about 9% below list. Public-sector discounts have shrunk since: under the current Carahsoft contract, CrowdStrike comes in at 3% off list, against 10% for Palo Alto Networks and Fortinet, 5% for Arctic Wolf, 3% for Rapid7, and 2% for SentinelOne and Sophos. Arctic Wolf also prices on different units, per user and server with concierge tiers on top, and a percentage discount is only comparable once the units match.

Support Is a Percentage of Your Subscription: The Under-Reported Inflator

A rate card published for UK public-sector buyers prices Express support at 12% of the annual software subscription with an annual cap. Essential applies to organizations with more than 2,500 employees and also costs 12%, but with an annual floor. Elite costs 25% of total annual cost with a six-figure floor and includes a Technical Account Manager. US rates may differ, so ask for the US support terms in writing.

Because support tracks spend, every dollar added to the platform can raise the support line without anyone renegotiating it. The 2,500-employee line separates the two 12% tiers, and endpoint count plays no part. CrowdStrike's Terms and Conditions also treat company size, measured by employee count, as a licensing metric. Under the UK rate card, a 3,000-employee company with 1,200 endpoints lands in the floored tier.

Retention Is the Real Multiplier

CrowdStrike prices its SIEM by how much data you send it and how long it keeps that data. Retention defaults to seven days and can be extended to 36 months.

Falcon Insight XDR customers get a 10 GB-per-day free ingestion tier. Above that limit, extra data isn't ingested unless you pay for more capacity, so the free tier stops collecting instead of generating an overage bill. The pay-as-you-go AWS Marketplace listing for the same SIEM works the other way: it bills $0.00595 per MB of non-Falcon data at 13-month retention.

On Falcon Complete itself, the Texas schedule adds about $3.75 or $10.55 per endpoint for longer retention options, whatever the volume band. Because those adders barely move while the base rate falls, retention takes a larger share of spend at larger deployments.

Confirm the included third-party ingestion allowance and the retention period in the quote, and ask whether your purchase vehicle stops collection at a capacity limit or bills actual usage.

What a First-Year Quote Contains

A first-year model needs a row for endpoint modules, Identity Threat Protection accounts, Cloud Security runtime coverage, and SIEM ingestion at a stated retention period, with support layered as a percentage over the total.

For Identity Threat Protection, CrowdStrike counts an account as active if it signed in during the last 90 days. Human and service accounts both count, so the active-identity total is not a headcount figure. An identity synced between on-prem Active Directory and the cloud counts once.

CrowdStrike doesn't publish onboarding or deployment fees, so have the order form state whether they are included or billed separately.

Contract Terms That Move the Total

CrowdStrike's online order and payment terms make auto-renewal the default. Renewals are priced at "CrowdStrike's then-standard price," which the terms note "might be different" from what you paid, and they set no uplift cap. Any negotiated cap has to be written into the order.

Mid-term growth compounds the renewal exposure. A customer that exceeds its licensed quantities buys extra licenses at the then-standard price, prorated to the end of the term, and those licenses count toward the renewal quantity. Growth can therefore be billed above the original negotiated rate and carried into the renewal base. Orders can't be cancelled and fees aren't refunded, with one exception: a full refund if you terminate within 30 days of the start date.

Falcon Flex replaces per-module, per-endpoint purchasing with a single committed amount that teams draw down across modules over the term. The commitment, not the deployed endpoint count, sets year-one cash exposure. Flex is now a major sales motion. In its Q2 fiscal 2027 results on August 26, 2026, CrowdStrike reported more than $2.29 billion in ending ARR from Flex accounts, up 101% year over year. It publishes no Flex term length, minimum commitment, or credit-expiry rules, so get them in writing.

Flex for Services, launched March 24, 2026, extends the same model to services including incident response. It offers a pool of service hours drawn down as needs change. For a limited time, qualifying new services customers can get 200 hours at no upfront cost: 160 for incident response and 40 for proactive work. The program runs independently of platform subscriptions. Before counting on the free hours, check who qualifies, when the hours expire, and what extra hours cost.

The Warranty, Read Precisely

The Falcon Complete warranty covers ransomware incidents only. Its two tiers reach up to $1 million for EDR customers and up to $2 million for customers who also license Falcon Identity Threat Protection. Payment is "calculated at $2,000 per impacted covered endpoint, up to the tier's maximum limit," so the $1 million ceiling takes 500 impacted endpoints and the $2 million ceiling takes 1,000.

Eligibility depends on configuration. Covered endpoints must run a supported operating system at Falcon Complete's recommended Measured Security Posture or higher and a supported sensor version (current or up to two prior). The customer must also enable MFA on internet-facing services and keep the Falcon Complete subscription active.

Because the higher tier requires Identity Threat Protection, ask in writing how the active-identity count affects both total cost and warranty eligibility before treating the $2 million figure as part of the value.

How Daylight Prices Against This

CrowdStrike now markets Falcon Complete as "agentic MDR": "MDR for the AI era, uniting advanced automation, autonomous agents, and 24/7 expert oversight." Since both services use AI, compare the pricing unit and how many cases come back to your team.

Every Falcon Complete meter above scales with the size of the estate. Daylight's position is that investigation effort tracks alert complexity and context more closely than device count, so Daylight does not frame its price as an endpoint rate. Fleet growth can still add telemetry, integrations, and service scope.

Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. MDR is the entry point, delivered as agentic MDR, with Threat Hunting and the Agentic Security Data Lake running on the same architecture. Daylight's MDR service investigates security alerts from integrated customer tools and cases raised by Daylight's own detection rules running on streaming logs. Each investigation runs through to resolution within the agreed scope. Daylight customers see roughly 10 to 15 escalations per month, compared with 150 to 200 with traditional MDR providers.

Daylight does not publish a price either. Ask any provider, Daylight included, to state its pricing unit, what triggers a price change mid-term, and how many cases it hands back, then confirm the answers in the quote.

How to Pressure-Test a Falcon Complete Quote

Each of these conditions changes which line of the quote deserves attention first:

1. If you are under 299 endpoints, the expired Texas schedule put you in Band 1 at $276.56 MSRP, so volume is your weakest lever.
2. If your employee count crosses 2,500, the UK support schedule moves you from a capped tier to a floored one, so price support before endpoints.
3. If you need more than the default retention period, model retention early, because at large deployments the adder becomes a growing share of per-endpoint cost.
4. If a rep offers five years, ask what the fifth year buys, given that the Texas prepaid discount was the same at three years and at five.
5. If you are being moved onto Flex, get credit-rollover and expiry terms in writing before giving up a fixed per-module rate.

Get whatever you negotiate on each of these written into the order form, where it can bind the renewal as well as the first year.

Frequently Asked Questions About CrowdStrike MDR Pricing

What Happens to My Band Rate When We Add Endpoints Mid-Term?

The public terms don't say whether crossing a volume threshold mid-term re-rates your whole population down a band or only adds seats at the current price. Ask before signing and get the answer in writing, since the difference compounds at renewal.

How Can I Estimate Falcon Complete Cost Before I Get a Quote?

Start from the band your endpoint count falls in on the expired Texas schedule, and treat that 2021 MSRP as a reference point, not a current price. Add the retention adder you need. Then add identity licensing for your active-account count and support at the percentage your employee count implies, and compare the total against the quote line by line.

I'm on Falcon Enterprise at $184.99. What Changes When I Move to Falcon Complete?

The per-endpoint line becomes a quoted MDR rate. Ask the rep for a written, module-level comparison against Enterprise that shows which capabilities are net-new. Then confirm warranty eligibility under the new subscription and check whether premium support is recalculated on the larger total.

Does Falcon Complete Pricing Include Incident Response?

CrowdStrike doesn't say how many incident-response hours, if any, come bundled with a Falcon Complete subscription. Because Flex for Services sits outside the platform subscription, ask whether a major incident would be handled inside Falcon Complete, drawn from a Flex service-hour pool, or billed as a separate engagement.

Is Converting to Falcon Flex a Discount or a Spend Increase?

Neither by default: Flex changes how spend is committed and guarantees no discount. Price the modules you expect to deploy on a standard subscription, compare that with the Flex commitment, and count any credits likely to expire unused as spend.