Rapid7 MDR Pricing: Tiers, AWS Prices and Contract Terms

Rapid7 sells MDR as Managed Threat Complete (MTC), a managed detection and response service bundled with SIEM and vulnerability-management tooling and 24/7 SOC monitoring across endpoints, servers and networks. Rapid7 MDR pricing is harder to find. The MTC pricing page shows three tiers and no prices, and every option ends in "Request demo."

The numbers are on AWS Marketplace, where Rapid7 lists Managed Threat Complete and its Incident Command SIEM with 12-month prices, one click apart. Subtract one from the other, back out the bundled vulnerability-management tooling, and what remains is the price of the managed layer. Add Rapid7's service scope documents, contract terms and warranty terms, and you can model a quote before the first sales call.

TL;DR:

• Rapid7's managed layer has a derivable public price: the full MTC bundle and the standalone SIEM both carry AWS Marketplace list prices, and the difference, less the bundled InsightVM, is roughly what the 24/7 service costs.
• "Unlimited" incident response is unlimited in count, but bounded in scope. It stops at the in-scope environment, and the SOC does not cover several categories of findings.
• The headline breach warranty is a top band, not the default. It applies only to Ultimate, pays far less at mid-market endpoint counts and nothing below the lowest band, and lapses whenever the deployment falls short of Rapid7's health conditions.

Asset scope, service exclusions and contract language therefore matter as much as the headline rate.

What Rapid7 Publishes on Its Pricing Pages

The MDR pricing page gives a basis but no rate. Rapid7 prices MDR by "the number of endpoints, servers, and networks we protect," and says it does not charge by SIEM data volume or incident count. Every tier includes 13 months of data retention and "Unlimited VRM tooling, InsightVM."

The general Rapid7 pricing page has per-unit prices only for standalone products, including InsightVM starting at $1.62 per asset per month for 500 assets. MTC isn't listed there. The billing unit matters because it decides which parts of an environment become separate costs, a pattern that runs across MDR pricing models.

Rapid7's pricing FAQ fills in more of the model. Each package is "custom quoted for your specific environment size," contracts are annual, prices vary by country, and the per-asset price drops as your asset count rises, though Rapid7 doesn't publish where the volume bands fall.

The Three Tiers, and the Two Legacy Packages Still in Service

The current Managed Threat Complete lineup runs Essential, Advanced and Ultimate, and each tier adds coverage and hands-on service to the one below it.

Two older packages, MDR Essentials and MDR Elite, are no longer sold on the pricing page, but existing customers keep their service. MDR Elite carries the same entitlements as MTC Advanced, and MDR Essentials the same as MTC Essential. If you're renewing on one of them, ask whether the renewal moves you to the current lineup and at what price.

If you're looking for Rapid7's MXDR package, MTC is it. A separate MDR for Microsoft service works with Microsoft Defender, but Rapid7 hasn't published tiers or prices for it, or which Microsoft licenses it requires.

What the AWS Listings Reveal About the Managed-Layer Premium

Rapid7's MTC AWS listing provides public list prices for 12-month contracts, summarized in the table below.

‍

Advanced at 500 assets is cheaper per asset than Essential at 300, despite being the higher tier, which is the volume discount showing up in the list prices. Essential at $73,000 works out to $20.28 per asset per month, the figure to hold against any monthly per-asset quote.

The Incident Command listing prices the standalone SIEM layer with a 251-asset minimum: Essentials $70.40 per asset per year, Advanced $96.80, Ultimate $123.20. At 500 assets, Incident Command Ultimate is a derived $61,600 against $175,000 for MTC Ultimate, a gap of about $113,400. At 300 assets on the entry tier, MTC Essential costs about 3.5 times the derived $21,120 for Incident Command Essentials.

The gap includes InsightVM because MTC bundles it. Back out InsightVM at list, $19.44 per asset per year or $9,720 for 500 assets, and roughly $103,680 a year on Ultimate remains attributable to the managed service itself.

How an Asset Is Counted, and Why That Defines Your Quote

Rapid7 defines assets as "hosts running a workstation or server operating system to which data has been attributed in the last 30 days," physical and virtual alike, and price "does not change based on asset type." Only hosts count, where Arctic Wolf's pricing counts users and servers. One company can produce different unit counts with each vendor.

Virtual machines count exactly like physical ones, which makes VM sprawl a line item. The 30-day window means a decommissioned host can stay billable for up to a month, while a host silent for longer drops out. And network appliances, containers, cloud services and identities are not hosts running a workstation or server OS. Their coverage is a scoping question with no published per-unit charge, so ask directly whether identity coverage costs extra.

What "Unlimited" Incident Response Covers

Every tier promises "unlimited incident and breach response." Rapid7's Ultimate service scope sets the limits: Rapid7 responds only to compromises of in-scope systems or data, "will not respond to an incident that occurs in an environment that is not in-scope," and delivers all incident response remotely.

What reaches incident response is also bounded by what the SOC detects. Vulnerability, containerized-workload and posture-management detections fall outside the SOC's scope for third-party event sources. Alerts that need customer input, such as OT/IoT, DLP and insider-threat alerts, go into a "Custom and Contextual" category that the customer triages, notifying Rapid7 when one looks malicious. Container and cloud-posture findings can therefore sit outside the managed service even when the telemetry exists elsewhere in the stack.

The engagement also depends on the customer. Rapid7 can pause or end an incident response engagement if the customer is unavailable to work with it, or makes no reasonable effort to carry out time-critical steps such as isolating an asset or disabling a user account. Rapid7's MDR terms also require Insight Agent deployment on at least 80% of licensed assets before the service starts.

What Inflates Year One

There's no onboarding fee, and deployment help is included, but it covers installing Rapid7 products only, not "provisioning physical or virtual resources/servers." Collectors, and typically internal scan engines and the orchestrator, run on servers the customer provisions. Network detection depends on the customer too: without DNS, firewall, VPN and web proxy logs connected, Rapid7 does not support its network-based-indicator detection rules.

Third-party security tool monitoring is a paid add-on at Essential. Advanced covers two third-party products and Ultimate covers four, with more available at an unpublished price. For a heterogeneous stack, that count can decide the tier.

To keep data longer than 13 months, Rapid7 recommends archiving it daily to an Amazon S3 bucket in your own AWS account, so storage lands on your AWS bill, and archived data can't be pulled back into the SIEM. Cloud security is also separate: InsightCloudSec starts at $5,775 a month for up to 500 instances, about $69,300 a year and close to the entire Essential MTC price. Hosted Velociraptor and ransomware prevention are included only at Ultimate and sold as add-ons below it. NGAV, Managed Digital Risk Protection, attack surface management and continuous red teaming are add-ons with no published price.

SOC monitoring runs 24x7x365 at every tier, but the Managed Digital Risk Protection analyst monitors the alert queue from 9 a.m. to 5 p.m. CET, Monday to Friday, and customer support runs regionally from 8 a.m. to 6 p.m. Any year-one comparison against other providers' SOC-as-a-service pricing has to add those servers, the storage and the cloud security line back in.

Contract Terms That Move the Total

Rapid7's standard contract terms let it reprice at renewal. Under Section 8.1, the term renews automatically for the same length at the rate on the ordering document, unless either side sends written notice at least 30 days before it ends.

The same section lets Rapid7 change rates, charges and usage policies, or add new charges, for the next term, provided it gives written notice, "which may be provided by e-mail," at least 60 days before the term ends.

A new price can therefore arrive by email 60 days out, the window to walk away closes 30 days out, and the published terms cap nothing. The software schedule bills excess usage "at Rapid7's then current list rates" for the rest of the term, and lets Rapid7 ask for a signed usage certification up to once every six months.

Rapid7 publishes no multi-year or prepayment discount for MTC. Data volume is the other open question: MTC promises "Unlimited data ingestion" at every tier, but the standalone SIEM's packages page describes a "Fair Use Monthly Data Policy that scales with asset tiers." Ask whether that policy applies to MTC, and get the answer into the contract.

How the Breach Warranty Pays by Endpoint Band

Rapid7's breach protection warranty is tied to MTC Ultimate or an underwriter-approved equivalent, requires separate enrollment and pays by endpoint band, as the table below shows.

‍

An Ultimate customer below 500 endpoints has no warranty. The seven-figure limit requires more than 10,000 covered endpoints; a 3,000-endpoint company gets the $100,000 band.

Appendix A requires at least 80% healthy agent deployment across in-scope assets, at least 80% of core event sources in a healthy state, and 100% healthy collector coverage, among other conditions. Rapid7 alone decides what counts as healthy, and any shortfall suspends eligibility "regardless of whether Rapid7 notifies Customer of the deficiency."

Claims run on a tight clock: you must notify Rapid7 within 72 hours of the Discovery Date and declare intent to claim within 30 days. Covered costs are forensic investigation, legal consultation, breach notification and identity-protection services for affected individuals, and public relations, each requiring prior written approval and a Rapid7-approved vendor. Legal consultation excludes litigation defense, and ransom and extortion payments are excluded, so treat the warranty as conditional reimbursement rather than liability transfer.

How to Turn the Public Numbers Into a Quote

Rapid7's public documents cover most of what a sales call would. These items only the order form can settle:

• The tier you're buying, and whether an older MDR Essentials or MDR Elite package is being renewed or migrated
• The asset count, measured against the 30-day attribution window, and the volume band it falls in
• The number of third-party products monitored, and the price of any beyond the tier's allowance
• Whether the Fair Use Monthly Data Policy applies to MTC
• A cap on renewal uplift, and enough time between any price notice and the 30-day non-renewal deadline to act on it
• Add-on prices, including Ultimate-only features bought at a lower tier
• For Ultimate buyers, how covered endpoints are counted for the warranty band

Each of those items can move the total, and the discipline carries over to any MDR provider on the shortlist.

How Daylight Prices Against This

Like Rapid7, Daylight quotes each environment individually and publishes no rate card, and a quote starts from a scoping call. A buyer who needs a public price to build a shortlist will not find one here either. Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. Its AI-native MDR service is the entry point, with threat hunting and the Agentic Security Data Lake running on the same architecture. Rapid7 now markets its MDR on "Transparent Agentic AI" after acquiring Kenzo Security in March 2026, so agentic investigation is on both sides of the comparison.

The AWS arithmetic above puts more than half of the MTC Ultimate list price on the managed service. The useful comparison is therefore how much investigation work that fee removes from the internal team. Daylight investigations start either from security alerts raised by the customer's existing tools or from Daylight's own proprietary detection rules running on streaming log data. Investigations run to a verdict using business context about the customer, which is why Daylight customers see roughly 10 to 15 escalations a month, compared to 150 to 200 with traditional MDR providers. Neither quote shows the internal hours those escalations cost the team.

Daylight's integrations are bi-directional and typically close resolved alerts in the tool that raised them, and its Glass Box model is built to show the evidence and reasoning behind each verdict, which lets the customer audit the work being paid for. Daylight also does not bundle vulnerability management, so a like-for-like comparison should back InsightVM out of the MTC price first.

The fit is narrower than a price comparison suggests. Value depends on cloud context, and organizations running mostly on-premises infrastructure may see less benefit. Full value takes months, because security experts build context during an intensive three-to-five-month onboarding and keep refining it as the business changes. Buyers choosing on the lowest headline number, and mature in-house SOCs looking for a co-managed model, are usually better served elsewhere.

Frequently Asked Questions About Rapid7 MDR Pricing

How Much Does Rapid7 MDR Cost?

At AWS Marketplace list, Rapid7 MDR costs $73,000 a year for Essential at 300 assets, $111,000 for Advanced at 500 assets and $175,000 for Ultimate at 500 assets, or roughly $222 to $350 per asset per year at those minimums. Custom quotes move with asset count, volume band and region, and Rapid7 publishes no multi-year discount.

Is the £24 per Device per Month Figure Usable for a US Budget?

Only as a rough, dated benchmark. ITHQ, a reseller on the UK government's G-Cloud marketplace, lists Rapid7 MTC at £24 per device per month, based on 2024 pricing with a 300-asset minimum and a two-year commitment. Another UK reseller, Longwall, lists MTC Advanced at £100 to £300 per device per year. Neither reflects a US quote, and Rapid7 publishes no US public-sector price list.

Does Managed Threat Complete Run on InsightIDR or Incident Command?

Both, because they are the same SIEM layer. Incident Command is Rapid7's newer name for the SIEM that MTC documents still call InsightIDR. For pricing, use the Incident Command per-asset rates as the SIEM comparable. The older InsightIDR AWS bundles, still listed at $21,479 to $46,149 for up to 500 assets, carry monthly data limits and price a different package.

What Does "Limited" Vulnerability Management Mean Below Ultimate?

Rapid7 does not define it. At Essential and Advanced, scan configuration and scheduling, and remediation prioritization and guidance, are marked "Limited." InsightVM scanning itself stays unlimited at every tier, so the limit falls on Rapid7's hands-on work rather than the tooling. Rapid7 doesn't say how much work "Limited" covers, so get it in writing before choosing a tier.

Has Rapid7 Been Acquired, and Does the 2026 Restructuring Change the Price?

No. Rapid7 is still an independent company that trades on Nasdaq as RPD. Its 2026 restructuring plan cut about 12% of its workforce, which SecurityWeek put at about 314 jobs, and Q2 2026 revenue came in at $210.9 million. Nothing Rapid7 has published links its prices to the restructuring.