Best cloud-native EDR for a mid-market company using AWS and Azure

I'm a senior security engineer for a 400-person SaaS company with the same multi-cloud setup, and we've been running CrowdStrike Falcon as our primary EDR for about three years across 500+ AWS EC2, Azure VMs, and container hosts.

* **Pricing and the SaaS Premium:** It's never cheap. For our mid-market size, expect a range of $30-50 per endpoint per year for their core EDR module. The real sticker shock is that to get full cloud-native context (like the CSPM features for spotting misconfigurations), you often need the Falcon Cloud Security add-on, which can add another 30-50% to the bill. The pricing is quoted annually per host, and the discount tiers are steep, so the commitment is real. The cost is the trade-off for a fully managed backend.
* **Agent Footprint and Performance:** The agent is genuinely lightweight. On our typical VMs, it uses 30-50MB of RAM and less than 1% CPU on average. The specific win for cloud workloads is the agent's "sensor" for Linux. It's a kernel module, but their cloud image library has pre-validated images for major AWS and Azure instances, which made golden image deployment straightforward. We saw no noticeable performance hit on data-intensive workloads, which was a concern for us.
* **Onboarding for Cloud and Containers:** The onboarding for cloud servers is frictionless if you use infrastructure-as-code. We deployed the agent via Terraform user-data scripts and Azure extensions. For containers, they offer a DaemonSet deployment, but it requires a specific orchestration (like their own Falcon Container) for runtime protection. The initial cloud workload discovery is excellent; it mapped our entire environment in hours. However, tuning the prevention policies for your specific cloud apps is where you'll spend 2-3 weeks to avoid false positives.
* **Limitation for a DIY Shop:** Your biggest cultural shift will be accepting a black box. You can't self-host the console or the threat graph. You get amazing telemetry and hunting APIs, but you cannot alter the backend detection logic. If your team is used to tweaking Prometheus rules, you'll feel constrained. The API is powerful for pulling data into your own Grafana dashboards, but you cannot build your own "detection" on their raw stream without their premium Falcon X (threat intelligence) module.

I'd recommend Falcon if your leadership values outsourced 24/7 managed threat hunting and your team lacks the deep expertise to tune and maintain a self-hosted EDR's detection engine. If your team's preference for open-source is a hard requirement, tell us your team's size for dedicated security engineering and your tolerance for managing backend infrastructure, as that's the real decision point.

Your skepticism about piecing together a solution is well-founded. Given your existing self-hosted Prometheus stack, you're familiar with the operational overhead of maintaining detection logic, signature updates, and correlation rules at scale. Building a comparable detection capability in-house isn't just about deploying OSSEC or Wazuh; it's the constant engineering time required to tune it, backfill the threat intelligence, and maintain 24/7 analysis coverage. That's the hidden premium you're weighing.

On the agent weight, the more relevant metric for cloud workloads is its impact on provisioning and scaling. In immutable infrastructure patterns, where you bake the agent into an AMI or Azure VM image, its runtime CPU/memory consumption is often secondary to how it behaves during auto-scaling events. Does it block instance readiness while it phones home? I've seen this cause subtle latency spikes in scaling groups when the local sensor's initial check-in coincides with application boot.

The pricing is indeed opaque until you engage their sales engineering. They calculate based on "sensor" units, which for containers can become especially convoluted. For 300 endpoints, you're unlikely to get significant volume discounts, and the mandatory annual commitment locks you in. Request a detailed, line-item quote that separates EDR from any cloud security modules; otherwise the true annual cost will be obscured.

Your cost skepticism is the correct lens for this. With 300 endpoints, you're entering a price band where the annual commit becomes significant.

The true cloud-native cost isn't just the agent license. It's the integration tax. If your cloud workloads are ephemeral, the standard per-host annual pricing model forces you to pay for coverage on instances that may only exist for hours. You'll need to negotiate a "Dynamic Host" or container-based pricing tier to avoid massive waste, and that's where the opacity is highest.

Running your own stack has a different cost profile: engineering hours instead of license fees. If your team's time is already allocated to security engineering, the open-source route can be more efficient. But if you'd need to hire or redirect significant effort from revenue-generating projects, the SaaS premium might actually show up as a net saving on your P&L.

Having built and later abandoned a Wazuh/Elastic stack for a cloud environment, I feel that cultural friction deeply. The "piecing together" path is seductive until you're the one responsible for stitching cloud workload identity (like IAM roles, instance tags) into your alerting logic at 2 a.m.

The biggest shift isn't even SaaS, it's handing over the entire pipeline from sensor to detection engineering. If you're used to tweaking Prometheus rules, you'll find Falcon's query language decent, but you're now a consumer of their threat intel and detections, not the author.

Their API is robust enough to feed your existing dashboards, so you can maintain some of that self-hosted ethos, but it's an appendage to their system, not the core. The premium you're paying is for the privilege of *not* caring about backend scalability or signature updates when a new Azure kernel vulnerability drops. Whether that's worth it depends entirely on your team's appetite for becoming a 24/7 security operations center on top of your other duties.