Everyone's rushing to get an EDR, and the first question is about haggling for a better price. That's putting the cart so far before the horse it's in another county. The real question you should be asking isn't about volume discounts, it's about what you're actually locking yourself into and what the final bill will look like after the "introductory" period evaporates.
Let's unpack that. You're focused on the per-endpoint license cost, probably because that's the big, shiny number the sales rep puts in the quote. That's a tiny fraction of the total cost of ownership. Have you calculated the hours your team will spend learning their proprietary query language? The cost of the dedicated server or cloud instance they'll insist you need for their management console? The professional services engagement they'll strongly recommend for "proper deployment," which is just their way of charging you to read their own manual? The price break on licenses means nothing if the operational overhead bleeds you dry.
And let's talk about that endpoint count. They love it when you ask this. It gives them a perfect number to anchor their "discount" to, while they quietly bake in mandatory add-ons for things like cloud workload coverage, their branded threat intelligence feed, or mobile device modules that you didn't even know were separate products. You think you're buying a comprehensive solution, but you're really buying a ticket to their ecosystem. Try to rip out their EDR in three years when you want to switch. The migration path is a one-way street into their data lake, and the export tools are either nonexistent or designed to output unusable, proprietary logs.
Before you utter the word "endpoints" to a vendor, you need an internal answer to several harder questions. What is your team's actual capacity to manage alerts, not the vendor's fantasy version of it? Have you audited your own estate to see what's really out there—every forgotten IoT device, every contractor's laptop, every legacy system that can't even run a modern agent? What are the contractual terms for price increases at renewal? What is the true, tested process for completely removing their agent, and what remnants does it leave behind in the registry or filesystem?
My advice? Stop looking at the sticker price. Calculate the cost of being wrong. Pilot an open-source agent framework alongside the flashy commercial product. Read the contract's termination and data retrieval clauses as if your job depends on it, because it might. The decent price break is a lure; the hook is a multi-year commitment to their way of doing everything.
Just my two cents
Skeptic by default
You're absolutely right about the TCO trap. That initial quote is just the entry fee.
In my experience, the real lock-in often isn't the license term, it's the data gravity and workflow integration. Once your team builds dozens of automations and custom detections around their specific data model, migrating becomes a multi-year project, not just a contract swap.
A practical tip: before you even talk price, get a clear, written spec on their API's capabilities and rate limits for pulling your own alert data. If they hedge, that's your first red flag on future flexibility and hidden costs.
Spot on about the API spec, but I'd push for more than just a document.
Demand a sandbox or trial tenant with API access included. A spec tells you what's possible, but actually hitting that API under a load will show you the real limits: timeouts, weird pagination, or nested data that makes simple log pulls a nightmare.
I've seen vendors with beautiful API docs where the alert export endpoint is practically useless for building a custom dashboard. If they won't give you temporary keys to test the data extraction yourself, assume it's because the process is fragile or resource-intensive for them. That's a cost coming your way later.
Show me the query.