Secureworks is the XDR and managed detection and response (MDR) vendor spun off from Dell Technologies and acquired by Sophos in February 2025. The combined entity operates the Taegis platform (Taegis XDR, Taegis ManagedXDR, Taegis VDR, Taegis NDR) alongside Sophos Central, positioning as a unified cybersecurity platform spanning self-managed XDR, fully managed MDR, vulnerability detection, and network detection. For enterprises, the Sophos acquisition created both opportunity (deeper commercial flexibility as the combined commercial team integrates Taegis into the broader Sophos portfolio) and risk (product SKU rationalization between Taegis and overlapping Sophos Central products). The XDR/MDR category in 2026 is dominated by CrowdStrike Falcon Complete, SentinelOne Vigilance, Palo Alto Networks Unit 42 MDR, Arctic Wolf, Expel, and the Secureworks-Sophos combined entity. For category context, see the Cybersecurity category benchmark.
Secureworks Pricing Model Explained
Secureworks prices the Taegis platform primarily on a per-endpoint or per-asset annual subscription model across four primary product lines. Taegis XDR (the self-managed detection and response platform) is priced per endpoint at $38-$78 per endpoint per year at enterprise volume, with tiered pricing stepping down at 1,000, 5,000, 10,000, and 25,000+ endpoint thresholds. Taegis ManagedXDR (the fully managed MDR service with 24/7 Secureworks counter threat unit SOC) carries a 2.0-2.8x multiple on Taegis XDR base pricing, typically $85-$195 per endpoint per year reflecting the bundled managed service. Taegis VDR (vulnerability detection and response) and Taegis NDR (network detection and response) are priced as incremental add-ons either per endpoint (VDR) or per sensor/network segment (NDR).
Post-acquisition commercial motion in 2026 has emphasized bundling Taegis platform with Sophos Central endpoint protection, firewall, and email security products into integrated cybersecurity platform deals. Customers evaluating Taegis in isolation frequently encounter commercial pressure to expand scope to Sophos Central bundles, with meaningful platform bundle discounts offered (typically 12-22%) for customers consolidating multiple security products onto the combined portfolio. Procurement teams should evaluate both standalone Taegis economics and bundled platform economics, and should negotiate explicit exit clauses from bundled products that may not align with long-term security architecture.
Professional services and incident response retainer pricing are material non-obvious cost drivers. Taegis ManagedXDR includes a baseline SOC response capability, but enterprise incident response engagements (significant breach events requiring extended investigation, forensics, and remediation) routinely trigger incremental incident response engagement fees. Secureworks IR retainer hours typically bundle at $385-$525 per hour depending on tier; Taegis ManagedXDR customers frequently benefit from bundled IR hours within the subscription, but hour depletion terms must be carefully negotiated to avoid mid-incident commercial friction.
Endpoint and Asset Count Variance
Endpoint and asset scope is the dominant Secureworks pricing driver, and actual scope frequently expands 15-40% beyond initial deployment estimates as the security team expands coverage to additional infrastructure (cloud workloads, mobile devices, IoT assets, identity assets). Pre-deployment scope modeling based on current endpoint counts frequently under-estimates because endpoint definitions evolve (is a container an endpoint? a cloud VM? a mobile device?), because shadow IT discovery expands inventory, and because Taegis NDR network segment pricing adds incrementally as network visibility expands. Procurement teams should build endpoint scope estimates conservatively (20-30% buffer above initial deployment), negotiate annual scope adjustment rights both upward and downward, and prefer tiered commit structures with explicit true-up and true-down mechanics.
What Enterprises Actually Pay for Secureworks
These 2026 figures reflect negotiated annual Secureworks spend across 48+ benchmarked enterprise deployments. "Typical" reflects median deal economics with modest competitive pressure; "Strong Leverage" assumes written CrowdStrike Falcon Complete, SentinelOne Vigilance, Palo Alto Unit 42 MDR, Arctic Wolf, and Expel competitive bids with Q4 timing.
| Deployment Profile | Primary Product | Typical Annual Spend (Negotiated) | With Strong Leverage |
|---|---|---|---|
| Mid Taegis XDR (1,500 endpoints) | Taegis XDR self-managed | $95K–$165K | $70K–$125K |
| Large Taegis XDR (7,500 endpoints) | Taegis XDR self-managed | $325K–$545K | $245K–$415K |
| Mid Taegis ManagedXDR (2,500 endpoints) | Taegis ManagedXDR MDR | $285K–$485K | $215K–$375K |
| Large Taegis ManagedXDR (10,000 endpoints) | Taegis ManagedXDR MDR | $885K–$1.6M | $675K–$1.25M |
| Enterprise Taegis ManagedXDR (25,000+ endpoints) | Taegis ManagedXDR MDR | $1.8M–$3.2M | $1.4M–$2.5M |
| Taegis VDR add-on | Vulnerability detection | $12–$28 per endpoint | $9–$22 per endpoint |
| Taegis NDR add-on | Network detection (per sensor) | $28K–$85K per segment | $22K–$65K per segment |
| IR retainer hours (incremental) | Incident response engagement | $385–$525 per hour | Bundled within ManagedXDR |
Median Fortune 1000 Secureworks Taegis ManagedXDR subscription is approximately $485,000 annually on 5,000-endpoint scope. The primary drivers of variance are endpoint/asset scope, deployment model (self-managed Taegis XDR versus fully managed Taegis ManagedXDR), and add-on product breadth (VDR and NDR incremental subscriptions). For comparative context within the XDR and MDR ecosystem, see our CrowdStrike Falcon pricing guide and Palo Alto Networks pricing guide.
Submit your Secureworks contract for a free benchmark
Upload your Taegis XDR, Taegis ManagedXDR, or Taegis VDR/NDR proposal and get a 24-hour benchmark. See exactly where you stand on per-endpoint economics, MDR multiple, and post-Sophos bundle pricing versus 48+ comparable enterprise deployments.
Submit Your Contract →Secureworks Discount Benchmarks — What Is Achievable?
Secureworks discount depth in 2026 is meaningfully richer than pre-Sophos-acquisition baseline, driven by post-acquisition commercial flexibility as the combined Secureworks-Sophos entity integrates Taegis into the broader Sophos portfolio and positions for strategic customer retention. Competitive pressure against CrowdStrike Falcon Complete, SentinelOne Vigilance, and pure-play MDR alternatives (Arctic Wolf, Expel) has pushed Secureworks to be more aggressive on strategic deals, particularly where customers are evaluating consolidation from multi-vendor cybersecurity stacks into unified platform deals.
| Discount Mechanism | Typical Depth | With Strong Leverage | Notes |
|---|---|---|---|
| Taegis small (under $150K) | 18–25% | 25–32% | Limited leverage, focus on terms |
| Taegis mid ($150K–$500K) | 24–34% | 34–40% | CrowdStrike/SentinelOne RFP unlocks depth |
| Taegis strategic ($500K+) | 30–40% | 40–45% | Post-Sophos aggression on strategic deals |
| Sophos Central platform bundle | 12–22% | 22–32% | Cross-product platform bundle discount |
| 3-year commitment uplift | 8–14% | 14–20% | Over 1-year equivalent |
| Q4 fiscal year-end timing | 4–8 points | 8–14 points | Jan-Mar aligned with Sophos FY close |
| IR retainer hour caps | Bundled hours within MDR | Pooled enterprise IR hours | Critical for post-breach economics |
| VDR/NDR add-on bundle | 15–25% | 25–35% | Multi-product Taegis bundle discount |
The credible competitive alternatives Secureworks commercial teams model against: CrowdStrike Falcon Complete (dominant MDR offering, typically 12-22% more expensive at equivalent scope but with deepest market mindshare and platform ecosystem), SentinelOne Vigilance Respond (strong autonomous AI-driven MDR, 8-18% above Taegis ManagedXDR on equivalent scope), Palo Alto Networks Unit 42 MDR (premium IR-forward MDR, typically priced at 15-28% premium), Arctic Wolf (pure-play MDR, frequently lowest-TCO at mid-market scale), and Expel (cloud-native MDR with strong AWS and Microsoft integration). Splunk security MDR and Microsoft Defender XDR with Microsoft-managed detection are adjacent alternatives for Microsoft-centric or Splunk-centric security stacks.
Secureworks Pricing by Product Family
Taegis XDR (Self-Managed Detection and Response)
Self-managed XDR platform delivering detection, investigation, and response capabilities for customer-operated SOCs. Priced per endpoint at $38-$78 per endpoint per year at enterprise volume. Competes directly against CrowdStrike Falcon Insight XDR, SentinelOne Singularity XDR, Microsoft Defender XDR, and Palo Alto Cortex XDR. Taegis XDR is typically 18-32% below CrowdStrike Falcon Insight XDR on equivalent endpoint scope, reflecting CrowdStrike's dominant market position. Typical deal: 5,000-endpoint scope at $225K-$390K annually. Negotiate endpoint count adjustment rights, overage pricing caps (3-5% above committed count), and explicit data retention and data portability commitments.
Taegis ManagedXDR (Fully Managed MDR)
Fully managed detection and response service with 24/7 Secureworks counter threat unit SOC, bundled response capabilities, and incident response retainer. Priced at a 2.0-2.8x multiple on Taegis XDR base pricing, typically $85-$195 per endpoint per year. Competes against CrowdStrike Falcon Complete, SentinelOne Vigilance Respond, Arctic Wolf Managed Detection and Response, Expel Managed Detection and Response, and Palo Alto Unit 42 MDR. Typical deal: 5,000-endpoint scope at $485K-$785K annually. Negotiate explicit SOC response SLAs, bundled IR retainer hours with rollover provisions, incident escalation terms, and annual service quality reviews.
Taegis VDR (Vulnerability Detection and Response)
Vulnerability detection and prioritization platform integrated with Taegis XDR/ManagedXDR. Priced per endpoint at $12-$28 per endpoint per year. Competes against Tenable, Qualys, Rapid7 InsightVM, and Microsoft Defender Vulnerability Management. Typically bundled as add-on to Taegis XDR or Taegis ManagedXDR at 15-25% bundle discount when purchased together. Negotiate scope definition for what constitutes a VDR-managed endpoint, integration with existing vulnerability management workflow, and data export rights for compliance and audit reporting.
Taegis NDR (Network Detection and Response)
Network detection and response capability with network sensors deployed across key network segments. Priced per sensor and per network segment at $28K-$85K per segment annually depending on throughput and traffic volume. Competes against Darktrace, ExtraHop, Vectra AI, Arista NDR (formerly Awake Security), and Corelight. Typically integrates with Taegis XDR and Taegis ManagedXDR as extension into network telemetry. Negotiate sensor hardware depreciation terms if on-premises, network segment count adjustment rights, and explicit data export rights.
Incident Response Retainer
Bundled or standalone incident response retainer hours for breach investigation, forensics, containment, and remediation. Taegis ManagedXDR includes bundled IR hours; standalone Taegis XDR customers purchase IR retainer incrementally. Hourly rates $385-$525 per hour depending on tier; enterprise deals bundle 100-500 IR hours per year with rollover provisions. Competes against CrowdStrike Services, Palo Alto Networks Unit 42 IR, Mandiant (Google Cloud), and Kroll. Negotiate hour depletion terms, post-incident retainer replenishment, and explicit breach response SLAs.
Benchmark Secureworks against CrowdStrike, SentinelOne, and Arctic Wolf
See how your Secureworks Taegis ManagedXDR economics compare against CrowdStrike Falcon Complete, SentinelOne Vigilance, Arctic Wolf, and Expel at equivalent endpoint scope. 24-hour benchmark across 48+ comparable enterprise deployments.
Contact Us →Common Secureworks Contract Traps to Watch For
Endpoint and Asset Count Overage
Taegis subscriptions above committed endpoint/asset count bill at 18-28% premium to committed count. High-growth enterprises face mid-term overage surprise invoices if endpoint scope expands during term due to M&A activity, cloud workload expansion, or shadow IT discovery. Negotiate monthly-average versus daily-peak measurement, overage pricing caps (3-5% above committed count rate), annual scope adjustment rights both upward and downward, and explicit definitions for what constitutes an endpoint versus asset.
Taegis VDR and NDR Add-On Pricing Creep
Taegis VDR and Taegis NDR add-on pricing often increases faster than base Taegis XDR/ManagedXDR economics, particularly as enterprises expand vulnerability management or network coverage scope. VDR add-on pricing can creep to 35-55% of base Taegis XDR pricing on larger deployments if not negotiated explicitly. Negotiate bundled pricing for Taegis XDR/ManagedXDR + VDR + NDR as integrated platform at meaningful bundle discount (25-35%), rather than point-pricing each add-on separately at renewal.
Professional Services and IR Retainer Hour Depletion
Incident response retainer hours within Taegis ManagedXDR bundle typically deplete during significant breach events. If hours deplete mid-incident, customers face commercial friction at the worst possible moment (breach response). Negotiate pooled IR hours with rollover provisions, explicit breach response SLAs, post-incident hour replenishment at bundled rate rather than incremental rate, and multi-year IR retainer commitments at locked rates.
Post-Sophos Acquisition Product SKU Rationalization
Post-acquisition Secureworks-Sophos product line overlaps (Taegis XDR vs Sophos Intercept X XDR, Taegis NDR vs Sophos firewall telemetry, Taegis VDR vs Sophos Vulnerability Management) create confusing product SKU transitions at renewal. Some Taegis or Sophos Central products may be merged, end-of-lifed, or repositioned. Negotiate explicit post-acquisition product continuity commitments: written confirmation that your subscribed Taegis product will be supported through renewal term, that feature parity or superior will be delivered on any migration paths, and that migration from end-of-lifed products is included at no incremental cost.
Secureworks Renewal Pricing: What Changes and What Does Not
Secureworks renewal behavior in 2026 is shaped by the post-Sophos acquisition commercial integration and the strategic priority of retaining Taegis customers within the combined portfolio. Renewal economics are meaningfully more favorable than pre-acquisition baseline for customers who activate competitive leverage.
What changes at renewal: Taegis per-endpoint rates typically escalate 5-9% annually absent negotiation. Endpoint tier thresholds shift as Secureworks repositions pricing. Sophos Central product bundles may be introduced or modified at renewal, potentially reshaping the overall commercial structure. Post-acquisition, product SKUs may transition at renewal, requiring scope re-validation against current Taegis product line.
What does not change without leverage: Discount depth does not improve at renewal absent competitive pressure. Multi-year term benefits carry forward only if renegotiated. VDR/NDR add-on bundle discounts remain unchanged unless previously negotiated. IR retainer hour bundles carry forward at then-current list rates rather than locked rates.
What changes with leverage: Written CrowdStrike Falcon Complete, SentinelOne Vigilance, Palo Alto Unit 42 MDR, Arctic Wolf, and Expel competitive bids at renewal initiation routinely unlock 10-20% incremental renewal depth, particularly as Secureworks-Sophos commercial team prioritizes strategic customer retention. Platform consolidation strategy (multiple Taegis products + Sophos Central products combined into unified deal) unlocks material bundle discount (22-32% combined). Multi-year renewal commit (3-year vs 1-year) unlocks 8-14% better per-year economics. Q4 timing alignment with Sophos fiscal year end (March) produces 4-10 points additional depth.
Frequently Asked Questions
How much does Secureworks cost for enterprise deployments?
Secureworks enterprise annual subscriptions typically range $95,000-$2.8M+ depending on product mix and endpoint/asset scope. Taegis XDR is priced per endpoint at $38-$78 per endpoint per year at enterprise volume. Taegis ManagedXDR carries a 2.0-2.8x multiple, typically $85-$195 per endpoint per year. Median Fortune 1000 Secureworks Taegis ManagedXDR subscription is approximately $485,000 annually on 5,000-endpoint scope.
What discount is achievable on Secureworks?
Secureworks discounts range 20-45% off list depending on deal size, competitive pressure, and product mix. Typical enterprise discount on multi-year Taegis ManagedXDR deals is 26-36%, with 36-45% achievable on strategic deals above $500K with written CrowdStrike Falcon Complete, SentinelOne Vigilance, Palo Alto Unit 42 MDR, Arctic Wolf, and Expel competitive bids. Q4 timing aligned with Sophos fiscal year end (March) unlocks an additional 4-8 points of depth.
How does Secureworks Taegis pricing compare to CrowdStrike and SentinelOne?
Secureworks Taegis XDR typically prices 18-32% below CrowdStrike Falcon Insight XDR on equivalent endpoint scope at the self-managed tier, reflecting CrowdStrike's dominant market position. Secureworks Taegis ManagedXDR typically prices 12-22% below CrowdStrike Falcon Complete on equivalent scope, and 8-18% below SentinelOne Vigilance Respond. For mid-market enterprises (1,000-5,000 endpoints), Secureworks Taegis ManagedXDR frequently wins on MDR TCO versus premium managed services from CrowdStrike and SentinelOne.
What are common Secureworks contract traps?
Key traps: (1) endpoint/asset count overage at 18-28% premium, (2) Taegis VDR and NDR add-on pricing creeping above base Taegis XDR economics on expansion, (3) IR retainer hour depletion during breach events creating mid-incident commercial friction, (4) post-Sophos acquisition product SKU rationalization creating potential transition costs for overlapping Taegis and Sophos Central products.
How has the Sophos acquisition changed Secureworks pricing?
The Sophos acquisition of Secureworks (closed February 2025) has created commercial flexibility as the combined entity integrates Taegis into the broader Sophos portfolio. Enterprises now see platform bundle offers combining Taegis XDR/ManagedXDR with Sophos Central endpoint protection, firewall, and email security at 12-22% bundle discount. Post-acquisition commercial team has been more aggressive on strategic Taegis retention deals versus pre-acquisition baseline. Product SKU rationalization is ongoing, creating both opportunity (migration pricing for customers consolidating to Taegis from Sophos Central overlapping products) and risk (potential end-of-life paths for redundant products requiring scope re-validation at renewal).
Next Steps
Secureworks deals reward post-Sophos-acquisition commercial flexibility, written competitive bids from CrowdStrike Falcon Complete, SentinelOne Vigilance, Palo Alto Unit 42 MDR, Arctic Wolf, and Expel, and strategic platform consolidation combining Taegis XDR/ManagedXDR with adjacent Sophos Central products into unified deals. The worst-priced Secureworks contracts we benchmark share a pattern: endpoint scope commits without growth buffer, VDR/NDR add-on point-pricing rather than integrated bundle pricing, IR retainer hour bundles without rollover provisions, no competitive RFP pressure at renewal, and mid-quarter execution. The best-priced deals do the opposite.
If you are evaluating Secureworks for new purchase, planning a multi-product Taegis platform consolidation, or facing a Secureworks renewal within 6-12 months, upload your current proposal or renewal quote for a 24-hour benchmark analysis against 48+ comparable enterprise deployments. For comparative context, see our CrowdStrike Falcon pricing guide, Palo Alto Networks pricing guide, Microsoft Sentinel pricing guide, and the Cybersecurity category benchmark.