EDR vs MDR at 2,000 endpoints: buying the tool or buying the team

The choice is a licence plus a rota, and only one half is priced

At 2,000 endpoints the question is not which detection engine is better. It is whether the security team can staff the hours the tool generates work for. CrowdStrike describes Falcon as a platform that combines security data, AI, automation and expertise to stop breaches, and sells MDR separately as elite 24/7 managed detection and response across the attack surface. Buying the platform gets the telemetry and the detection; buying MDR gets someone contracted to act on it at three in the morning.

That split is the whole decision. An EDR purchase is a per-endpoint licence for software the internal team operates. An MDR purchase is the same software plus an analyst contract, and the buyer pays twice: once per endpoint and once for the humans. The platform page does not publish either number, so a 2,000-endpoint estate has to get both quoted before the comparison means anything.

What the page does establish is the shape of the bill. Falcon is presented as a set of modules rather than a single SKU: endpoint protection and EDR, identity security, cloud protection, SaaS security, browser protection, data protection, and a SOC platform, each described as its own capability. A quote for 2,000 endpoints therefore depends on how many of those modules the estate actually needs, and the per-endpoint figure moves with the bundle.

What Falcon actually puts in front of the analyst

The platform page describes a single agent and console covering endpoint, identity, cloud, SaaS and browser, with telemetry collected once and reused across the modules. For a 2,000-endpoint estate that matters less as a feature list and more as an operating cost: every additional console an analyst has to watch is hours the rota has to cover, and consolidation is the argument CrowdStrike makes for buying the modules together rather than from separate vendors.

The managed tier is described as stopping breaches across the entire attack surface with 24/7 detection and response. The page does not state response times, analyst ratios, escalation paths or what the service does when it finds something at the weekend. Those are the terms to ask for in writing, because they are what the contract is actually buying and they are not on the page.

CrowdStrike also lists incident response, proactive services and threat hunting as separate offerings. A buyer comparing self-run against managed should check which of those are included in the MDR quote and which are priced again when something goes wrong, since the page presents them as distinct services rather than parts of one contract.

The internal rota is the cost nobody quotes

A self-run Falcon deployment at 2,000 endpoints needs coverage outside office hours. The platform page does not say how many analysts that takes, and no vendor publishes a rota cost, so the buyer has to build it: shifts per week, the number of people needed to cover them without a single point of failure, and the on-call premium. That figure is the real comparison against the MDR quote, and it is the one number in this decision that comes from the buyer's own payroll rather than a vendor.

The arithmetic is unforgiving at this size. Two thousand endpoints is large enough to generate a steady queue of alerts and small enough that a dedicated 24/7 team is hard to justify on headcount alone. Below a certain endpoint count the managed contract wins on cost; above it, the internal team amortises. The platform page gives no threshold, and CrowdStrike publishes no crossover point, so the buyer has to calculate it from the quote and the salary line.

Ask the vendor for the per-endpoint rate at 2,000 seats for the modules in scope, the MDR service fee at the same count, the contract term and any minimum, and what happens to pricing if the estate grows by a fifth mid-term. None of those appear on the platform page, and a quote that omits them is not comparable with the internal option.

Microsoft is the cost benchmark, not the answer

Microsoft Defender for Business is the page that puts a number-shaped hole in the comparison. It bundles AI-powered endpoint detection and response with automatic attack disruption, vulnerability management and cross-platform device coverage, sold standalone or as part of Microsoft 365 plans, with no dedicated security team required. For an estate already paying for Microsoft 365, that is a real cost per seat to weigh against a Falcon quote.

The cap settles it for this buyer. Defender for Business is documented for up to 300 users and up to five devices per user, with no minimum device requirement. A 2,000-endpoint estate is roughly seven times that ceiling, so Defender for Business cannot be the primary platform at this size whatever its price. It remains useful as the benchmark for what the productivity suite already includes, which is the number a Falcon quote has to beat to be justified.

The page also states no price for Defender for Business itself, only that it is available standalone or within Microsoft 365 plans. A buyer using it as a benchmark has to price the Microsoft 365 tier that carries it, not the security product alone, or the comparison flatters Microsoft by leaving out the suite.

Where the managed contract stops being cheaper

MDR earns its fee when the alternative is hiring. At 2,000 endpoints the internal option means at least a small team, and the managed option means a per-endpoint service fee that scales with the estate. The crossover sits wherever the annual MDR fee exceeds the fully loaded cost of the rota, and because neither CrowdStrike number is published, the buyer cannot find that point without two quotes and a payroll figure.

The managed tier also changes what the internal team does. With response contracted out, the estate still needs someone to own policy, exceptions and the vendor relationship, but not necessarily someone awake at 03:00. That is a different hiring plan, and it is the part of the decision that survives the contract renewal: a team built for self-run EDR is expensive to dismantle if the estate later moves to managed.

CrowdStrike's page lists both paths without recommending either, which is honest and unhelpful in equal measure. The buyer's job is to price the rota first, then request the MDR quote against it, because a managed quote compared against nothing always looks reasonable.

The decision rule for a 2,000-endpoint estate

Choose the self-run Falcon platform if the estate already has a security operations team covering extended hours, the endpoint count is expected to grow well beyond 2,000 during the term, and the modules in scope are broad enough that consolidating identity, cloud and endpoint telemetry into one console removes tools the team currently pays for separately. In that case the per-endpoint quote is the whole cost and the rota is already funded.

Choose Falcon with MDR if the team cannot cover nights and weekends without new hires, if the endpoint count is stable or shrinking, or if the compliance obligation requires documented 24/7 response that an internal rota cannot evidence. Ask for response times, escalation terms and what is included beyond detection before signing, because the platform page does not state them.

Treat Defender for Business as a benchmark rather than an option at this size, since the 300-user cap puts it out of scope for a 2,000-endpoint primary deployment, and price the Microsoft 365 tier that carries it before using it to judge a Falcon quote. Whichever path is chosen, request per-endpoint pricing at 2,000 seats for the exact modules in scope and the MDR fee at the same count in the same document, or the two numbers will not be comparable.