MDR Pricing Models Exposed: Why Asset-Based vs. Ingestion-Based Contracts Leave Security Gaps in 2026

In the current threat landscape—characterized by identity-centric attacks, living-off-the-land techniques, and low-and-slow lateral movement—the difference between a contained incident and a catastrophic breach often comes down to log visibility and retention. When evaluating Managed Detection and Response (MDR) providers in 2026, the pricing model you select is not merely a procurement detail; it is an architectural decision that determines whether your SOC can investigate a compromised account six months after initial access or trace an attacker's subtle movements across your hybrid environment.

Two proposals with identical annual price tags can deliver radically different security outcomes. One provider operating on an asset-based model might offer comprehensive endpoint telemetry but restrict network flow data, while an ingestion-based competitor might provide unlimited data volume but impose severe constraints on historical retention or investigative depth. Understanding these distinctions is critical for CISOs and SOC managers who need to align their detection capabilities with actual threat actor dwell times, which currently average 10-14 days for ransomware affiliates and can extend to months for nation-state actors.

The Technical Divide: Asset-Based vs. Ingestion-Based MDR

Asset-Based Pricing: The Per-Endpoint Reality

Asset-based pricing charges per protected endpoint, server, or workload. While predictable for budgeting, this model creates artificial scarcity in visibility. Providers operating under this model often tier their services based on asset criticality, leaving security teams to make impossible choices about which systems warrant "premium" detection coverage.

From a defender's perspective, asset-based models frequently result in:

Telemetry gaps on non-critical assets: Development servers, IoT devices, or legacy systems excluded from coverage become pivot points for lateral movement. In 2025-2026, we've observed threat actors specifically targeting unmanaged assets precisely because they lack EDR coverage.
Retention limitations: To maintain margins on per-asset pricing, providers may restrict log retention to 30 days. This creates forensic blind spots when investigating business email compromise (BEC) or supply chain compromises where initial access occurred months prior.
Investigation scope restrictions: Some asset-based contracts limit the number of "deep-dive" investigations per month, forcing SOC analysts to triage based on budget rather than threat severity.

Ingestion-Based Pricing: The Volume Trap

Ingestion-based models charge based on data volume—typically measured in GB/day or TB/month. While this approach promises "unlimited endpoint coverage," it introduces different operational risks that manifest during active incident response.

Critical limitations include:

Data throttling during attacks: During an active intrusion, log volume spikes exponentially. Ingestion-based providers may throttle collection or drop non-essential telemetry precisely when you need full packet capture and verbose PowerShell logging most.
Hot/Cold storage tiering: To control costs, providers often move older logs to cold storage with 24-48 hour retrieval times. When you're hunting a persistent threat actor, waiting two days for historical authentication logs is operationally devastating.
Noise-based cost inflation: Poorly tuned environments generate massive log volumes. An ingestion-based MDR may financially penalize you for enabling verbose audit policies that are essential for detecting living-off-the-land techniques (LOLBins) or Kerberoasting.

The Investigation Gap: Where Pricing Models Fail

When investigating a compromised identity—the predominant attack vector in 2026—the differences become stark:

Asset-based limitation example: Your provider monitors only Tier-1 assets. An attacker compromises a service account on an unmanaged development server, then moves laterally to a monitored production database. Your MDR sees the database activity but lacks the preceding authentication context from the dev server, severing the attack chain visibility.

Ingestion-based limitation example: You detect suspicious Kerberos ticket requests indicating potential Golden Ticket activity. However, your provider's contract only retains 14 days of Active Directory logs in hot storage. The attacker established persistence 45 days ago, and the forensic evidence of initial compromise has been rotated out of accessible storage.

Detection & Response Considerations by Model

For Asset-Based Deployments

If your organization has committed to an asset-based MDR, implement compensating controls to address coverage gaps:

Critical Asset Reclassification: Quarterly review of asset criticality with security leadership. Ensure that "low-value" assets cannot serve as pivot points to high-value targets (network segmentation verification).
Supplemental Logging: Deploy Sysmon or equivalent on non-covered assets with local log retention (90+ days) to bridge visibility gaps without incurring per-asset MDR costs.
Retention Negotiation: Contractually mandate minimum 90-day hot storage for all security-relevant telemetry, regardless of asset tier. Threat actor dwell times routinely exceed 30 days.

For Ingestion-Based Deployments

For organizations under ingestion-based pricing:

Log Source Rationalization: Implement aggressive filtering at the collector level. Debug logs, informational events, and redundant network flows should be dropped before ingestion to preserve budget for security-relevant telemetry.
Dynamic Throttling Protections: Negotiate "burst capacity" clauses that prevent data dropping during incident response. Specify that security events (Event IDs 4688, 4624, 4625, etc.) take priority over operational logs during high-volume periods.
Hot Storage Guarantees: Contractually require 180-day hot retention for authentication logs, DNS queries, and process execution events. Cold storage retrieval SLAs must be under 4 hours for IR scenarios.

Universal Evaluation Criteria for 2026

Regardless of pricing model, your MDR evaluation must verify:

Identity Telemetry Coverage: Can they ingest and correlate Entra ID (Azure AD), Okta, and Active Directory logs? Identity is the new perimeter.
NDR Integration: Do they monitor network traffic for encrypted command-and-control detection, or rely solely on endpoint agents?
Forensic Readiness: Can they perform memory acquisition and disk imaging on covered assets, or do they only analyze existing logs?
SOAR Capabilities: Is automated containment (host isolation, account disablement) included, or is it an additional professional services engagement?

Remediation and Procurement Actions

For organizations currently evaluating MDR providers or renegotiating contracts:

Conduct a Logging Requirements Workshop: Before reviewing pricing, document your required telemetry sources (Windows Event Logs, Sysmon, EDR telemetry, Firewall logs, DNS, DHCP, CloudTrail, O365 audit logs). Calculate actual GB/day requirements for each.
Model Investigation Scenarios: Require vendors to demonstrate how they would investigate a simulated compromise of a service account with 90-day-old initial access. Force them to show the retrieval process for archived logs.
Include Threat Hunting SLAs: Specify minimum hunting hours per month in the contract. Ingestion-based models often restrict hunting to control compute costs; asset-based models may restrict it by asset tier.
Verify Compliance Alignment: Ensure retention periods meet your regulatory requirements (PCI-DSS requires 1 year, HIPAA 6 years, NIST CSF recommends 90+ days for high-value assets). Non-compliant retention is an audit finding waiting to happen.
Test Data Egress: Verify you can export all your data in standard formats (JSON, CEF, LEEF) without excessive egress fees if you switch providers. Data hostage scenarios are common in ingestion-based contracts.

Conclusion

The choice between asset-based and ingestion-based MDR pricing is a choice between different failure modes. Asset-based models risk leaving blind spots in your perimeter; ingestion-based models risk losing historical context during long-term investigations.

In 2026, the mature approach is hybrid: negotiate asset-based pricing for critical infrastructure requiring deep forensic visibility, supplemented by ingestion-based pricing for broad endpoint coverage. Most importantly, ensure your contract guarantees the retention periods and investigation depth necessary to detect the low-and-slow techniques that define modern intrusions.

Your MDR provider is an extension of your SOC. If their pricing model prevents them from seeing the full attack chain, you haven't purchased detection and response—you've purchased expensive alert forwarding.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub